@aegis-scan/core 0.16.2 → 0.16.4

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AA+N7D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC;AA0CjF,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,WAAW,CAAC,MAAM,CAAU,GACjC,OAAO,CAAC,WAAW,CAAC,CA4DtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AAqO7D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC;AA0CjF,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,WAAW,CAAC,MAAM,CAAU,GACjC,OAAO,CAAC,WAAW,CAAC,CA4DtB"}

package/dist/config.js

@@ -163,15 +163,21 @@ const DEFAULT_IGNORE = [
     '.windsurf',
     '.codex',
     '.aider',
-    // Test + benchmark fixtures (v0.7.1): scanning these is almost always
-    // noise — they contain intentionally-vulnerable code OR mocked data.
-    // Users who DO want to scan their tests can override via
-    // aegis.config.json `ignore` (unions with this list) or explicitly
-    // include paths on the CLI.
+    // Test + benchmark fixtures (v0.7.1, narrowed v0.16.3 D-CA-001):
+    // scanning these is almost always noise — they contain intentionally-
+    // vulnerable code OR mocked data. The list deliberately OMITS bare
+    // `'test'` and `'tests'` since those matched as path-segments
+    // anywhere (including legitimate Next.js App Router routes like
+    // `app/api/test/route.ts`), silently hiding real vulnerabilities
+    // whenever an operator named a route `test` / `tests`. Round-7
+    // comprehensive audit empirical-repro: identical source under
+    // `/test/` got 0 findings while under `/vuln/` got 6. Unambiguous
+    // test-framework conventions (`__tests__`, `__test__`, `__mocks__`,
+    // `__fixtures__`) remain — those are zero-collision-risk. Users who
+    // want to skip their own `test/` directory can add it via
+    // aegis.config.json `ignore` (unions with this list) or via CLI.
     '__tests__',
     '__test__',
-    'test',
-    'tests',
     '__mocks__',
     '__fixtures__',
     'fixtures',

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;CACrE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjE,GAAG,EAAE,eAAe;IACpB,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;CACjG,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;CAClH,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,sDAAsD;KAChE,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,CAAC;SACnB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,6DAA6D;KACvE,CAAC,CACH;SACA,QAAQ,EAAE;IACb,wBAAwB,EAAE,CAAC;SACxB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,gEAAgE;KAC1E,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,WAAW,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IACtD,eAAe,EAAE,kCAAkC,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEnC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,6DAA6D;IAC7D,qEAAqE;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,eAAe;IACf,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,sEAAsE;IACtE,qEAAqE;IACrE,yDAAyD;IACzD,mEAAmE;IACnE,4BAA4B;IAC5B,WAAW;IACX,UAAU;IACV,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;IACd,UAAU;IACV,WAAW;IACX,YAAY;IACZ,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,SAAS;IACT,SAAS;IACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,wDAAwD;IACxD,6DAA6D;IAC7D,mEAAmE;IACnE,gEAAgE;IAChE,4DAA4D;IAC5D,sDAAsD;IACtD,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC;AAQF;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAuB,CAAC;YACxC,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAClF,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB;gBAC1D,yEAAyE;gBACzE,YAAY,OAAO,IAAI;gBACvB,iEAAiE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;gBAC/G,iCAAiC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAA4B,MAAM;IAElC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAgB;QAC1B,WAAW;QACX,KAAK;QACL,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC;IAEF,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAmB,CAAC;QACpE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,gEAAgE;YAChE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAClD,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,CAAC;QACD,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACxD,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAChD,CAAC;QACD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QAC5D,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;CACrE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjE,GAAG,EAAE,eAAe;IACpB,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;CACjG,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;CAClH,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,sDAAsD;KAChE,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,CAAC;SACnB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,6DAA6D;KACvE,CAAC,CACH;SACA,QAAQ,EAAE;IACb,wBAAwB,EAAE,CAAC;SACxB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;QAChB,OAAO,EAAE,gEAAgE;KAC1E,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,WAAW,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IACtD,eAAe,EAAE,kCAAkC,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEnC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,6DAA6D;IAC7D,qEAAqE;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,eAAe;IACf,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,iEAAiE;IACjE,sEAAsE;IACtE,mEAAmE;IACnE,8DAA8D;IAC9D,gEAAgE;IAChE,iEAAiE;IACjE,+DAA+D;IAC/D,8DAA8D;IAC9D,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,iEAAiE;IACjE,WAAW;IACX,UAAU;IACV,WAAW;IACX,cAAc;IACd,UAAU;IACV,WAAW;IACX,YAAY;IACZ,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,SAAS;IACT,SAAS;IACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,wDAAwD;IACxD,6DAA6D;IAC7D,mEAAmE;IACnE,gEAAgE;IAChE,4DAA4D;IAC5D,sDAAsD;IACtD,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC;AAQF;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAuB,CAAC;YACxC,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAClF,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB;gBAC1D,yEAAyE;gBACzE,YAAY,OAAO,IAAI;gBACvB,iEAAiE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;gBAC/G,iCAAiC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAA4B,MAAM;IAElC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAgB;QAC1B,WAAW;QACX,KAAK;QACL,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC;IAEF,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAmB,CAAC;QACpE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,gEAAgE;YAChE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAClD,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,CAAC;QACD,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACxD,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAChD,CAAC;QACD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QAC5D,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { loadConfig, type ConfigFileShape } from './config.js';
 export { Orchestrator } from './orchestrator.js';
 export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache, getChangedFiles, type ExecResult, type ExecOptions } from './utils.js';
 export { getVersion } from './version.js';
+export { isTestFile } from './is-test-path.js';
 export { parseSuppressions, isSuppressed, getUnusedSuppressions, getNakedSuppressions, type Suppression, } from './suppressions.js';
 export { globToRegex, configSuppressionMatches, applyPipelineSuppressions, type SuppressionStats, } from './suppression-filter.js';
 export { PRECISION_GATES, SCANNER_TIERS, tierOf, gateFor, passesPrecisionGate, type PrecisionTier, } from './precision-tiers.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -5,6 +5,7 @@ export { loadConfig } from './config.js';
 export { Orchestrator } from './orchestrator.js';
 export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache, getChangedFiles } from './utils.js';
 export { getVersion } from './version.js';
+export { isTestFile } from './is-test-path.js';
 export { parseSuppressions, isSuppressed, getUnusedSuppressions, getNakedSuppressions, } from './suppressions.js';
 export { globToRegex, configSuppressionMatches, applyPipelineSuppressions, } from './suppression-filter.js';
 export { PRECISION_GATES, SCANNER_TIERS, tierOf, gateFor, passesPrecisionGate, } from './precision-tiers.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAqC,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAqC,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC"}

