@hookwarden/engine 0.0.1 → 0.1.1

package/dist/redaction/structural.js

@@ -0,0 +1,37 @@
+// D-39: structural snippet redaction. Literals → typed placeholders; identifiers preserved.
+// Browser-safe: pure string transformation, no Node built-ins.
+// Property-tested: every string literal becomes <STRING:N>; every identifier is unchanged.
+// Sort spans descending by start so we can splice without shifting indices.
+function sortSpans(spans) {
+    return [...spans].sort((a, b) => b.start - a.start);
+}
+function placeholderFor(span, secretPrefixes) {
+    if (span.kind === "secret")
+        return "<SECRET_LITERAL>";
+    if (span.kind === "string") {
+        for (const prefix of secretPrefixes) {
+            if (span.value.startsWith(prefix))
+                return "<SECRET_LITERAL>";
+        }
+        return `<STRING:${span.value.length}>`;
+    }
+    if (span.kind === "number")
+        return "<NUMBER>";
+    if (span.kind === "template")
+        return "<TEMPLATE>";
+    if (span.kind === "regex")
+        return "<REGEX>";
+    // Exhaustiveness: every LiteralKind covered above.
+    const _exhaustive = span.kind;
+    return `<UNKNOWN:${_exhaustive}>`;
+}
+export function redactSnippet(input) {
+    const secretPrefixes = input.secret_literal_prefixes ?? [];
+    let out = input.source_text;
+    for (const span of sortSpans(input.literals)) {
+        const placeholder = placeholderFor(span, secretPrefixes);
+        out = out.slice(0, span.start) + placeholder + out.slice(span.end);
+    }
+    return out;
+}
+//# sourceMappingURL=structural.js.map

package/dist/redaction/structural.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"structural.js","sourceRoot":"","sources":["../../src/redaction/structural.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,+DAA+D;AAC/D,2FAA2F;AAwB3F,4EAA4E;AAC5E,SAAS,SAAS,CAAC,KAAiC;IAClD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB,EAAE,cAAqC;IAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,kBAAkB,CAAC;QAC/D,CAAC;QACD,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC5C,mDAAmD;IACnD,MAAM,WAAW,GAAU,IAAI,CAAC,IAAI,CAAC;IACrC,OAAO,YAAY,WAAqB,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,cAAc,GAAG,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC;IAC3D,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/types/config.d.ts

@@ -0,0 +1,7 @@
+export interface Config {
+    readonly reachability_max_depth: number;
+    readonly scanned_at: string;
+    readonly engine_commit_sha: string | null;
+    readonly total_files_count: number;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,MAAM;IAErB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAExC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC"}

package/dist/types/config.js

@@ -0,0 +1,6 @@
+// D-01: Engine is pure — caller supplies wall clock and git context, engine never reads them.
+// D-34: reachability_max_depth bounds handler reachability walk (default 3 hops).
+// D-38: engine_commit_sha and total_files_count flow through Config into ScanMetadata.
+// ENGINE-06: bounded reachability depth keeps the 30s/50KLOC perf budget achievable.
+export {};
+//# sourceMappingURL=config.js.map

package/dist/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,kFAAkF;AAClF,uFAAuF;AACvF,qFAAqF"}

package/dist/types/finding.d.ts

@@ -0,0 +1,32 @@
+export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type SuppressionSource = "inline" | "ignore" | "baseline";
+export interface SuppressedPayload {
+    readonly source: SuppressionSource;
+    readonly pattern?: string;
+    readonly comment?: string;
+    readonly baselined_at?: string;
+}
+export type Verdict = "verified" | "not-verified" | "manual-review";
+export type FindingId = string;
+export interface SourceLocation {
+    readonly line: number;
+    readonly col: number;
+    readonly end_line: number;
+    readonly end_col: number;
+}
+export interface Finding {
+    readonly id: FindingId;
+    readonly rule_id: string;
+    readonly provider: string;
+    readonly severity: Severity;
+    readonly state: Verdict;
+    readonly file_path: string;
+    readonly location: SourceLocation;
+    readonly snippet: string;
+    readonly handler_id: string | null;
+    readonly primary_location_line_hash: string;
+    readonly message: string;
+    readonly metadata: Readonly<Record<string, string | number | boolean | null>>;
+    readonly suppressed?: SuppressedPayload | null;
+}
+//# sourceMappingURL=finding.d.ts.map

package/dist/types/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/types/finding.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAIvE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,cAAc,GAAG,eAAe,CAAC;AAGpE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAChD"}

