agentic-qe 3.15.5 → 3.15.7

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -9,6 +9,27 @@ import { getCodeMetricsAnalyzer } from '../../../shared/metrics/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
+/** Metrics the static analyzer produces when the caller asks for all of them. */
+const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
+/** Metrics computed from parsing each source file. */
+const PARSED_METRICS = new Set(['complexity', 'maintainability', 'testability']);
+/**
+ * #1021: a parsed metric with read/parse failures is still evidence when at
+ * least this share of the analysable files (in-scope minus excluded) was
+ * analysed. Below it, the unseen files are too large a blind spot for an
+ * average to describe the target, so the metric is unmeasured. 95% keeps one
+ * failure in a 20-file scope acceptable but not one in 10.
+ */
+export const MIN_ANALYSED_SHARE = 0.95;
+/** #1011: the sentinel for "not measured" in score and complexity fields. */
+const UNMEASURED = -1;
+/** First reasons of a failure list, for a one-line explanation. */
+function summariseFailures(failures) {
+    return failures.slice(0, 3).map((f) => f.reason).join('; ')
+        + (failures.length > 3 ? `; and ${failures.length - 3} more` : '');
+}
 const DEFAULT_CONFIG = {
     enableTrendAnalysis: true,
     trendDataPointsMin: 3,
@@ -52,14 +73,15 @@ export class QualityAnalyzerService {
      */
     constructor(memoryOrDependencies, config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
-        this.metricsAnalyzer = getCodeMetricsAnalyzer();
         // Support both old and new constructor signatures
         if ('memory' in memoryOrDependencies) {
             // New signature: dependencies object
             this.memory = memoryOrDependencies.memory;
             this.llmRouter = memoryOrDependencies.llmRouter;
+            this.metricsAnalyzer = memoryOrDependencies.metricsAnalyzer ?? getCodeMetricsAnalyzer();
         }
         else {
+            this.metricsAnalyzer = getCodeMetricsAnalyzer();
             // Old signature: direct MemoryBackend
             this.memory = memoryOrDependencies;
             this.llmRouter = undefined;
@@ -84,11 +106,11 @@ export class QualityAnalyzerService {
      * Generate quality insights using LLM
      * Provides AI-powered explanation and prioritized recommendations
      */
-    async generateQualityInsightsWithLLM(metrics, score, codeContext) {
+    async generateQualityInsightsWithLLM(metrics, score, codeContext, unmeasured = []) {
         if (!this.llmRouter)
             return null;
         try {
-            const prompt = this.buildQualityInsightsPrompt(metrics, score, codeContext);
+            const prompt = this.buildQualityInsightsPrompt(metrics, score, codeContext, unmeasured);
             const modelId = this.getModelForTier(this.config.llmModelTier ?? 2);
             const response = await this.llmRouter.chat({
                 messages: [
@@ -136,7 +158,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('LLM insights generation failed:');
             return null;
         }
@@ -144,13 +166,18 @@ Focus on:
     /**
      * Build prompt for quality insights generation
      */
-    buildQualityInsightsPrompt(metrics, score, codeContext) {
+    buildQualityInsightsPrompt(metrics, score, codeContext, unmeasured = []) {
         let prompt = `## Quality Analysis Results\n\n`;
-        prompt += `### Overall Score: ${score.overall}/100\n\n`;
+        prompt += score.overall >= 0
+            ? `### Overall Score: ${score.overall}/100\n\n`
+            : `### Overall Score: not measured\n\n`;
         prompt += `### Detailed Metrics:\n`;
         for (const metric of metrics) {
             prompt += `- **${metric.name}**: ${metric.value} (Rating: ${metric.rating}, Trend: ${metric.trend})\n`;
         }
+        for (const missing of unmeasured) {
+            prompt += `- **${missing.metric}**: not measured (${missing.reason})\n`;
+        }
         prompt += `\n`;
         // #996: -1 means "not measured"; never present it to the model as a value.
