@intentius/chant 0.124.13 → 0.124.14

package/dist/audit/lineage.js

@@ -0,0 +1,91 @@
+export const coreAuditLineage = {
+    AGT002: [
+        { tool: "agent-audit", rule: "auth-bypass/env-secret-in-config", url: "https://raw.githubusercontent.com/piiiico/agent-audit/main/README.md", relation: "equivalent" },
+        { tool: "mcp-audit", rule: "Secrets Detection", url: "https://raw.githubusercontent.com/apisec-inc/mcp-audit/main/README.md", relation: "overlaps" },
+        { tool: "agent-scan", rule: "W008", url: "https://raw.githubusercontent.com/invariantlabs-ai/mcp-scan/main/docs/issue-codes.md", relation: "overlaps" },
+    ],
+    COR020: [
+        { tool: "cfn-lint", rule: "E3004", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3004", relation: "equivalent" },
+    ],
+    EXT001: [
+        { tool: "cfn-lint", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/cfn-schema-specification.md#extending-the-schemas-with-new-keywords", relation: "equivalent" },
+        { tool: "cfn-lint", rule: "E3014", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3014", relation: "equivalent" },
+        { tool: "cfn-lint", rule: "E3021", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3021", relation: "equivalent" },
+    ],
+    NGX001: [
+        { tool: "gixy-ng", rule: "weak_ssl_tls", url: "https://gixy.getpagespeed.com/plugins/weak_ssl_tls/", relation: "overlaps" },
+    ],
+    NGX002: [
+        { tool: "gixy-ng", rule: "weak_ssl_tls", url: "https://gixy.getpagespeed.com/plugins/weak_ssl_tls/", relation: "overlaps" },
+    ],
+    NGX004: [
+        { tool: "gixy", rule: "alias_traversal", url: "https://github.com/yandex/gixy", relation: "equivalent" },
+        { tool: "gixy-ng", rule: "alias_traversal", url: "https://gixy.getpagespeed.com/plugins/aliastraversal/", relation: "equivalent" },
+    ],
+    NGX005: [
+        { tool: "gixy-ng", rule: "status_page_exposed", url: "https://gixy.getpagespeed.com/checks/status-page-exposed/", relation: "overlaps" },
+    ],
+    NGX006: [
+        { tool: "gixy-ng", rule: "version_disclosure", url: "https://gixy.getpagespeed.com/plugins/version_disclosure/", relation: "equivalent" },
+    ],
+    SEC001: [
+        { tool: "gitleaks", rule: "aws-access-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+        { tool: "trufflehog", rule: "aws", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/aws/access_keys/accesskey.go", relation: "overlaps" },
+        { tool: "detect-secrets", rule: "AWSKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/aws.py", relation: "equivalent" },
+    ],
+    SEC002: [
+        { tool: "gitleaks", rule: "generic-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+        { tool: "trufflehog", rule: "aws", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/aws/access_keys/accesskey.go", relation: "overlaps" },
+        { tool: "detect-secrets", rule: "AWSKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/aws.py", relation: "overlaps" },
+    ],
+    SEC003: [
+        { tool: "gitleaks", rule: "github-pat", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+        { tool: "trufflehog", rule: "github", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/github/v2/github.go", relation: "equivalent" },
+        { tool: "detect-secrets", rule: "GitHubTokenDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/github_token.py", relation: "overlaps" },
+    ],
+    SEC004: [
+        { tool: "gitleaks", rule: "slack-bot-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+        { tool: "trufflehog", rule: "slack", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/slack/slack.go", relation: "overlaps" },
+        { tool: "detect-secrets", rule: "SlackDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/slack.py", relation: "overlaps" },
+    ],
+    SEC005: [
+        { tool: "gitleaks", rule: "gcp-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+        { tool: "trufflehog", rule: "googlegemini", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/googlegemini/googlegemini.go", relation: "overlaps" },
+    ],
+    SEC006: [
+        { tool: "gitleaks", rule: "stripe-access-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+        { tool: "trufflehog", rule: "stripe", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/stripe/stripe.go", relation: "overlaps" },
+        { tool: "detect-secrets", rule: "StripeDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/stripe.py", relation: "overlaps" },
+    ],
+    SEC007: [
+        { tool: "gitleaks", rule: "private-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+        { tool: "trufflehog", rule: "privatekey", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/privatekey/privatekey.go", relation: "equivalent" },
+        { tool: "detect-secrets", rule: "PrivateKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/private_key.py", relation: "equivalent" },
+    ],
+    SEC008: [
+        { tool: "gitleaks", rule: "curl-auth-header", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    ],
+    SEC009: [
+        { tool: "detect-secrets", rule: "BasicAuthDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/basic_auth.py", relation: "equivalent" },
+        { tool: "trufflehog", rule: "uri", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/uri/uri.go", relation: "overlaps" },
+        { tool: "gitleaks", rule: "curl-auth-user", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    ],
+    SEC010: [
+        { tool: "detect-secrets", rule: "Base64HighEntropyString", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/high_entropy_strings.py", relation: "overlaps" },
+        { tool: "detect-secrets", rule: "HexHighEntropyString", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/high_entropy_strings.py", relation: "overlaps" },
+        { tool: "gitleaks", rule: "generic-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    ],
+    // TF023 is the one TF id core owns (./terraform-state.ts); the rest of the
+    // family credits its prior art from lexicons/terraform/src/lint/audit-lineage.ts.
