[Fire162]

What changed and why

Restores lockfileSource to report.json alongside scannedAt and cliVersion in handleSingleFolderScan (src/scan/single-scan.ts).

When #1176 unified report.json with the --json payload builder, lockfileSource was omitted because it is not part of the standard --json output. Adding lockfileSource: reportData.lockfileSource to jsonPayload restores the field so report.json remains a strict superset of the --json shape.

Also updates test assertions in tests/html-reporter.test.ts and tests/e2e/validation-and-outputs.test.ts to verify lockfileSource presence in report.json and absence from the standard --json payload.

Closes #1263

[prx-my]

Heads-up: this branch is currently behind main, which blocks the merge. Could you update it?

• Click Update branch on this PR, or
• Rebase locally:

  git fetch upstream
  git rebase upstream/main
  git push --force-with-lease
  

Once updated, CI will re-run. Thanks!

[sonukapoor]

Closing this as a duplicate of #1264, which merged as d378bbe and closes #1263. Yours was fifteen minutes behind it and the project gives the oldest duplicate the first chance.

One thing from yours I did want to keep, so it is on the record: you were the only one of the two to notice that the negative assertion in tests/html-reporter.test.ts reads as a claim about report.json once the field comes back. You picked a different remedy than I would, since that assertion is a live guard on the shared --json builder and overwriting it loses coverage, but the observation was right and neither #1264 nor I spotted it. A comment making it explicit is going on my list.

Thanks for the PR.

[Fire162]

Thank you for the detailed feedback and explanation, @sonukapoor. Glad the observation on the test assertion was helpful. Appreciate your time reviewing this!