@vyuhlabs/dxkit 2.4.6 → 2.4.8

package/README.md

@@ -32,11 +32,11 @@ npx @vyuhlabs/dxkit init --full --yes         # everything: DX + quality + hooks
 
 The two modes are complementary. The analyzers run anywhere; the scaffolder writes `.claude/` so Claude Code and other agents have project-specific context and slash commands that delegate to the same analyzers.
 
-> **Already installed dxkit globally? Upgrade explicitly.** `npx @vyuhlabs/dxkit@<version>` resolves the `vyuh-dxkit` binary off PATH first — if you previously ran `npm install -g @vyuhlabs/dxkit`, npx silently uses that older global binary regardless of the `@<version>` you specified. This is npx behavior, not a dxkit bug. To pick up the latest fixes (e.g. the 2.4.5 osv-scanner-fix data-mutation fix), run:
+> **Already installed dxkit globally?** Globals don't auto-update. If you previously ran `npm install -g @vyuhlabs/dxkit`, the `vyuh-dxkit` binary on your PATH stays pinned to whatever version was installed then; running `vyuh-dxkit` (without `npx`) keeps using the pinned version. To pick up the latest fixes, either upgrade the global or remove it and rely on `npx` (which fetches the requested version on demand):
 >
 > ```bash
 > npm install -g @vyuhlabs/dxkit@latest
-> # or, if you don't need a global install, remove the old one and rely on npx:
+> # or:
 > npm uninstall -g @vyuhlabs/dxkit
 > ```
 
@@ -44,33 +44,39 @@ The two modes are complementary. The analyzers run anywhere; the scaffolder writ
 
 ## Analyzer CLI (`vyuh-dxkit <command>`)
 
-Seven deterministic analyzers. Each emits a markdown report to `.dxkit/reports/` and optional structured JSON.
+Seven deterministic analyzers + a one-shot orchestrator. Each emits a markdown report to `.dxkit/reports/` and a structured JSON file the dashboard reads.
 
 | Command           | What it does                                                                                                                                                                                                                                                                                                          | Runtime | Output                                        |
 | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | --------------------------------------------- |
 | `health`          | 6-dimension score (Testing, Quality, Docs, Security, Maint, DX)                                                                                                                                                                                                                                                       | 10–20s  | `.dxkit/reports/health-audit-<date>.md`       |
 | `vulnerabilities` | gitleaks + semgrep + per-pack dep-audit (enriched with EPSS exploit probability, CISA KEV catalog, reachability from your source, composite riskScore; per-advisory detail in `--detailed`)                                                                                                                           | 5–30s   | `.dxkit/reports/vulnerability-scan-<date>.md` |
-| `test-gaps`       | Coverage artifact → import-graph → filename (strongest wins)                                                                                                                                                                                                                                                          | <1s     | `.dxkit/reports/test-gaps-<date>.md`          |
+| `test-gaps`       | Coverage artifact → import-graph → filename (strongest wins). Headline coverage carries a `coverageFidelity` tier; banners surface heuristic-vs-line-coverage trust.                                                                                                                                                  | <1s     | `.dxkit/reports/test-gaps-<date>.md`          |
 | `quality`         | Slop score + jscpd duplication + eslint/ruff + hygiene                                                                                                                                                                                                                                                                | 5–15s   | `.dxkit/reports/quality-review-<date>.md`     |
-| `dev-report`      | Commits, contributors, hot files, velocity, conventional %                                                                                                                                                                                                                                                            | <1s     | `.dxkit/reports/developer-report-<date>.md`   |
+| `dev-report`      | Commits, contributors, hot files (autogen-filtered), weekly velocity (with zero-rows for empty weeks), conventional %                                                                                                                                                                                                 | <1s     | `.dxkit/reports/developer-report-<date>.md`   |
 | `licenses`        | Dependency license inventory across every active pack (TS, Python, Go, Rust, C#; Kotlin + Java omitted — no canonical CLI license tool for Maven/Gradle ecosystems)                                                                                                                                                   | 5–20s   | `.dxkit/reports/licenses-<date>.md`           |
 | `bom`             | **Bill of Materials** — joins licenses + vulns per package, groups by top-level manifest dep (Snyk-style), enriches with CISA KEV + EPSS + reachability, ranks by composite risk score with "This Week's Triage" summary, aggregates nested sub-projects, `--filter=top-level` collapses transitive rows, 15-col XLSX | 10–40s  | `.dxkit/reports/bom-<date>.{md,xlsx}`         |
+| `coverage`        | Side-effecting — runs each active pack's `test-with-coverage` command to materialize the artifact `test-gaps` / `health` read back. Use this once before analysis, or pass `--with-coverage` to the analyzer.                                                                                                         | 1–10m   | per-pack artifact (`coverage.json` etc.)      |
+| `dashboard`       | Renders every report under `.dxkit/reports/` into a single HTML page (tiles + per-report tabs + cross-cutting "Critical Issues at a Glance"). Reads `*-detailed.json` (written unconditionally as of 2.4.7).                                                                                                          | <1s     | `.dxkit/reports/dashboard.html`               |
+| `report`          | **One-shot full audit** — runs every analyzer + dashboard in dependency order. `--with-coverage` materializes coverage once upfront so both `health` and `test-gaps` benefit without re-running tests per analyzer.                                                                                                   | 5–15m   | every output above + dashboard                |
 