+    // No linter or scanner in #2107's survey checks for committed state, but the
+    // style guide's .gitignore section names the exact files, so the document is
+    // both the authority and the first written statement of the rule.
+    TF023: [
+        {
+            tool: "hashicorp-style-guide",
+            rule: ".gitignore: do not commit terraform.tfstate, terraform.tfstate.* backups, or the .terraform directory",
+            url: "https://developer.hashicorp.com/terraform/language/style#gitignore",
+            relation: "equivalent",
+        },
+    ],
+};

package/dist/audit/nginx.js

@@ -0,0 +1,366 @@
+/**
+ * nginx config audit (#1979, the #446 follow-up) — the second spike-gated
+ * format after Wrangler (PR #1978). nginx's native config is a directive/block
+ * DSL no structured-data parser reads, so before this the audit engine could
+ * fetch an estate's `nginx.conf` but not see inside it.
+ *
+ * Follows `wrangler.ts`'s shape exactly: no lexicon plugin, no
+ * `AuditInput`/`classifyFiles` involvement, no npm package. A principled,
+ * dependency-free recursive-descent parser (directives end with `;`, blocks
+ * nest with `{}`, `#` comments, single/double quotes) feeds a fixed check
+ * list; `auditNginxConfigs` is called alongside `auditWranglerConfigs` from
+ * the CLI. Disjoint id namespace (`NGX0xx`), `AuditFinding.lexicon = "nginx"`.
+ *
+ * Detection is two-stage on purpose: the *path* detector is broad (`.conf`
+ * under nginx-ish directories), because `conf.d/`-style names are shared with
+ * unrelated software (systemd drop-ins are `.conf` too) — so a candidate only
+ * produces findings when its parsed form also carries an nginx marker
+ * directive (`http`, `server`, `location`, `upstream`, …). A file that fails
+ * to parse, or parses to something that isn't nginx, contributes nothing:
+ * the audit contract is "runs against any repo," never a crash on odd config.
+ *
+ * Pure: no fs, no network, no Node-only global — Workers-safe (epic #350).
