@vyuhlabs/dxkit 2.4.6 → 2.4.8

package/dist/analyzers/tools/minified-detection.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLikelyMinified = isLikelyMinified;
+/**
+ * Minified / bundled source-file detection.
+ *
+ * Complements the autogen-header probe by catching another class of
+ * machine-emitted files that frequently land in customer
+ * `src/` / `public/` trees: minified or bundled JavaScript / CSS.
+ * These files are technically "source" by extension but carry no
+ * engineering signal — they're build output (webpack / vite /
+ * esbuild hash-suffixed chunks), CDN-downloaded libraries dropped
+ * into `public/`, or pre-minified vendored editors. When they slip
+ * past the standard exclusions they distort:
+ *
+ *   • `largestFileLines` + `largestFilePath` ("Largest file: 18K
+ *     lines" points at a webpack chunk, not a human-authored file)
+ *   • `filesOver500Lines` (every minified JS file is one line at
+ *     thousands of chars, so doesn't inflate this; but the BUNDLE
+ *     CHUNKS that span multiple lines do)
+ *   • `densestFile` from graphify (4,000+ functions in a single
+ *     minified file)
+ *   • Top Files by Size (the table reads as "split these" but the
+ *     files are all autogen artifacts)
+ *
+ * Detection heuristic: read the first ~4KB, count newlines, compare
+ * to byte length. If average bytes-per-line crosses a threshold the
+ * file is almost certainly minified or a hash-suffixed bundle chunk.
+ * Threshold picked at 500 bytes/line — well above typical
+ * hand-written source (~80–120 cols, ~100 bytes/line including
+ * indentation) and well below typical minified output (often
+ * 5,000–50,000 bytes per "line" in single-line minified files, or
+ * 200–800 bytes/line in webpack bundles with semicolon-split
+ * chunks).
+ *
+ * Scope: applied to `.js`, `.jsx`, `.mjs`, `.cjs`, `.css`, `.scss`,
+ * `.sass`, `.less`. NOT applied to `.ts` / `.tsx` because TS source
+ * is rarely minified in-place (the minified output lands in a
+ * separate `dist/` directory which is already excluded by the
+ * standard ignore list); checking every .ts file would burn I/O
+ * for no benefit.
+ *
+ * Repo-specific autogen that doesn't match this heuristic (e.g.
+ * vendor-tool–emitted classes with hand-typeable filenames + no
+ * autogen header) is best handled via `.dxkit-ignore` — a per-repo
+ * customization the customer maintains.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Extensions where minified content is plausibly present in the source tree. */
+const MINIFIABLE_EXTENSIONS = new Set([
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.css',
+    '.scss',
+    '.sass',
+    '.less',
+]);
+/** Bytes-per-line floor above which the file is almost certainly
+ *  minified / bundled. Calibrated to admit hand-written code at any
+ *  reasonable line length while rejecting any minifier output. */
+const MIN_BYTES_PER_LINE_FOR_MINIFIED = 500;
+/** Sample size — large enough to get reliable line statistics on
+ *  even the shortest minified chunk, small enough to keep the I/O
+ *  cost negligible vs. the existing autogen-header probe. */
+const SAMPLE_BYTES = 4096;
+/**
+ * True when the file at `absPath` looks like minified / bundled
+ * output by the bytes-per-line heuristic. Returns false on read
+ * errors or for files whose extension isn't in
+ * `MINIFIABLE_EXTENSIONS` — over-include is preferable to silently
+ * dropping legit source.
+ */
+function isLikelyMinified(absPath) {
+    const ext = path.extname(absPath).toLowerCase();
+    if (!MINIFIABLE_EXTENSIONS.has(ext))
+        return false;
+    let fd = null;
+    try {
+        fd = fs.openSync(absPath, 'r');
+        const buf = Buffer.alloc(SAMPLE_BYTES);
+        const n = fs.readSync(fd, buf, 0, SAMPLE_BYTES, 0);
+        if (n === 0)
+            return false;
+        // Count newlines in the sample. A single-line file with N bytes
+        // and zero newlines reports bytesPerLine = N (way above the
+        // floor). A normal source file with N bytes and N/100 newlines
+        // reports ~100 bytes/line.