 Plus a converter: `vyuh-dxkit to-xlsx <json-file>` renders any `licenses` or `bom` detailed JSON as the canonical 15-column XLSX.
 
 ### Flags (apply to all analyzer commands)
 
-| Flag             | Effect                                                                                                                                        |
-| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
-| `--detailed`     | Also writes `<name>-detailed.md` + `.json` with evidence + ranked remediation actions                                                         |
-| `--json`         | Emit pure JSON on stdout. Logs go to stderr so pipes stay clean                                                                               |
-| `--verbose`      | Print per-tool timing to stderr                                                                                                               |
-| `--no-save`      | Skip writing markdown; useful with `--json`                                                                                                   |
-| `--xlsx`         | (`licenses`, `bom` only) Also write 15-col `.xlsx` — drop-in for spreadsheet workflows                                                        |
-| `-o <file>`      | (`licenses`, `bom`, `to-xlsx`) Override output path for xlsx / converted file                                                                 |
-| `--since <date>` | (`dev-report` only) Analyze commits on or after `YYYY-MM-DD`                                                                                  |
-| `--filter`       | (`bom` only) `all` (default) or `top-level` — keep only root manifest deps; the byTopLevelDep rollup still reflects transitives               |
-| `--no-nested`    | (`bom` only) Disable nested-project aggregation. Default discovers every sub-project with a language manifest under cwd and merges their BOMs |
+| Flag              | Effect                                                                                                                                                                                                                                                                  |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `--detailed`      | Surface the success-log line for the detailed report. (As of 2.4.7 the `-detailed.json` + `-detailed.md` files are written **unconditionally** so the dashboard always finds fresh input — this flag only controls the console-side noise.)                             |
+| `--json`          | Emit pure JSON on stdout. Logs go to stderr so pipes stay clean                                                                                                                                                                                                         |
+| `--verbose`       | Print per-tool timing to stderr                                                                                                                                                                                                                                         |
+| `--no-save`       | Skip writing markdown; useful with `--json`                                                                                                                                                                                                                             |
+| `--xlsx`          | (`licenses`, `bom` only) Also write 15-col `.xlsx` — drop-in for spreadsheet workflows                                                                                                                                                                                  |
+| `-o <file>`       | (`licenses`, `bom`, `to-xlsx`) Override output path for xlsx / converted file                                                                                                                                                                                           |
+| `--since <date>`  | (`dev-report` only) Analyze commits on or after `YYYY-MM-DD`                                                                                                                                                                                                            |
+| `--filter`        | (`bom` only) `all` (default) or `top-level` — keep only root manifest deps; the byTopLevelDep rollup still reflects transitives                                                                                                                                         |
+| `--no-nested`     | (`bom` only) Disable nested-project aggregation. Default discovers every sub-project with a language manifest under cwd and merges their BOMs                                                                                                                           |
+| `--with-coverage` | (`health`, `test-gaps`, `report`) Materialize coverage artifacts via per-pack `runTests()` **before** analysis. Promotes the headline from filename-match heuristic to `line-coverage` truth. With `report`, runs once upfront — health + test-gaps share the artifact. |
+| `--lang <id>`     | (`coverage`, `--with-coverage`) Restrict to one pack id when the repo is polyglot                                                                                                                                                                                       |
+| `--no-fail-fast`  | (`coverage`, `--with-coverage`) Continue running coverage across remaining packs after a `failed` outcome                                                                                                                                                               |
 
 ### Detailed mode — evidence + ranked fixes
 
@@ -85,12 +91,24 @@ Plus a converter: `vyuh-dxkit to-xlsx <json-file>` renders any `licenses` or `bo
 
 Three signals, strongest wins for files it covers:
 
-1. **Coverage artifact** — Istanbul JSON (TS/JS), `coverage.json` (Python), `coverage.out` (Go), cobertura XML (C#/Rust), `lcov.info` (Rust), JaCoCo XML (Kotlin). If the tool measured a file, that decision is authoritative.
+1. **Coverage artifact** — Istanbul JSON (TS/JS), `coverage.json` (Python), `coverage.out` (Go), cobertura XML (C#/Rust), `lcov.info` (Rust), JaCoCo XML (Kotlin/Java), SimpleCov resultset (Ruby). If the tool measured a file, that decision is authoritative.
 2. **Import-graph reachability** — files transitively imported from an active test file (up to 3 hops). Rescues integration tests + behavior-named tests the filename matcher misses.
 3. **Filename match** — last-resort basename similarity.
 