+ */
+/** nginx-ish directories whose `.conf` files are candidates. */
+const NGINX_DIR_RE = /(^|\/)(nginx|conf\.d|sites-available|sites-enabled|snippets)(\/|$)/;
+/** Detector: does this path look like nginx config? (Confirmed by content markers at parse time.) */
+export function isNginxConfigPath(path) {
+    const base = path.split("/").pop() ?? path;
+    if (base === "nginx.conf")
+        return true;
+    return base.endsWith(".conf") && NGINX_DIR_RE.test(path.slice(0, path.length - base.length));
+}
+export class NginxParseError extends Error {
+    constructor(message, line) {
+        super(`${message} (line ${line})`);
+        this.line = line;
+        this.name = "NginxParseError";
+    }
+}
+function tokenize(content) {
+    const tokens = [];
+    let i = 0;
+    let line = 1;
+    const n = content.length;
+    while (i < n) {
+        const c = content[i];
+        if (c === "\n") {
+            line++;
+            i++;
+        }
+        else if (c === " " || c === "\t" || c === "\r") {
+            i++;
+        }
+        else if (c === "#") {
+            while (i < n && content[i] !== "\n")
+                i++;
+        }
+        else if (c === "{" || c === "}" || c === ";") {
+            tokens.push({ value: c, line, kind: c });
+            i++;
+        }
+        else if (c === '"' || c === "'") {
+            const quote = c;
+            const startLine = line;
+            let value = "";
+            i++;
+            while (i < n && content[i] !== quote) {
+                if (content[i] === "\\" && i + 1 < n) {
+                    value += content[i + 1];
+                    if (content[i + 1] === "\n")
+                        line++;
+                    i += 2;
+                }
+                else {
+                    if (content[i] === "\n")
+                        line++;
+                    value += content[i];
+                    i++;
+                }
+            }
+            if (i >= n)
+                throw new NginxParseError("Unterminated quoted string", startLine);
+            i++; // closing quote
+            tokens.push({ value, line: startLine, kind: "word" });
+        }
+        else {
+            const start = i;
+            const startLine = line;
+            while (i < n && !' \t\r\n#{};"\''.includes(content[i]))
+                i++;
+            tokens.push({ value: content.slice(start, i), line: startLine, kind: "word" });
+        }
+    }
+    return tokens;
+}
+/** Parse nginx config into a directive tree. Throws `NginxParseError` on malformed input. */
+export function parseNginx(content) {
+    const tokens = tokenize(content);
+    let pos = 0;
+    function parseDirectives(depth) {
+        const out = [];
+        while (pos < tokens.length) {
+            const tok = tokens[pos];
+            if (tok.kind === "}") {
+                if (depth === 0)
+                    throw new NginxParseError("Unexpected '}'", tok.line);
+                pos++;
+                return out;
+            }
+            if (tok.kind !== "word")
+                throw new NginxParseError(`Unexpected '${tok.value}'`, tok.line);
+            const name = tok.value;
+            const line = tok.line;
+            pos++;
+            const args = [];
+            for (;;) {
+                if (pos >= tokens.length)
+                    throw new NginxParseError(`Directive "${name}" is never terminated`, line);
+                const next = tokens[pos];
+                if (next.kind === "word") {
+                    args.push(next.value);
+                    pos++;
+                }
+                else if (next.kind === ";") {
+                    pos++;
+                    out.push({ name, args, line });
+                    break;
+                }
+                else if (next.kind === "{") {
+                    pos++;
+                    out.push({ name, args, line, block: parseDirectives(depth + 1) });
+                    break;
+                }
+                else {
+                    throw new NginxParseError(`Unexpected '}' inside directive "${name}"`, next.line);
+                }
+            }
+        }
+        if (depth > 0)
+            throw new NginxParseError("Unclosed '{'", tokens[tokens.length - 1]?.line ?? 1);
+        return out;
+    }
+    return parseDirectives(0);
+}
+// ── Walk helpers ────────────────────────────────────────────────────────────
+/** Directive names that confirm a parsed `.conf` is actually nginx. */
+const NGINX_MARKERS = new Set(["http", "server", "location", "upstream", "events", "stream", "listen", "proxy_pass", "server_name"]);
+function hasNginxMarker(tree) {
+    return tree.some((d) => NGINX_MARKERS.has(d.name) || (d.block !== undefined && hasNginxMarker(d.block)));
+}
+/** Depth-first visit of every directive with its ancestor block-name chain. */
+function walk(tree, visit, ancestors = []) {
+    for (const d of tree) {
+        visit(d, ancestors);
+        if (d.block)
+            walk(d.block, visit, [...ancestors, d.name]);
+    }
+}
+// ── NGX001: deprecated TLS protocol enabled ─────────────────────────────────
+const DEPRECATED_TLS = new Set(["sslv2", "sslv3", "tlsv1", "tlsv1.1"]);
+function checkDeprecatedTls(file, tree) {
+    const out = [];
+    walk(tree, (d) => {
+        if (d.name !== "ssl_protocols")
+            return;
+        const bad = d.args.filter((a) => DEPRECATED_TLS.has(a.toLowerCase()));
+        if (bad.length === 0)
+            return;
+        out.push({
+            checkId: "NGX001",
+            severity: "error",
+            message: `ssl_protocols enables ${bad.join(", ")} — protocols with known breaks (POODLE, BEAST) that every current client has moved past. Serve TLSv1.2 and TLSv1.3 only.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: "ssl_protocols",
+            line: d.line,
+        });
+    });
+    return out;
+}
+// ── NGX002: weak cipher suite enabled ───────────────────────────────────────
+const WEAK_CIPHER_RE = /(RC4|DES|MD5|NULL|EXPORT|LOW|aNULL|eNULL)/i;
+function checkWeakCiphers(file, tree) {
+    const out = [];
+    walk(tree, (d) => {
+        if (d.name !== "ssl_ciphers")
+            return;
+        // A cipher string is ':'-separated; an entry starting with '!' is an
+        // exclusion (good), so only positive entries can be findings.
