specforge-mcp 0.1.0

package/dist/engine/stack-auditor/manifest-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reader.js","sourceRoot":"","sources":["../../../src/engine/stack-auditor/manifest-reader.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB;IACvD,MAAM,MAAM,GAAuB;QACjC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;QAC9B,CAAC,gBAAgB,EAAE,QAAQ,CAAC;QAC5B,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChB,CAAC,YAAY,EAAE,MAAM,CAAC;QACtB,CAAC,SAAS,EAAE,MAAM,CAAC;QACnB,CAAC,cAAc,EAAE,MAAM,CAAC;QACxB,CAAC,uBAAuB,EAAE,QAAQ,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,WAAW,WAAW,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IACtE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,gEAAgE;AAChE,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,6DAA6D;IAC7D,MAAM,EAAE,GAAG,sCAAsC,CAAC;IAClD,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA4D,CAAC;IAClF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,UAAU,GAAmD;QACjE,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACjC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;KACxC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,EAAkB,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,SAAS;IACT,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,MAAM;gBACf,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,MAAM;gBACf,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;gBAC5B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IAED,SAAS;IACT,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAAmB;IACpD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,kBAAkB,GAA2B,EAAE,CAAC;IAEpD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3E,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB,GAAG,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxC,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1D,MAAM,WAAW,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjE,MAAM,CAAC,GAAG,OAAO,IAAI,WAAW,CAAC;gBACjC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnB,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB,GAAG,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEjE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC9E,CAAC;AAED,iCAAiC;AACjC,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/engine/stack-auditor/vulnerability-scanner.d.ts

@@ -0,0 +1,10 @@
+import type { AuditedDependency, KnownVulnerablePackage } from '../../types/index.js';
+declare const KNOWN_VULNERABLE_RANGES: Record<string, KnownVulnerablePackage>;
+/**
+ * Scan dependencies for known vulnerabilities.
+ * Updates statusCode to 'vulnerable' and populates cves[] when matched.
+ * The _projectPath parameter is reserved for future network-based scanning.
+ */
+export declare function scanForVulnerabilities(deps: AuditedDependency[], _projectPath: string): AuditedDependency[];
+export { KNOWN_VULNERABLE_RANGES };
+//# sourceMappingURL=vulnerability-scanner.d.ts.map

package/dist/engine/stack-auditor/vulnerability-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-scanner.d.ts","sourceRoot":"","sources":["../../../src/engine/stack-auditor/vulnerability-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAO9B,QAAA,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAuCnE,CAAC;AA+CF;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EAAE,EACzB,YAAY,EAAE,MAAM,GACnB,iBAAiB,EAAE,CAgBrB;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/engine/stack-auditor/vulnerability-scanner.js