 A file counts as "tested" when the strongest available signal says so.
 
+#### Coverage fidelity tier (2.4.7+)
+
+Test-gap reports now carry a `coverageFidelity` tier so a 0% from a heuristic can't be confused with a 0% from a real coverage run:
+
+| Tier             | Source                                                                     | Trust              |
+| ---------------- | -------------------------------------------------------------------------- | ------------------ |
+| `line-coverage`  | Any of the artifacts above                                                 | Line-level truth   |
+| `import-graph`   | Test-file import edges (up to N hops)                                      | Informed heuristic |
+| `filename-match` | Source files with a name-matched test (200-line file / 5-line test passes) | Pure heuristic     |
+
+The test-gaps markdown leads with a ⚠️ / ℹ️ banner when fidelity isn't `line-coverage`, pointing at `vyuh-dxkit coverage` and `vyuh-dxkit health --with-coverage` as the install paths to ground-truth.
+
 ---
 
 ## Tool Registry
@@ -281,6 +299,32 @@ Mirrors pre-push but also runs the slop check against the PR base branch, so `--
 
 ---
 
+## Scoring
+
+dxkit produces a 0-100 score + A/B/C/D/E letter rating for six
+dimensions of every codebase. Three properties define the scoring
+model:
+
+- **Deterministic** — pure-function evaluator over a declarative spec
+  per dimension. Same `git rev-parse HEAD` + same dxkit version
+  produces the identical score on every run, every machine. This is
+  the moat against LLM-driven review products, where outputs drift
+  run-to-run.
+- **Anchored** — methodology cites underlying open international
+  standards (ISO/IEC 25010, ISO/IEC 5055, SQALE method, CVSS v4,
+  CWE, OWASP, OpenSSF Scorecard) rather than invented thresholds.
+- **Actionable** — every score is paired with structured provenance
+  so the report says what to fix and how much the score would lift.
+  Customer-facing markdown surfaces a "Top actions" block per
+  dimension; agents consume the same structured `ScoreResult` JSON
+  directly.
+
+The customer-facing methodology document — including the per-
+dimension penalty/cap breakdown and citations — lives at
+**[`docs/SCORING.md`](docs/SCORING.md)**.
+
+---
+
 ## Quality Gates for Agent-Written Code
 
 dxkit's guiding principle: **deterministic guardrails that catch bad output regardless of who wrote it.** Scaffolded hooks + CI give every repo:
@@ -356,24 +400,46 @@ Both loops use the session framework — checkpoints, skill evolution, progress
 
 ## Reports
 
-All analyzer commands save timestamped reports to `.dxkit/reports/`:
+All analyzer commands save timestamped reports to `.dxkit/reports/`.
+Every command writes a summary markdown, a detailed markdown, and a
+canonical detailed JSON. `bom` adds an XLSX; `licenses` adds an XLSX
+when `--xlsx` is set. `dashboard` (or `report`) writes the single-file
+HTML view that stitches everything together.
 
 ```
 .dxkit/reports/
-  health-audit-<date>.md
-  health-audit-<date>-detailed.md           # with --detailed
-  health-audit-<date>-detailed.json         # agent-consumable
+  health-audit-<date>.md                    # 6-dimension summary
+  health-audit-<date>-detailed.md           # with per-dim plans + evidence
+  health-audit-<date>-detailed.json         # agent-consumable schema
+
   vulnerability-scan-<date>.md
+  vulnerability-scan-<date>-detailed.{md,json}
+
   test-gaps-<date>.md
+  test-gaps-<date>-detailed.{md,json}
+
   quality-review-<date>.md
+  quality-review-<date>-detailed.{md,json}
+
   developer-report-<date>.md
+  developer-report-<date>-detailed.{md,json}
+
+  bom-<date>.md                             # Bill of Materials summary
+  bom-<date>-detailed.{md,json}             # full per-package rows
+  bom-<date>.xlsx                           # 15-col XLSX (with --xlsx)
+
+  licenses-<date>.md                        # license inventory
+  licenses-<date>-detailed.{md,json}
+  licenses-<date>.xlsx                      # with --xlsx
+
+  dashboard.html                            # single-file HTML view
 ```
 
 Export options:
 