+        const weak = d.args
+            .flatMap((a) => a.split(":"))
+            .filter((s) => s !== "" && !s.startsWith("!") && WEAK_CIPHER_RE.test(s));
+        if (weak.length === 0)
+            return;
+        out.push({
+            checkId: "NGX002",
+            severity: "error",
+            message: `ssl_ciphers enables weak suite(s): ${[...new Set(weak)].join(", ")} — breakable ciphers (RC4/DES/MD5/NULL/EXPORT classes) undermine every connection that negotiates one. Use a modern cipher list.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: "ssl_ciphers",
+            line: d.line,
+        });
+    });
+    return out;
+}
+// ── NGX003: directory listing enabled ───────────────────────────────────────
+function checkAutoindex(file, tree) {
+    const out = [];
+    walk(tree, (d, ancestors) => {
+        if (d.name !== "autoindex" || d.args[0]?.toLowerCase() !== "on")
+            return;
+        out.push({
+            checkId: "NGX003",
+            severity: "warning",
+            message: `autoindex on (${ancestors.join(" > ") || "top level"}) — the directory's full file listing is served to anyone, including files never meant to be enumerated.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: "autoindex",
+            line: d.line,
+        });
+    });
+    return out;
+}
+// ── NGX004: alias path traversal (the gixy classic) ─────────────────────────
+/** Location args end with the prefix; earlier args are modifiers (`=`, `^~`, `~`, `~*`). */
+function locationPrefix(args) {
+    if (args.length === 0)
+        return undefined;
+    const modifiers = args.slice(0, -1);
+    return { prefix: args[args.length - 1], isRegex: modifiers.includes("~") || modifiers.includes("~*") };
+}
+function checkAliasTraversal(file, tree) {
+    const out = [];
+    walk(tree, (d) => {
+        if (d.name !== "location" || !d.block)
+            return;
+        const loc = locationPrefix(d.args);
+        if (!loc || loc.isRegex || loc.prefix.endsWith("/"))
+            return;
+        for (const inner of d.block) {
+            if (inner.name !== "alias")
+                continue;
+            const target = inner.args[0] ?? "";
+            if (!target.endsWith("/"))
+                continue;
+            out.push({
+                checkId: "NGX004",
+                severity: "error",
+                message: `location "${loc.prefix}" (no trailing slash) with alias "${target}" — a request for "${loc.prefix}../" resolves outside the aliased directory (path traversal). End the location prefix with "/" to match the alias.`,
+                file: file.path,
+                lexicon: "nginx",
+                entity: loc.prefix,
+                line: inner.line,
+            });
+        }
+    });
+    return out;
+}
+// ── NGX005: status endpoint with no access restriction ──────────────────────
+function checkOpenStatusEndpoint(file, tree) {
+    const out = [];
+    walk(tree, (d) => {
+        if (d.name !== "location" || !d.block)
+            return;
+        const hasStatus = d.block.some((inner) => inner.name === "stub_status");
+        if (!hasStatus)
+            return;
+        const restricted = d.block.some((inner) => inner.name === "deny" || inner.name === "allow" || inner.name === "auth_basic" || inner.name === "auth_request");
+        if (restricted)
+            return;
+        out.push({
+            checkId: "NGX005",
+            severity: "warning",
+            message: `stub_status in location "${d.args[d.args.length - 1] ?? ""}" with no allow/deny or auth — the server's connection metrics are readable by anyone, a reconnaissance gift.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: "stub_status",
+            line: d.line,
+        });
+    });
+    return out;
+}
+// ── NGX006: server version disclosure (server_tokens not disabled) ──────────
+function checkServerTokens(file, tree) {