package/dist/types/finding.js

@@ -0,0 +1,12 @@
+// D-29: Verdict three-state output.
+// D-30: FindingId is a stable composite hash string.
+// D-37: Composite stable id is sha256 hex from WebCrypto.
+// D-39: snippet is the structurally redacted slice.
+// D-63: Suppressed findings stay in findings[] with a payload describing the source.
+//       Engine emits suppressed = null/undefined; the CLI Phase 4 suppression annotator
+//       populates non-null values. The field is optional so existing engine emit sites
+//       compile unchanged.
+// ENGINE-04: Finding carries fingerprint, file path, line:col, severity, provider,
+//            three-state state field, and redacted snippet.
+export {};
+//# sourceMappingURL=finding.js.map

package/dist/types/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/types/finding.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,qDAAqD;AACrD,0DAA0D;AAC1D,oDAAoD;AACpD,qFAAqF;AACrF,wFAAwF;AACxF,uFAAuF;AACvF,2BAA2B;AAC3B,mFAAmF;AACnF,4DAA4D"}

package/dist/types/handler.d.ts

@@ -0,0 +1,39 @@
+import type { FindingId, SourceLocation, Verdict } from "./finding.ts";
+export type Framework = "express" | "hono" | "fastify" | "nextjs" | "flask" | "fastapi" | "django";
+export type WebhookEvidenceKind = "path_pattern_match" | "signature_header_read" | "sdk_import" | "sdk_verify_call" | "body_as_bytes_or_buffer" | "secret_env_var_reference" | "secret_literal_match";
+export interface WebhookEvidence {
+    readonly kind: WebhookEvidenceKind;
+    readonly provider: string;
+    readonly location: SourceLocation;
+    readonly detail: string;
+}
+export interface ResolvedMiddleware {
+    readonly name: string;
+    readonly import_source: string | null;
+    readonly position: number;
+    readonly location: SourceLocation;
+}
+export interface ReachableSymbol {
+    readonly qualified_name: string;
+    readonly import_source: string | null;
+    readonly hops: number;
+    readonly via: string;
+}
+export interface WebhookHandler {
+    readonly id: string;
+    readonly framework: Framework;
+    readonly framework_version: string | null;
+    readonly route_pattern: string;
+    readonly http_methods: ReadonlyArray<string>;
+    readonly file_path: string;
+    readonly location: SourceLocation;
+    readonly handler_function_name: string | null;
+    readonly provider: string;
+    readonly verification_state: Verdict;
+    readonly evidence: ReadonlyArray<WebhookEvidence>;
+    readonly middleware_chain: ReadonlyArray<ResolvedMiddleware>;
+    readonly reachable_symbols: ReadonlyArray<ReachableSymbol>;
+    readonly findings_ref: ReadonlyArray<FindingId>;
+    readonly redacted_snippet: string;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/types/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/types/handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAGnG,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,uBAAuB,GACvB,YAAY,GACZ,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,GAC1B,sBAAsB,CAAC;AAE3B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC"}

package/dist/types/handler.js

@@ -0,0 +1,7 @@
+// D-32: WebhookEvidence multi-signal model — engine computes, rules query thresholds.
+// D-34: ReachableSymbol bounded-depth reachability set per WebhookHandler.
+// D-36: WebhookHandler shape — every field used by Phase 3 CLI inventory + Phase 8 SaaS dashboard.
+// D-37: WebhookHandler.id derivation locked.
+// D-39: redacted_snippet is structurally redacted.
+export {};
+//# sourceMappingURL=handler.js.map

package/dist/types/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/types/handler.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,2EAA2E;AAC3E,mGAAmG;AACnG,6CAA6C;AAC7C,mDAAmD"}

package/dist/types/index.d.ts

@@ -0,0 +1,7 @@
+export type { Config } from "./config.ts";
+export type { Finding, FindingId, Severity, SourceLocation, SuppressedPayload, SuppressionSource, Verdict, } from "./finding.ts";
+export type { Framework, ReachableSymbol, ResolvedMiddleware, WebhookEvidence, WebhookEvidenceKind, WebhookHandler, } from "./handler.ts";
+export type { ImportEdge, MiddlewareRegistration, ParsedFile, ParseErrorRecord, ProjectModel, } from "./project-model.ts";
+export type { DeclarativeMatcher, MatcherName, PathSeverityOverride, ProviderCatalog, ProviderCatalogEntry, RuleDefinition, RulePredicate, RuleSet, } from "./rule-set.ts";
+export type { ScanMetadata, ScanResult } from "./scan-result.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EACV,OAAO,EACP,SAAS,EACT,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,4 @@
+// Public type surface for @hookwarden/engine. Anything not exported here is internal.
+// Locked by phase-2 plan 01; later plans wire the runtime against these contracts.
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,mFAAmF"}

