@aegis-scan/core 0.2.0 → 0.7.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AEGIS Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AA8C7D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC;AA8BjF,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,WAAW,CAAC,MAAM,CAAU,GACjC,OAAO,CAAC,WAAW,CAAC,CA0CtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AAyF7D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC;AA0CjF,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,WAAW,CAAC,MAAM,CAAU,GACjC,OAAO,CAAC,WAAW,CAAC,CA4DtB"}

package/dist/config.js

@@ -2,6 +2,31 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { z } from 'zod';
 import { detectStack } from './detect.js';
+const CweStringSchema = z.string().regex(/^CWE-\d+$/, { message: 'expected CWE-<digits>' });
+const SeverityEnum = z.enum(['blocker', 'critical', 'high', 'medium', 'low', 'info']);
+const CustomSourceSchema = z.object({
+    pattern: z.string().min(1, { message: 'pattern must not be empty' }),
+}).strict();
+const CustomSinkSchema = z.object({
+    pattern: z.string().min(1, { message: 'pattern must not be empty' }),
+    type: z.enum(['call', 'constructor', 'property']).default('call'),
+    cwe: CweStringSchema,
+    severity: SeverityEnum.default('high'),
+    category: z.string().optional(),
+}).strict();
+const CustomSanitizerSchema = z.object({
+    pattern: z.string().min(1, { message: 'pattern must not be empty' }),
+    cwes: z.array(CweStringSchema).min(1, { message: 'sanitizer must neutralize at least one CWE' }),
+}).strict();
+const SuppressionEntrySchema = z.object({
+    file: z.string().min(1, { message: 'file glob must not be empty' }),
+    rule: z.string().optional(),
+    reason: z.string().min(10, { message: 'reason must be at least 10 characters so future readers understand WHY' }),
+}).strict();
+const SuppressionOptionsSchema = z.object({
+    warnUnused: z.boolean().default(true),
+    warnNaked: z.boolean().default(true),
+}).strict();
 const ConfigFileSchema = z.object({
     stack: z.object({
         framework: z.string().optional(),
@@ -20,6 +45,12 @@ const ConfigFileSchema = z.object({
     rules: z.record(z.string()).optional(),
     ignore: z.array(z.string()).optional(),
     target: z.string().optional(),
+    customSources: z.array(CustomSourceSchema).optional(),
+    customSinks: z.array(CustomSinkSchema).optional(),
+    customSanitizers: z.array(CustomSanitizerSchema).optional(),
+    suppressions: z.array(SuppressionEntrySchema).optional(),
+    suppressionOptions: SuppressionOptionsSchema.optional(),
+    allowOverrides: z.boolean().optional(),
 }).strict();
 const DEFAULT_IGNORE = [
     'node_modules',
@@ -43,6 +74,12 @@ const DEFAULT_IGNORE = [
     '.gradle',
     '.idea',
     '.vscode',
+    '.auto-claude',
+    '.claude',
+    '.cursor',
+    '.windsurf',
+    '.codex',
+    '.aider',
 ];
 /**
  * Attempt to load aegis.config.json from the project directory.
@@ -59,12 +96,22 @@ async function loadConfigFile(projectPath) {
             if (result.success) {
                 return result.data;
             }
-            // Validation failed — log warning but don't crash, fall back to auto-detection
-            console.warn(`[aegis] Config validation warning in ${jsonPath}: ${result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ')}. Falling back to auto-detection.`);
+            // Validation failed — escalate to console.error so it doesn't get lost in
+            // CI output noise. The whole config is discarded and auto-detection runs
+            // (the safer default — better than applying a partial config).
+            const details = result.error.issues
+                .map((i) => `  - ${i.path.length > 0 ? i.path.join('.') : '<root>'}: ${i.message}`)
+                .join('\n');
+            console.error(`[aegis] CONFIG REJECTED — ${jsonPath} failed validation.\n` +
+                `Custom rules, suppressions, and all other fields WILL NOT BE APPLIED.\n` +
+                `Issues:\n${details}\n` +
+                `Fix the config file and re-run. Falling back to auto-detection.`);
             return null;
         }
-        catch {
-            // Malformed JSON — fall through
+        catch (err) {
+            // Malformed JSON — also escalate (same problem: user thinks config is applied but isn't)
+            console.error(`[aegis] CONFIG REJECTED — ${jsonPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}.\n` +
+                `Falling back to auto-detection.`);
         }
     }
     return null;
@@ -105,6 +152,24 @@ export async function loadConfig(projectPath, mode = 'scan') {
         if (fileConfig.target !== undefined) {
             config.target = fileConfig.target;
         }
+        if (fileConfig.customSources !== undefined) {
+            config.customSources = fileConfig.customSources;
+        }
+        if (fileConfig.customSinks !== undefined) {
+            config.customSinks = fileConfig.customSinks;
+        }
+        if (fileConfig.customSanitizers !== undefined) {
+            config.customSanitizers = fileConfig.customSanitizers;
+        }
+        if (fileConfig.suppressions !== undefined) {
+            config.suppressions = fileConfig.suppressions;
+        }
+        if (fileConfig.suppressionOptions !== undefined) {
+            config.suppressionOptions = fileConfig.suppressionOptions;
+        }
+        if (fileConfig.allowOverrides !== undefined) {
+            config.allowOverrides = fileConfig.allowOverrides;
+        }
     }
     return config;
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,eAAe;IACf,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;CACV,CAAC;AAQF;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAuB,CAAC;YACxC,CAAC;YACD,+EAA+E;YAC/E,OAAO,CAAC,IAAI,CACV,wCAAwC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CACvK,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAA4B,MAAM;IAElC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAgB;QAC1B,WAAW;QACX,KAAK;QACL,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC;IAEF,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAmB,CAAC;QACpE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,gEAAgE;YAChE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;CACrE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjE,GAAG,EAAE,eAAe;IACpB,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;CACjG,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;CAClH,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,eAAe;IACf,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,QAAQ;CACT,CAAC;AAQF;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAuB,CAAC;YACxC,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAClF,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB;gBAC1D,yEAAyE;gBACzE,YAAY,OAAO,IAAI;gBACvB,iEAAiE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;gBAC/G,iCAAiC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAA4B,MAAM;IAElC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAgB;QAC1B,WAAW;QACX,KAAK;QACL,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC;IAEF,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAmB,CAAC;QACpE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,gEAAgE;YAChE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAClD,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,CAAC;QACD,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACxD,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAChD,CAAC;QACD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QAC5D,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,9 @@ export { detectStack } from './detect.js';
 export { calculateScore, getGrade, getBadge, CATEGORY_WEIGHTS } from './scoring.js';
 export { loadConfig, type ConfigFileShape } from './config.js';
 export { Orchestrator } from './orchestrator.js';
-export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache, type ExecResult, type ExecOptions } from './utils.js';
+export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache, getChangedFiles, type ExecResult, type ExecOptions } from './utils.js';
 export { getVersion } from './version.js';
+export { parseSuppressions, isSuppressed, getUnusedSuppressions, getNakedSuppressions, type Suppression, } from './suppressions.js';
+export { globToRegex, configSuppressionMatches, applyPipelineSuppressions, type SuppressionStats, } from './suppression-filter.js';
+export { PRECISION_GATES, SCANNER_TIERS, tierOf, gateFor, passesPrecisionGate, type PrecisionTier, } from './precision-tiers.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -3,6 +3,9 @@ export { detectStack } from './detect.js';
 export { calculateScore, getGrade, getBadge, CATEGORY_WEIGHTS } from './scoring.js';
 export { loadConfig } from './config.js';
 export { Orchestrator } from './orchestrator.js';
-export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache } from './utils.js';
+export { exec, commandExists, walkFiles, readFileSafe, clearWalkFilesCache, getChangedFiles } from './utils.js';
 export { getVersion } from './version.js';
+export { parseSuppressions, isSuppressed, getUnusedSuppressions, getNakedSuppressions, } from './suppressions.js';
+export { globToRegex, configSuppressionMatches, applyPipelineSuppressions, } from './suppression-filter.js';
+export { PRECISION_GATES, SCANNER_TIERS, tierOf, gateFor, passesPrecisionGate, } from './precision-tiers.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAqC,MAAM,YAAY,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAqC,MAAM,YAAY,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,MAAM,EACN,OAAO,EACP,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC"}