@@ -0,0 +1,107 @@
+import { parseSemver } from './health-scorer.js';
+// ---------------------------------------------------------------------------
+// Known vulnerable ranges (subset of well-known public CVEs)
+// ---------------------------------------------------------------------------
+const KNOWN_VULNERABLE_RANGES = {
+    lodash: {
+        ranges: [
+            { minVersion: '0.0.0', maxVersion: '4.17.21', cves: ['CVE-2021-23337', 'CVE-2020-8203'] },
+        ],
+    },
+    qs: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '6.7.3', cves: ['CVE-2022-24999'] }],
+    },
+    axios: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '1.6.0', cves: ['CVE-2023-45857'] }],
+    },
+    'node-fetch': {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '2.6.7', cves: ['CVE-2022-0235'] }],
+    },
+    minimist: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '1.2.6', cves: ['CVE-2021-44906'] }],
+    },
+    moment: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '2.29.4', cves: ['CVE-2022-24785'] }],
+    },
+    jsonwebtoken: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '9.0.0', cves: ['CVE-2022-23529'] }],
+    },
+    'serialize-javascript': {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '3.1.0', cves: ['CVE-2020-7660'] }],
+    },
+    'path-parse': {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '1.0.7', cves: ['CVE-2021-23343'] }],
+    },
+    glob: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '7.2.3', cves: ['CVE-2021-21315'] }],
+    },
+    tar: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '6.1.11', cves: ['CVE-2021-37712'] }],
+    },
+    semver: {
+        ranges: [{ minVersion: '0.0.0', maxVersion: '7.5.2', cves: ['CVE-2022-25883'] }],
+    },
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Return true if version is in [minVersion, maxVersion) range.
+ * Uses a best-effort semver comparison.
+ */
+function isInRange(version, range) {
+    const cur = parseSemver(version);
+    const min = parseSemver(range.minVersion);
+    const max = parseSemver(range.maxVersion);
+    if (!cur || !min || !max) {
+        return false;
+    }
+    const curNum = cur.major * 1_000_000 + cur.minor * 1_000 + cur.patch;
+    const minNum = min.major * 1_000_000 + min.minor * 1_000 + min.patch;
+    const maxNum = max.major * 1_000_000 + max.minor * 1_000 + max.patch;
+    return curNum >= minNum && curNum < maxNum;
+}
+/**
+ * Check if a dependency version matches any known vulnerable range.
+ * Returns the list of CVE IDs if vulnerable, empty array otherwise.
+ */
+function findCves(name, version) {
+    const pkg = KNOWN_VULNERABLE_RANGES[name];
+    if (!pkg) {
+        return [];
+    }
+    const cves = [];
+    for (const range of pkg.ranges) {
+        if (isInRange(version, range)) {
+            cves.push(...range.cves);
+        }
+    }
+    return cves;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Scan dependencies for known vulnerabilities.
+ * Updates statusCode to 'vulnerable' and populates cves[] when matched.
+ * The _projectPath parameter is reserved for future network-based scanning.
+ */
+export function scanForVulnerabilities(deps, _projectPath) {
+    return deps.map((dep) => {
+        if (dep.statusCode === 'vulnerable') {
+            return dep;
+        }
+        const cves = findCves(dep.name, dep.currentVersion);
+        if (cves.length === 0) {
+            return dep;
+        }
+        return {
+            ...dep,
+            statusCode: 'vulnerable',
+            severity: 'critical',
+            cves,
+        };
+    });
+}
+export { KNOWN_VULNERABLE_RANGES };
+//# sourceMappingURL=vulnerability-scanner.js.map

package/dist/engine/stack-auditor/vulnerability-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-scanner.js","sourceRoot":"","sources":["../../../src/engine/stack-auditor/vulnerability-scanner.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,uBAAuB,GAA2C;IACtE,MAAM,EAAE;QACN,MAAM,EAAE;YACN,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE;SAC1F;KACF;IACD,EAAE,EAAE;QACF,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;KAChF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAClF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;KAChF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;IACD,GAAG,EAAE;QACH,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAClF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;KACjF;CACF,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,KAAsB;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,GAAG,CAAC,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,GAAG,CAAC,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,GAAG,CAAC,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAErE,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAyB,EACzB,YAAoB;IAEpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO;YACL,GAAG,GAAG;YACN,UAAU,EAAE,YAAqB;YACjC,QAAQ,EAAE,UAAmB;YAC7B,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/engine/supply-chain/build-checker.d.ts

@@ -0,0 +1,10 @@
+import type { SupplyChainGap, BuildCheckResult } from '../../types/index.js';
+/**
+ * Detect reproducible build signals in the project.
+ */
+export declare function checkBuild(projectPath: string): Promise<BuildCheckResult>;
+/**
+ * Build reproducible-build gaps from check results.
+ */
+export declare function buildBuildGaps(result: BuildCheckResult): SupplyChainGap[];
+//# sourceMappingURL=build-checker.d.ts.map

package/dist/engine/supply-chain/build-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-checker.d.ts","sourceRoot":"","sources":["../../../src/engine/supply-chain/build-checker.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAmH7E;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmB/E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAwBzE"}