+        let newlines = 0;
+        for (let i = 0; i < n; i++) {
+            if (buf[i] === 0x0a)
+                newlines++;
+        }
+        const linesInSample = Math.max(1, newlines);
+        const bytesPerLine = n / linesInSample;
+        return bytesPerLine >= MIN_BYTES_PER_LINE_FOR_MINIFIED;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}
+//# sourceMappingURL=minified-detection.js.map

package/dist/analyzers/tools/minified-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minified-detection.js","sourceRoot":"","sources":["../../../src/analyzers/tools/minified-detection.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,4CAgCC;AA5GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH;;kEAEkE;AAClE,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C;;6DAE6D;AAC7D,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1B,gEAAgE;QAChE,4DAA4D;QAC5D,+DAA+D;QAC/D,2BAA2B;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,CAAC;QACvC,OAAO,YAAY,IAAI,+BAA+B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/analyzers/tools/nuget-package-reference.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Direct `<PackageReference>` parser — D025f (2.4.7).
+ *
+ * Extracts NuGet PackageReference entries from `.csproj` XML text
+ * without invoking `dotnet restore` or any other .NET toolchain. The
+ * output feeds an ad-hoc `packages.lock.json`-shaped file that
+ * osv-scanner ingests via `--lockfile=<path>` (the file MUST be
+ * literally named `packages.lock.json` — osv-scanner v2.x detects the
+ * NuGet ecosystem by filename, not by a prefix). This closes the D036
+ * customer-outcome gap on the .NET WinForms benchmark (where
+ * `dotnet list package` couldn't run from a multi-project parent
+ * directory).
+ *
+ * Lives under `src/analyzers/tools/` (alongside `osv-scanner-deps.ts`,
+ * `jacoco.ts`, `npm-registry.ts`, `cvss-v4.ts`) — CLAUDE.md rule #6
+ * keeps each language pack as a single file; ecosystem-specific tool
+ * helpers consumed by one or more packs go in `analyzers/tools/`.
+ * csharp.ts imports this module the same way it already imports
+ * `osv` and `osv-scanner-deps`.
+ *
+ * Architectural rationale:
+ *
+ *   D025c (Sprint A) routed the gather through `findTool(TOOL_DEFS
+ *   ['dotnet-format'])` so users with `~/.dotnet/dotnet` (the
+ *   Microsoft-recommended non-sudo install) got dotnet discovered.
+ *   That fix was necessary but not sufficient: `dotnet list package
+ *   --vulnerable` still requires an explicit `.csproj`/`.sln` in cwd,
+ *   and the .NET WinForms benchmark's
+ *   `Code/Source/Dev/Core/<Module>/<Module>.csproj` layout puts the
+ *   project files 3 levels deeper than the natural
+ *   `dxkit vulnerabilities Code/Source/` cwd.
+ *
+ *   D025f sidesteps the dotnet CLI entirely. We walk every `.csproj`
+ *   reachable from cwd (depth 5, matching csharp.detect()), parse
+ *   each, and feed the union to osv-scanner via a synthetic lockfile.
+ *   Cross-platform — `net9.0-windows` targets that won't restore on
+ *   Linux/Mac still get scanned.
+ *
+ *   Trade-off: this catches DIRECT PackageReferences only. Transitive
+ *   deps (resolved by NuGet's dep graph from each direct ref's own
+ *   dependencies) are NOT visible without a populated
+ *   `project.assets.json`. Industry studies put ~80% of typical
+ *   .NET CVE surface on direct refs; the remaining ~20% (transitives)
+ *   land cleanly when `dotnet restore` is available and the
+ *   dotnet-path-resolved D025c codepath runs.
+ *
+ * Shared with D031: the licenses degraded-inventory fallback uses the
+ * same parser to produce a "133 packages identified; license info
+ * unavailable" rendering when `nuget-license` isn't installed.
+ *
+ * Pure function. No I/O. Tested via a fixture suite of representative
+ * .csproj shapes (attribute-form, element-form, Central Package
+ * Management, conditional `<ItemGroup>` blocks).
