@vyuhlabs/dxkit 2.4.5 → 2.4.7

package/dist/analyzers/security/aggregator.d.ts

@@ -0,0 +1,236 @@
+/**
+ * Canonical security aggregator (G_v4_8 / 2.4.7 Phase C1).
+ *
+ * One source of truth for "code findings by severity", "dependency
+ * advisories by severity", "unique advisory count", and cross-tool
+ * dedup. Every consumer (standalone vuln-scan, health-side scorer,
+ * BoM, dashboard) reads from `SecurityAggregate` instead of
+ * re-counting raw envelope arrays.
+ *
+ * The disease this closes (D086 / D087 / D091):
+ *
+ *   - **D086** Health Security section and standalone vuln-scan Code
+ *     Findings table both reported "code findings by severity" but
+ *     came up with different numbers (`0C 11H 18M 0L` vs
+ *     `0C 17H 14M 0L`) on the same repo. Two consumers, two
+ *     aggregation paths, slightly-different inclusion rules.
+ *
+ *   - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
+ *     dep-vuln severity buckets) and the same page later said
+ *     "81 advisories" (findings.length). 70 vs 81 on one page.
+ *
+ *   - **D091** A single TLS-bypass root finding surfaced twice in the
+ *     Code Findings table (registry-grep at `:74` HIGH, semgrep at
+ *     `:72` MEDIUM) because code findings carried no fingerprint and
+ *     no cross-tool dedup ran.
+ *
+ * Architectural posture:
+ *
+ *   - The aggregator sits BETWEEN gather and reports. Gather still
+ *     produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
+ *     `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
+ *     the aggregator merges + dedups + buckets them into the canonical
+ *     shape; consumers read by field name.
+ *
+ *   - Three separately-named severity buckets (`codeBySeverity`,
+ *     `depBySeverity`, `secretsBySeverity`) — the shape forbids any
+ *     consumer from accidentally summing cross-axis again.
+ *
+ *   - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
+ *     canonical user-facing total; `dependencyFindingsRawCount` for
+ *     diagnostic audit). Renderers cannot pick "the wrong number"
+ *     without naming which they want.
+ *
+ *   - Code findings get a canonical-rule + line-window fingerprint;
+ *     cross-tool collisions collapse to ONE CodeFinding with
+ *     `keptSeverity = max(severities)` and `producedBy` listing all
+ *     contributing tools. The `dedupCollisions` audit trail records
+ *     every collapse for `--detailed` visibility.
+ *
+ *   - `provenance` distinguishes "tool ran, 0 findings" from "tool
+ *     didn't run" — drives D080-style "(not run: typescript)" labels.
+ *
+ * G_v4_8 architectural gate (`scripts/check-architecture.sh`) blocks
+ * `countBySeverity` / severity-Record accumulator declarations
+ * outside this file, mirroring G_v4_7's walker allowlist.
+ */
+import type { DepVulnFinding } from '../../languages/capabilities/types';
+import type { Severity, SecurityFinding } from './types';
+export type { Severity, FindingCategory, SecurityFinding } from './types';
+/**
+ * Per-severity counts. Local copy (avoids cross-module import friction
+ * with `capabilities/types.SeverityCounts` — same shape, different
+ * module home).
+ */
+export interface SeverityCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+}
+/**
+ * Post-aggregation code/secret/config finding. Extends raw
+ * `SecurityFinding` with the identity + provenance fields the
+ * aggregator stamps:
+ *
+ *   - `fingerprint` — stable 16-char hash of
+ *     `(canonicalRule | file | lineWindow)`. Same key across runs;
+ *     enables diff tooling and dedup-by-identity downstream.
+ *   - `canonicalRule` — normalized rule id from the canonical-rule
+ *     registry. Different raw tool/rule pairs that describe the same
+ *     root finding collapse to the same `canonicalRule`. Unmapped
+ *     pairs pass through as `raw:${tool}:${rule}` — conservative
+ *     default; new collapse rules require explicit registry entries.
+ *   - `producedBy` — every raw `tool` that contributed to this
+ *     finding. Length > 1 means cross-tool dedup fired.