package/dist/engine/supply-chain/build-checker.js

@@ -0,0 +1,153 @@
+// engine/supply-chain/build-checker.ts — SPEC-046
+// Detects reproducible build signals: pinned Docker images, nix, bazel, frozen lockfile flags.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { glob } from 'glob';
+// Reproducible build tools
+const HERMETIC_BUILD_TOOLS = ['nix', 'guix', 'bazel'];
+// CI flags that indicate frozen/reproducible installs
+const FROZEN_LOCKFILE_FLAGS = [
+    '--frozen-lockfile',
+    '--ci',
+    'npm ci',
+    'pip install --require-hashes',
+];
+// Docker digest pattern (pinned base image)
+const DIGEST_PATTERN = /FROM\s+\S+@sha256:[a-f0-9]{64}/i;
+// Non-pinned FROM patterns
+const UNPINNED_FROM_PATTERN = /FROM\s+\S+:latest\b/i;
+const BUILD_REFS = [
+    'https://reproducible-builds.org/',
+    'https://docs.docker.com/build/building/base-images/',
+    'https://nixos.org/',
+];
+/** Find all Dockerfiles in the project. */
+async function findDockerfiles(projectPath) {
+    try {
+        const files = await glob(['Dockerfile', '**/Dockerfile', '**/*.dockerfile'], {
+            cwd: projectPath,
+            nodir: true,
+            maxDepth: 5,
+            ignore: ['node_modules/**', 'vendor/**', '.git/**'],
+        });
+        return files.map((f) => join(projectPath, f));
+    }
+    catch {
+        return [];
+    }
+}
+/** Check if all Dockerfiles use pinned base image digests. */
+async function checkDockerfilePinning(projectPath) {
+    const dockerfiles = await findDockerfiles(projectPath);
+    if (dockerfiles.length === 0) {
+        return { hasPinned: false, hasUnpinned: false };
+    }
+    let hasPinned = false;
+    let hasUnpinned = false;
+    for (const file of dockerfiles) {
+        try {
+            const content = await readFile(file, 'utf-8');
+            if (DIGEST_PATTERN.test(content)) {
+                hasPinned = true;
+            }
+            if (UNPINNED_FROM_PATTERN.test(content)) {
+                hasUnpinned = true;
+            }
+        }
+        catch {
+            // Skip unreadable files
+        }
+    }
+    return { hasPinned, hasUnpinned };
+}
+/** Detect hermetic build tool (nix, bazel, guix). */
+async function detectHermeticBuildTool(projectPath) {
+    for (const tool of HERMETIC_BUILD_TOOLS) {
+        const candidates = tool === 'nix'
+            ? ['flake.nix', 'default.nix', 'shell.nix']
+            : tool === 'bazel'
+                ? ['BUILD', 'WORKSPACE', 'BUILD.bazel']
+                : ['guix.scm'];
+        for (const file of candidates) {
+            try {
+                await readFile(join(projectPath, file), 'utf-8');
+                return tool;
+            }
+            catch {
+                // File not found
+            }
+        }
+    }
+    return null;
+}
+/** Check if CI workflows use frozen lockfile flags. */
+async function hasFrozenLockfileInCi(projectPath) {
+    try {
+        const workflowFiles = await glob(['.github/workflows/*.yml', '.github/workflows/*.yaml'], {
+            cwd: projectPath,
+            nodir: true,
+            absolute: false,
+        });
+        for (const f of workflowFiles) {
+            try {
+                const content = await readFile(join(projectPath, f), 'utf-8');
+                if (FROZEN_LOCKFILE_FLAGS.some((flag) => content.includes(flag))) {
+                    return true;
+                }
+            }
+            catch {
+                // Skip
+            }
+        }
+    }
+    catch {
+        // No workflows directory
+    }
+    return false;
+}
+/**
+ * Detect reproducible build signals in the project.
+ */
+export async function checkBuild(projectPath) {
+    const [dockerfileInfo, hermeticTool, frozenLockfileInCi] = await Promise.all([
+        checkDockerfilePinning(projectPath),
+        detectHermeticBuildTool(projectPath),
+        hasFrozenLockfileInCi(projectPath),
+    ]);
+    const reproducibleBuild = dockerfileInfo.hasPinned ||
+        hermeticTool !== null ||
+        (frozenLockfileInCi && !dockerfileInfo.hasUnpinned);
+    return {
+        reproducibleBuild,
+        dockerfilesPinned: dockerfileInfo.hasPinned,
+        dockerfilesHaveUnpinned: dockerfileInfo.hasUnpinned,
+        hermeticTool,
+        frozenLockfileInCi,
+    };
+}
+/**
+ * Build reproducible-build gaps from check results.
+ */
+export function buildBuildGaps(result) {
+    const gaps = [];
+    if (result.dockerfilesHaveUnpinned) {
+        gaps.push({
+            category: 'reproducible',
+            severity: 'warning',
+            message: 'Dockerfile uses `FROM ...latest` — base image is not pinned to a digest',
+            fix: 'Pin base images to a digest: `FROM node:20-alpine@sha256:<digest>`',
+            references: [BUILD_REFS[1] ?? ''],
+        });
+    }
+    if (!result.reproducibleBuild && !result.dockerfilesPinned && result.hermeticTool === null) {
+        gaps.push({
+            category: 'reproducible',
+            severity: 'info',
+            message: 'No reproducible build signals detected — builds may not be deterministic',
+            fix: 'Use `npm ci` / `--frozen-lockfile` in CI, pin Dockerfile base images, or adopt Nix/Bazel for hermetic builds',
+            references: BUILD_REFS,
+        });
+    }
+    return gaps;
+}
+//# sourceMappingURL=build-checker.js.map