+ */
+/**
+ * Per-package entry extracted from a `.csproj`. Both fields are
+ * post-trimmed; `version` is the raw NuGet version string (which may
+ * be a single version `"9.0.1"` or a range `"[9.0.1, 10.0.0)"` —
+ * osv-scanner accepts both forms in the lockfile's `resolved` field).
+ */
+export interface PackageReferenceEntry {
+    name: string;
+    version: string;
+}
+/**
+ * Match shapes (in priority order):
+ *
+ *   1. `<PackageReference Include="Foo" Version="1.0.0" />` — most
+ *      common; attributes can appear in any order (also matched
+ *      `Version="1.0.0" Include="Foo"`).
+ *   2. `<PackageReference Include="Foo"><Version>1.0.0</Version>
+ *      </PackageReference>` — element-form, equivalent semantics;
+ *      common in repos that prefer multiline configs or use child
+ *      elements for `<PrivateAssets>`/`<IncludeAssets>` siblings.
+ *   3. `<PackageReference Include="Foo" />` WITHOUT Version — Central
+ *      Package Management (CPM): the version comes from a separate
+ *      `Directory.Packages.props` file. Skipped here; the CPM-aware
+ *      pass (a future enhancement) would resolve them.
+ *
+ * Skipped shapes:
+ *
+ *   - `<PackageReference Update="Foo" Version="..." />` — CPM
+ *     override syntax for transitive pins; NOT a direct reference.
+ *   - `<GlobalPackageReference ... />` — CPM-only; pins all projects.
+ *     Not a direct reference of this csproj.
+ *   - Comments / CDATA — best-effort; the regex is generous and
+ *     can theoretically match `<!-- <PackageReference ... -->`
+ *     comments; users with literal PackageReference strings inside
+ *     comments would get false positives. Acceptable: pathological
+ *     case, and osv-scanner won't surface advisories for non-real
+ *     packages, so the worst case is a wasted scan entry.
+ */
+export declare function parseCsprojPackageReferences(xml: string): PackageReferenceEntry[];
+/**
+ * Generate the body of an ad-hoc `packages.lock.json` that osv-scanner
+ * v2.x reads via `--lockfile=<path>` (caller MUST write this content to
+ * a file literally named `packages.lock.json` — osv-scanner detects
+ * ecosystem by filename). The schema matches NuGet's native
+ * `dotnet restore`-produced lockfile (which osv-scanner already
+ * supports natively), simplified to the minimum osv-scanner consults
+ * for vulnerability matching:
+ *
+ *   {
+ *     "version": 1,
+ *     "dependencies": {
+ *       "net0.0": {
+ *         "<Pkg>": {
+ *           "type": "Direct",
+ *           "resolved": "<Version>",
+ *           "requested": "[<Version>, )"
+ *         }
+ *       }
+ *     }
+ *   }
+ *
+ * - `"version": 1` matches `dotnet restore`'s lockfile schema version.
+ * - `"net0.0"` is a placeholder framework moniker — osv-scanner reads
+ *   the package map without validating the framework key, so any
+ *   non-empty string works. We use a non-real moniker so it can't be
+ *   confused with a real target framework in downstream debugging.
+ * - `type: "Direct"` truthfully reflects that we ONLY parsed direct
+ *   references. Transitive vulns are out of scope for this path
+ *   (covered by D025c's `dotnet list` codepath when available).
+ * - `requested` is a NuGet version range; we use a single-anchored
+ *   `[V, )` form so the lockfile is valid even though the real
+ *   `.csproj` might have been a pinned single version.
+ *
+ * Returns a JSON-stringified string suitable for writing to a temp
+ * file. Callers should clean up the temp file after osv-scanner
+ * consumes it.
+ */
+export declare function buildNugetAdhocLockfile(entries: ReadonlyArray<PackageReferenceEntry>): string;
+//# sourceMappingURL=nuget-package-reference.d.ts.map

package/dist/analyzers/tools/nuget-package-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuget-package-reference.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/nuget-package-reference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,EAAE,CA6BjF;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAiB7F"}

package/dist/analyzers/tools/nuget-package-reference.js

@@ -0,0 +1,177 @@
+"use strict";
+/**
+ * Direct `<PackageReference>` parser — D025f (2.4.7).
