@intentius/chant 0.7.0 → 0.8.0

package/dist/attrref.d.ts

@@ -0,0 +1,35 @@
+import { INTRINSIC_MARKER, type Intrinsic } from "./intrinsic.js";
+/**
+ * Reference to an attribute of a parent entity.
+ * Lexicon serializers read `getLogicalName()` and `attribute` to produce
+ * their own output format (e.g. CloudFormation `Fn::GetAttr`).
+ */
+export declare class AttrRef implements Intrinsic {
+    readonly [INTRINSIC_MARKER]: true;
+    readonly parent: WeakRef<object>;
+    readonly attribute: string;
+    private logicalName?;
+    constructor(parent: object, attribute: string);
+    /**
+     * Set the logical name for this attribute reference
+     * @internal
+     */
+    _setLogicalName(name: string): void;
+    /**
+     * Get the logical name assigned to this attribute reference.
+     */
+    getLogicalName(): string | undefined;
+    /**
+     * Serialize to a generic envelope. Lexicon-specific serializers should
+     * read `getLogicalName()` and `attribute` directly instead of relying
+     * on this format.
+     * @throws {Error} If logical name has not been set
+     */
+    toJSON(): {
+        __attrRef: {
+            entity: string;
+            attribute: string;
+        };
+    };
+}
+//# sourceMappingURL=attrref.d.ts.map

package/dist/attrref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attrref.d.ts","sourceRoot":"","sources":["../src/attrref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;GAIG;AACH,qBAAa,OAAQ,YAAW,SAAS;IACvC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,WAAW,CAAC,CAAS;gBAEjB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAK7C;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAInC;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS;IAIpC;;;;;OAKG;IACH,MAAM,IAAI;QAAE,SAAS,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAU/D"}