package/dist/engine/supply-chain/build-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-checker.js","sourceRoot":"","sources":["../../../src/engine/supply-chain/build-checker.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,+FAA+F;AAE/F,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,2BAA2B;AAC3B,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,sDAAsD;AACtD,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB;IACnB,MAAM;IACN,QAAQ;IACR,8BAA8B;CAC/B,CAAC;AAEF,4CAA4C;AAC5C,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,2BAA2B;AAC3B,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAErD,MAAM,UAAU,GAAG;IACjB,kCAAkC;IAClC,qDAAqD;IACrD,oBAAoB;CACrB,CAAC;AAEF,2CAA2C;AAC3C,KAAK,UAAU,eAAe,CAAC,WAAmB;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE;YAC3E,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,sBAAsB,CACnC,WAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IACxD,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,UAAU,GACd,IAAI,KAAK,KAAK;YACZ,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC;YAC3C,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC;gBACvC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAErB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,EAAE;YACxF,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACjE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,WAAmB;IAClD,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3E,sBAAsB,CAAC,WAAW,CAAC;QACnC,uBAAuB,CAAC,WAAW,CAAC;QACpC,qBAAqB,CAAC,WAAW,CAAC;KACnC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GACrB,cAAc,CAAC,SAAS;QACxB,YAAY,KAAK,IAAI;QACrB,CAAC,kBAAkB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAEtD,OAAO;QACL,iBAAiB;QACjB,iBAAiB,EAAE,cAAc,CAAC,SAAS;QAC3C,uBAAuB,EAAE,cAAc,CAAC,WAAW;QACnD,YAAY;QACZ,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yEAAyE;YAClF,GAAG,EAAE,oEAAoE;YACzE,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,0EAA0E;YACnF,GAAG,EAAE,8GAA8G;YACnH,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/supply-chain/dependency-checker.d.ts

@@ -0,0 +1,10 @@
+import type { SupplyChainGap, DependencyCheckResult } from '../../types/index.js';
+/**
+ * Check for dependency confusion risks and lock file hygiene.
+ */
+export declare function checkDependencies(projectPath: string): Promise<DependencyCheckResult>;
+/**
+ * Build dependency-related gaps from check results.
+ */
+export declare function buildDependencyGaps(result: DependencyCheckResult): SupplyChainGap[];
+//# sourceMappingURL=dependency-checker.d.ts.map

package/dist/engine/supply-chain/dependency-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-checker.d.ts","sourceRoot":"","sources":["../../../src/engine/supply-chain/dependency-checker.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAEV,cAAc,EACd,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAuG9B;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8B3F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,cAAc,EAAE,CAiCnF"}