package/dist/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAmC,MAAM,YAAY,CAAC;AAcrG,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAiB;IAEjC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI1B,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CAiGrD"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAmC,MAAM,YAAY,CAAC;AAgBrG,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAiB;IAEjC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI1B,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CA2HrD"}

package/dist/orchestrator.js

@@ -1,4 +1,6 @@
 import { calculateScore } from './scoring.js';
+import { applyPipelineSuppressions } from './suppression-filter.js';
+import { walkFiles } from './utils.js';
 const SCANNER_TIMEOUT_MS = 120_000; // 2 minutes per scanner
 function withTimeout(promise, ms, label) {
     return new Promise((resolve, reject) => {
@@ -55,7 +57,7 @@ export class Orchestrator {
         // Aggregate and deduplicate findings (same file + line + title = duplicate)
         const rawFindings = scanResults.flatMap((r) => r.findings);
         const seen = new Set();
-        const allFindings = [];
+        let allFindings = [];
         for (const f of rawFindings) {
             const key = `${f.file ?? ''}:${f.line ?? 0}:${f.title}`;
             if (!seen.has(key)) {
@@ -63,6 +65,31 @@ export class Orchestrator {
                 allFindings.push(f);
             }
         }
+        // Diff-mode: only keep findings for changed files
+        if (config.diffFiles && config.diffFiles.length > 0) {
+            const diffSet = new Set(config.diffFiles);
+            allFindings = allFindings.filter((f) => {
+                if (!f.file)
+                    return false; // no file = project-level finding, skip in diff mode
+                return diffSet.has(f.file);
+            });
+        }
+        // Pipeline-level suppressions — applies to ALL scanners, not just taint-analyzer.
+        // Inline (// aegis-ignore) + Config-level (aegis.config.json suppressions[]).
+        // When warnUnused is enabled, also walk the project for stale suppressions
+        // in files that produced no findings (cheap — pre-filtered by substring).
+        const warnUnused = config.suppressionOptions?.warnUnused !== false;
+        const scannedFiles = warnUnused
+            ? walkFiles(config.projectPath, config.ignore ?? [], ['ts', 'js', 'tsx', 'jsx'])
+            : undefined;
+        const suppressionResult = applyPipelineSuppressions(allFindings, config, scannedFiles);
+        allFindings = suppressionResult.kept;
+        for (const msg of suppressionResult.stats.nakedWarnings) {
+            process.stderr.write(`${msg}\n`);
+        }
+        for (const msg of suppressionResult.stats.unusedWarnings) {
+            process.stderr.write(`${msg}\n`);
+        }
         // Calculate confidence based on SECURITY-focused external tools.
         // npm-audit, react-doctor, license-checker are always available (built-in node tools)
         // and don't indicate real external security tool installation.

package/dist/orchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,CAAC,wBAAwB;AAE5D,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,qBAAqB,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CACV,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,YAAY;IACf,QAAQ,GAAc,EAAE,CAAC;IAEjC,QAAQ,CAAC,OAAgB;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAuB,EAAE;YAC5E,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,CAAC;oBACX,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EACxC,kBAAkB,EAClB,OAAO,CAAC,IAAI,CACb,CAAC;gBACF,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACpD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEpD,4EAA4E;QAC5E,MAAM,WAAW,GAAc,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,sFAAsF;QACtF,+DAA+D;QAC/D,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3G,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CACnD,CAAC;QACF,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9E,IAAI,UAAsB,CAAC;QAC3B,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAC3B,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;aAAM,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,QAAQ,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,2EAA2E;QAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW;YACrB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,CAAC,wBAAwB;AAE5D,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,qBAAqB,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CACV,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,YAAY;IACf,QAAQ,GAAc,EAAE,CAAC;IAEjC,QAAQ,CAAC,OAAgB;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAmB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAuB,EAAE;YAC5E,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,CAAC;oBACX,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EACxC,kBAAkB,EAClB,OAAO,CAAC,IAAI,CACb,CAAC;gBACF,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACpD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEpD,4EAA4E;QAC5E,MAAM,WAAW,GAAc,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,WAAW,GAAc,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC,CAAC,qDAAqD;gBAChF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,EAAE,UAAU,KAAK,KAAK,CAAC;QACnE,MAAM,YAAY,GAAG,UAAU;YAC7B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAChF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACvF,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,iEAAiE;QACjE,sFAAsF;QACtF,+DAA+D;QAC/D,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3G,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CACnD,CAAC;QACF,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9E,IAAI,UAAsB,CAAC;QAC3B,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAC3B,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;aAAM,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,QAAQ,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,2EAA2E;QAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW;YACrB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}