+ *
+ * Extracts NuGet PackageReference entries from `.csproj` XML text
+ * without invoking `dotnet restore` or any other .NET toolchain. The
+ * output feeds an ad-hoc `packages.lock.json`-shaped file that
+ * osv-scanner ingests via `--lockfile=<path>` (the file MUST be
+ * literally named `packages.lock.json` — osv-scanner v2.x detects the
+ * NuGet ecosystem by filename, not by a prefix). This closes the D036
+ * customer-outcome gap on the .NET WinForms benchmark (where
+ * `dotnet list package` couldn't run from a multi-project parent
+ * directory).
+ *
+ * Lives under `src/analyzers/tools/` (alongside `osv-scanner-deps.ts`,
+ * `jacoco.ts`, `npm-registry.ts`, `cvss-v4.ts`) — CLAUDE.md rule #6
+ * keeps each language pack as a single file; ecosystem-specific tool
+ * helpers consumed by one or more packs go in `analyzers/tools/`.
+ * csharp.ts imports this module the same way it already imports
+ * `osv` and `osv-scanner-deps`.
+ *
+ * Architectural rationale:
+ *
+ *   D025c (Sprint A) routed the gather through `findTool(TOOL_DEFS
+ *   ['dotnet-format'])` so users with `~/.dotnet/dotnet` (the
+ *   Microsoft-recommended non-sudo install) got dotnet discovered.
+ *   That fix was necessary but not sufficient: `dotnet list package
+ *   --vulnerable` still requires an explicit `.csproj`/`.sln` in cwd,
+ *   and the .NET WinForms benchmark's
+ *   `Code/Source/Dev/Core/<Module>/<Module>.csproj` layout puts the
+ *   project files 3 levels deeper than the natural
+ *   `dxkit vulnerabilities Code/Source/` cwd.
+ *
+ *   D025f sidesteps the dotnet CLI entirely. We walk every `.csproj`
+ *   reachable from cwd (depth 5, matching csharp.detect()), parse
+ *   each, and feed the union to osv-scanner via a synthetic lockfile.
+ *   Cross-platform — `net9.0-windows` targets that won't restore on
+ *   Linux/Mac still get scanned.
+ *
+ *   Trade-off: this catches DIRECT PackageReferences only. Transitive
+ *   deps (resolved by NuGet's dep graph from each direct ref's own
+ *   dependencies) are NOT visible without a populated
+ *   `project.assets.json`. Industry studies put ~80% of typical
+ *   .NET CVE surface on direct refs; the remaining ~20% (transitives)
+ *   land cleanly when `dotnet restore` is available and the
+ *   dotnet-path-resolved D025c codepath runs.
+ *
+ * Shared with D031: the licenses degraded-inventory fallback uses the
+ * same parser to produce a "133 packages identified; license info
+ * unavailable" rendering when `nuget-license` isn't installed.
+ *
+ * Pure function. No I/O. Tested via a fixture suite of representative
+ * .csproj shapes (attribute-form, element-form, Central Package
+ * Management, conditional `<ItemGroup>` blocks).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCsprojPackageReferences = parseCsprojPackageReferences;
+exports.buildNugetAdhocLockfile = buildNugetAdhocLockfile;
+/**
+ * Match shapes (in priority order):
+ *
+ *   1. `<PackageReference Include="Foo" Version="1.0.0" />` — most
+ *      common; attributes can appear in any order (also matched
+ *      `Version="1.0.0" Include="Foo"`).
+ *   2. `<PackageReference Include="Foo"><Version>1.0.0</Version>
+ *      </PackageReference>` — element-form, equivalent semantics;
+ *      common in repos that prefer multiline configs or use child
+ *      elements for `<PrivateAssets>`/`<IncludeAssets>` siblings.
+ *   3. `<PackageReference Include="Foo" />` WITHOUT Version — Central
+ *      Package Management (CPM): the version comes from a separate
+ *      `Directory.Packages.props` file. Skipped here; the CPM-aware
+ *      pass (a future enhancement) would resolve them.
+ *
+ * Skipped shapes:
+ *
+ *   - `<PackageReference Update="Foo" Version="..." />` — CPM
+ *     override syntax for transitive pins; NOT a direct reference.
+ *   - `<GlobalPackageReference ... />` — CPM-only; pins all projects.