-- **HTML dashboard**: `/dashboard` (Claude Code slash command) — dark-themed sidebar navigation
-- **PDF**: `/export-pdf all` — converts all reports to PDF
-- **Structured JSON**: `--detailed` on any command emits a canonical JSON schema
+- **HTML dashboard**: `vyuh-dxkit dashboard` or the `/dashboard` slash command — dark-themed sidebar navigation, reads every `*-detailed.json` under `.dxkit/reports/`
+- **PDF**: `/export-pdf all` — converts every report to PDF
+- **Structured JSON**: every command writes a `-detailed.json` unconditionally as of 2.4.7, so agents and dashboards always have the structured schema available
 
 ---
 
@@ -402,15 +468,22 @@ When create-devstack writes `.project.yaml` before calling dxkit, detection and
 ## CLI Reference
 
 ```bash
-# Analyzer commands — each writes to .dxkit/reports/<name>-<date>.md
-vyuh-dxkit health [path]                       # 6-dimension score
+# Analyzer commands — each writes to .dxkit/reports/<name>-<date>.md + <name>-<date>-detailed.{md,json}
+vyuh-dxkit health [path] [--with-coverage]     # 6-dimension score
 vyuh-dxkit vulnerabilities [path]              # Security scan, ranked by composite risk
-vyuh-dxkit test-gaps [path]                    # Coverage + gaps + actions
+vyuh-dxkit test-gaps [path] [--with-coverage]  # Coverage + gaps + actions
 vyuh-dxkit quality [path]                      # Slop + duplication + lint
 vyuh-dxkit dev-report [path] [--since <date>]  # Git activity report
 vyuh-dxkit licenses [path]                     # Dependency license inventory
 vyuh-dxkit bom [path] [--filter=top-level]     # Bill of Materials + risk-ranked triage
 
+# Coverage materialization (side-effecting — runs each pack's test runner)
+vyuh-dxkit coverage [path] [--lang <id>] [--no-fail-fast]
+
+# Dashboard + one-shot full audit
+vyuh-dxkit dashboard [path]                    # render .dxkit/reports/ to a single HTML page
+vyuh-dxkit report [path] [--with-coverage]     # run every analyzer + dashboard end-to-end
+
 # Data conversion
 vyuh-dxkit to-xlsx <json-file>        # render licenses/bom detailed JSON as 15-col XLSX
 
@@ -442,6 +515,38 @@ No LLM in the analysis path. Scores are reproducible: same repo state → same r
 
 ---
 
+## Community + Contributing
+
+- **[`CHANGELOG.md`](CHANGELOG.md)** — release notes by version,
+  including methodology shifts that may change scores between
+  releases (e.g. the 2.4.7 scoring foundation).
+- **[`CONTRIBUTING.md`](CONTRIBUTING.md)** — local setup, the
+  pre-commit hook stack, test conventions, and the "Adding a new
+  language" walkthrough.
+- **[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)** — a short tour
+  of the analyzer data flow, the three core patterns (language
+  packs, scoring specs, centralized exclusions + tool registry),
+  the subprocess discipline, and the `AnalysisResult` cache.
+- **[`CLAUDE.md`](CLAUDE.md)** — the authoritative architectural
+  rule set with pre-commit + CI enforcement. Required reading
+  before opening a PR that touches scoring, packs, exclusions, or
+  tool invocation.
+- **[`docs/SCORING.md`](docs/SCORING.md)** — full scoring
+  methodology: dimensions, weights, thresholds, caps, and the
+  Layer-1 standards each spec anchors to.
+- **[`SECURITY.md`](SECURITY.md)** — security policy, supported
+  versions, response SLAs, and the [private vulnerability
+  reporting](https://github.com/vyuh-labs/dxkit/security/advisories/new)
+  channel.
+- **[`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md)** — Contributor
+  Covenant 2.1.
+
+Bug reports, feature requests, and questions: file an
+[issue](https://github.com/vyuh-labs/dxkit/issues/new/choose) using
+one of the templates.
+
+---
+
 ## License
 
 MIT

package/dist/analysis-result.d.ts

@@ -0,0 +1,112 @@
+/**
+ * AnalysisResult — the canonical cross-process aggregate that every
+ * dxkit subcommand reads from instead of independently re-running the
+ * tool gather.
+ *
+ * Architectural posture:
+ *
+ *   - **One gather per repo+SHA.** `vyuh-dxkit health`, `vulnerabilities`,
+ *     `test-gaps`, `quality`, `dev-report`, `licenses`, `bom`, `dashboard`,
+ *     and `coverage` all build OR read this same struct. When two
+ *     subcommands run minutes apart on the same commit, they see byte-
+ *     identical inputs — multi-consumer drift on shared metrics becomes
+ *     structurally impossible.
+ *
+ *   - **Provenance is part of the type.** `commitSha` + `dxkitVersion`
+ *     + `schemaVersion` + `ignoreFileMtime` form the cache invalidation
+ *     key. Any of them changing means the cached file is stale and the
+ *     gather must rerun.
+ *
+ *   - **Dirty trees never persist.** When the working tree has
+ *     uncommitted changes, `workingTreeDirty` is true. The cache module
+ *     refuses to read or write the on-disk file in that state; in-
+ *     process callers can still share a single rebuild via the in-