package/dist/is-test-path.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Canonical test-file detection — returns true only for files that are
+ * unambiguously part of the test/mock/e2e infrastructure, so scanners
+ * can skip them without masking real vulnerabilities in legitimate
+ * production code.
+ *
+ * The predicate deliberately distinguishes between unambiguous
+ * test-framework conventions (which are safe to use as substring
+ * matches) and the ambiguous path substrings `/test/` and `/tests/`
+ * (which are NOT safe — `app/api/test/route.ts` is a legitimate
+ * Next.js App Router route-handler, not a test file).
+ *
+ * v0.16.3 D-CA-001 (2026-04-21) — Round-7 comprehensive-audit surfaced
+ * a systemic silent-skip class: 19 scanner files used
+ * `filePath.includes('/test/') || filePath.includes('/tests/')` as
+ * substring-match in their local isTestFile/shouldSkipFile helpers,
+ * silently skipping every file whose path contained either segment
+ * anywhere. Empirical RED-reproduction: identical source code under
+ * `src/app/api/test/route.ts` got 0 findings while the same source
+ * under `src/app/api/vuln/route.ts` got 6 findings — jwt-detector,
+ * taint-analyzer, tenant-isolation-checker, sql-concat-checker, and
+ * every other scanner silently no-oped on the `/test/` path. This
+ * helper closes that class by dropping the substring-match and keeping
+ * only the unambiguous conventions.
+ *
+ * Matches (returns true):
+ *   - `.test.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `.spec.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `.e2e.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `__tests__/` directory segment anywhere in the path
+ *   - `__mocks__/` directory segment anywhere in the path
+ *   - `playwright/` directory segment (v0.6.1 console-checker extension)
+ *   - `cypress/` directory segment (v0.6.1 console-checker extension)
+ *   - `e2e/` directory segment (v0.6.1 console-checker extension)
+ *
+ * Does NOT match (returns false):
+ *   - `app/api/test/route.ts` — legitimate Next.js route named "test"
+ *   - `src/testing/utils.ts` — non-test utility with "test" in a dir-name
+ *   - `src/components/TestButton.tsx` — legitimate component
+ *   - `tests/helpers.ts` at top-level — no `.test.` extension and no
+ *     `__tests__/` segment, so we defer to the scanner-specific
+ *     judgment rather than silent-skip
+ *
+ * Path separators are normalized so the predicate works on both POSIX
+ * (`/`) and Windows (`\`) paths.
+ */
+export declare function isTestFile(filePath: string): boolean;
+//# sourceMappingURL=is-test-path.d.ts.map

package/dist/is-test-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-test-path.d.ts","sourceRoot":"","sources":["../src/is-test-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBpD"}