+ */
+export interface CodeFinding extends SecurityFinding {
+    fingerprint: string;
+    canonicalRule: string;
+    producedBy: string[];
+}
+/**
+ * One collapsed-collision audit entry. Renders in `--detailed` so a
+ * security reviewer can verify "yes, these two tools agreed on this
+ * one finding" rather than wondering why a tool's findings count
+ * differs from the report's surface count.
+ */
+export interface DedupCollision {
+    canonicalRule: string;
+    file: string;
+    line: number;
+    keptSeverity: Severity;
+    collapsedFrom: ReadonlyArray<{
+        tool: string;
+        rule: string;
+        line: number;
+        severity: Severity;
+    }>;
+}
+/**
+ * Per-tool run-state provenance. Distinguishes "tool ran with zero
+ * findings" from "tool didn't run." Drives the "(not run: …)" labels
+ * on report tool-attribution lines and the security scorer's "scan
+ * was partial" cap signal (D025e / D080 lineage).
+ */
+export interface AggregateProvenance {
+    secrets: {
+        tool: string | null;
+        ran: boolean;
+    };
+    codePatterns: {
+        tool: string | null;
+        ran: boolean;
+    };
+    tlsBypass: {
+        ran: boolean;
+        patternCount: number;
+    };
+    fileFindings: {
+        ran: boolean;
+    };
+    depVulns: {
+        tool: string | null;
+        available: boolean;
+        unavailableReason: string;
+    };
+}
+/**
+ * The canonical security aggregate. Every consumer reads from this;
+ * consumers MUST NOT re-aggregate from raw envelope arrays. The
+ * G_v4_8 architectural gate enforces this at commit time.
+ */
+export interface SecurityAggregate {
+    /** Code-pattern findings by severity (semgrep + tls-bypass-registry
+     *  + any future per-pack code-pattern producers), post-dedup. */
+    codeBySeverity: SeverityCounts;
+    /** Dependency advisories by severity, derived from the
+     *  fingerprint-unique advisory set (NOT the per-pack envelope
+     *  count sum). Sums to `dependencyAdvisoryUniqueCount`. */
+    depBySeverity: SeverityCounts;
+    /** Secret + secret-adjacent findings (gitleaks + private-key files +
+     *  .env-in-git) by severity. Each axis stays separate so consumers
+     *  pick which they own. */
+    secretsBySeverity: SeverityCounts;
+    /** Findings partitioned by category, post-dedup. Renderers iterate
+     *  these — never iterate raw envelope arrays. `dependency` is the
+     *  fingerprint-unique advisory set. */
+    findingsByCategory: {
+        secret: ReadonlyArray<CodeFinding>;
+        code: ReadonlyArray<CodeFinding>;
+        config: ReadonlyArray<CodeFinding>;
+        dependency: ReadonlyArray<DepVulnFinding>;
+    };
+    /**
+     * The canonical user-facing advisory count: unique fingerprints
+     * across every pack's findings. Use for the vuln-scan "Subtotal:"
+     * line, BoM `totalAdvisories`, and the "Showing N of M" denominator.
+     * Aligns with BoM's existing fingerprint-unique semantics (D076 /
+     * D085) so vuln-scan and BoM never report different totals.
+     */
+    dependencyAdvisoryUniqueCount: number;
+    /**
+     * Diagnostic-only: per-pack envelope.findings.length sum BEFORE
+     * fingerprint dedup. Surfaces in `--detailed` audit logs so the
+     * delta vs `dependencyAdvisoryUniqueCount` is visible. Renderers
+     * should NOT use this for any user-facing count.
+     */
+    dependencyFindingsRawCount: number;
+    /** Audit trail of every cross-tool / cross-line-window collapse.
+     *  Empty in the no-collision case. */
+    dedupCollisions: ReadonlyArray<DedupCollision>;
+    /** Per-source provenance — drives "(not run: typescript)" labels. */
+    provenance: AggregateProvenance;
+}
+/**
+ * Input envelopes for `buildSecurityAggregate`. Each field maps 1:1
+ * to a `gather*` function in `security/gather.ts`. The aggregator
+ * never invokes I/O; it's a pure function over already-gathered
+ * data, which keeps unit testing trivial.