         const show = (value, unit = '') => (value >= 0 ? `${value}${unit}` : 'not measured');
@@ -200,7 +227,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('Failed to parse LLM insights response:');
             return null;
         }
@@ -234,8 +261,8 @@ Focus on:
             if (sourceFiles.length === 0) {
                 return err(new Error('No source files provided for analysis'));
             }
-            // Analyze metrics for each file
-            const fileMetrics = await this.collectFileMetrics(sourceFiles, includeMetrics);
+            // Analyze metrics for each file; failures become unmeasured (#1011)
+            const { fileMetrics, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
             // Calculate aggregated metrics
             const metricDetails = this.aggregateMetrics(fileMetrics);
             // Calculate overall quality score
@@ -249,7 +276,7 @@ Focus on:
             // ADR-051: Generate LLM insights if enabled
             let llmInsights;
             if (this.isLLMInsightsAvailable()) {
-                const insights = await this.generateQualityInsightsWithLLM(metricDetails, score);
+                const insights = await this.generateQualityInsightsWithLLM(metricDetails, score, undefined, unmeasured);
                 if (insights) {
                     llmInsights = insights;
                 }
@@ -260,6 +287,9 @@ Focus on:
                 trends,
                 recommendations,
                 llmInsights,
+                unmeasured,
+                excluded,
+                partial,
             };
             // Store the report
             await this.storeReport(report, sourceFiles);
@@ -344,88 +374,149 @@ Focus on:
     // ============================================================================
     // Private Helper Methods
     // ============================================================================
-    async collectFileMetrics(files, includeMetrics) {
+    /**
+     * Collect per-file metric values. #1011 / #1021:
+     * - excluded files (binary, generated, minified, declarations, refused by
+     *   reader policy) leave the scope with a reason;
+     * - failed files (unreadable, unparseable) make a parsed metric partial, or
+     *   unmeasured below MIN_ANALYSED_SHARE or when a failed file was named
+     *   explicitly;
+     * - failed duplication detection and missing coverage are unmeasured.
+     * Never a fixed fallback value.
+     */
+    async collectFileMetrics(files, includeMetrics, explicitFiles) {
+        const requested = includeMetrics.length === 0 ? [...ANALYZER_METRICS] : includeMetrics;
+        const wants = (metric) => requested.includes(metric);
         const fileMetrics = new Map();
-        const includeAll = includeMetrics.length === 0;
-        // Collect duplication across all files if requested
-        let duplicationPercentage = 0;
-        if (includeAll || includeMetrics.includes('duplication')) {
-            try {
-                const duplicationResult = await this.metricsAnalyzer.detectDuplication(files);
-                duplicationPercentage = duplicationResult.percentage;
-            }
-            catch {
-                duplicationPercentage = 0;
-            }
-        }
+        const unmeasured = [];
+        const excluded = [];
+        const partial = [];
+        const parseFailed = [];
+        const unreadable = [];
+        const readable = [];
+        const missingCoverage = [];
+        const explicit = new Set(explicitFiles);
+        const needsAnalysis = requested.some((m) => PARSED_METRICS.has(m) || m === 'duplication');
         for (const file of files) {
             const metrics = {};
-            // Analyze the file using CodeMetricsAnalyzer
-            const fileAnalysis = await this.metricsAnalyzer.analyzeFile(file);
-            if (fileAnalysis) {
-                // Real metrics from analysis
-                if (includeAll || includeMetrics.includes('complexity')) {
-                    metrics.complexity = fileAnalysis.cyclomaticComplexity;
-                }
-                if (includeAll || includeMetrics.includes('maintainability')) {
-                    metrics.maintainability = fileAnalysis.maintainabilityIndex;
+            if (needsAnalysis) {
+                const outcome = await this.metricsAnalyzer.analyzeFileDetailed(file);
+                const reason = outcome.reason ?? `${file} could not be analysed`;
+                if (outcome.status === 'excluded') {
+                    excluded.push({ file, reason });
+                    continue;
                 }
-                if (includeAll || includeMetrics.includes('duplication')) {
-                    metrics.duplication = duplicationPercentage;
+                if (outcome.metrics)
+                    readable.push(file);
+                if (outcome.status === 'failed') {
+                    (outcome.metrics ? parseFailed : unreadable).push({ file, reason });