+ *     memory cache, but nothing reaches `.dxkit/cache/` on disk.
+ *
+ *   - **`capabilities` + `metrics` are the canonical aggregates** —
+ *     identical to what the health analyzer's internal gather produces,
+ *     just persisted between processes. `CapabilityReport` already
+ *     carries the canonical security aggregate (one severity-bucket
+ *     source for every consumer). This envelope generalizes the same
+ *     "one aggregate, many consumers" template up one architectural
+ *     level: one `AnalysisResult` across the process boundary.
+ *
+ *   - **`derived` is for lazily-materialized per-analyzer outputs**
+ *     (LicensesReport, BomReport, DevReport, …). Empty at first;
+ *     consumers widen the union as each analyzer migrates so a
+ *     subcommand can fetch its pre-rendered report by name. Keeping
+ *     it optional lets every consumer choose between "render from
+ *     `capabilities` + `metrics`" and "read the cached derived report"
+ *     without forcing a single answer up front.
+ */
+import type { DetectedStack } from './types';
+import type { CapabilityReport, HealthMetrics } from './analyzers/types';
+/**
+ * Bump whenever the shape of `AnalysisResult` or any of its nested
+ * types changes in a way that makes an older cached JSON file
+ * incompatible. The cache module treats any mismatch as a hard miss
+ * and rebuilds from scratch.
+ */
+export declare const ANALYSIS_RESULT_SCHEMA_VERSION: 3;
+export type AnalysisResultSchemaVersion = typeof ANALYSIS_RESULT_SCHEMA_VERSION;
+/**
+ * Reserved for lazily-materialized per-analyzer outputs. Empty at
+ * present; each analyzer that migrates onto the cache adds its
+ * rendered report under a named key here. Keeping the type optional
+ * and extensible lets analyzers migrate one at a time without forcing
+ * a single decision on which ones cache their derived output (vs
+ * render fresh on every call from `capabilities` + `metrics`).
+ */
+export interface AnalysisResultDerived {
+}
+/**
+ * The non-provenance content of an `AnalysisResult` — what the
+ * gather pipeline actually produces. `cache.ts` accepts a builder
+ * function returning this shape and stamps the surrounding provenance
+ * itself, so callers don't have to hand-roll SHA / mtime / version
+ * detection.
+ */
+export interface AnalysisResultBody {
+    stack: DetectedStack;
+    capabilities: CapabilityReport;
+    metrics: HealthMetrics;
+    derived?: AnalysisResultDerived;
+}
+/**
+ * The full cached envelope. Provenance fields up front, body fields
+ * follow. Serialized to JSON when persisted; the schema-version field
+ * makes future migrations explicit rather than relying on shape
+ * detection.
+ */
+export interface AnalysisResult extends AnalysisResultBody {
+    /** Short SHA (`git rev-parse --short HEAD`). Empty when not in a git repo. */
+    commitSha: string;
+    /** Current branch name. Empty when not in a git repo. */
+    branch: string;
+    /** Absolute repo path the gather ran against. Disambiguates two
+     *  worktrees of the same repo persisting independent caches. */
+    cwd: string;
+    /** ISO timestamp of when the result was built (NOT when it was last
+     *  read from cache). Useful for "report is X minutes old" surfacing
+     *  in the CLI and for distinguishing a fresh rebuild from a hit. */
+    builtAt: string;
+    /** Version of dxkit that produced the result. Different versions can
+     *  produce different metrics (new tools added, scoring formulas
+     *  changed); a version delta invalidates the cache. */
+    dxkitVersion: string;
+    /** Schema version of THIS envelope shape. See
+     *  `ANALYSIS_RESULT_SCHEMA_VERSION`. */
+    schemaVersion: AnalysisResultSchemaVersion;
+    /** `.dxkit-ignore` mtime in ms (from `fs.statSync(...).mtimeMs`).
+     *  `null` when the file doesn't exist. Differences invalidate the
+     *  cache — ignore-rule changes alter what gets scanned, so cached
+     *  metrics computed against the old ruleset are stale. */
+    ignoreFileMtime: number | null;
+    /** True when `git status --porcelain` reports any change. Dirty-tree
+     *  results NEVER persist to disk and are not read back from disk
+     *  (their commit SHA doesn't reflect the on-disk state). The flag
+     *  surfaces in JSON-mode output so consumers know they're looking at
+     *  an in-process-only result. */
+    workingTreeDirty: boolean;
+}
+//# sourceMappingURL=analysis-result.d.ts.map

package/dist/analysis-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-result.d.ts","sourceRoot":"","sources":["../src/analysis-result.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAG,CAAU,CAAC;AACzD,MAAM,MAAM,2BAA2B,GAAG,OAAO,8BAA8B,CAAC;AAEhF;;;;;;;GAOG;AAWH,MAAM,WAAW,qBAAqB;CAAG;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAElB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IAEf;oEACgE;IAChE,GAAG,EAAE,MAAM,CAAC;IAEZ;;wEAEoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAEhB;;2DAEuD;IACvD,YAAY,EAAE,MAAM,CAAC;IAErB;4CACwC;IACxC,aAAa,EAAE,2BAA2B,CAAC;IAE3C;;;8DAG0D;IAC1D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B;;;;qCAIiC;IACjC,gBAAgB,EAAE,OAAO,CAAC;CAC3B"}