+ */
+export interface SecurityAggregateInput {
+    secrets: {
+        findings: SecurityFinding[];
+        toolUsed: string | null;
+    };
+    fileFindings: SecurityFinding[];
+    codePatterns: {
+        findings: SecurityFinding[];
+        toolUsed: string | null;
+    };
+    tlsBypass: SecurityFinding[];
+    /** Pattern count from `allTlsBypassPatterns()` — drives the
+     *  `provenance.tlsBypass.ran` flag (ran=false when no patterns were
+     *  registered, NOT when 0 findings matched against a non-empty
+     *  pattern set). */
+    tlsBypassPatternCount: number;
+    depVulns: {
+        findings: DepVulnFinding[];
+        tool: string | null;
+        available: boolean;
+        unavailableReason: string;
+    };
+}
+/**
+ * Build the canonical aggregate from per-gatherer envelopes. Pure
+ * function — same input always produces the same output.
+ *
+ * Dedup pipeline (code-side):
+ *   1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
+ *   2. Group by `(canonicalRule, file, lineWindow)` key.
+ *   3. For each group:
+ *      - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
+ *        `producedBy` = unique sources.
+ *      - If the group had >1 raw finding, record a `DedupCollision`
+ *        audit entry.
+ *
+ * Dedup pipeline (dep-side):
+ *   - Group `depVulns.findings` by `fingerprint`.
+ *   - For each group: pick the highest-severity entry as the
+ *     representative; severity counts are derived from the unique
+ *     set so they match `dependencyAdvisoryUniqueCount`.
+ *   - Findings without a fingerprint pass through unchanged (defensive;
+ *     `stampFingerprints` in `gatherDepVulns` runs before this).
+ */
+export declare function buildSecurityAggregate(input: SecurityAggregateInput): SecurityAggregate;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/analyzers/security/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/aggregator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1E,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1E;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,QAAQ,CAAC;IACvB,aAAa,EAAE,aAAa,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,QAAQ,CAAC;KACpB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/C,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,SAAS,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,YAAY,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;qEACiE;IACjE,cAAc,EAAE,cAAc,CAAC;IAE/B;;+DAE2D;IAC3D,aAAa,EAAE,cAAc,CAAC;IAE9B;;+BAE2B;IAC3B,iBAAiB,EAAE,cAAc,CAAC;IAElC;;2CAEuC;IACvC,kBAAkB,EAAE;QAClB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;KAC3C,CAAC;IAEF;;;;;;OAMG;IACH,6BAA6B,EAAE,MAAM,CAAC;IAEtC;;;;;OAKG;IACH,0BAA0B,EAAE,MAAM,CAAC;IAEnC;0CACsC;IACtC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAE/C,qEAAqE;IACrE,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAuFD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClE,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B;;;wBAGoB;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE;QACR,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAsNvF"}

package/dist/analyzers/security/aggregator.js

@@ -0,0 +1,347 @@
+"use strict";
+/**
+ * Canonical security aggregator (G_v4_8 / 2.4.7 Phase C1).
+ *
+ * One source of truth for "code findings by severity", "dependency
+ * advisories by severity", "unique advisory count", and cross-tool
+ * dedup. Every consumer (standalone vuln-scan, health-side scorer,
+ * BoM, dashboard) reads from `SecurityAggregate` instead of
+ * re-counting raw envelope arrays.
+ *
+ * The disease this closes (D086 / D087 / D091):
+ *
+ *   - **D086** Health Security section and standalone vuln-scan Code
+ *     Findings table both reported "code findings by severity" but
+ *     came up with different numbers (`0C 11H 18M 0L` vs
+ *     `0C 17H 14M 0L`) on the same repo. Two consumers, two
+ *     aggregation paths, slightly-different inclusion rules.
+ *
+ *   - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
+ *     dep-vuln severity buckets) and the same page later said
+ *     "81 advisories" (findings.length). 70 vs 81 on one page.