package/dist/precision-tiers.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Precision-Tier Classification for Scanners.
+ *
+ * Different scanner types have different realistic precision ceilings:
+ *   - Pattern-matching on explicit syntax (CSP headers, cookie flags) can hit 85-95%
+ *   - Taint propagation through AST is 70-85% due to inference limits
+ *   - Heuristic "missing X guard" checks are 50-70% because context is fuzzy
+ *
+ * Flat 70% gates would unfairly punish heuristic scanners and be too lax for
+ * pattern ones. This module defines tiered gates, each scanner classified once
+ * and explicitly — no inline code-review arguments about where a scanner belongs.
+ *
+ * Scanners below their tier's gate on the measurement corpus ship as
+ * `--experimental` only (quarantine tier) and don't count toward the overall
+ * precision score.
+ */
+export type PrecisionTier = 'definitive' | 'pattern' | 'taint' | 'heuristic' | 'quarantine';
+/**
+ * Merge-gate per tier. A scanner whose measured precision on the dogfood
+ * corpus is below its gate cannot ship in the default scan output.
+ */
+export declare const PRECISION_GATES: Record<PrecisionTier, number>;
+/**
+ * Explicit scanner → tier mapping.
+ *
+ * NOT classified here (by design):
+ *   - External tool wrappers (semgrep, gitleaks, trivy, …) inherit the tool's
+ *     own precision; AEGIS doesn't re-assess.
+ *   - Runtime probes (auth-probe, race-probe, …) measure live behavior, not
+ *     static precision.
+ *   - Compliance meta-scanners (gdpr-engine, iso27001-checker, …) aggregate
+ *     findings from underlying scanners; precision inherited.
+ *
+ * New scanners MUST be added here before merge. The `tierOf` function returns
+ * undefined for unclassified scanners, which the precision CLI reports as an
+ * error so merge isn't silently possible.
+ */
+export declare const SCANNER_TIERS: Partial<Record<string, PrecisionTier>>;
+/** Look up a scanner's tier. Returns undefined for unclassified/external/probe. */
+export declare function tierOf(scannerName: string): PrecisionTier | undefined;
+/** Return the precision gate for a scanner, or undefined if unclassified. */
+export declare function gateFor(scannerName: string): number | undefined;
+/**
+ * Check whether a measured precision passes the scanner's tier gate.
+ * Returns false if scanner is unclassified (must be explicit before merge).
+ */
+export declare function passesPrecisionGate(scannerName: string, precision: number): boolean;
+//# sourceMappingURL=precision-tiers.d.ts.map

package/dist/precision-tiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"precision-tiers.d.ts","sourceRoot":"","sources":["../src/precision-tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAWzD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAgDhE,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGnF"}

package/dist/precision-tiers.js

@@ -0,0 +1,111 @@
+/**
+ * Precision-Tier Classification for Scanners.
+ *
+ * Different scanner types have different realistic precision ceilings:
+ *   - Pattern-matching on explicit syntax (CSP headers, cookie flags) can hit 85-95%
+ *   - Taint propagation through AST is 70-85% due to inference limits
+ *   - Heuristic "missing X guard" checks are 50-70% because context is fuzzy
+ *
+ * Flat 70% gates would unfairly punish heuristic scanners and be too lax for
+ * pattern ones. This module defines tiered gates, each scanner classified once
+ * and explicitly — no inline code-review arguments about where a scanner belongs.
+ *
+ * Scanners below their tier's gate on the measurement corpus ship as
+ * `--experimental` only (quarantine tier) and don't count toward the overall
+ * precision score.
+ */
+/**
+ * Merge-gate per tier. A scanner whose measured precision on the dogfood
+ * corpus is below its gate cannot ship in the default scan output.
+ */
+export const PRECISION_GATES = {
+    /** Definitive signal — entropy, known-bad strings. High confidence expected. */
+    definitive: 0.80,
+    /** Syntax-level pattern matching. Clear, objective signal. */
+    pattern: 0.75,
+    /** Taint propagation — inference limits keep this from pattern-level precision. */
+    taint: 0.70,
+    /** Context-heavy heuristics — accept lower precision for harder signal. */
+    heuristic: 0.60,
+    /** Below any tier's gate — ships `--experimental` only, not default scan. */
+    quarantine: 0.0,
+};
+/**
+ * Explicit scanner → tier mapping.
+ *
+ * NOT classified here (by design):
+ *   - External tool wrappers (semgrep, gitleaks, trivy, …) inherit the tool's
+ *     own precision; AEGIS doesn't re-assess.
+ *   - Runtime probes (auth-probe, race-probe, …) measure live behavior, not
+ *     static precision.
+ *   - Compliance meta-scanners (gdpr-engine, iso27001-checker, …) aggregate
+ *     findings from underlying scanners; precision inherited.
+ *
+ * New scanners MUST be added here before merge. The `tierOf` function returns
+ * undefined for unclassified scanners, which the precision CLI reports as an
+ * error so merge isn't silently possible.
+ */
+export const SCANNER_TIERS = {
+    // Definitive (80% gate) — signal is objective, high-confidence
+    'entropy-scanner': 'definitive',
+    'gitleaks': 'definitive',
+    'trufflehog': 'definitive',
+    // Pattern (75% gate) — syntax-level pattern matching
+    'cookie-checker': 'pattern',
+    'cors-checker': 'pattern',
+    'header-checker': 'pattern',
+    'crypto-auditor': 'pattern',
+    'config-auditor': 'pattern',
+    'console-checker': 'pattern',
+    'http-timeout-checker': 'pattern',
+    'jwt-checker': 'pattern',
+    'open-redirect-checker': 'pattern',
+    'redos-checker': 'pattern',
+    'timing-safe-checker': 'pattern',
+    'xss-checker': 'pattern',
+    'error-leakage-checker': 'pattern',
+    'rls-bypass-checker': 'pattern',
+    'rsc-data-checker': 'pattern',
+    'license-checker': 'pattern',
+    // v0.6 additions:
+    'next-public-leak': 'pattern',
+    // Taint (70% gate) — AST-based dataflow
+    'taint-analyzer': 'taint',
+    'sql-concat-checker': 'taint',
+    'ssrf-checker': 'taint',
+    'path-traversal-checker': 'taint',
+    // Heuristic (60% gate) — context-heavy "missing X guard"-style signals
+    'auth-enforcer': 'heuristic',
+    'rate-limit-checker': 'heuristic',
+    'tenant-isolation-checker': 'heuristic',
+    'mass-assignment-checker': 'heuristic',
+    'pagination-checker': 'heuristic',
+    'zod-enforcer': 'heuristic',
+    'csrf-checker': 'heuristic',
+    'env-validation-checker': 'heuristic',
+    'logging-checker': 'heuristic',
+    'upload-validator': 'heuristic',
+    'prompt-injection-checker': 'heuristic',
+    'supply-chain': 'heuristic',
+    'react-doctor': 'heuristic',
+    'dep-confusion-checker': 'heuristic',
+    'i18n-quality': 'heuristic',
+};
+/** Look up a scanner's tier. Returns undefined for unclassified/external/probe. */
+export function tierOf(scannerName) {
+    return SCANNER_TIERS[scannerName];
+}
+/** Return the precision gate for a scanner, or undefined if unclassified. */
+export function gateFor(scannerName) {
+    const tier = tierOf(scannerName);
+    return tier !== undefined ? PRECISION_GATES[tier] : undefined;
+}
+/**
+ * Check whether a measured precision passes the scanner's tier gate.
+ * Returns false if scanner is unclassified (must be explicit before merge).
+ */
+export function passesPrecisionGate(scannerName, precision) {
+    const gate = gateFor(scannerName);
+    return gate !== undefined && precision >= gate;
+}
+//# sourceMappingURL=precision-tiers.js.map