+    const http = tree.find((d) => d.name === "http" && d.block);
+    if (!http)
+        return []; // a partial include has no http{} — the main conf is where this belongs
+    let disabled = false;
+    walk(tree, (d) => {
+        if (d.name === "server_tokens" && d.args[0]?.toLowerCase() !== "on")
+            disabled = true;
+    });
+    if (disabled)
+        return [];
+    return [
+        {
+            checkId: "NGX006",
+            severity: "info",
+            message: `server_tokens is not disabled — nginx defaults to advertising its exact version in the Server header and error pages, handing scanners a version to match CVEs against. Add "server_tokens off;" in the http block.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: "http",
+            line: http.line,
+        },
+    ];
+}
+// ── NGX007: access logging disabled at server scope ─────────────────────────
+function checkAccessLogOff(file, tree) {
+    const out = [];
+    walk(tree, (d, ancestors) => {
+        if (d.name !== "access_log" || d.args[0]?.toLowerCase() !== "off")
+            return;
+        // Silencing a single noisy location (favicon, health checks) is normal
+        // practice; going dark at http/server scope is what blocks investigation.
+        const scope = ancestors[ancestors.length - 1] ?? "top level";
+        if (scope === "location")
+            return;
+        out.push({
+            checkId: "NGX007",
+            severity: "info",
+            message: `access_log off at ${scope} scope — no requests are recorded for this ${scope === "server" ? "server" : "configuration"}, which will slow down or block incident investigation.`,
+            file: file.path,
+            lexicon: "nginx",
+            entity: scope,
+            line: d.line,
+        });
+    });
+    return out;
+}
+const CHECKS = [
+    checkDeprecatedTls,
+    checkWeakCiphers,
+    checkAutoindex,
+    checkAliasTraversal,
+    checkOpenStatusEndpoint,
+    checkServerTokens,
+    checkAccessLogOff,
+];
+/**
+ * Audit every nginx config in `files`. Pure with respect to the filesystem
+ * and network. A candidate that fails to parse, or parses to something with
+ * no nginx marker directive (a systemd-style `.conf` in a `conf.d/`),
+ * contributes no findings.
+ */
+export function auditNginxConfigs(files) {
+    const findings = [];
+    for (const file of files) {
+        if (!isNginxConfigPath(file.path))
+            continue;
+        let tree;
+        try {
+            tree = parseNginx(file.content);
+        }
+        catch (err) {
+            if (err instanceof NginxParseError)
+                continue;
+            throw err;
+        }
+        if (!hasNginxMarker(tree))
+            continue;
+        for (const check of CHECKS)
+            findings.push(...check(file, tree));
+    }
+    return findings;
+}

package/dist/audit/prior-art.js

@@ -0,0 +1,132 @@
+/**
+ * Prior art for chant's audit rules.
+ *
+ * Most of what `chant audit` checks has been checked before by a dedicated
+ * open-source tool: zizmor and poutine for GitHub Actions, hadolint for
+ * Dockerfiles, cfn-lint and cfn_nag for CloudFormation, kube-linter and
+ * kube-score for Kubernetes manifests, gitleaks for secrets, and so on. chant's
+ * rules were written independently against the emitted output, but the ideas
+ * are shared, and the people who wrote them down first deserve the credit.
+ *
+ * A rule declares its lineage as `Lineage[]` on its `RuleMeta` entry: which
+ * tool, which upstream rule, where it is documented, and how the two relate.
+ * `PRIOR_ART` is the registry those entries key into, so a tool is named,
+ * linked and licensed once. The audit rules reference renders both, the
+ * markdown and HTML reports credit the tool beside the finding, and the SARIF
+ * and JSON outputs carry the entries verbatim for consumers.