+ *     Not a direct reference of this csproj.
+ *   - Comments / CDATA — best-effort; the regex is generous and
+ *     can theoretically match `<!-- <PackageReference ... -->`
+ *     comments; users with literal PackageReference strings inside
+ *     comments would get false positives. Acceptable: pathological
+ *     case, and osv-scanner won't surface advisories for non-real
+ *     packages, so the worst case is a wasted scan entry.
+ */
+function parseCsprojPackageReferences(xml) {
+    const out = [];
+    const seen = new Set(); // dedupe `${name}@${version}` within a single .csproj
+    // Form 1 (attribute-form): two attribute orderings.
+    // Match Include="X" ... Version="Y"
+    const attrIncludeFirstRe = /<PackageReference\s+[^>]*\bInclude\s*=\s*"([^"]+)"[^>]*\bVersion\s*=\s*"([^"]+)"[^>]*\/?>/gi;
+    // Match Version="Y" ... Include="X"
+    const attrVersionFirstRe = /<PackageReference\s+[^>]*\bVersion\s*=\s*"([^"]+)"[^>]*\bInclude\s*=\s*"([^"]+)"[^>]*\/?>/gi;
+    let m;
+    while ((m = attrIncludeFirstRe.exec(xml)) !== null) {
+        pushEntry(out, seen, m[1], m[2]);
+    }
+    while ((m = attrVersionFirstRe.exec(xml)) !== null) {
+        pushEntry(out, seen, m[2], m[1]);
+    }
+    // Form 2 (element-form): <PackageReference Include="X"><Version>Y</Version>...</PackageReference>
+    // The element form spans multiple lines; the regex is multi-line aware.
+    const elementFormRe = /<PackageReference\s+[^>]*\bInclude\s*=\s*"([^"]+)"[^>]*>[\s\S]*?<Version>\s*([^<\s]+)\s*<\/Version>[\s\S]*?<\/PackageReference>/gi;
+    while ((m = elementFormRe.exec(xml)) !== null) {
+        pushEntry(out, seen, m[1], m[2]);
+    }
+    return out;
+}
+function pushEntry(out, seen, rawName, rawVersion) {
+    const name = rawName.trim();
+    const version = rawVersion.trim();
+    if (!name || !version)
+        return;
+    const key = `${name}@${version}`;
+    if (seen.has(key))
+        return;
+    seen.add(key);
+    out.push({ name, version });
+}
+/**
+ * Generate the body of an ad-hoc `packages.lock.json` that osv-scanner
+ * v2.x reads via `--lockfile=<path>` (caller MUST write this content to
+ * a file literally named `packages.lock.json` — osv-scanner detects
+ * ecosystem by filename). The schema matches NuGet's native
+ * `dotnet restore`-produced lockfile (which osv-scanner already
+ * supports natively), simplified to the minimum osv-scanner consults
+ * for vulnerability matching:
+ *
+ *   {
+ *     "version": 1,
+ *     "dependencies": {
+ *       "net0.0": {
+ *         "<Pkg>": {
+ *           "type": "Direct",
+ *           "resolved": "<Version>",
+ *           "requested": "[<Version>, )"
+ *         }
+ *       }
+ *     }
+ *   }
+ *
+ * - `"version": 1` matches `dotnet restore`'s lockfile schema version.
+ * - `"net0.0"` is a placeholder framework moniker — osv-scanner reads
+ *   the package map without validating the framework key, so any
+ *   non-empty string works. We use a non-real moniker so it can't be
+ *   confused with a real target framework in downstream debugging.
+ * - `type: "Direct"` truthfully reflects that we ONLY parsed direct
+ *   references. Transitive vulns are out of scope for this path
+ *   (covered by D025c's `dotnet list` codepath when available).
+ * - `requested` is a NuGet version range; we use a single-anchored
+ *   `[V, )` form so the lockfile is valid even though the real
+ *   `.csproj` might have been a pinned single version.
+ *
+ * Returns a JSON-stringified string suitable for writing to a temp
+ * file. Callers should clean up the temp file after osv-scanner
+ * consumes it.