+ *
+ *   - **D091** A single TLS-bypass root finding surfaced twice in the
+ *     Code Findings table (registry-grep at `:74` HIGH, semgrep at
+ *     `:72` MEDIUM) because code findings carried no fingerprint and
+ *     no cross-tool dedup ran.
+ *
+ * Architectural posture:
+ *
+ *   - The aggregator sits BETWEEN gather and reports. Gather still
+ *     produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
+ *     `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
+ *     the aggregator merges + dedups + buckets them into the canonical
+ *     shape; consumers read by field name.
+ *
+ *   - Three separately-named severity buckets (`codeBySeverity`,
+ *     `depBySeverity`, `secretsBySeverity`) — the shape forbids any
+ *     consumer from accidentally summing cross-axis again.
+ *
+ *   - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
+ *     canonical user-facing total; `dependencyFindingsRawCount` for
+ *     diagnostic audit). Renderers cannot pick "the wrong number"
+ *     without naming which they want.
+ *
+ *   - Code findings get a canonical-rule + line-window fingerprint;
+ *     cross-tool collisions collapse to ONE CodeFinding with
+ *     `keptSeverity = max(severities)` and `producedBy` listing all
+ *     contributing tools. The `dedupCollisions` audit trail records
+ *     every collapse for `--detailed` visibility.
+ *
+ *   - `provenance` distinguishes "tool ran, 0 findings" from "tool
+ *     didn't run" — drives D080-style "(not run: typescript)" labels.
+ *
+ * G_v4_8 architectural gate (`scripts/check-architecture.sh`) blocks
+ * `countBySeverity` / severity-Record accumulator declarations
+ * outside this file, mirroring G_v4_7's walker allowlist.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityAggregate = buildSecurityAggregate;
+const crypto_1 = require("crypto");
+// ─── Canonical-rule registry ──────────────────────────────────────────────
+/**
+ * Maps raw `(tool, rule)` pairs to a canonical rule id. Two raw
+ * findings with the same canonical rule (and same file + line window)
+ * collapse to one `CodeFinding` with `keptSeverity = max` and
+ * `producedBy = [tool₁, tool₂, …]`.
+ *
+ * Unmapped pairs fall through to `raw:${tool}:${rule}` — never
+ * accidentally collapses unrelated findings. Adding a new collapse
+ * is a one-line addition here; no aggregator code changes.
+ *
+ * Initial entries close D091's observed TLS-bypass cross-tool
+ * double-counting. Future entries land when a new language pack or
+ * semgrep ruleset surfaces overlap with an existing finding type.
+ */
+const CANONICAL_RULE_MAP = new Map([
+    // TLS / certificate validation bypass — D091 closure
+    ['tls-bypass-registry:tls-validation-disabled', 'canonical:tls-bypass'],
+    ['semgrep:bypass-tls-verification', 'canonical:tls-bypass'],
+    ['semgrep:nodejsscan.node_tls_reject_unauthorized', 'canonical:tls-bypass'],
+    // Private-key file on disk — find + gitleaks may both surface
+    ['find:private-key-file', 'canonical:private-key-on-disk'],
+    ['gitleaks:private-key', 'canonical:private-key-on-disk'],
+]);
+function canonicalRuleFor(tool, rule) {
+    return CANONICAL_RULE_MAP.get(`${tool}:${rule}`) ?? `raw:${tool}:${rule}`;
+}
+/**
+ * Line-window bucketing. Tools report the same code construct at
+ * slightly-different lines (semgrep on the declaration, registry-grep
+ * on the assignment — D091's `:72` vs `:74` shape). 3-line buckets
+ * absorb that drift without collapsing genuinely-different findings
+ * in the same file.
+ *
+ * Boundary edge case closed by C1.10: the natural fixed-boundary
+ * bucketing alone would miss adjacent findings straddling a
+ * multiple-of-3 (web-client surfaced DBConfigureForm.js:43 + :45 →
+ * buckets 42 + 45 → no collapse pre-C1.10). The grouping loop now
+ * does a neighbor-bucket lookup (naturalBucket ± 3) after the natural
+ * miss, restoring D091's intent across boundary-straddling pairs.