+ *
+ * Lineage is credit, not authority. `authority` (./catalog.ts) is a standard
+ * or vendor document that says a finding matters; lineage is a tool that
+ * checks the same condition. The two are independent: a rule may have either,
+ * both, or neither, and lineage never changes a rule's category or tier.
+ */
+/**
+ * The registry of prior art. Keys are the slugs `Lineage.tool` uses. Populated
+ * from the per-family research recorded in the PR that introduced lineage; the
+ * prior-art sweep (scripts/prior-art-sweep.ts) reads the same table.
+ */
+export const PRIOR_ART = {
+    "checkov": { name: "Checkov", url: "https://www.checkov.io/", license: "Apache-2.0", kind: "scanner" },
+    "kics": { name: "KICS", url: "https://docs.kics.io/", license: "Apache-2.0", kind: "scanner" },
+    "zizmor": { name: "zizmor", url: "https://docs.zizmor.sh/", license: "MIT", kind: "scanner" },
+    "cfn-nag": { name: "cfn_nag", url: "https://github.com/stelligent/cfn_nag", license: "MIT", kind: "scanner" },
+    "gitlab-docs": { name: "GitLab CI/CD YAML reference", url: "https://docs.gitlab.com/ci/yaml/", license: "CC-BY-SA-4.0", kind: "specification" },
+    "guard-rules-registry": { name: "AWS Guard Rules Registry", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry", license: "Apache-2.0", kind: "scanner" },
+    "polaris": { name: "Fairwinds Polaris", url: "https://polaris.docs.fairwinds.com/", license: "Apache-2.0", kind: "scanner" },
+    "kube-linter": { name: "KubeLinter", url: "https://github.com/stackrox/kube-linter", license: "Apache-2.0", kind: "scanner" },
+    "kube-score": { name: "kube-score", url: "https://github.com/zegl/kube-score", license: "MIT", kind: "scanner" },
+    "psrule-azure": { name: "PSRule for Azure", url: "https://azure.github.io/PSRule.Rules.Azure/", license: "MIT", kind: "scanner" },
+    "gcp-policy-library": { name: "Google Cloud Policy Library", url: "https://github.com/GoogleCloudPlatform/policy-library", license: "Apache-2.0", kind: "scanner" },
+    "poutine": { name: "poutine", url: "https://boostsecurityio.github.io/poutine/", license: "Apache-2.0", kind: "scanner" },
+    "scorecard": { name: "OpenSSF Scorecard", url: "https://github.com/ossf/scorecard", license: "Apache-2.0", kind: "scanner" },
+    "cfn-lint": { name: "cfn-lint", url: "https://github.com/aws-cloudformation/cfn-lint", license: "MIT-0", kind: "scanner" },
+    "controlplane-docs": { name: "Control Plane reference documentation", url: "https://docs.controlplane.com", license: "n/a", kind: "specification" },
+    "gitleaks": { name: "gitleaks", url: "https://github.com/gitleaks/gitleaks", license: "MIT", kind: "scanner" },
+    "octoscan": { name: "octoscan", url: "https://github.com/synacktiv/octoscan", license: "GPL-3.0", kind: "scanner" },
+    "detect-secrets": { name: "detect-secrets", url: "https://github.com/Yelp/detect-secrets", license: "Apache-2.0", kind: "scanner" },
+    "actionlint": { name: "actionlint", url: "https://github.com/rhysd/actionlint", license: "MIT", kind: "scanner" },
+    "trufflehog": { name: "TruffleHog", url: "https://github.com/trufflesecurity/trufflehog", license: "AGPL-3.0", kind: "scanner" },
+    "gixy-ng": { name: "gixy-ng (maintained Gixy fork)", url: "https://github.com/dvershinin/gixy", license: "MPL-2.0", kind: "scanner" },
+    "kubesec": { name: "kubesec", url: "https://kubesec.io/", license: "Apache-2.0", kind: "scanner" },
+    "datree": { name: "Datree", url: "https://hub.datree.io/built-in-rules", license: "Apache-2.0", kind: "scanner" },
+    "helm-lint": { name: "helm lint", url: "https://helm.sh/docs/helm/helm_lint/", license: "Apache-2.0", kind: "vendor-validator" },