package/dist/precision-tiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"precision-tiers.js","sourceRoot":"","sources":["../src/precision-tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAkC;IAC5D,gFAAgF;IAChF,UAAU,EAAE,IAAI;IAChB,8DAA8D;IAC9D,OAAO,EAAK,IAAI;IAChB,mFAAmF;IACnF,KAAK,EAAO,IAAI;IAChB,2EAA2E;IAC3E,SAAS,EAAG,IAAI;IAChB,6EAA6E;IAC7E,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2C;IACnE,+DAA+D;IAC/D,iBAAiB,EAAW,YAAY;IACxC,UAAU,EAAkB,YAAY;IACxC,YAAY,EAAgB,YAAY;IAExC,qDAAqD;IACrD,gBAAgB,EAAY,SAAS;IACrC,cAAc,EAAc,SAAS;IACrC,gBAAgB,EAAY,SAAS;IACrC,gBAAgB,EAAY,SAAS;IACrC,gBAAgB,EAAY,SAAS;IACrC,iBAAiB,EAAW,SAAS;IACrC,sBAAsB,EAAM,SAAS;IACrC,aAAa,EAAe,SAAS;IACrC,uBAAuB,EAAK,SAAS;IACrC,eAAe,EAAa,SAAS;IACrC,qBAAqB,EAAO,SAAS;IACrC,aAAa,EAAe,SAAS;IACrC,uBAAuB,EAAK,SAAS;IACrC,oBAAoB,EAAQ,SAAS;IACrC,kBAAkB,EAAU,SAAS;IACrC,iBAAiB,EAAW,SAAS;IACrC,kBAAkB;IAClB,kBAAkB,EAAU,SAAS;IAErC,wCAAwC;IACxC,gBAAgB,EAAY,OAAO;IACnC,oBAAoB,EAAQ,OAAO;IACnC,cAAc,EAAc,OAAO;IACnC,wBAAwB,EAAI,OAAO;IAEnC,uEAAuE;IACvE,eAAe,EAAa,WAAW;IACvC,oBAAoB,EAAQ,WAAW;IACvC,0BAA0B,EAAE,WAAW;IACvC,yBAAyB,EAAG,WAAW;IACvC,oBAAoB,EAAQ,WAAW;IACvC,cAAc,EAAc,WAAW;IACvC,cAAc,EAAc,WAAW;IACvC,wBAAwB,EAAI,WAAW;IACvC,iBAAiB,EAAW,WAAW;IACvC,kBAAkB,EAAU,WAAW;IACvC,0BAA0B,EAAE,WAAW;IACvC,cAAc,EAAc,WAAW;IACvC,cAAc,EAAc,WAAW;IACvC,uBAAuB,EAAK,WAAW;IACvC,cAAc,EAAc,WAAW;CACxC,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,WAAmB;IACxC,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,SAAiB;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC;AACjD,CAAC"}

package/dist/suppression-filter.d.ts

@@ -0,0 +1,38 @@
+import type { AegisConfig, Finding, SuppressionEntry } from './types.js';
+/**
+ * Convert a user-provided glob to a RegExp.
+ *
+ * Supported tokens:
+ *   - `**`       — zero or more path segments (crosses `/`)
+ *   - `*`        — zero or more characters in a single segment (no `/`)
+ *   - `?`        — exactly one character (no `/`)
+ *   - everything else is literal
+ *
+ * Leading `/` in the glob is treated literally (don't confuse absolute paths
+ * — inputs are always POSIX-normalized relative paths inside the orchestrator).
+ */
+export declare function globToRegex(glob: string): RegExp;
+/**
+ * Check whether a config-level suppression entry covers the given finding.
+ */
+export declare function configSuppressionMatches(entry: SuppressionEntry, relPath: string, scannerName: string, cwe: number | undefined): boolean;
+export interface SuppressionStats {
+    suppressedByInline: number;
+    suppressedByConfig: number;
+    nakedWarnings: string[];
+    unusedWarnings: string[];
+}
+/**
+ * Filter findings by suppressions. Returns kept findings + diagnostic stats.
+ * Caller is responsible for emitting nakedWarnings/unusedWarnings if desired.
+ *
+ * @param scannedFiles  Optional list of all files that scanners visited. When
+ *   provided AND `warnUnused !== false`, suppressions in these files are
+ *   checked even if the file produced zero findings (catches stale
+ *   suppressions left behind after refactors).
+ */
+export declare function applyPipelineSuppressions(findings: Finding[], config: AegisConfig, scannedFiles?: string[]): {
+    kept: Finding[];
+    stats: SuppressionStats;
+};
+//# sourceMappingURL=suppression-filter.d.ts.map

package/dist/suppression-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-filter.d.ts","sourceRoot":"","sources":["../src/suppression-filter.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAUzE;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBhD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,OAAO,CAST;AAED,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,WAAW,EACnB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB;IAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAuF9C"}