+ */
+function buildNugetAdhocLockfile(entries) {
+    const dependencies = { 'net0.0': {} };
+    for (const entry of entries) {
+        // If the same package appears in multiple .csproj files at different
+        // versions, last-write-wins per the lockfile shape (it's one entry
+        // per package name within a framework). osv-scanner will scan
+        // whichever version we stamped; the cross-csproj merging trade-off
+        // is documented at the caller. At enterprise scale (~74 csprojs)
+        // collisions are common but typically converge on a single resolved
+        // version per the repo's dependency hygiene practices.
+        dependencies['net0.0'][entry.name] = {
+            type: 'Direct',
+            resolved: entry.version,
+            requested: `[${entry.version}, )`,
+        };
+    }
+    return JSON.stringify({ version: 1, dependencies }, null, 2);
+}
+//# sourceMappingURL=nuget-package-reference.js.map

package/dist/analyzers/tools/nuget-package-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuget-package-reference.js","sourceRoot":"","sources":["../../../src/analyzers/tools/nuget-package-reference.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;;AAyCH,oEA6BC;AAuDD,0DAiBC;AAjID;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,4BAA4B,CAAC,GAAW;IACtD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,sDAAsD;IAEtF,oDAAoD;IACpD,oCAAoC;IACpC,MAAM,kBAAkB,GACtB,6FAA6F,CAAC;IAChG,oCAAoC;IACpC,MAAM,kBAAkB,GACtB,6FAA6F,CAAC;IAEhG,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,kGAAkG;IAClG,wEAAwE;IACxE,MAAM,aAAa,GACjB,mIAAmI,CAAC;IACtI,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAChB,GAA4B,EAC5B,IAAiB,EACjB,OAAe,EACf,UAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO;IAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAgB,uBAAuB,CAAC,OAA6C;IACnF,MAAM,YAAY,GAA4C,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,qEAAqE;QACrE,mEAAmE;QACnE,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,oEAAoE;QACpE,uDAAuD;QACvD,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;YACnC,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,SAAS,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK;SAClC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/analyzers/tools/osv-scanner-deps.d.ts

@@ -1,4 +1,5 @@
 import type { DepVulnFinding, DepVulnGatherOutcome, SeverityCounts } from '../../languages/capabilities/types';
+import type { LanguageId } from '../../types';
 /**
  * Pure parser for osv-scanner v2.x JSON output, scoped to a single
  * ecosystem. Other ecosystems are filtered out so polyglot repos
@@ -12,7 +13,7 @@ import type { DepVulnFinding, DepVulnGatherOutcome, SeverityCounts } from '../..
  * Returns counts + findings + the raw OSV vuln records for downstream
  * CVSS resolution. Exported for unit tests.
  */
-export declare function parseOsvScannerFindings(raw: string, ecosystem: string): {
+export declare function parseOsvScannerFindings(raw: string, ecosystem: string, packId?: LanguageId): {
     counts: SeverityCounts;
     findings: DepVulnFinding[];
     vulnsForCvss: Array<{
@@ -43,5 +44,5 @@ export declare function parseOsvScannerFindings(raw: string, ecosystem: string):
  * `database_specific.severity` strings. resolveCvssScores looks up
  * via CVE alias when the primary record lacks a vector.
  */
-export declare function gatherOsvScannerDepVulnsResult(cwd: string, source: string, ecosystem: string, manifestCandidates: string[]): Promise<DepVulnGatherOutcome>;
+export declare function gatherOsvScannerDepVulnsResult(cwd: string, packId: LanguageId, ecosystem: string, manifestCandidates: string[]): Promise<DepVulnGatherOutcome>;
 //# sourceMappingURL=osv-scanner-deps.d.ts.map

package/dist/analyzers/tools/osv-scanner-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osv-scanner-deps.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EAEpB,cAAc,EACf,MAAM,oCAAoC,CAAC;AAiB5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5F,CAiEA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}
+{"version":3,"file":"osv-scanner-deps.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EAEpB,cAAc,EACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiB9C;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,UAAU,GAClB;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5F,CA8EA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAiD/B"}

package/dist/analyzers/tools/osv-scanner-deps.js

@@ -45,7 +45,7 @@ const tool_registry_1 = require("./tool-registry");
  * Returns counts + findings + the raw OSV vuln records for downstream
  * CVSS resolution. Exported for unit tests.