+ * Effective collapse window: ~3-5 lines depending on alignment.
+ */
+function lineWindowFor(line) {
+    return Math.floor(line / 3) * 3;
+}
+/**
+ * Stable 16-char hex hash of `(canonicalRule | file | lineWindow)`.
+ * NUL-separated so distinct tuples can't collide via concatenation
+ * tricks. Mirrors `tools/fingerprint.computeFingerprint`'s format
+ * (SHA-1 first 8 bytes hex) so dep-vuln and code-finding fingerprints
+ * share a downstream type contract.
+ */
+function computeCodeFingerprint(canonicalRule, file, line) {
+    const input = `${canonicalRule}\0${file}\0${lineWindowFor(line)}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+// ─── Severity helpers ─────────────────────────────────────────────────────
+const SEVERITY_RANK = {
+    critical: 3,
+    high: 2,
+    medium: 1,
+    low: 0,
+};
+function maxSeverity(a, b) {
+    return SEVERITY_RANK[a] >= SEVERITY_RANK[b] ? a : b;
+}
+function emptyCounts() {
+    return { critical: 0, high: 0, medium: 0, low: 0 };
+}
+function bumpCounts(counts, severity) {
+    counts[severity]++;
+}
+/**
+ * Build the canonical aggregate from per-gatherer envelopes. Pure
+ * function — same input always produces the same output.
+ *
+ * Dedup pipeline (code-side):
+ *   1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
+ *   2. Group by `(canonicalRule, file, lineWindow)` key.
+ *   3. For each group:
+ *      - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
+ *        `producedBy` = unique sources.
+ *      - If the group had >1 raw finding, record a `DedupCollision`
+ *        audit entry.
+ *
+ * Dedup pipeline (dep-side):
+ *   - Group `depVulns.findings` by `fingerprint`.
+ *   - For each group: pick the highest-severity entry as the
+ *     representative; severity counts are derived from the unique
+ *     set so they match `dependencyAdvisoryUniqueCount`.
+ *   - Findings without a fingerprint pass through unchanged (defensive;
+ *     `stampFingerprints` in `gatherDepVulns` runs before this).
+ */
+function buildSecurityAggregate(input) {
+    // ─── Code-side dedup ────────────────────────────────────────────────
+    const rawCodeFindings = [
+        ...input.secrets.findings,
+        ...input.fileFindings,
+        ...input.codePatterns.findings,
+        ...input.tlsBypass,
+    ];
+    const groups = new Map();
+    for (const f of rawCodeFindings) {
+        const canonicalRule = canonicalRuleFor(f.tool, f.rule);
+        const naturalFingerprint = computeCodeFingerprint(canonicalRule, f.file, f.line);
+        // C1.10: neighbor-bucket lookup. The 3-line fixed bucket misses
+        // adjacent findings that straddle a multiple-of-3 line (web-client
+        // DBConfigureForm.js:43 + :45 → buckets 42 + 45 → different keys
+        // → no collapse pre-C1.10). Look up the natural bucket first, then
+        // the adjacent buckets (naturalBucket ± 3 via `line ± 3`). Same
+        // canonical-rule + file + neighbor-bucket counts as a match; merges
+        // into that group. Effective dedup window grows from "0-2 lines
+        // within one bucket" to "3-5 lines across one bucket boundary."
+        let fingerprint = naturalFingerprint;
+        let existing = groups.get(fingerprint);
+        if (!existing) {
+            for (const offset of [-3, 3]) {
+                const neighborFingerprint = computeCodeFingerprint(canonicalRule, f.file, f.line + offset);
+                const candidate = groups.get(neighborFingerprint);
+                if (candidate) {
+                    existing = candidate;
+                    fingerprint = neighborFingerprint;
+                    break;
+                }
+            }
+        }
+        if (existing) {
+            existing.severity = maxSeverity(existing.severity, f.severity);
+            existing.producedBy.add(f.tool);
+            existing.raws.push({
+                tool: f.tool,
+                rule: f.rule,
+                line: f.line,
+                severity: f.severity,
+            });
+            // Prefer the lower line number as the canonical line — semgrep
+            // typically reports the declaration (earlier line) while
+            // registry-grep reports the assignment; the declaration is the
+            // more useful navigation target. Tie-break by category preserve.