package/dist/suppression-filter.js

@@ -0,0 +1,147 @@
+/**
+ * Pipeline-level suppression filter.
+ *
+ * Applied by the Orchestrator AFTER all scanners have produced findings and
+ * AFTER dedup. This makes suppressions cross-cutting: they affect every
+ * scanner (auth-enforcer, csrf-checker, header-checker, taint-analyzer, …),
+ * not only the taint-analyzer that originally spoke this DSL.
+ *
+ * Two layers:
+ *   1. Inline  — `// aegis-ignore` comments in source files (finding.line scoped)
+ *   2. Config  — `suppressions[]` in aegis.config.json (file glob + rule scoped)
+ */
+import { relative } from 'node:path';
+import { readFileSafe } from './utils.js';
+import { parseSuppressions, isSuppressed, getUnusedSuppressions, getNakedSuppressions, } from './suppressions.js';
+/**
+ * Convert a user-provided glob to a RegExp.
+ *
+ * Supported tokens:
+ *   - `**`       — zero or more path segments (crosses `/`)
+ *   - `*`        — zero or more characters in a single segment (no `/`)
+ *   - `?`        — exactly one character (no `/`)
+ *   - everything else is literal
+ *
+ * Leading `/` in the glob is treated literally (don't confuse absolute paths
+ * — inputs are always POSIX-normalized relative paths inside the orchestrator).
+ */
+export function globToRegex(glob) {
+    // All transformations use placeholders so that intermediate regex output
+    // (e.g., `.*` from `**`) is not re-matched by later rules (`*` → `[^/]*`).
+    const escaped = glob
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\/\*\*\//g, '__AEGIS_MIDSTAR__')
+        .replace(/^\*\*\//g, '__AEGIS_PRESTAR__')
+        .replace(/\/\*\*$/g, '__AEGIS_POSTSTAR__')
+        .replace(/\*\*/g, '__AEGIS_DOUBLESTAR__')
+        .replace(/\*/g, '__AEGIS_STAR__')
+        .replace(/\?/g, '__AEGIS_QMARK__')
+        .replace(/__AEGIS_MIDSTAR__/g, '/(?:.+/)?')
+        .replace(/__AEGIS_PRESTAR__/g, '(?:.+/)?')
+        .replace(/__AEGIS_POSTSTAR__/g, '(?:/.+)?')
+        .replace(/__AEGIS_DOUBLESTAR__/g, '.*')
+        .replace(/__AEGIS_STAR__/g, '[^/]*')
+        .replace(/__AEGIS_QMARK__/g, '[^/]');
+    return new RegExp('^' + escaped + '$');
+}
+/**
+ * Check whether a config-level suppression entry covers the given finding.
+ */
+export function configSuppressionMatches(entry, relPath, scannerName, cwe) {
+    if (!globToRegex(entry.file).test(relPath))
+        return false;
+    if (entry.rule === undefined)
+        return true; // catch-all for this file
+    if (entry.rule === scannerName)
+        return true;
+    if (cwe !== undefined) {
+        const m = entry.rule.match(/^CWE-(\d+)$/);
+        if (m && Number.parseInt(m[1], 10) === cwe)
+            return true;
+    }
+    return false;
+}
+/**
+ * Filter findings by suppressions. Returns kept findings + diagnostic stats.
+ * Caller is responsible for emitting nakedWarnings/unusedWarnings if desired.
+ *
+ * @param scannedFiles  Optional list of all files that scanners visited. When
+ *   provided AND `warnUnused !== false`, suppressions in these files are
+ *   checked even if the file produced zero findings (catches stale
+ *   suppressions left behind after refactors).
+ */
+export function applyPipelineSuppressions(findings, config, scannedFiles) {
+    const diagnostics = config.suppressionOptions ?? {};
+    const warnUnused = diagnostics.warnUnused !== false;
+    const warnNaked = diagnostics.warnNaked !== false;
+    const configSups = config.suppressions ?? [];
+    const fileCache = new Map();
+    const warnedNakedFiles = new Set();
+    const stats = {
+        suppressedByInline: 0,
+        suppressedByConfig: 0,
+        nakedWarnings: [],
+        unusedWarnings: [],
+    };
+    const kept = [];
+    function getSups(file) {
+        let sups = fileCache.get(file);
+        if (sups !== undefined)
+            return sups;
+        const content = readFileSafe(file);
+        sups = content ? parseSuppressions(content) : [];
+        fileCache.set(file, sups);
+        if (warnNaked && !warnedNakedFiles.has(file)) {
+            warnedNakedFiles.add(file);
+            for (const naked of getNakedSuppressions(sups)) {
+                stats.nakedWarnings.push(`[aegis] Naked suppression in ${file}:${naked.startLine} — please add a reason after '—' so future readers understand WHY.`);
+            }
+        }
+        return sups;
+    }
+    for (const f of findings) {
+        // Inline suppression — per-file comment, finest granularity
+        if (f.file && f.line !== undefined) {
+            const sups = getSups(f.file);
+            if (isSuppressed(f.line, f.cwe, sups)) {
+                stats.suppressedByInline++;
+                continue;
+            }
+        }
+        // Config-level suppression — glob + rule
+        if (configSups.length > 0) {
+            const relPath = f.file
+                ? relative(config.projectPath, f.file).split('\\').join('/')
+                : '';
+            const match = configSups.some((s) => configSuppressionMatches(s, relPath, f.scanner, f.cwe));
+            if (match) {
+                stats.suppressedByConfig++;
+                continue;
+            }
+        }
+        kept.push(f);
+    }
+    if (warnUnused) {
+        // Scan files that produced zero findings but may still contain
+        // stale `// aegis-ignore` directives. Cheap pre-filter: quick substring
+        // check skips files that certainly have no suppressions.
+        if (scannedFiles) {
+            for (const file of scannedFiles) {
+                if (fileCache.has(file))
+                    continue;
+                const content = readFileSafe(file);
+                if (!content || !content.includes('aegis-ignore'))
+                    continue;
+                fileCache.set(file, parseSuppressions(content));
+            }
+        }
+        for (const [file, sups] of fileCache) {
+            for (const u of getUnusedSuppressions(sups)) {
+                stats.unusedWarnings.push(`[aegis] Unused suppression in ${file}:${u.startLine} — ` +
+                    `${u.cwe ? `CWE-${u.cwe}` : 'catch-all'} never matched a finding. Consider removing it.`);
+            }
+        }
+    }
+    return { kept, stats };
+}
+//# sourceMappingURL=suppression-filter.js.map