package/dist/engine/supply-chain/dependency-checker.js

@@ -0,0 +1,161 @@
+// engine/supply-chain/dependency-checker.ts — SPEC-046
+// Detects dependency confusion risks, lock file presence, and signing hygiene.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+// Lock files per ecosystem
+const LOCK_FILES = [
+    'package-lock.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'Pipfile.lock',
+    'poetry.lock',
+    'uv.lock',
+    'go.sum',
+    'Cargo.lock',
+];
+const DEP_CONFUSION_REFS = [
+    'https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610',
+    'https://owasp.org/www-project-top-ten/2021/A06_2021-Vulnerable_and_Outdated_Components',
+    'https://docs.npmjs.com/cli/v9/using-npm/package-lock-json',
+];
+/** Detect if a lock file is present in the project. */
+async function detectLockFile(projectPath) {
+    for (const lockFile of LOCK_FILES) {
+        try {
+            await readFile(join(projectPath, lockFile), 'utf-8');
+            return lockFile;
+        }
+        catch {
+            // File not found, continue
+        }
+    }
+    return null;
+}
+/** Check if lock file has integrity hashes (npm package-lock.json or pnpm-lock.yaml). */
+async function lockFileHasHashes(projectPath, lockFile) {
+    if (!lockFile.includes('package-lock') && !lockFile.includes('pnpm-lock')) {
+        // For other lock files we can't easily verify hash presence without parsing
+        return true; // Assume pinned for yarn.lock, poetry.lock, go.sum, Cargo.lock
+    }
+    try {
+        const content = await readFile(join(projectPath, lockFile), 'utf-8');
+        return content.includes('integrity') || content.includes('sha512') || content.includes('sha1');
+    }
+    catch {
+        return false;
+    }
+}
+/** Check for .npmrc with registry configuration. */
+async function hasNpmrcRegistryConfig(projectPath) {
+    try {
+        const content = await readFile(join(projectPath, '.npmrc'), 'utf-8');
+        return content.includes(':registry=') || content.includes('registry=');
+    }
+    catch {
+        return false;
+    }
+}
+/** Check if pip.conf or similar Python registry config exists. */
+async function hasPythonRegistryConfig(projectPath) {
+    const configs = ['pip.conf', '.pip/pip.conf', 'pyproject.toml'];
+    for (const cfg of configs) {
+        try {
+            const content = await readFile(join(projectPath, cfg), 'utf-8');
+            if (content.includes('index-url') ||
+                content.includes('extra-index-url') ||
+                content.includes('[[tool.uv.index]]')) {
+                return true;
+            }
+        }
+        catch {
+            // File not found
+        }
+    }
+    return false;
+}
+/** Detect unscoped private npm packages (potential confusion targets). */
+async function detectUnscopedPrivatePackages(projectPath) {
+    try {
+        const content = await readFile(join(projectPath, 'package.json'), 'utf-8');
+        const pkg = JSON.parse(content);
+        const name = pkg.name ?? '';
+        const isScoped = name.startsWith('@');
+        const isPrivate = pkg.private === true;
+        const hasPublishConfig = pkg.publishConfig?.registry !== undefined;
+        // Risk: non-scoped package that is not explicitly private and has no publishConfig
+        if (!isScoped && !isPrivate && !hasPublishConfig) {
+            return { count: 1, hasPublishConfig: false };
+        }
+        return { count: 0, hasPublishConfig };
+    }
+    catch {
+        return { count: 0, hasPublishConfig: false };
+    }
+}
+/**
+ * Check for dependency confusion risks and lock file hygiene.
+ */
+export async function checkDependencies(projectPath) {
+    const lockFile = await detectLockFile(projectPath);
+    const hasHashes = lockFile ? await lockFileHasHashes(projectPath, lockFile) : false;
+    const [hasNpmrc, hasPyConf, unscopedInfo] = await Promise.all([
+        hasNpmrcRegistryConfig(projectPath),
+        hasPythonRegistryConfig(projectPath),
+        detectUnscopedPrivatePackages(projectPath),
+    ]);
+    const hasRegistryConfig = hasNpmrc || hasPyConf;
+    // Assess dependency confusion risk
+    // Only flag risk when there are unscoped private packages without registry binding
+    let risk = 'none';
+    if (!lockFile) {
+        risk = 'critical';
+    }
+    else if (unscopedInfo.count > 0 && !hasRegistryConfig) {
+        risk = 'high';
+    }
+    else if (unscopedInfo.count > 0) {
+        risk = 'low';
+    }
+    return {
+        lockFile,
+        lockFileHasHashes: hasHashes,
+        dependencyConfusionRisk: risk,
+        hasRegistryConfig,
+        unscopedPrivateCount: unscopedInfo.count,
+    };
+}
+/**
+ * Build dependency-related gaps from check results.
+ */
+export function buildDependencyGaps(result) {
+    const gaps = [];
+    if (!result.lockFile) {
+        gaps.push({
+            category: 'lockfile',
+            severity: 'critical',
+            message: 'No lock file detected — builds are not reproducible and are vulnerable to supply chain attacks',
+            fix: 'Commit a lock file (package-lock.json, pnpm-lock.yaml, poetry.lock, go.sum, Cargo.lock)',
+            references: [DEP_CONFUSION_REFS[2] ?? ''],
+        });
+    }
+    else if (!result.lockFileHasHashes && result.lockFile.includes('package-lock')) {
+        gaps.push({
+            category: 'lockfile',
+            severity: 'warning',
+            message: 'Lock file found but integrity hashes are missing — packages not hash-pinned',
+            fix: 'Regenerate the lock file with `npm install` or `pnpm install` to include integrity fields',
+            references: [DEP_CONFUSION_REFS[2] ?? ''],
+        });
+    }
+    if (result.dependencyConfusionRisk === 'critical' || result.dependencyConfusionRisk === 'high') {
+        gaps.push({
+            category: 'dependency-confusion',
+            severity: result.dependencyConfusionRisk === 'critical' ? 'critical' : 'warning',
+            message: `Dependency confusion risk: ${result.dependencyConfusionRisk} — unscoped package names without explicit registry binding`,
+            fix: 'Use scoped packages (@company/pkg) and add registry config in .npmrc or pip.conf',
+            references: DEP_CONFUSION_REFS.slice(0, 2),
+        });
+    }
+    return gaps;
+}
+//# sourceMappingURL=dependency-checker.js.map