                 }
-                if (includeAll || includeMetrics.includes('testability')) {
-                    // Testability is derived from complexity and maintainability
-                    // Lower complexity and higher maintainability = higher testability
-                    const complexityFactor = Math.max(0, 100 - fileAnalysis.cyclomaticComplexity * 3);
-                    const maintainabilityFactor = fileAnalysis.maintainabilityIndex;
-                    metrics.testability = Math.round((complexityFactor * 0.4 + maintainabilityFactor * 0.6) * 100) / 100;
-                }
-                if (includeAll || includeMetrics.includes('coverage')) {
-                    // Coverage requires external data (from test runners)
-                    // Only use real stored coverage — never fabricate a number
-                    const storedCoverage = await this.getStoredCoverage(file);
-                    if (storedCoverage !== null) {
-                        metrics.coverage = storedCoverage;
+                else if (outcome.metrics) {
+                    const analysis = outcome.metrics;
+                    if (wants('complexity'))
+                        metrics.complexity = analysis.cyclomaticComplexity;
+                    if (wants('maintainability'))
+                        metrics.maintainability = analysis.maintainabilityIndex;
+                    if (wants('testability')) {
+                        // Testability is derived from complexity and maintainability
+                        // Lower complexity and higher maintainability = higher testability
+                        const complexityFactor = Math.max(0, 100 - analysis.cyclomaticComplexity * 3);
+                        const maintainabilityFactor = analysis.maintainabilityIndex;
+                        metrics.testability = Math.round((complexityFactor * 0.4 + maintainabilityFactor * 0.6) * 100) / 100;
                     }
-                    // If no coverage data exists, omit the metric rather than guessing
                 }
             }
-            else {
-                // Fallback for files that couldn't be analyzed
-                if (includeAll || includeMetrics.includes('coverage')) {
-                    // Only use real stored coverage — never fabricate a number
-                    const storedCoverage = await this.getStoredCoverage(file);
-                    if (storedCoverage !== null) {
-                        metrics.coverage = storedCoverage;
-                    }
-                }
-                if (includeAll || includeMetrics.includes('complexity')) {
-                    metrics.complexity = 10;
+            if (wants('coverage')) {
+                // Coverage requires external data (from test runners) — never fabricate a number
+                const storedCoverage = await this.getStoredCoverage(file);
+                if (storedCoverage !== null) {
+                    metrics.coverage = storedCoverage;
                 }
-                if (includeAll || includeMetrics.includes('maintainability')) {
-                    metrics.maintainability = 70;
-                }
-                if (includeAll || includeMetrics.includes('duplication')) {
-                    metrics.duplication = duplicationPercentage;
-                }
-                if (includeAll || includeMetrics.includes('testability')) {
-                    metrics.testability = 70;
+                else {
+                    missingCoverage.push(file);
                 }
             }
             fileMetrics.set(file, metrics);
         }
-        return fileMetrics;
+        const total = fileMetrics.size;
+        if (missingCoverage.length > 0) {
+            for (const metrics of fileMetrics.values())
+                delete metrics.coverage;
+            unmeasured.push({
+                metric: 'coverage',
+                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s)`,
+            });
+        }
+        /** Decide whether a metric with these failures is measured, partial or unmeasured. */
+        const judge = (metric, failures) => {
+            const analysed = total - failures.length;
+            if (analysed === 0) {
+                unmeasured.push({
+                    metric,
+                    reason: total === 0
+                        ? `no analysable files: ${excluded.length} file(s) excluded (${summariseFailures(excluded)})`
+                        : `none of ${total} file(s) could be analysed: ${summariseFailures(failures)}`,
+                    ...(failures.length > 0 ? { files: failures.map((f) => f.file) } : {}),
+                });
+                return false;
+            }
+            if (failures.length === 0)
+                return true;
+            const share = analysed / total;
+            // Round DOWN so a partial scope never reads as 1 / 100% (#1021).