package/dist/analysis-result.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * AnalysisResult — the canonical cross-process aggregate that every
+ * dxkit subcommand reads from instead of independently re-running the
+ * tool gather.
+ *
+ * Architectural posture:
+ *
+ *   - **One gather per repo+SHA.** `vyuh-dxkit health`, `vulnerabilities`,
+ *     `test-gaps`, `quality`, `dev-report`, `licenses`, `bom`, `dashboard`,
+ *     and `coverage` all build OR read this same struct. When two
+ *     subcommands run minutes apart on the same commit, they see byte-
+ *     identical inputs — multi-consumer drift on shared metrics becomes
+ *     structurally impossible.
+ *
+ *   - **Provenance is part of the type.** `commitSha` + `dxkitVersion`
+ *     + `schemaVersion` + `ignoreFileMtime` form the cache invalidation
+ *     key. Any of them changing means the cached file is stale and the
+ *     gather must rerun.
+ *
+ *   - **Dirty trees never persist.** When the working tree has
+ *     uncommitted changes, `workingTreeDirty` is true. The cache module
+ *     refuses to read or write the on-disk file in that state; in-
+ *     process callers can still share a single rebuild via the in-
+ *     memory cache, but nothing reaches `.dxkit/cache/` on disk.
+ *
+ *   - **`capabilities` + `metrics` are the canonical aggregates** —
+ *     identical to what the health analyzer's internal gather produces,
+ *     just persisted between processes. `CapabilityReport` already
+ *     carries the canonical security aggregate (one severity-bucket
+ *     source for every consumer). This envelope generalizes the same
+ *     "one aggregate, many consumers" template up one architectural
+ *     level: one `AnalysisResult` across the process boundary.
+ *
+ *   - **`derived` is for lazily-materialized per-analyzer outputs**
+ *     (LicensesReport, BomReport, DevReport, …). Empty at first;
+ *     consumers widen the union as each analyzer migrates so a
+ *     subcommand can fetch its pre-rendered report by name. Keeping
+ *     it optional lets every consumer choose between "render from
+ *     `capabilities` + `metrics`" and "read the cached derived report"
+ *     without forcing a single answer up front.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANALYSIS_RESULT_SCHEMA_VERSION = void 0;
+/**
+ * Bump whenever the shape of `AnalysisResult` or any of its nested
+ * types changes in a way that makes an older cached JSON file
+ * incompatible. The cache module treats any mismatch as a hard miss
+ * and rebuilds from scratch.
+ */
+exports.ANALYSIS_RESULT_SCHEMA_VERSION = 3;
+//# sourceMappingURL=analysis-result.js.map

package/dist/analysis-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-result.js","sourceRoot":"","sources":["../src/analysis-result.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;;;AAKH;;;;;GAKG;AACU,QAAA,8BAA8B,GAAG,CAAU,CAAC"}

package/dist/analyzers/bom/detailed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EACP,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,uBAAuB,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,cAAc,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAChD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,CA8HrE;AASD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA6G9F"}
+{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EACP,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,uBAAuB,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,cAAc,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAChD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,CA8HrE;AASD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAmI9F"}

package/dist/analyzers/bom/detailed.js

@@ -152,6 +152,25 @@ function formatBomDetailedMarkdown(detailed, elapsed) {
         L.push(`- **Vuln-only entries (license gap):** ${s.vulnOnlyPackages}`);
     }
     L.push('');
+    // D070 (2.4.7): full per-root listing lives in the detailed report
+    // only — the main report collapses to a count + 5-root preview to
+    // stay scannable. One root per line here so customers auditing
+    // per-root attribution can grep / sort cleanly.
+    if (s.projectRoots.length > 1) {
+        L.push(`## Project Roots (${s.projectRoots.length})`);
+        L.push('');
+        L.push('Each row in the package tables unions the roots that installed the ' +
+            'package; the full list is reproduced here for per-root audit. See the ' +
+            '`sources` column in `bom-<date>.xlsx` (when `--xlsx` is passed) for ' +
+            'machine-readable per-row attribution.');
+        L.push('');
+        for (const r of s.projectRoots) {