package/dist/engine/supply-chain/dependency-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-checker.js","sourceRoot":"","sources":["../../../src/engine/supply-chain/dependency-checker.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,+EAA+E;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,2BAA2B;AAC3B,MAAM,UAAU,GAAG;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,WAAW;IACX,cAAc;IACd,aAAa;IACb,SAAS;IACT,QAAQ;IACR,YAAY;CACb,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,mEAAmE;IACnE,wFAAwF;IACxF,2DAA2D;CAC5D,CAAC;AAEF,uDAAuD;AACvD,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,QAAgB;IACpE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,4EAA4E;QAC5E,OAAO,IAAI,CAAC,CAAC,+DAA+D;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IACxD,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACrC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,6BAA6B,CAC1C,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAI7B,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;QACvC,MAAM,gBAAgB,GAAG,GAAG,CAAC,aAAa,EAAE,QAAQ,KAAK,SAAS,CAAC;QAEnE,mFAAmF;QACnF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IACzD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEpF,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,sBAAsB,CAAC,WAAW,CAAC;QACnC,uBAAuB,CAAC,WAAW,CAAC;QACpC,6BAA6B,CAAC,WAAW,CAAC;KAC3C,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,QAAQ,IAAI,SAAS,CAAC;IAEhD,mCAAmC;IACnC,mFAAmF;IACnF,IAAI,IAAI,GAA4B,MAAM,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,GAAG,UAAU,CAAC;IACpB,CAAC;SAAM,IAAI,YAAY,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;SAAM,IAAI,YAAY,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,SAAS;QAC5B,uBAAuB,EAAE,IAAI;QAC7B,iBAAiB;QACjB,oBAAoB,EAAE,YAAY,CAAC,KAAK;KACzC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,UAAU;YACpB,OAAO,EACL,gGAAgG;YAClG,GAAG,EAAE,yFAAyF;YAC9F,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6EAA6E;YACtF,GAAG,EAAE,2FAA2F;YAChG,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,UAAU,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,sBAAsB;YAChC,QAAQ,EAAE,MAAM,CAAC,uBAAuB,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAChF,OAAO,EAAE,8BAA8B,MAAM,CAAC,uBAAuB,6DAA6D;YAClI,GAAG,EAAE,kFAAkF;YACvF,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/supply-chain/index.d.ts

@@ -0,0 +1,12 @@
+import type { SupplyChainReport } from '../../types/index.js';
+export { detectSlsaLevel, buildSlsaGaps, detectSlsaProvenanceFormat, detectNpmProvenance, } from './slsa-checker.js';
+export type { NpmProvenanceResult, SlsaProvenanceFormat } from './slsa-checker.js';
+export { checkSbom, buildSbomGaps } from './sbom-checker.js';
+export { checkDependencies, buildDependencyGaps } from './dependency-checker.js';
+export { checkBuild, buildBuildGaps } from './build-checker.js';
+/**
+ * Run all supply chain security checks and return a consolidated SupplyChainReport.
+ * Accepts an optional compliance context to tune gap severities.
+ */
+export declare function runSupplyChainChecks(projectPath: string, isGovernmentOrEnterprise?: boolean): Promise<SupplyChainReport>;
+//# sourceMappingURL=index.d.ts.map