+            if (f.line < existing.line) {
+                existing.line = f.line;
+                existing.title = f.title;
+                existing.rule = f.rule;
+                existing.tool = f.tool;
+                existing.cwe = f.cwe || existing.cwe;
+            }
+        }
+        else {
+            groups.set(fingerprint, {
+                fingerprint,
+                canonicalRule,
+                file: f.file,
+                line: f.line,
+                severity: f.severity,
+                category: f.category,
+                cwe: f.cwe,
+                rule: f.rule,
+                title: f.title,
+                tool: f.tool,
+                producedBy: new Set([f.tool]),
+                raws: [
+                    {
+                        tool: f.tool,
+                        rule: f.rule,
+                        line: f.line,
+                        severity: f.severity,
+                    },
+                ],
+            });
+        }
+    }
+    const codeFindingsByCategory = {
+        secret: [],
+        code: [],
+        config: [],
+    };
+    const codeBySeverity = emptyCounts();
+    const secretsBySeverity = emptyCounts();
+    const dedupCollisions = [];
+    for (const g of groups.values()) {
+        const finding = {
+            severity: g.severity,
+            category: g.category,
+            cwe: g.cwe,
+            rule: g.rule,
+            title: g.title,
+            file: g.file,
+            line: g.line,
+            tool: g.tool,
+            fingerprint: g.fingerprint,
+            canonicalRule: g.canonicalRule,
+            producedBy: [...g.producedBy].sort(),
+        };
+        if (g.category === 'secret') {
+            codeFindingsByCategory.secret.push(finding);
+            bumpCounts(secretsBySeverity, g.severity);
+        }
+        else if (g.category === 'config') {
+            codeFindingsByCategory.config.push(finding);
+            // Config findings (`.env in git`) are secret-adjacent — they
+            // share the secrets axis so the Security dimension treats them
+            // as the same risk class. Pre-aggregator code paths agreed on
+            // this; we preserve it.
+            bumpCounts(secretsBySeverity, g.severity);
+        }
+        else {
+            codeFindingsByCategory.code.push(finding);
+            bumpCounts(codeBySeverity, g.severity);
+        }
+        if (g.raws.length > 1) {
+            dedupCollisions.push({
+                canonicalRule: g.canonicalRule,
+                file: g.file,
+                line: g.line,
+                keptSeverity: g.severity,
+                collapsedFrom: g.raws,
+            });
+        }
+    }
+    // ─── Dep-side dedup ─────────────────────────────────────────────────
+    // Group by fingerprint. Findings without a fingerprint (defensive
+    // path — shouldn't happen post-`stampFingerprints`) get a synthetic
+    // unique key so they pass through individually.
+    const depGroups = new Map();
+    let syntheticFingerprintCounter = 0;
+    for (const f of input.depVulns.findings) {
+        const key = f.fingerprint ?? `__unstamped__${syntheticFingerprintCounter++}`;
+        const existing = depGroups.get(key);
+        if (!existing) {
+            depGroups.set(key, f);
+        }
+        else {
+            // Keep the higher-severity representative. Same advisory may
+            // appear multiple times if cross-pack joins didn't already
+            // collapse it (defensive).
+            if (SEVERITY_RANK[f.severity] > SEVERITY_RANK[existing.severity]) {
+                depGroups.set(key, f);
+            }
+        }
+    }
+    const uniqueDepFindings = [...depGroups.values()];
+    const depBySeverity = emptyCounts();
+    for (const f of uniqueDepFindings) {
+        bumpCounts(depBySeverity, f.severity);
+    }
+    // ─── Provenance ─────────────────────────────────────────────────────
+    const provenance = {
+        secrets: {
+            tool: input.secrets.toolUsed,
+            ran: input.secrets.toolUsed !== null,
+        },
+        codePatterns: {
+            tool: input.codePatterns.toolUsed,
+            ran: input.codePatterns.toolUsed !== null,
+        },
+        tlsBypass: {
+            // ran=true means the registry walk happened (patterns existed).