package/dist/suppression-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-filter.js","sourceRoot":"","sources":["../src/suppression-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI;SACjB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC;SACxC,OAAO,CAAC,UAAU,EAAE,oBAAoB,CAAC;SACzC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC;SACxC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC;SAChC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC;SACjC,OAAO,CAAC,oBAAoB,EAAE,WAAW,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC;SACzC,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC;SAC1C,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC;SACtC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAuB,EACvB,OAAe,EACf,WAAmB,EACnB,GAAuB;IAEvB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IACrE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,MAAmB,EACnB,YAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,KAAK,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC;IAElD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IACnD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,MAAM,KAAK,GAAqB;QAC9B,kBAAkB,EAAE,CAAC;QACrB,kBAAkB,EAAE,CAAC;QACrB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,EAAE;KACnB,CAAC;IAEF,MAAM,IAAI,GAAc,EAAE,CAAC;IAE3B,SAAS,OAAO,CAAC,IAAY;QAC3B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1B,IAAI,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,aAAa,CAAC,IAAI,CACtB,gCAAgC,IAAI,IAAI,KAAK,CAAC,SAAS,oEAAoE,CAC5H,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,4DAA4D;QAC5D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI;gBACpB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CACvD,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,+DAA+D;QAC/D,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAC5D,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,cAAc,CAAC,IAAI,CACvB,iCAAiC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK;oBACvD,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,iDAAiD,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/suppressions.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Inline suppression parsing and matching.
+ *
+ * Syntax:
+ *   // aegis-ignore — reason text                    (applies to NEXT line)
+ *   // aegis-ignore CWE-918 — legitimer proxy call   (CWE-specific, next line)
+ *   /* aegis-ignore-block CWE-78 * /                 (applies until aegis-ignore-end)
+ *   /* aegis-ignore-end * /
+ *
+ * A suppression without a CWE is a catch-all for that line.
+ * A suppression WITH a CWE only matches findings with that exact CWE number.
+ * Reason text is recommended (warned if missing/too short).
+ */
+export interface Suppression {
+    /** 1-indexed line where suppression starts applying. */
+    startLine: number;
+    /** 1-indexed line where suppression stops applying (inclusive). */
+    endLine: number;
+    /** Optional specific CWE; undefined = any CWE on this line. */
+    cwe?: number;
+    /** Free-text reason for the suppression. */
+    reason: string;
+    /** Mutable — flipped to true when a finding matched this suppression. */
+    used: boolean;
+    /** Kind for diagnostics. */
+    kind: 'next-line' | 'block';
+}
+/**
+ * Parse suppression directives from source content.
+ * Returns all suppressions found, including orphan block-starts (which are logged
+ * as warnings later).
+ */
+export declare function parseSuppressions(content: string): Suppression[];
+/**
+ * Return true if the given (line, cwe) is covered by any suppression.
+ * Mutates matching suppression's `used` flag.
+ */
+export declare function isSuppressed(findingLine: number | undefined, findingCwe: number | undefined, suppressions: Suppression[]): boolean;
+/** Return the list of suppressions that were never triggered by a finding. */
+export declare function getUnusedSuppressions(suppressions: Suppression[]): Suppression[];
+/** Return suppressions missing a meaningful reason (fewer than 3 non-space chars). */
+export declare function getNakedSuppressions(suppressions: Suppression[]): Suppression[];
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../src/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;IACd,4BAA4B;IAC5B,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;CAC7B;AAmBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAqEhE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,WAAW,EAAE,GAC1B,OAAO,CAST;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAEhF;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAE/E"}

package/dist/suppressions.js

@@ -0,0 +1,115 @@
+/**
+ * Inline suppression parsing and matching.
+ *
+ * Syntax:
+ *   // aegis-ignore — reason text                    (applies to NEXT line)
+ *   // aegis-ignore CWE-918 — legitimer proxy call   (CWE-specific, next line)
+ *   /* aegis-ignore-block CWE-78 * /                 (applies until aegis-ignore-end)
+ *   /* aegis-ignore-end * /
+ *
+ * A suppression without a CWE is a catch-all for that line.
+ * A suppression WITH a CWE only matches findings with that exact CWE number.
+ * Reason text is recommended (warned if missing/too short).
+ */
+// Accept em-dash (—), en-dash (–), double-dash (--), or single-dash separator.
+// Negative lookahead `(?!-)` prevents `aegis-ignore-block` from matching as a
+// single-line directive with reason="block" (that's what BLOCK_START_RE is for).
+const SINGLE_LINE_RE = /\/\/\s*aegis-ignore(?!-)(?:\s+CWE-(\d+))?\s*(?:[\u2014\u2013]|--|-)?\s*(.*)$/;
+// Block start: /* aegis-ignore-block [CWE-nnn] [— reason] */
+const BLOCK_START_RE = /\/\*\s*aegis-ignore-block(?:\s+CWE-(\d+))?\s*(?:[\u2014\u2013]|--|-)?\s*([^*]*?)\s*\*\//;
+// Block end: /* aegis-ignore-end */
+const BLOCK_END_RE = /\/\*\s*aegis-ignore-end\s*\*\//;
+// Known limitation (v1): these regexes run on raw line text, not TS comment ranges.
+// String literals containing suppression syntax (e.g., `const doc = "// aegis-ignore"`)
+// WILL be matched. Documented — ts.getLeadingCommentRanges migration planned for v2.
+/**
+ * Parse suppression directives from source content.
+ * Returns all suppressions found, including orphan block-starts (which are logged
+ * as warnings later).
+ */
+export function parseSuppressions(content) {
+    const lines = content.split('\n');
+    const suppressions = [];
+    let openBlock = null;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNumber = i + 1;
+        if (openBlock) {
+            if (BLOCK_END_RE.test(line)) {
+                suppressions.push({
+                    startLine: openBlock.startLine,
+                    endLine: lineNumber,
+                    cwe: openBlock.cwe,
+                    reason: openBlock.reason,
+                    used: false,
+                    kind: 'block',
+                });
+                openBlock = null;
+            }
+            continue;
+        }
+        const blockMatch = line.match(BLOCK_START_RE);
+        if (blockMatch) {
+            const cwe = blockMatch[1] ? Number.parseInt(blockMatch[1], 10) : undefined;
+            const reason = (blockMatch[2] ?? '').trim();
+            // Same-line close? `/* aegis-ignore-block */ exec(x); /* aegis-ignore-end */`
+            // Search for BLOCK_END_RE in the text AFTER the block-start match.
+            const afterBlockStart = line.slice(blockMatch.index + blockMatch[0].length);
+            if (BLOCK_END_RE.test(afterBlockStart)) {
+                suppressions.push({
+                    startLine: lineNumber,
+                    endLine: lineNumber,
+                    cwe,
+                    reason,
+                    used: false,
+                    kind: 'block',
+                });
+                continue;
+            }
+            openBlock = { startLine: lineNumber, cwe, reason };
+            continue;
+        }
+        const singleMatch = line.match(SINGLE_LINE_RE);
+        if (singleMatch) {
+            const cwe = singleMatch[1] ? Number.parseInt(singleMatch[1], 10) : undefined;
+            const reason = (singleMatch[2] ?? '').trim();
+            // Applies to the NEXT line (common convention — same as eslint-disable-next-line)
+            suppressions.push({
+                startLine: lineNumber + 1,
+                endLine: lineNumber + 1,
+                cwe,
+                reason,
+                used: false,
+                kind: 'next-line',
+            });
+        }
+    }
+    // Orphan block-start (no end) — leave openBlock discarded; caller can check via logs
+    return suppressions;
+}
+/**
+ * Return true if the given (line, cwe) is covered by any suppression.
+ * Mutates matching suppression's `used` flag.
+ */
+export function isSuppressed(findingLine, findingCwe, suppressions) {
+    if (findingLine === undefined)
+        return false;
+    for (const s of suppressions) {
+        if (findingLine < s.startLine || findingLine > s.endLine)
+            continue;
+        if (s.cwe !== undefined && s.cwe !== findingCwe)
+            continue;
+        s.used = true;
+        return true;
+    }
+    return false;
+}
+/** Return the list of suppressions that were never triggered by a finding. */
+export function getUnusedSuppressions(suppressions) {
+    return suppressions.filter((s) => !s.used);
+}
+/** Return suppressions missing a meaningful reason (fewer than 3 non-space chars). */
+export function getNakedSuppressions(suppressions) {
+    return suppressions.filter((s) => s.reason.replace(/\s/g, '').length < 3);
+}
+//# sourceMappingURL=suppressions.js.map