+            const permille = Math.floor((analysed * 1000) / total);
+            const coverageOfScope = permille / 1000;
+            const explicitFailure = failures.find((f) => explicit.has(f.file));
+            if (explicitFailure || share < MIN_ANALYSED_SHARE) {
+                const why = explicitFailure
+                    ? `explicit target ${explicitFailure.file} could not be analysed`
+                    : `${analysed} of ${total} file(s) analysed (${permille / 10}%, below ${MIN_ANALYSED_SHARE * 100}%)`;
+                unmeasured.push({
+                    metric,
+                    reason: `${why}: ${summariseFailures(failures)}`,
+                    files: failures.map((f) => f.file),
+                });
+                return false;
+            }
+            partial.push({ metric, analysedFiles: analysed, totalFiles: total, coverageOfScope, failed: failures });
+            return true;
+        };
+        const failedToParse = [...unreadable, ...parseFailed];
+        for (const metric of requested.filter((m) => PARSED_METRICS.has(m))) {
+            if (!judge(metric, failedToParse)) {
+                for (const metrics of fileMetrics.values())
+                    delete metrics[metric];
+            }
+        }
+        // Duplication needs readable text, not a parse (#1021 N2).
+        if (wants('duplication') && judge('duplication', unreadable)) {
+            try {
+                const { percentage } = await this.metricsAnalyzer.detectDuplication(readable);
+                for (const metrics of fileMetrics.values())
+                    metrics.duplication = percentage;
+            }
+            catch (error) {
+                const index = partial.findIndex((p) => p.metric === 'duplication');
+                if (index >= 0)
+                    partial.splice(index, 1);
+                unmeasured.push({ metric: 'duplication', reason: `duplication detection failed: ${toError(error).message}` });
+            }
+        }
+        return { fileMetrics, unmeasured, excluded, partial };
     }
     async getStoredCoverage(file) {
         try {
             // 1. Try per-file coverage stored by test executor
-            const fileCoverage = await this.memory.get(`coverage:file:${file}`);
-            if (fileCoverage && typeof fileCoverage.line === 'number') {
-                return fileCoverage.line;
+            // #1014: only measured records count. Legacy unstamped estimate
+            // records (written by <= 3.15.4, never expiring) are ignored.
+            for (const key of fileCoverageLookupKeys(file)) {
+                const fileCoverage = measuredFileCoverage(await this.memory.get(key));
+                if (fileCoverage)
+                    return fileCoverage.line;
             }
             // 2. Fall back to project-wide summary from coverage-analyzer
-            const summary = await this.memory.get('coverage:latest');
-            if (summary && typeof summary.line === 'number') {
+            const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));
+            if (summary) {
                 return summary.line;
             }
             // No coverage data available — return null (never fabricate)
@@ -480,17 +571,18 @@ Focus on:
             weightedSum += normalizedValue * weight;
             totalWeight += weight;
         }
-        const overall = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+        // #1011: no measured metric means no score — -1, never 0.
+        const overall = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : UNMEASURED;
         // Use -1 to signal "no data available" rather than 0 which implies "0% coverage"
         // (#996: the same holds for every score field — never fabricate a value).
-        const valueOf = (name) => metrics.find((m) => m.name === name)?.value ?? -1;
+        const valueOf = (name) => metrics.find((m) => m.name === name)?.value ?? UNMEASURED;
         return {
             overall,
             coverage: valueOf('coverage'),
             complexity: valueOf('complexity'),
             maintainability: valueOf('maintainability'),
             // No security analysis runs here; -1 = not measured (was a fixed 85 placeholder).
-            security: -1,
+            security: UNMEASURED,
         };
     }
     async generateTrends(currentMetrics, _compareBaseline) {
@@ -559,7 +651,7 @@ Focus on:
             });
         }
         // Overall score recommendation
-        if (score.overall < 70) {
+        if (score.overall >= 0 && score.overall < 70) {
             recommendations.push({
                 type: 'critical',
                 title: 'Overall Quality Improvement Needed',
@@ -575,50 +667,43 @@ Focus on:
     }
     async analyzeFileComplexity(file, requestedMetrics) {
         const includesAll = requestedMetrics.length === 0;
+        const wants = (metric) => includesAll || requestedMetrics.includes(metric);
         // Use real CodeMetricsAnalyzer for file analysis
-        const fileAnalysis = await this.metricsAnalyzer.analyzeFile(file);
-        if (fileAnalysis) {
+        const { status, metrics: analysis, reason } = await this.metricsAnalyzer.analyzeFileDetailed(file);
+        if (status !== 'measured' || !analysis) {
+            // #1011: never invent values for a file that could not be analysed
             return {
                 path: file,
-                cyclomatic: includesAll || requestedMetrics.includes('cyclomatic')
-                    ? fileAnalysis.cyclomaticComplexity
-                    : 0,
-                cognitive: includesAll || requestedMetrics.includes('cognitive')
-                    ? fileAnalysis.cognitiveComplexity
-                    : 0,
-                maintainability: includesAll || requestedMetrics.includes('maintainability')
-                    ? fileAnalysis.maintainabilityIndex
-                    : 0,
-                linesOfCode: fileAnalysis.linesOfCode,
+                cyclomatic: UNMEASURED,
+                cognitive: UNMEASURED,
+                maintainability: UNMEASURED,
+                linesOfCode: UNMEASURED,
+                unmeasuredReason: reason ?? `${file} could not be analysed`,
             };
         }
-        // Fallback for files that couldn't be analyzed
+        // A metric that was not requested is not measured (-1), not 0 — a 0
+        // maintainability would otherwise be reported as a critical hotspot.