+            L.push(`- \`${r}\``);
+        }
+        L.push('');
+        L.push('---');
+        L.push('');
+    }
     L.push(`> Reconciles with \`vyuh-dxkit vulnerabilities\`: that command counts ` +
         `per-advisory (${s.totalAdvisories}); bom collapses per-package ` +
         `(${s.vulnerablePackages}) so each xlsx row is one upgrade decision.`);

package/dist/analyzers/bom/detailed.js.map

@@ -1 +1 @@
-{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA0BH,4CA8HC;AASD,8DA6GC;AApPD,SAAgB,gBAAgB,CAAC,MAAiB;IAChD,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,oBAAoB;IACpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,SAAS;QAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,sCAAsC;YAC7C,SAAS,EACP,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;YACvE,cAAc,EACZ,gEAAgE;gBAChE,6DAA6D;YAC/D,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,qCAAqC;YAC5C,SAAS,EACP,gEAAgE;gBAChE,+DAA+D;gBAC/D,wCAAwC;YAC1C,cAAc,EACZ,gEAAgE;gBAChE,4DAA4D;YAC9D,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,2CAA2C;YAClD,SAAS,EACP,gEAAgE;gBAChE,gEAAgE;YAClE,cAAc,EACZ,+DAA+D;gBAC/D,mDAAmD;YACrD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,0CAA0C;YACjD,SAAS,EAAE,0DAA0D;YACrE,cAAc,EAAE,2CAA2C;YAC3D,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,iCAAiC;YACxC,SAAS,EAAE,gEAAgE;YAC3E,cAAc,EACZ,4DAA4D;gBAC5D,4DAA4D;gBAC5D,6BAA6B;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,KAAK;YACf,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,8BAA8B;YACrC,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,8CAA8C;YAC9D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,yCAAyC;YAChD,SAAS,EACP,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,wBAAwB;YAC1B,cAAc,EACZ,+DAA+D;gBAC/D,+DAA+D;gBAC/D,wCAAwC;YAC1C,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAgB,yBAAyB,CAAC,QAA2B,EAAE,OAAe;IACpF,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAE3B,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,eAAe,8BAA8B,CAAC,CAAC;IACnF,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,wEAAwE;QACtE,iBAAiB,CAAC,CAAC,eAAe,+BAA+B;QACjE,IAAI,CAAC,CAAC,kBAAkB,6CAA6C,CACxE,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC,CAAC,IAAI,CACJ,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,MAAM,IAAI,CACvF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,oEAAoE;IACpE,oEAAoE;IACpE,oCAAoC;IACpC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CACJ;SACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5F,CAAC;IAEJ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACtE,CAAC,CAAC,IAAI,CACJ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,OAAO,IAAI,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA0BH,4CA8HC;AASD,8DAmIC;AA1QD,SAAgB,gBAAgB,CAAC,MAAiB;IAChD,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,oBAAoB;IACpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,SAAS;QAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,sCAAsC;YAC7C,SAAS,EACP,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;YACvE,cAAc,EACZ,gEAAgE;gBAChE,6DAA6D;YAC/D,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,qCAAqC;YAC5C,SAAS,EACP,gEAAgE;gBAChE,+DAA+D;gBAC/D,wCAAwC;YAC1C,cAAc,EACZ,gEAAgE;gBAChE,4DAA4D;YAC9D,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,2CAA2C;YAClD,SAAS,EACP,gEAAgE;gBAChE,gEAAgE;YAClE,cAAc,EACZ,+DAA+D;gBAC/D,mDAAmD;YACrD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,0CAA0C;YACjD,SAAS,EAAE,0DAA0D;YACrE,cAAc,EAAE,2CAA2C;YAC3D,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,iCAAiC;YACxC,SAAS,EAAE,gEAAgE;YAC3E,cAAc,EACZ,4DAA4D;gBAC5D,4DAA4D;gBAC5D,6BAA6B;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,KAAK;YACf,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,8BAA8B;YACrC,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,8CAA8C;YAC9D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,yCAAyC;YAChD,SAAS,EACP,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,wBAAwB;YAC1B,cAAc,EACZ,+DAA+D;gBAC/D,+DAA+D;gBAC/D,wCAAwC;YAC1C,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAgB,yBAAyB,CAAC,QAA2B,EAAE,OAAe;IACpF,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAE3B,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,eAAe,8BAA8B,CAAC,CAAC;IACnF,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,mEAAmE;IACnE,kEAAkE;IAClE,+DAA+D;IAC/D,gDAAgD;IAChD,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,qEAAqE;YACnE,wEAAwE;YACxE,sEAAsE;YACtE,uCAAuC,CAC1C,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,CAAC,CAAC,IAAI,CACJ,wEAAwE;QACtE,iBAAiB,CAAC,CAAC,eAAe,+BAA+B;QACjE,IAAI,CAAC,CAAC,kBAAkB,6CAA6C,CACxE,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC,CAAC,IAAI,CACJ,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,MAAM,IAAI,CACvF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,oEAAoE;IACpE,oEAAoE;IACpE,oCAAoC;IACpC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CACJ;SACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5F,CAAC;IAEJ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACtE,CAAC,CAAC,IAAI,CACJ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,OAAO,IAAI,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/bom/gather.d.ts