package/dist/suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../src/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiBH,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,cAAc,GAClB,8EAA8E,CAAC;AAEjF,6DAA6D;AAC7D,MAAM,cAAc,GAClB,yFAAyF,CAAC;AAE5F,oCAAoC;AACpC,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAEtD,oFAAoF;AACpF,wFAAwF;AACxF,qFAAqF;AAErF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,IAAI,SAAS,GAEF,IAAI,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,YAAY,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,OAAO,EAAE,UAAU;oBACnB,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,IAAI,EAAE,KAAK;oBACX,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAE5C,8EAA8E;YAC9E,mEAAmE;YACnE,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7E,IAAI,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACvC,YAAY,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE,UAAU;oBACrB,OAAO,EAAE,UAAU;oBACnB,GAAG;oBACH,MAAM;oBACN,IAAI,EAAE,KAAK;oBACX,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,SAAS,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACnD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,kFAAkF;YAClF,YAAY,CAAC,IAAI,CAAC;gBAChB,SAAS,EAAE,UAAU,GAAG,CAAC;gBACzB,OAAO,EAAE,UAAU,GAAG,CAAC;gBACvB,GAAG;gBACH,MAAM;gBACN,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,WAA+B,EAC/B,UAA8B,EAC9B,YAA2B;IAE3B,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,WAAW,GAAG,CAAC,CAAC,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO;YAAE,SAAS;QACnE,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;YAAE,SAAS;QAC1D,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,YAA2B;IAC/D,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,YAA2B;IAC9D,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/types.d.ts

@@ -14,6 +14,49 @@ export interface Finding {
     owasp?: string;
     cwe?: number;
     reference?: string;
+    /**
+     * True when the finding is about the file AS A WHOLE, not a specific line
+     * (e.g., "this route file lacks an auth guard", "this config lacks a CSP").
+     * Scanners that emit such findings conventionally set `line: 1`, but the
+     * precision-CLI fingerprint must not depend on source context near line 1 —
+     * that context shifts when unrelated edits are made above.
+     *
+     * Set this to `true` on file-level emit sites. The precision CLI uses it to
+     * short-circuit context-window hashing in favor of a stable
+     * `scanner|file|title` identity that survives arbitrary line-drift.
+     *
+     * Optional (backward-compat). Undefined / false means "per-line finding" —
+     * the default behavior remains unchanged.
+     */
+    fileLevel?: boolean;
+    /**
+     * v0.7 Phase 2: true when the finding spans a cross-module call — the
+     * sink was reached via a summary of an exported function declared in a
+     * different file from the one containing the taint source. Consumers
+     * (SARIF reporter, precision CLI) treat this as a signal to emit
+     * `relatedLocations` pointing at {@link crossFileOrigin}.
+     */
+    crossFile?: boolean;
+    /**
+     * v0.7 Phase 2: absolute path of the file declaring the cross-file
+     * function that triggered the finding. Present only when `crossFile:
+     * true`. The SARIF reporter emits this as a `relatedLocations` entry
+     * so GitHub Code Scanning, Azure DevOps, and other SARIF consumers can
+     * jump to the cross-module origin of the vulnerability.
+     */
+    crossFileOrigin?: string;
+    /**
+     * v0.7 Phase 5 calibration lever: per-finding confidence tier,
+     * distinct from the scan-level `AuditResult.confidence`. Scanners
+     * opt in when a finding class has measurement uncertainty that isn't
+     * captured by severity alone. Cross-file findings in v0.7 set
+     * `confidence: 'medium'` pending the n≥20 dogfood measurement that
+     * v0.8 targets — the sample size in the v0.7 pre-tag dogfood (n=2)
+     * was below the plan §3 TBD-3 threshold, so the FP-rate zone is
+     * unmeasurable, not failed. Default (undefined / absent) continues
+     * to mean "scanner's default confidence tier (typically high)".
+     */
+    confidence?: Confidence;
 }
 export interface ScanResult {
     scanner: string;
@@ -42,6 +85,55 @@ export interface DetectedStack {
     hasI18n: boolean;
     hasTests: boolean;
 }
+/**
+ * User-defined taint source (extends built-in TAINT_SOURCES).
+ * Pattern is the exact expression prefix — e.g., `internalCtx.userInput`.
+ */
+export interface CustomSource {
+    pattern: string;
+}
+/**
+ * User-defined sink.
+ * `type` selects which sink registry to extend (call / constructor / property).
+ * `cwe` is required — without it the scanner cannot report a meaningful finding.
+ */
+export interface CustomSink {
+    pattern: string;
+    type?: 'call' | 'constructor' | 'property';
+    cwe: string;
+    severity?: Severity;
+    category?: string;
+}
+/**
+ * User-defined sanitizer — neutralizes taint for the listed CWEs.
+ * If `cwes` is empty, the sanitizer is treated as blocking ALL taint classes.
+ */
+export interface CustomSanitizer {
+    pattern: string;
+    cwes: string[];
+}
+/**
+ * Config-level suppression — glob-matched file filter.
+ * Applies before inline `// aegis-ignore` runs, so this is the coarser layer.
+ */
+export interface SuppressionEntry {
+    /** Glob pattern, relative to projectPath (e.g., `src/legacy/**`). */
+    file: string;
+    /** Optional CWE (`CWE-918`) or scanner-id (`taint-analyzer`) filter. */
+    rule?: string;
+    /** Required — why this suppression exists. */
+    reason: string;
+}
+/**
+ * Options for the inline suppression diagnostic layer.
+ * Controls whether unused/naked suppressions warn on stderr.
+ */
+export interface SuppressionOptions {
+    /** Default true — log a warning for each suppression that never matched. */
+    warnUnused?: boolean;
+    /** Default true — log a warning for suppressions without a reason. */
+    warnNaked?: boolean;
+}
 export interface AegisConfig {
     projectPath: string;
     stack: DetectedStack;
@@ -52,6 +144,20 @@ export interface AegisConfig {
     ignore?: string[];
     target?: string;
     mode: 'scan' | 'audit' | 'pentest' | 'siege' | 'fortress';
+    /** When set, only report findings for files in this list (diff mode). Absolute paths. */
+    diffFiles?: string[];
+    /** User-defined taint sources extending built-in TAINT_SOURCES. */
+    customSources?: CustomSource[];
+    /** User-defined sinks extending built-in TAINT_SINKS/CONSTRUCTOR_SINKS/PROPERTY_SINKS. */
+    customSinks?: CustomSink[];
+    /** User-defined sanitizers extending built-in TAINT_SANITIZER_DEFS. */
+    customSanitizers?: CustomSanitizer[];
+    /** Config-level file/rule suppressions (coarse layer; complements inline `// aegis-ignore`). */
+    suppressions?: SuppressionEntry[];
+    /** Controls stderr diagnostic output for inline suppressions. */
+    suppressionOptions?: SuppressionOptions;
+    /** Opt-in override of built-in security defaults (e.g., PARSE_NOT_SANITIZER). Default false. */
+    allowOverrides?: boolean;
 }
 export type Grade = 'S' | 'A' | 'B' | 'C' | 'D' | 'F';
 export type Badge = 'FORTRESS' | 'HARDENED' | 'SOLID' | 'NEEDS_WORK' | 'AT_RISK' | 'CRITICAL';