         return {
             path: file,
-            cyclomatic: includesAll || requestedMetrics.includes('cyclomatic') ? 5 : 0,
-            cognitive: includesAll || requestedMetrics.includes('cognitive') ? 8 : 0,
-            maintainability: includesAll || requestedMetrics.includes('maintainability') ? 70 : 0,
-            linesOfCode: 100,
+            cyclomatic: wants('cyclomatic') ? analysis.cyclomaticComplexity : UNMEASURED,
+            cognitive: wants('cognitive') ? analysis.cognitiveComplexity : UNMEASURED,
+            maintainability: wants('maintainability') ? analysis.maintainabilityIndex : UNMEASURED,
+            linesOfCode: analysis.linesOfCode,
         };
     }
     calculateComplexitySummary(files) {
-        if (files.length === 0) {
-            return {
-                averageCyclomatic: 0,
-                averageCognitive: 0,
-                averageMaintainability: 0,
-                totalLinesOfCode: 0,
-            };
-        }
-        const sumCyclomatic = files.reduce((sum, f) => sum + f.cyclomatic, 0);
-        const sumCognitive = files.reduce((sum, f) => sum + f.cognitive, 0);
-        const sumMaintainability = files.reduce((sum, f) => sum + f.maintainability, 0);
-        const totalLOC = files.reduce((sum, f) => sum + f.linesOfCode, 0);
+        // #1011: average measured values only; -1 when nothing was measured.
+        const average = (values) => {
+            const measured = values.filter((v) => v >= 0);
+            if (measured.length === 0)
+                return UNMEASURED;
+            return Math.round((measured.reduce((sum, v) => sum + v, 0) / measured.length) * 100) / 100;
+        };
         return {
-            averageCyclomatic: Math.round((sumCyclomatic / files.length) * 100) / 100,
-            averageCognitive: Math.round((sumCognitive / files.length) * 100) / 100,
-            averageMaintainability: Math.round((sumMaintainability / files.length) * 100) / 100,
-            totalLinesOfCode: totalLOC,
+            averageCyclomatic: average(files.map((f) => f.cyclomatic)),
+            averageCognitive: average(files.map((f) => f.cognitive)),
+            averageMaintainability: average(files.map((f) => f.maintainability)),
+            totalLinesOfCode: files.reduce((sum, f) => sum + Math.max(0, f.linesOfCode), 0),
         };
     }
     identifyHotspots(files) {
@@ -647,8 +732,8 @@ Focus on:
                         : 'Simplify control flow and reduce nesting depth.',
                 });
             }
-            // Check maintainability (lower is worse)
-            if (file.maintainability <= thresholds.maintainability.warning) {
+            // Check maintainability (lower is worse); -1 = not measured, never a hotspot
+            if (file.maintainability >= 0 && file.maintainability <= thresholds.maintainability.warning) {
                 hotspots.push({
                     file: file.path,
                     function: 'unknown',

package/dist/domains/quality-assessment/services/quality-gate.js

@@ -5,6 +5,7 @@
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 const DEFAULT_CONFIG = {
     strictMode: false,
     enableWarnings: true,
@@ -80,6 +81,12 @@ export class QualityGateService {
             // Evaluate each threshold
             checks.push(...this.evaluateMinThresholds(metrics, thresholds));
             checks.push(...this.evaluateMaxThresholds(metrics, thresholds));
+            if (checks.length === 0) {
+                return err(new Error('No thresholds configured for gate evaluation'));
+            }
+            const unmeasured = checks
+                .filter((check) => !isMeasuredMetricValue(check.value))
+                .map((check) => check.name);
             // Collect failed checks
             for (const check of checks) {
                 if (!check.passed) {
@@ -89,13 +96,15 @@ export class QualityGateService {
             // Calculate overall score (0-100)
             const overallScore = this.calculateOverallScore(checks);