+    "cedar-validator": { name: "Cedar policy validator", url: "https://docs.cedarpolicy.com/policies/validation.html", license: "Apache-2.0", kind: "vendor-validator" },
+    "flux-docs": { name: "Flux Kustomization API reference", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/", license: "n/a", kind: "specification" },
+    "hadolint": { name: "hadolint", url: "https://github.com/hadolint/hadolint", license: "GPL-3.0", kind: "scanner" },
+    "agent-audit": { name: "agent-audit", url: "https://github.com/piiiico/agent-audit", license: "MIT", kind: "scanner" },
+    "arm-ttk": { name: "ARM Template Toolkit (arm-ttk)", url: "https://github.com/Azure/arm-ttk", license: "MIT", kind: "scanner" },
+    "bicep-linter": { name: "Bicep linter", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter", license: "MIT", kind: "scanner" },
+    "cedar-cli": { name: "Cedar CLI", url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli", license: "Apache-2.0", kind: "vendor-validator" },
+    "dockle": { name: "Dockle", url: "https://github.com/goodwithtech/dockle", license: "Apache-2.0", kind: "scanner" },
+    "mcp-audit": { name: "mcp-audit (APIsec)", url: "https://github.com/apisec-inc/mcp-audit", license: "MIT", kind: "scanner" },
+    "render-docs": { name: "Render Blueprint YAML reference", url: "https://render.com/docs/blueprint-spec", license: "n/a", kind: "specification" },
+    "agent-scan": { name: "Snyk Agent Scan (formerly mcp-scan)", url: "https://github.com/invariantlabs-ai/mcp-scan", license: "Apache-2.0", kind: "scanner" },
+    "cedar-docs": { name: "Cedar policy language reference", url: "https://docs.cedarpolicy.com/policies/json-format.html", license: "n/a", kind: "specification" },
+    "cedar-policy-crate": { name: "cedar-policy crate (PolicySet loader)", url: "https://docs.rs/cedar-policy/latest/cedar_policy/", license: "Apache-2.0", kind: "vendor-validator" },
+    "chart-testing": { name: "chart-testing (ct)", url: "https://github.com/helm/chart-testing", license: "Apache-2.0", kind: "vendor-validator" },
+    "fly-docs": { name: "Fly Machines API reference", url: "https://fly.io/docs/machines/api/machines-resource/", license: "n/a", kind: "specification" },
+    "gixy": { name: "Gixy", url: "https://github.com/yandex/gixy", license: "MPL-2.0", kind: "scanner" },
+    "kube-bench": { name: "kube-bench", url: "https://github.com/aquasecurity/kube-bench", license: "Apache-2.0", kind: "scanner" },
+    "pluto": { name: "Pluto", url: "https://github.com/FairwindsOps/pluto", license: "Apache-2.0", kind: "scanner" },
+    "choudoufu": { name: "choudoufu", url: "https://github.com/INTENTIUS/choudoufu", license: "MPL-2.0", kind: "scanner" },
+    // Terraform lint family (#2107). Registry entries recorded in
+    // lexicons/terraform/src/lint/audit-lineage.ts's header comment; added here
+    // the first time a shipped rule cites them (#2109).
+    "tflint-ruleset-terraform": { name: "tflint-ruleset-terraform", url: "https://github.com/terraform-linters/tflint-ruleset-terraform", license: "MPL-2.0", kind: "scanner" },
+    "terraform-sentinel-policies": { name: "HashiCorp reference Sentinel policies", url: "https://github.com/hashicorp/terraform-sentinel-policies", license: "MPL-2.0", kind: "specification" },
+    "hashicorp-style-guide": { name: "HashiCorp Terraform style guide", url: "https://developer.hashicorp.com/terraform/language/style", license: "n/a", kind: "specification" },
+    "aws-terraform-prescriptive-guidance": { name: "AWS prescriptive guidance for Terraform", url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/", license: "n/a", kind: "specification" },
+    // A multi-page series; a credit cites the specific page and fragment, not
+    // this landing URL. First cited by TF014 and TF015 (#2112).