  */
-function parseOsvScannerFindings(raw, ecosystem) {
+function parseOsvScannerFindings(raw, ecosystem, packId) {
     const counts = { critical: 0, high: 0, medium: 0, low: 0 };
     const findings = [];
     const vulnsForCvss = [];
@@ -87,12 +87,27 @@ function parseOsvScannerFindings(raw, ecosystem) {
                     tool: 'osv-scanner',
                     severity: tier,
                 };
+                // G_v4_4 (2.4.7): stamp the producing pack so `buildUpgradeCommand`
+                // can dispatch to the right `LanguageSupport.upgradeCommand` without
+                // a hardcoded switch on `tool`. Caller passes the pack id; absent
+                // (`undefined`) only on legacy paths we haven't migrated yet.
+                if (packId)
+                    finding.packId = packId;
                 if (cvss !== null)
                     finding.cvssScore = cvss;
                 if (aliases.length > 0)
                     finding.aliases = aliases;
                 if (vuln.summary)
                     finding.summary = vuln.summary;
+                // D042: surface the patch version when OSV's `affected[].
+                // ranges[].events[].fixed` is populated. This is the customer's
+                // actionable next-step (e.g. "upgrade Newtonsoft.Json from
+                // 9.0.1 to 13.0.1 to clear GHSA-5crp-9r3c-p9vr"). Pre-D042 the
+                // standalone scan rendered `Fix: —` for every osv-scanner-
+                // sourced finding because this field went unread.
+                const fixVersion = (0, osv_1.extractOsvFixVersion)(vuln);
+                if (fixVersion)
+                    finding.fixedVersion = fixVersion;
                 // OSV.dev hosts a canonical page per id — synthesize when the
                 // record's `references[]` is empty, otherwise keep the
                 // tool-supplied URLs.
@@ -132,7 +147,7 @@ function parseOsvScannerFindings(raw, ecosystem) {
  * `database_specific.severity` strings. resolveCvssScores looks up
  * via CVE alias when the primary record lacks a vector.
  */
-async function gatherOsvScannerDepVulnsResult(cwd, source, ecosystem, manifestCandidates) {
+async function gatherOsvScannerDepVulnsResult(cwd, packId, ecosystem, manifestCandidates) {
     let manifest = null;
     for (const rel of manifestCandidates) {
         if ((0, runner_1.fileExists)(cwd, rel)) {
@@ -140,15 +155,20 @@ async function gatherOsvScannerDepVulnsResult(cwd, source, ecosystem, manifestCa
             break;
         }
     }
-    if (!manifest)
-        return { kind: 'tool-missing' };
+    if (!manifest) {
+        return {
+            kind: 'no-manifest',
+            reason: `no lockfile found (looked for: ${manifestCandidates.join(', ')})`,
+        };
+    }
     const scanner = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['osv-scanner'], cwd);
-    if (!scanner.available || !scanner.path)
-        return { kind: 'tool-missing' };
+    if (!scanner.available || !scanner.path) {
+        return { kind: 'unavailable', reason: 'osv-scanner not installed' };
+    }
     const raw = (0, runner_1.run)(`${scanner.path} scan source --lockfile ${manifest} --format json 2>/dev/null`, cwd, 180000);
     if (!raw)
-        return { kind: 'no-output' };
-    const { counts, findings, vulnsForCvss } = parseOsvScannerFindings(raw, ecosystem);
+        return { kind: 'unavailable', reason: 'osv-scanner produced no output' };
+    const { counts, findings, vulnsForCvss } = parseOsvScannerFindings(raw, ecosystem, packId);
     if (findings.length > 0) {
         const resolved = await (0, osv_1.resolveCvssScores)(vulnsForCvss);
         for (const f of findings) {
@@ -164,12 +184,10 @@ async function gatherOsvScannerDepVulnsResult(cwd, source, ecosystem, manifestCa
         counts,
         findings,
     };
-    // Note: `source` is unused at the envelope level today — DepVulnResult
-    // carries `tool: 'osv-scanner'` as the producer attribution. Reserved
-    // for a future enhancement that distinguishes per-pack provenance
-    // (e.g., when both kotlin and java packs run on a mixed monorepo and
-    // we want to attribute findings to the originating pack).