             // Determine pass/fail based on critical checks
-            const passed = this.determineGateStatus(checks);
+            const passed = unmeasured.length === 0 && this.determineGateStatus(checks);
             const result = {
                 gateName,
                 passed,
                 checks,
                 overallScore,
                 failedChecks,
+                evidenceStatus: unmeasured.length === 0 ? 'measured' : 'insufficient-evidence',
+                unmeasured,
             };
             // Store evaluation result in memory
             await this.storeEvaluationResult(result);
@@ -188,9 +197,9 @@ export class QualityGateService {
         return checks;
     }
     createCheck(name, value, threshold, type, severity) {
-        const passed = type === 'min'
+        const passed = isMeasuredMetricValue(value) && (type === 'min'
             ? value >= threshold
-            : value <= threshold;
+            : value <= threshold);
         return {
             name,
             passed,

package/dist/domains/security-compliance/dependency-advisory-engine.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Dependency advisory (OSV) engine for the scan-security task (#1049).
+ *
+ * Runs the security-compliance DependencyScanner on the project's package.json
+ * and turns its outcome into an execution receipt. A failed or partial OSV
+ * lookup is a failed/partial engine with the unchecked packages listed, never
+ * a completed engine with zero findings.
+ */
+import type { SecurityEngineEvidence } from './scan-evidence.js';
+import type { Vulnerability, UncheckedDependency, LocalDependency } from './interfaces.js';
+import type { DependencyScanResult } from './services/scanners/scanner-types.js';
+import type { Result } from '../../shared/types/index.js';
+export declare const DEPENDENCY_ADVISORY_ENGINE_ID = "osv-dependency-advisories";
+/** The dependency scan as reported to MCP and CLI consumers. */
+export interface DependencyScanReport {
+    status: 'complete' | 'incomplete' | 'failed' | 'not-run';
+    measured: boolean;
+    manifest?: string;
+    /** Lockfile the checked versions were resolved from, or null (exact specs only). */
+    lockfile?: string | null;
+    packagesRequested: number;
+    packagesChecked: number;
+    uncheckedPackages: UncheckedDependency[];
+    /** Local workspace / linked packages: not OSV subjects, excluded from the counts. */
+    localPackages: LocalDependency[];
+    /** Why the scan is not complete beyond individual packages (malformed lockfile, workspace root #1057). */
+    resolutionErrors: string[];
+    /** Only direct dependencies are checked; transitive dependencies are not. */
+    scope: 'direct';
+    vulnerabilities: number;
+    scanId?: string;
+    error?: string;
+    /** One plain sentence for humans; says when advisories could not be checked. */
+    message: string;
+}
+export interface DependencyAdvisoryOutcome {
+    engine: SecurityEngineEvidence;
+    vulnerabilities: Vulnerability[];
+    report: DependencyScanReport;
+}
+interface PackageJsonScanner {
+    scanPackageJson(packageJsonPath: string): Promise<Result<DependencyScanResult>>;
+}
+/** The package.json for a scan target: the target directory's, else the project root's. */
+export declare function findPackageJson(targetPath: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+/** Human message for a dependency scan outcome. */
+export declare const DEPENDENCY_SCOPE_NOTE = "direct dependencies of this package.json only; workspace members and transitive dependencies are not checked";
+export declare function dependencyScanMessage(report: Omit<DependencyScanReport, 'message'>): string;
+/** Run the OSV dependency scan for a target and describe it as an engine receipt. */
+export declare function runDependencyAdvisoryScan(scanner: PackageJsonScanner, targetPath: string): Promise<DependencyAdvisoryOutcome>;
+export {};
+//# sourceMappingURL=dependency-advisory-engine.d.ts.map