package/dist/types/project-model.d.ts

@@ -0,0 +1,42 @@
+import type { WebhookHandler } from "./handler.ts";
+export interface ParsedFile {
+    readonly file_path: string;
+    readonly language: "javascript" | "typescript" | "python";
+    readonly dialect: "babel" | "tree-sitter-python";
+    readonly source_text: string;
+    readonly raw_ast: unknown;
+    readonly imports: ReadonlyArray<ImportEdge>;
+    readonly parse_error: ParseErrorRecord | null;
+}
+export interface ParseErrorRecord {
+    readonly message: string;
+    readonly location: {
+        readonly line: number;
+        readonly col: number;
+    };
+    readonly source: "babel" | "tree-sitter";
+}
+export interface ImportEdge {
+    readonly from_file: string;
+    readonly to_module: string;
+    readonly imported_names: ReadonlyArray<{
+        readonly local: string;
+        readonly source: string;
+    }>;
+    readonly is_default: boolean;
+}
+export interface MiddlewareRegistration {
+    readonly file_path: string;
+    readonly framework: WebhookHandler["framework"];
+    readonly app_symbol: string;
+    readonly call_site_position: number;
+    readonly middleware_name: string;
+    readonly import_source: string | null;
+}
+export interface ProjectModel {
+    readonly parsed_files: ReadonlyArray<ParsedFile>;
+    readonly handlers: ReadonlyArray<WebhookHandler>;
+    readonly middleware_registrations: ReadonlyArray<MiddlewareRegistration>;
+    readonly import_graph: ReadonlyArray<ImportEdge>;
+}
+//# sourceMappingURL=project-model.d.ts.map

package/dist/types/project-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-model.d.ts","sourceRoot":"","sources":["../../src/types/project-model.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC/C;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAC;CAC1C;AAGD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACjD,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACzE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAClD"}

package/dist/types/project-model.js

@@ -0,0 +1,5 @@
+// D-25: Hybrid normalization layer — ParsedFile retains raw AST plus normalized concepts.
+// D-26: Normalized layer = WebhookHandler + MiddlewareChain + ImportEdge ONLY in v1.
+// D-27: Parse errors are all-or-nothing — one parse-error Finding per failed file.
+export {};
+//# sourceMappingURL=project-model.js.map

package/dist/types/project-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-model.js","sourceRoot":"","sources":["../../src/types/project-model.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,qFAAqF;AACrF,mFAAmF"}

package/dist/types/rule-set.d.ts

@@ -0,0 +1,42 @@
+import type { Severity, Verdict } from "./finding.ts";
+import type { WebhookHandler } from "./handler.ts";
+import type { ProjectModel } from "./project-model.ts";
+export interface ProviderCatalogEntry {
+    readonly signature_header: ReadonlyArray<string>;
+    readonly sdk_packages: ReadonlyArray<string>;
+    readonly sdk_verify_calls: ReadonlyArray<string>;
+    readonly secret_env_prefix: ReadonlyArray<string>;
+    readonly secret_literal_prefix: ReadonlyArray<string>;
+    readonly conventional_paths: ReadonlyArray<string>;
+}
+export type ProviderCatalog = Readonly<Record<string, ProviderCatalogEntry>>;
+export type MatcherName = "importMissing" | "callMatches" | "argumentEquals" | "middlewareOrder" | "secretLiteralPrefix" | "signatureHeaderRead";
+export interface DeclarativeMatcher {
+    readonly name: MatcherName;
+    readonly args: Readonly<Record<string, string | number | boolean | ReadonlyArray<string>>>;
+}
+export type RulePredicate = (handler: WebhookHandler, model: ProjectModel) => Promise<Verdict | null>;
+export interface PathSeverityOverride {
+    readonly patterns: ReadonlyArray<string>;
+    readonly severity: Severity;
+}
+export interface RuleDefinition {
+    readonly rule_id: string;
+    readonly provider: string;
+    readonly severity: Severity;
+    readonly emits_state: Verdict;
+    readonly message: string;
+    readonly matcher: DeclarativeMatcher | null;
+    readonly predicate_name: string | null;
+    readonly applies_to: ReadonlyArray<WebhookHandler["framework"]> | "all";
+    readonly provider_docs_url: string;
+    readonly path_severity_overrides: ReadonlyArray<PathSeverityOverride> | null;
+}
+export interface RuleSet {
+    readonly schema_version: number;
+    readonly rule_pack_version: string;
+    readonly providers: ProviderCatalog;
+    readonly rules: ReadonlyArray<RuleDefinition>;
+    readonly predicates: Readonly<Record<string, RulePredicate>>;
+}
+//# sourceMappingURL=rule-set.d.ts.map