@@ -4,7 +4,8 @@
  * (CLAUDE.md rule 2). The gather just calls each, then walks both
  * result sets to build a per-package join keyed by `package@version`.
  */
-import type { DepVulnFinding } from '../../languages/capabilities/types';
+import type { DepVulnSummary } from '../security/types';
+import type { DepVulnFinding, LicensesResult } from '../../languages/capabilities/types';
 import type { BomEntry, BomTopLevelRollup } from './types';
 /**
  * Compare two version strings as semver triples. Strips a leading
@@ -58,34 +59,34 @@ export interface BomGatherResult {
     entries: BomEntry[];
     toolsUsed: string[];
     toolsUnavailable: string[];
-    /** Cwd-relative project-root paths the gather walked. Length 1 for
-     *  single-root scans ("." ); length >1 for nested aggregation. */
-    projectRoots: string[];
 }
 /**
- * Merge per-root gather results into one deduplicated set.
+ * Both pre-gathered envelopes are optional. The override pattern lets
+ * the analyzer layer hand BoM a canonical inventory + advisory set
+ * built once at repo-root, so the gather pipeline never re-walks the
+ * tree from a different cwd (the root cause of cross-consumer drift
+ * on the same logical metric — e.g. licenses-vs-BoM package count
+ * diverging on a deep C# monorepo because two walks visited two
+ * different subsets of csproj files).
  *
- * Dedupe key is `(package, version)` — the same logical package at
- * the same version installed under two roots is the same artifact,
- * so reporting two rows would be noise. When the same key appears
- * under multiple roots:
+ * `depVulnsOverride`: shared dep-vuln set across nested callers.
+ *   Pre-fix BoM called `gatherDepVulns(absRoot)` per sub-root, and
+ *   the csharp pack's gather was cwd-sensitive — at a sub-root with
+ *   a stale `obj/project.assets.json` it returned 0 advisories via
+ *   dotnet, while at repo-root with no `.csproj` it correctly fell
+ *   back to `osv-scanner-nuget-direct` and surfaced them. Override +
+ *   the pack-layer cwd-invariance work closed that gap.
  *
- *   - `sources` unions the sub-paths
- *   - `isTopLevel` OR-merges — if any root treats the package as
- *     top-level, the merged entry is top-level (upgrade decisions
- *     surface under Top-Level Dep Groups)
- *   - `vulns` unions with dedup on `(id, package, installedVersion)`
- *     — the same advisory reported from two roots collapses into
- *     one finding but its `topLevelDep` list unions
- *   - license metadata (licenseType, sourceUrl, etc.) prefers the
- *     first root with non-UNKNOWN data, falling back to whatever
- *     the first-seen entry carried
- *
- * Pure function; unit-testable without filesystem.
+ * `licensesOverride`: pre-gathered canonical license inventory.
+ *   When set, the gather skips its own `gatherLicensesResult(cwd)`
+ *   call and uses the override directly. `null` (a deliberate
+ *   "license inventory exists but is empty / unavailable") is
+ *   distinguished from `undefined` ("gather it yourself") — the
+ *   canonical analyzer-layer caller always passes the cached
+ *   envelope shape verbatim.
  */
-export declare function mergeNestedBomEntries(perRoot: ReadonlyArray<{
-    relPath: string;
-    result: BomGatherResult;
-}>): BomGatherResult;
-export declare function gatherBomEntries(cwd: string): Promise<BomGatherResult>;
+export declare function gatherBomEntries(cwd: string, options?: {
+    depVulnsOverride?: DepVulnSummary;
+    licensesOverride?: LicensesResult | null;
+}): Promise<BomGatherResult>;
 //# sourceMappingURL=gather.d.ts.map

package/dist/analyzers/bom/gather.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/gather.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIxE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;mDACmD;AACnD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM,CAQrE;AAYD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAkCzF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;sEACkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,GACnE,eAAe,CAkEjB;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkF5E"}
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/gather.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EAEd,cAAc,EACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIxE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;mDACmD;AACnD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM,CAQrE;AAYD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAkCzF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IACP,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,gBAAgB,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACrC,GACL,OAAO,CAAC,eAAe,CAAC,CAmF1B"}