+    "gcp-terraform-best-practices": { name: "Google Cloud Terraform best-practices series", url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure", license: "n/a", kind: "specification" },
+    "tflint-ruleset-redeploy": { name: "tflint-ruleset-redeploy", url: "https://github.com/RedeployAB/tflint-ruleset-redeploy", license: "0BSD", kind: "scanner" },
+    "tflint-ruleset-avm": { name: "tflint-ruleset-avm (Azure Verified Modules)", url: "https://github.com/Azure/tflint-ruleset-avm", license: "MIT", kind: "scanner" },
+    // tfsec is frozen rather than archived, and its docs site 404s above v0.61.x,
+    // so its credits cite pinned repository paths (a tag or `master`), never the
+    // docs site. The three `general/secrets` checks chant credits live only here:
+    // trivy dropped them when it absorbed tfsec.
+    "tfsec": { name: "tfsec", url: "https://github.com/aquasecurity/tfsec", license: "MIT", kind: "scanner" },
+    "trivy-checks": { name: "trivy-checks", url: "https://github.com/aquasecurity/trivy-checks", license: "MIT", kind: "scanner" },
+    // Semgrep's engine is LGPL-2.1 but its rules are not: they ship under the
+    // proprietary Semgrep Rules License v1.0, which forbids redistribution. So
+    // this entry carries no SPDX id, and no semgrep rule text is ever copied into
+    // this repository — a credit by name and link is the whole of it (#2107).
+    "semgrep": { name: "Semgrep Registry rules", url: "https://github.com/semgrep/semgrep-rules", license: "Semgrep Rules License v1.0 (proprietary, not an SPDX id)", kind: "scanner" },
+    // Prometheus and Grafana observability family (#2916). promtool and amtool
+    // ship in the Prometheus and Alertmanager repositories and have no per-rule
+    // ids: credits to them name the check (`check rules`, `check-config`) in the
+    // lineage file's comments and omit `rule`.
+    "promtool": { name: "promtool check rules", url: "https://prometheus.io/docs/prometheus/latest/command-line/promtool/#promtool-check-rules", license: "Apache-2.0", kind: "vendor-validator" },
+    "amtool": { name: "amtool check-config", url: "https://github.com/prometheus/alertmanager/blob/main/cmd/amtool/check_config.go", license: "Apache-2.0", kind: "vendor-validator" },
+    "pint": { name: "pint (Cloudflare)", url: "https://github.com/cloudflare/pint", license: "Apache-2.0", kind: "scanner" },
+    "dashboard-linter": { name: "Grafana dashboard-linter", url: "https://github.com/grafana/dashboard-linter", license: "Apache-2.0", kind: "scanner" },
+    // Postgres schema and migration checks (#3285). squawk and strong_migrations
+    // are migration linters; their type rules overlap schema-level checks. The
+    // wiki page is documentation, not a tool.
+    "squawk": { name: "squawk", url: "https://github.com/sbdchd/squawk", license: "Apache-2.0", kind: "scanner" },
+    "strong_migrations": { name: "strong_migrations", url: "https://github.com/ankane/strong_migrations", license: "MIT", kind: "scanner" },
+    "postgres-wiki-dont-do-this": { name: "PostgreSQL wiki: Don't Do This", url: "https://wiki.postgresql.org/wiki/Don%27t_Do_This", license: "n/a", kind: "specification" },
+};
+/**
+ * Attach lineage to a catalog in place. A lexicon keeps its lineage in a
+ * sibling `audit-lineage.ts` (one `Record<ruleId, Lineage[]>`) and calls this
+ * once at the bottom of its `audit-catalog.ts`, so the prose metadata and the
+ * credits stay next to each other but the credits can be regenerated by the
+ * prior-art sweep without touching the rule text. Throws at module load if the
+ * lineage names a rule the catalog does not have: a stale id is a bug, not a
+ * silent no-op.
+ */
+export function applyLineage(catalog, lineage) {
+    for (const [id, entries] of Object.entries(lineage)) {
+        const rule = catalog[id];
+        if (!rule)
+            throw new Error(`audit lineage names ${id}, which this catalog does not define`);
+        if (entries.length > 0)
+            rule.lineage = entries;
+    }
+}
+/** Render one lineage entry as "tool rule (relation)" for prose contexts. */
+export function lineageLabel(l) {
+    const tool = PRIOR_ART[l.tool]?.name ?? l.tool;
+    return l.rule ? `${tool} ${l.rule}` : tool;
+}