+            // ran=false means no pack registered TLS-bypass patterns — a
+            // legitimate "nothing to scan" state on a repo with no active
+            // packs declaring patterns.
+            ran: input.tlsBypassPatternCount > 0,
+            patternCount: input.tlsBypassPatternCount,
+        },
+        fileFindings: { ran: true },
+        depVulns: {
+            tool: input.depVulns.tool,
+            available: input.depVulns.available,
+            unavailableReason: input.depVulns.unavailableReason,
+        },
+    };
+    return {
+        codeBySeverity,
+        depBySeverity,
+        secretsBySeverity,
+        findingsByCategory: {
+            secret: codeFindingsByCategory.secret,
+            code: codeFindingsByCategory.code,
+            config: codeFindingsByCategory.config,
+            dependency: uniqueDepFindings,
+        },
+        dependencyAdvisoryUniqueCount: uniqueDepFindings.length,
+        dependencyFindingsRawCount: input.depVulns.findings.length,
+        dedupCollisions,
+        provenance,
+    };
+}
+//# sourceMappingURL=aggregator.js.map

package/dist/analyzers/security/aggregator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../../src/analyzers/security/aggregator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;AAwQH,wDAsNC;AA5dD,mCAAoC;AAoIpC,6EAA6E;AAE7E;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAiB;IACjD,qDAAqD;IACrD,CAAC,6CAA6C,EAAE,sBAAsB,CAAC;IACvE,CAAC,iCAAiC,EAAE,sBAAsB,CAAC;IAC3D,CAAC,iDAAiD,EAAE,sBAAsB,CAAC;IAE3E,8DAA8D;IAC9D,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;IAC1D,CAAC,sBAAsB,EAAE,+BAA+B,CAAC;CAC1D,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,aAAqB,EAAE,IAAY,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,GAAG,aAAa,KAAK,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,6EAA6E;AAE7E,MAAM,aAAa,GAA6B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB,EAAE,QAAkB;IAC5D,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,sBAAsB,CAAC,KAA6B;IAClE,uEAAuE;IACvE,MAAM,eAAe,GAAsB;QACzC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ;QACzB,GAAG,KAAK,CAAC,YAAY;QACrB,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ;QAC9B,GAAG,KAAK,CAAC,SAAS;KACnB,CAAC;IAkBF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAExC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAEjF,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,gEAAgE;QAChE,gEAAgE;QAChE,IAAI,WAAW,GAAG,kBAAkB,CAAC;QACrC,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;gBAC3F,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClD,IAAI,SAAS,EAAE,CAAC;oBACd,QAAQ,GAAG,SAAS,CAAC;oBACrB,WAAW,GAAG,mBAAmB,CAAC;oBAClC,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC/D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,+DAA+D;YAC/D,yDAAyD;YACzD,+DAA+D;YAC/D,iEAAiE;YACjE,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACzB,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;gBACtB,WAAW;gBACX,aAAa;gBACb,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,EAAE;oBACJ;wBACE,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;qBACrB;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAwD;QAClF,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,EAAE;KACX,CAAC;IACF,MAAM,cAAc,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,iBAAiB,GAAG,WAAW,EAAE,CAAC;IACxC,MAAM,eAAe,GAAqB,EAAE,CAAC;IAE7C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAgB;YAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;SACrC,CAAC;QAEF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC5B,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,6DAA6D;YAC7D,+DAA+D;YAC/D,8DAA8D;YAC9D,wBAAwB;YACxB,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,eAAe,CAAC,IAAI,CAAC;gBACnB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,CAAC,CAAC,QAAQ;gBACxB,aAAa,EAAE,CAAC,CAAC,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,IAAI,2BAA2B,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,gBAAgB,2BAA2B,EAAE,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,6DAA6D;YAC7D,2DAA2D;YAC3D,2BAA2B;YAC3B,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAClC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,uEAAuE;IACvE,MAAM,UAAU,GAAwB;QACtC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAC5B,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