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEnF,MAAM,MAAM,YAAY,GACpB,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY,GAAG,SAAS,GAC/D,eAAe,GAAG,aAAa,GAAG,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAClF,QAAQ,CAAC;AAEb,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IACxL,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACtG,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1F,EAAE,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACvE,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACjF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACvG,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;CAC3D;AAED,MAAM,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AACtD,MAAM,MAAM,KAAK,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;AAC9F,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEnF,MAAM,MAAM,YAAY,GACpB,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY,GAAG,SAAS,GAC/D,eAAe,GAAG,aAAa,GAAG,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAClF,QAAQ,CAAC;AAEb,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IACxL,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACtG,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1F,EAAE,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACvE,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACjF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACvG,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;IAC1D,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,mEAAmE;IACnE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,gGAAgG;IAChG,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AACtD,MAAM,MAAM,KAAK,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;AAC9F,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;CACrC"}

package/dist/utils.d.ts

@@ -34,4 +34,9 @@ export declare function walkFiles(dir: string, ignore?: string[], extensions?: s
  * Reads a file, returning null on any failure (file not found, permission denied, etc.).
  */
 export declare function readFileSafe(filePath: string): string | null;
+/**
+ * Get files changed between a base ref and HEAD using `git diff --name-only`.
+ * Returns absolute paths. Throws if git is not available or the ref is invalid.
+ */
+export declare function getChangedFiles(projectPath: string, baseRef: string): string[];
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA2BrB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQrE;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,EAAO,EACrB,UAAU,GAAE,MAAM,EAAO,GACxB,MAAM,EAAE,CAmDV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA2BrB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQrE;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,EAAO,EACrB,UAAU,GAAE,MAAM,EAAO,GACxB,MAAM,EAAE,CAmDV;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW9E"}

package/dist/utils.js

@@ -120,4 +120,17 @@ export function readFileSafe(filePath) {
         return null;
     }
 }
+/**
+ * Get files changed between a base ref and HEAD using `git diff --name-only`.
+ * Returns absolute paths. Throws if git is not available or the ref is invalid.
+ */
+export function getChangedFiles(projectPath, baseRef) {
+    const resolvedPath = path.resolve(projectPath);
+    const result = childProcess.execSync(`git diff --name-only --diff-filter=ACMRT ${baseRef}...HEAD`, { cwd: resolvedPath, encoding: 'utf-8', timeout: 10_000 });
+    return result
+        .trim()
+        .split('\n')
+        .filter((line) => line.length > 0)
+        .map((relativePath) => path.resolve(resolvedPath, relativePath));
+}
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAclC;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAClB,OAAe,EACf,OAAiB,EAAE,EACnB,UAAuB,EAAE;IAEzB,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAEhD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,YAAY,CAAC,QAAQ,CACnB,OAAO,EACP,IAAI,EACJ;YACE,GAAG;YACH,OAAO;YACP,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YACrC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG;SACxB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,IAAK,KAAsC,CAAC,MAAM,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,mEAAmE;YACnE,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,IAAI,EAAE;gBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;gBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE,KAAmC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,SAAmB,EAAE,EACrB,aAAuB,EAAE;IAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAE9E,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,SAAS,IAAI,CAAC,OAAe;QAC3B,oCAAoC;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1C,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,mFAAmF;oBACnF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,CAAC;IAClB,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAclC;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAClB,OAAe,EACf,OAAiB,EAAE,EACnB,UAAuB,EAAE;IAEzB,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAEhD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,YAAY,CAAC,QAAQ,CACnB,OAAO,EACP,IAAI,EACJ;YACE,GAAG;YACH,OAAO;YACP,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YACrC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG;SACxB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,IAAK,KAAsC,CAAC,MAAM,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,mEAAmE;YACnE,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,IAAI,EAAE;gBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;gBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE,KAAmC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,SAAmB,EAAE,EACrB,aAAuB,EAAE;IAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAE9E,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,SAAS,IAAI,CAAC,OAAe;QAC3B,oCAAoC;QACpC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1C,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,mFAAmF;oBACnF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,CAAC;IAClB,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,OAAe;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAClC,4CAA4C,OAAO,SAAS,EAC5D,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAC1D,CAAC;IACF,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aegis-scan/core",
-  "version": "0.2.0",
+  "version": "0.7.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -19,7 +19,7 @@
     "scoring",
     "scanner"
   ],
-  "description": "AEGIS core engine \u2014 orchestrator, scoring, config",
+  "description": "AEGIS core engine — orchestrator, scoring, config",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -29,11 +29,6 @@
       "types": "./dist/index.d.ts"
     }
   },
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "clean": "rm -rf dist"
-  },
   "dependencies": {
     "zod": "^3.23.0"
   },
@@ -41,5 +36,10 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.1.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
   }
-}
+}