package/dist/engine/supply-chain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/engine/supply-chain/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAM9D,OAAO,EACL,eAAe,EACf,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,wBAAwB,UAAQ,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}

package/dist/engine/supply-chain/index.js

@@ -0,0 +1,38 @@
+// engine/supply-chain/index.ts — SPEC-046
+// Orchestrator: runs all supply chain checkers and produces a SupplyChainReport.
+import { detectSlsaLevel, buildSlsaGaps } from './slsa-checker.js';
+import { checkSbom, buildSbomGaps } from './sbom-checker.js';
+import { checkDependencies, buildDependencyGaps } from './dependency-checker.js';
+import { checkBuild, buildBuildGaps } from './build-checker.js';
+export { detectSlsaLevel, buildSlsaGaps, detectSlsaProvenanceFormat, detectNpmProvenance, } from './slsa-checker.js';
+export { checkSbom, buildSbomGaps } from './sbom-checker.js';
+export { checkDependencies, buildDependencyGaps } from './dependency-checker.js';
+export { checkBuild, buildBuildGaps } from './build-checker.js';
+/**
+ * Run all supply chain security checks and return a consolidated SupplyChainReport.
+ * Accepts an optional compliance context to tune gap severities.
+ */
+export async function runSupplyChainChecks(projectPath, isGovernmentOrEnterprise = false) {
+    const [slsaResult, sbomResult, depResult, buildResult] = await Promise.all([
+        detectSlsaLevel(projectPath),
+        checkSbom(projectPath),
+        checkDependencies(projectPath),
+        checkBuild(projectPath),
+    ]);
+    const slsaGaps = buildSlsaGaps(slsaResult.level, slsaResult.isPublishing, slsaResult.hasOidc);
+    const sbomGaps = buildSbomGaps(sbomResult, isGovernmentOrEnterprise);
+    const depGaps = buildDependencyGaps(depResult);
+    const buildGaps = buildBuildGaps(buildResult);
+    return {
+        slsaLevel: slsaResult.level,
+        sbomPresent: sbomResult.sbomPresent,
+        sbomValid: sbomResult.sbomValid,
+        sbomFormat: sbomResult.sbomFormat,
+        lockfilePresent: depResult.lockFile !== null,
+        dependencyConfusionRisk: depResult.dependencyConfusionRisk,
+        reproducibleBuild: buildResult.reproducibleBuild,
+        signingPresent: slsaResult.level === 'L2' || slsaResult.level === 'L3',
+        gaps: [...slsaGaps, ...sbomGaps, ...depGaps, ...buildGaps],
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/engine/supply-chain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/engine/supply-chain/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,iFAAiF;AAGjF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EACL,eAAe,EACf,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,wBAAwB,GAAG,KAAK;IAEhC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzE,eAAe,CAAC,WAAW,CAAC;QAC5B,SAAS,CAAC,WAAW,CAAC;QACtB,iBAAiB,CAAC,WAAW,CAAC;QAC9B,UAAU,CAAC,WAAW,CAAC;KACxB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE9C,OAAO;QACL,SAAS,EAAE,UAAU,CAAC,KAAK;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,eAAe,EAAE,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC5C,uBAAuB,EAAE,SAAS,CAAC,uBAAuB;QAC1D,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;QAChD,cAAc,EAAE,UAAU,CAAC,KAAK,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,IAAI;QACtE,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/dist/engine/supply-chain/sbom-checker.d.ts

@@ -0,0 +1,11 @@
+import type { SupplyChainGap, SbomCheckResult } from '../../types/index.js';
+/**
+ * Detect SBOM presence and validate its content.
+ * Returns SbomCheckResult with format, validity, and CI integration status.
+ */
+export declare function checkSbom(projectPath: string): Promise<SbomCheckResult>;
+/**
+ * Build SBOM gaps from check results.
+ */
+export declare function buildSbomGaps(result: SbomCheckResult, isGovernmentOrEnterprise: boolean): SupplyChainGap[];
+//# sourceMappingURL=sbom-checker.d.ts.map

package/dist/engine/supply-chain/sbom-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-checker.d.ts","sourceRoot":"","sources":["../../../src/engine/supply-chain/sbom-checker.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAc,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA2GxF;;;GAGG;AACH,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAqC7E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,eAAe,EACvB,wBAAwB,EAAE,OAAO,GAChC,cAAc,EAAE,CA4BlB"}