-    void source;
+    // G_v4_4 (2.4.7): `packId` is forwarded into `parseOsvScannerFindings`
+    // so each finding carries the producing pack, which `buildUpgradeCommand`
+    // dispatches on. Envelope-level `tool: 'osv-scanner'` stays as the
+    // tool-attribution string used in `toolsUsed`.
     return { kind: 'success', envelope };
 }
 //# sourceMappingURL=osv-scanner-deps.js.map

package/dist/analyzers/tools/osv-scanner-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"osv-scanner-deps.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":";;AAiEA,0DAwEC;AAwBD,wEAiDC;AAlND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,+BAAkG;AAClG,qCAA2C;AAC3C,mDAAsD;AAuBtD;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CACrC,GAAW,EACX,SAAiB;IAMjB,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,YAAY,GAIb,EAAE,CAAC;IACR,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5C,CAAC;IACD,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;gBAAE,SAAS;YACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,UAAU,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEnB,MAAM,GAAG,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GACR,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK;oBACvE,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,QAAQ,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAEf,MAAM,IAAI,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAmB;oBAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,gBAAgB,EAAE,UAAU;oBAC5B,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,IAAI;iBACf,CAAC;gBACF,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBAClD,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBACjD,8DAA8D;gBAC9D,uDAAuD;gBACvD,sBAAsB;gBACtB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1F,OAAO,CAAC,UAAU;oBAChB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iCAAiC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEvB,YAAY,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,YAAY,EAAE,IAAI;oBAClB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,8BAA8B,CAClD,GAAW,EACX,MAAc,EACd,SAAiB,EACjB,kBAA4B;IAE5B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,GAAG,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAG,IAAA,YAAG,EACb,GAAG,OAAO,CAAC,IAAI,2BAA2B,QAAQ,4BAA4B,EAC9E,GAAG,EACH,MAAM,CACP,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAiB,EAAC,YAAY,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,QAAQ;KACT,CAAC;IACF,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,0DAA0D;IAC1D,KAAK,MAAM,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"osv-scanner-deps.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-deps.ts"],"names":[],"mappings":";;AAwEA,0DAsFC;AAwBD,wEAsDC;AA5OD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,+BAMe;AACf,qCAA2C;AAC3C,mDAAsD;AAwBtD;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CACrC,GAAW,EACX,SAAiB,EACjB,MAAmB;IAMnB,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,YAAY,GAIb,EAAE,CAAC;IACR,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC5C,CAAC;IACD,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;gBAAE,SAAS;YACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,UAAU,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEnB,MAAM,GAAG,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GACR,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK;oBACvE,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,QAAQ,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAEf,MAAM,IAAI,GAAG,IAAA,yBAAmB,EAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAmB;oBAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,gBAAgB,EAAE,UAAU;oBAC5B,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,IAAI;iBACf,CAAC;gBACF,oEAAoE;gBACpE,qEAAqE;gBACrE,kEAAkE;gBAClE,8DAA8D;gBAC9D,IAAI,MAAM;oBAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACpC,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBAClD,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBACjD,0DAA0D;gBAC1D,gEAAgE;gBAChE,2DAA2D;gBAC3D,+DAA+D;gBAC/D,2DAA2D;gBAC3D,kDAAkD;gBAClD,MAAM,UAAU,GAAG,IAAA,0BAAoB,EAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,UAAU;oBAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC;gBAClD,8DAA8D;gBAC9D,uDAAuD;gBACvD,sBAAsB;gBACtB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1F,OAAO,CAAC,UAAU;oBAChB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iCAAiC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEvB,YAAY,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,YAAY,EAAE,IAAI;oBAClB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,8BAA8B,CAClD,GAAW,EACX,MAAkB,EAClB,SAAiB,EACjB,kBAA4B;IAE5B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,GAAG,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,kCAAkC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,YAAG,EACb,GAAG,OAAO,CAAC,IAAI,2BAA2B,QAAQ,4BAA4B,EAC9E,GAAG,EACH,MAAM,CACP,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAEnF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAE3F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAiB,EAAC,YAAY,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,QAAQ;KACT,CAAC;IACF,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,+CAA+C;IAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC"}