package/dist/is-test-path.js

@@ -0,0 +1,74 @@
+/**
+ * Canonical test-file detection — returns true only for files that are
+ * unambiguously part of the test/mock/e2e infrastructure, so scanners
+ * can skip them without masking real vulnerabilities in legitimate
+ * production code.
+ *
+ * The predicate deliberately distinguishes between unambiguous
+ * test-framework conventions (which are safe to use as substring
+ * matches) and the ambiguous path substrings `/test/` and `/tests/`
+ * (which are NOT safe — `app/api/test/route.ts` is a legitimate
+ * Next.js App Router route-handler, not a test file).
+ *
+ * v0.16.3 D-CA-001 (2026-04-21) — Round-7 comprehensive-audit surfaced
+ * a systemic silent-skip class: 19 scanner files used
+ * `filePath.includes('/test/') || filePath.includes('/tests/')` as
+ * substring-match in their local isTestFile/shouldSkipFile helpers,
+ * silently skipping every file whose path contained either segment
+ * anywhere. Empirical RED-reproduction: identical source code under
+ * `src/app/api/test/route.ts` got 0 findings while the same source
+ * under `src/app/api/vuln/route.ts` got 6 findings — jwt-detector,
+ * taint-analyzer, tenant-isolation-checker, sql-concat-checker, and
+ * every other scanner silently no-oped on the `/test/` path. This
+ * helper closes that class by dropping the substring-match and keeping
+ * only the unambiguous conventions.
+ *
+ * Matches (returns true):
+ *   - `.test.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `.spec.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `.e2e.{ts,tsx,js,jsx,mjs,cjs}` file-name extension
+ *   - `__tests__/` directory segment anywhere in the path
+ *   - `__mocks__/` directory segment anywhere in the path
+ *   - `playwright/` directory segment (v0.6.1 console-checker extension)
+ *   - `cypress/` directory segment (v0.6.1 console-checker extension)
+ *   - `e2e/` directory segment (v0.6.1 console-checker extension)
+ *
+ * Does NOT match (returns false):
+ *   - `app/api/test/route.ts` — legitimate Next.js route named "test"
+ *   - `src/testing/utils.ts` — non-test utility with "test" in a dir-name
+ *   - `src/components/TestButton.tsx` — legitimate component
+ *   - `tests/helpers.ts` at top-level — no `.test.` extension and no
+ *     `__tests__/` segment, so we defer to the scanner-specific
+ *     judgment rather than silent-skip
+ *
+ * Path separators are normalized so the predicate works on both POSIX
+ * (`/`) and Windows (`\`) paths.
+ */
+export function isTestFile(filePath) {
+    // (1) Proper test-file extensions — `.test.ts`, `.spec.ts`, `.e2e.ts`, etc.
+    if (/\.(test|spec|e2e)\.(ts|tsx|js|jsx|mjs|cjs)$/.test(filePath))
+        return true;
+    // (2) Unambiguous test-framework directory conventions as path segments.
+    //     `[\/\\]<name>[\/\\]` ensures we match a directory segment rather
+    //     than a substring of a filename or a longer directory name.
+    if (/[\/\\]__tests__[\/\\]/.test(filePath))
+        return true;
+    if (/[\/\\]__mocks__[\/\\]/.test(filePath))
+        return true;
+    // (3) E2E-framework directory conventions (v0.6.1 console-checker
+    //     extension — dogfood on cal-com and dub found 44 of 46
+    //     console-checker FPs in `apps/web/playwright/**` with unit-test-
+    //     conventions-only matching; keeping these as unambiguous skips
+    //     preserves that trade-off).
+    if (/[\/\\]playwright[\/\\]/.test(filePath))
+        return true;
+    if (/[\/\\]cypress[\/\\]/.test(filePath))
+        return true;
+    if (/[\/\\]e2e[\/\\]/.test(filePath))
+        return true;
+    // Deliberately NOT `/test/` or `/tests/` substring — legitimate
+    // routes/directories (app/api/test/route.ts, src/testing/utils.ts,
+    // …) must be scanned. D-CA-001 fix (2026-04-21).
+    return false;
+}
+//# sourceMappingURL=is-test-path.js.map

package/dist/is-test-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-test-path.js","sourceRoot":"","sources":["../src/is-test-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,4EAA4E;IAC5E,IAAI,6CAA6C,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9E,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,kEAAkE;IAClE,4DAA4D;IAC5D,sEAAsE;IACtE,oEAAoE;IACpE,iCAAiC;IACjC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,gEAAgE;IAChE,mEAAmE;IACnE,iDAAiD;IACjD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aegis-scan/core",
-  "version": "0.16.2",
+  "version": "0.16.4",
   "description": "AEGIS core engine — orchestrator, scoring (0-1000), config loader with Zod-strict schema, suppression filter, shared types + utilities. The foundation of the AEGIS security-scanner suite for Next.js + Supabase.",
   "license": "MIT",
   "author": "RideMatch1 <230386010+RideMatch1@users.noreply.github.com>",
@@ -55,6 +55,7 @@
   },
   "scripts": {
     "build": "tsc",
+    "lint": "tsc --noEmit",
     "test": "vitest run",
     "clean": "rm -rf dist"
   }