package/dist/types/rule-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-set.d.ts","sourceRoot":"","sources":["../../src/types/rule-set.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAG7E,MAAM,MAAM,WAAW,GACnB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CAC5F;AAGD,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAI7B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC;IAGxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,uBAAuB,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC9D"}

package/dist/types/rule-set.js

@@ -0,0 +1,6 @@
+// D-03: RuleSet is pre-parsed by the caller; engine never reads YAML.
+// D-28: Declarative matchers + signed TS predicate escape hatch.
+// D-29: Rule emits state directly.
+// D-33: ProviderCatalog ships in @hookwarden/rules; consumed via RuleSet.
+export {};
+//# sourceMappingURL=rule-set.js.map

package/dist/types/rule-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-set.js","sourceRoot":"","sources":["../../src/types/rule-set.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,iEAAiE;AACjE,mCAAmC;AACnC,0EAA0E"}

package/dist/types/scan-result.d.ts

@@ -0,0 +1,19 @@
+import type { Finding } from "./finding.ts";
+import type { WebhookHandler } from "./handler.ts";
+export interface ScanMetadata {
+    readonly engine_version: string;
+    readonly engine_commit_sha: string | null;
+    readonly rule_pack_version: string;
+    readonly rule_pack_content_hash: string;
+    readonly scanned_at: string;
+    readonly parse_errors_count: number;
+    readonly parsed_files_count: number;
+    readonly total_files_count: number;
+    readonly parse_candidates_count: number;
+}
+export interface ScanResult {
+    readonly findings: ReadonlyArray<Finding>;
+    readonly inventory: ReadonlyArray<WebhookHandler>;
+    readonly metadata: ScanMetadata;
+}
+//# sourceMappingURL=scan-result.d.ts.map

package/dist/types/scan-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-result.d.ts","sourceRoot":"","sources":["../../src/types/scan-result.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAGD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC"}

package/dist/types/scan-result.js

@@ -0,0 +1,8 @@
+// D-35: ScanResult bundle shape — atomic snapshot of findings + inventory + metadata.
+// D-38: ScanMetadata fields — every field surfaced through CLI/SaaS for ENGINE-08.
+// D-64: parse_candidates_count is the extension-allowlisted denominator for the CLI-side parse-coverage gate.
+//       Population happens in Plan 09 (packages/cli/src/pipeline.ts) by overriding ScanResult.metadata
+//       after engine.evaluate(...) returns. This preserves engine purity (D-01): the engine never
+//       imports from packages/cli/, never reads the walker's allowlist, never knows the candidate count.
+export {};
+//# sourceMappingURL=scan-result.js.map

package/dist/types/scan-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-result.js","sourceRoot":"","sources":["../../src/types/scan-result.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,mFAAmF;AACnF,8GAA8G;AAC9G,uGAAuG;AACvG,kGAAkG;AAClG,yGAAyG"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const ENGINE_VERSION = "0.0.1";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,UAAU,CAAC"}

package/dist/version.js

@@ -0,0 +1,5 @@
+// Single source of truth for engine version. Changesets keeps this in lockstep with
+// package.json (D-05). Update both fields at the same commit. Plan 02-09 adds a CI gate
+// that asserts they match.
+export const ENGINE_VERSION = "0.0.1";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wFAAwF;AACxF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookwarden/engine",
-  "version": "0.0.1",
+  "version": "0.1.1",
   "description": "hookwarden audit engine — browser-safe, pure-functional. Performs zero I/O.",
   "license": "Apache-2.0",
   "type": "module",
@@ -18,13 +18,27 @@
     "LICENSE"
   ],
   "publishConfig": {
-    "access": "public",
-    "provenance": false
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Hookwarden/hookwarden.git",
+    "directory": "packages/engine"
   },
-  "repository": "github:hookwarden/hookwarden",
   "engines": {
     "node": ">=22.0.0"
   },
+  "dependencies": {
+    "@babel/parser": "^7.29.3",
+    "picomatch": "^4.0.4",
+    "web-tree-sitter": "^0.26.8"
+  },
+  "devDependencies": {
+    "@babel/types": "^7.29.0",
+    "@types/picomatch": "^4.0.3",
+    "fast-check": "^3.23.0",
+    "tree-sitter-python": "^0.25.0"
+  },
   "scripts": {
     "test": "vitest run"
   }