;SACrC;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ;YACjC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,KAAK,IAAI;SAC1C;QACD,SAAS,EAAE;YACT,gEAAgE;YAChE,6DAA6D;YAC7D,8DAA8D;YAC9D,4BAA4B;YAC5B,GAAG,EAAE,KAAK,CAAC,qBAAqB,GAAG,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,qBAAqB;SAC1C;QACD,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;QAC3B,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;YACnC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,iBAAiB;SACpD;KACF,CAAC;IAEF,OAAO;QACL,cAAc;QACd,aAAa;QACb,iBAAiB;QACjB,kBAAkB,EAAE;YAClB,MAAM,EAAE,sBAAsB,CAAC,MAAM;YACrC,IAAI,EAAE,sBAAsB,CAAC,IAAI;YACjC,MAAM,EAAE,sBAAsB,CAAC,MAAM;YACrC,UAAU,EAAE,iBAAiB;SAC9B;QACD,6BAA6B,EAAE,iBAAiB,CAAC,MAAM;QACvD,0BAA0B,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAC1D,eAAe;QACf,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/analyzers/security/detailed.d.ts

@@ -1,10 +1,10 @@
 import { SecurityReport } from './types';
 import { RankedAction } from '../remediation';
-import { SecurityCounts } from './scoring';
+import { SecurityScoreInput } from '../../scoring';
 export interface SecurityDetailedReport extends SecurityReport {
     schemaVersion: string;
     securityScore: number;
-    actions: Array<RankedAction<SecurityCounts>>;
+    actions: Array<RankedAction<SecurityScoreInput>>;
 }
 export declare function buildSecurityDetailed(report: SecurityReport): SecurityDetailedReport;
 export declare function formatSecurityDetailedMarkdown(detailed: SecurityDetailedReport, elapsed: string): string;

package/dist/analyzers/security/detailed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAA6B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,YAAY,EAAQ,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAEhE,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAUpF;AAID,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAsKR"}
+{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAA6B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,YAAY,EAAQ,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAyB,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AAGxF,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;CAClD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAYpF;AAID,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAoKR"}

package/dist/analyzers/security/detailed.js

@@ -4,15 +4,18 @@ exports.buildSecurityDetailed = buildSecurityDetailed;
 exports.formatSecurityDetailedMarkdown = formatSecurityDetailedMarkdown;
 const remediation_1 = require("../remediation");
 const actions_1 = require("./actions");
-const scoring_1 = require("./scoring");
+const scoring_1 = require("../../scoring");
+const tools_unavailable_prose_1 = require("../tools/tools-unavailable-prose");
 function buildSecurityDetailed(report) {
-    const counts = (0, actions_1.countsFromReport)(report);
-    const actions = (0, remediation_1.rank)((0, actions_1.buildSecurityActions)(report), counts, scoring_1.scoreSecurityCounts);
+    const input = (0, actions_1.countsFromReport)(report);
+    const scoreFromInput = (i) => (0, scoring_1.evaluateSpec)(scoring_1.SECURITY_SCORING_SPEC, i);
+    const actions = (0, remediation_1.rank)((0, actions_1.buildSecurityActions)(report), input, scoreFromInput);
     return {
         ...report,
-        // v12 adds per-advisory dep-vuln detail under summary.dependencies.findings.
-        schemaVersion: '12',
-        securityScore: (0, scoring_1.scoreSecurityCounts)(counts).score,
+        // v13 carries the unified scorer output; same path the health
+        // audit's Security dimension uses, identical scores.
+        schemaVersion: '13',
+        securityScore: scoreFromInput(input).score,
         actions,
     };
 }
@@ -157,9 +160,7 @@ function formatSecurityDetailedMarkdown(detailed, elapsed) {
         L.push('');
     }
     L.push(`**Tools used:** ${detailed.toolsUsed.join(', ')}`);
-    if (detailed.toolsUnavailable.length > 0) {
-        L.push(`**Tools unavailable:** ${detailed.toolsUnavailable.join(', ')}`);
-    }
+    L.push(...(0, tools_unavailable_prose_1.renderToolsUnavailableLines)(detailed.toolsUnavailable));
     L.push(`**Analysis time:** ${elapsed}s`);
     L.push('');
     L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) — detailed mode*');