package/dist/audit/catalog.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Rule catalog — classifies every CI post-synth check the auditor can surface.
+ *
+ * Two axes drive how a finding is presented:
+ *  - `tier`: `merge-worthy` (a security vuln/supply-chain exposure or a hard
+ *    correctness bug — worth opening a PR to the target) vs `report-only`
+ *    (hygiene/style/perf/deprecation — shown in the report, never a PR title).
+ *  - `fixKind`: `deterministic` (a safe mechanical fix can be auto-applied or
+ *    diffed) vs `guidance` (needs human/LLM judgment — emit remediation text
+ *    only; never auto-applied; never run by the hosted service).
+ *
+ * The catalog covers exactly the post-synth checks run by the audit across all
+ * lexicons (CI: GHA/WGL/WFJ; IaC and manifests: WK8/WAW/AZR/WGC/WHM/DKRD/ARGO).
+ * A drift-guard test asserts it stays in sync with the lexicons, and that every
+ * entry has a `category`.
+ */
+export type Tier = "merge-worthy" | "report-only";
+/** deterministic = safe auto-fix/diff; guidance = report text only (needs judgment). */
+export type FixKind = "deterministic" | "guidance";
+/**
+ * What kind of finding this is — orthogonal to `tier` (fix confidence). Lets the
+ * report say "N security, M best-practice, K correctness" instead of branding
+ * everything "security." `security` = exposure/vuln/supply-chain; `correctness`
+ * = a structural bug (broken reference, invalid schema, never-runs); everything
+ * else is `best-practice` (hygiene/style/deprecation/reliability).
+ */
+export type Category = "security" | "correctness" | "best-practice";
+export interface Authority {
+    name: string;
+    url: string;
+}
+export interface RuleMeta {
+    id: string;
+    tier: Tier;
+    fixKind: FixKind;
+    /** What kind of finding this is (security / correctness / best-practice). */
+    category: Category;
+    title: string;
+    /** External backing so a finding isn't just chant's opinion. */
+    authority?: Authority[];
+    /** One-line fix guidance (always present). */
+    remediation: string;
+    /**
+     * False if the check reads the chant model (`ctx.entities`) rather than the
+     * emitted YAML (`ctx.outputs`) — such a check won't fire on audited YAML.
+     * All current post-synth checks are output-based, so this is true.
+     */
+    yamlBased: boolean;
+}
+/**
+ * Finding category per rule (#415). Curated: security rules are those that
+ * cite an authority or guard an exposure; correctness rules flag structural
+ * bugs (broken references, invalid schema, never-runs); the rest are
+ * best-practice. A drift test asserts this covers every catalogued rule.
+ */
+export declare const RULE_CATEGORY: Record<string, Category>;
+/** Every audited post-synth check, keyed by id. */
+export declare const RULE_CATALOG: Record<string, RuleMeta>;
+/** Look up catalog metadata for a check id, if known. */
+export declare function ruleMeta(id: string): RuleMeta | undefined;
+/** Docs path for the audit rules reference (one anchor per rule id). */
+export declare const RULES_DOC_PATH = "/chant/lint-rules/audit-rules/";
+/** Absolute URL to a rule's entry in the audit rules reference. */
+export declare function ruleDocUrl(id: string): string;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/audit/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/audit/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAiFD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAuNlD,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwOjD,CAAC;AAEF,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/audit/core.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Audit core — run chant's CI security checks against arbitrary repo YAML.
+ *
+ * The post-synth security checks (`lexicons/<lex>/src/lint/post-synth/*.ts`)
+ * read the emitted workflow YAML from `ctx.outputs`, not the chant model
+ * (`ctx.entities`). So an auditor can feed *existing* repo YAML straight in as
+ * a synthetic output and run the real rules — no import-to-chant-model step.
+ *
+ * Each file is audited as its own `primary` output so single-document security
+ * checks (the merge-worthy tier: permissions, pinning, injection, secrets)
+ * fire on every workflow. Cross-file checks (e.g. duplicate workflow names)
+ * only see one file at a time here; that is acceptable because the security
+ * tier is per-document.
+ *
+ * Checks that read `ctx.entities` instead of `ctx.outputs` will not fire on
+ * audited YAML — the security tier is YAML-based, so this is by design.
+ */
+import type { Severity } from "../lint/rule.js";
+import type { PostSynthCheck } from "../lint/post-synth.js";
+/**
+ * The lexicon whose post-synth checks run against an audited file. Any lexicon
+ * name is accepted — `defaultChecksProvider` loads the plugin by name — so a
+ * caller can audit a lexicon outside the built-in set. The listed names are the
+ * ones with built-in content detection (see `discover.ts`), kept here only for
+ * editor autocomplete; `(string & {})` keeps the union open.
+ */
+export type AuditLexicon = "github" | "gitlab" | "forgejo" | "k8s" | "docker" | "aws" | "azure" | "gcp" | "helm" | (string & {});
+/** A single CI file to audit. */
+export interface AuditInput {
+    /** Path used to tag findings (e.g. ".github/workflows/ci.yml"). */
+    path: string;
+    /** Raw content of the file. */
+    content: string;
+    /** Which lexicon's checks to run against it. */
+    lexicon: AuditLexicon;
+    /**
+     * Bundle inputs (e.g. a Helm chart) supply a files map keyed by relative path
+     * — checks that read `output.files` (helm, docker) see the whole bundle.
+     */
+    files?: Record<string, string>;
+}
+/** A finding produced by a post-synth check against an audited file. */
+export interface AuditFinding {
+    checkId: string;
+    severity: Severity;
+    message: string;
+    /** The audited file this finding came from. */
+    file: string;
+    /** The lexicon that produced the finding. */
+    lexicon: string;
+    /** Optional entity (e.g. job name) the check attached. */
+    entity?: string;
+}
+/**
+ * Resolve the post-synth checks for a lexicon. Injectable so the core can be
+ * unit-tested without loading real lexicon packages.
+ */
+export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]>;
+/**
+ * Default provider: load the lexicon plugin(s) and return their post-synth
+ * checks. Forgejo workflows are GitHub-dialect YAML, so the GitHub security
+ * tier is run against them in addition to Forgejo's own checks.
+ */
+/** Thrown when a lexicon package the audit needs isn't installed. */
+export declare class MissingLexiconError extends Error {
+}
+/**
+ * Audit a set of CI files and return all findings. Pure with respect to the
+ * filesystem and network — callers supply file contents.
+ */
+export declare function auditFiles(inputs: AuditInput[], opts?: {
+    checksProvider?: ChecksProvider;
+}): Promise<AuditFinding[]>;
+/** Label for findings that span more than one file (e.g. duplicate names). */
+export declare const CROSS_FILE = "(cross-file)";
+//# sourceMappingURL=core.d.ts.map

package/dist/audit/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/audit/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AAI3E;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,KAAK,GACL,QAAQ,GACR,KAAK,GACL,OAAO,GACP,KAAK,GACL,MAAM,GACN,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAYlF;;;;GAIG;AACH,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAsCjD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,cAAc,CAAA;CAAO,GAC7C,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBzB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,iBAAiB,CAAC"}

package/dist/audit/discover.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Unified, detectTemplate-driven discovery (prototype for #391).
+ *
+ * Today `commands/audit.ts` ships six bespoke discoverers — `discoverManifests`,
+ * `discoverGcp`, `discoverCloudFormation`, `discoverArm`, `discoverDocker`,
+ * `discoverHelm` — each walking the tree and re-implementing a `looksLike*`
+ * content heuristic that mostly duplicates the lexicon plugin's own
+ * `detectTemplate(parsed)` (already used by `chant import`).
+ *
+ * This module collapses that into ONE walk plus a single content-detection
+ * pass that delegates to each plugin's `detectTemplate`. A new content-detected
+ * lexicon then needs only a `detectTemplate` and a precedence entry — no new
+ * walk, no new heuristic.
+ *
+ * It is deliberately a HYBRID, because some classification can't be expressed
+ * by content shape alone:
+ *   - CI (github/forgejo/gitlab) stays a PATH fast-path. github and forgejo
+ *     workflows are byte-for-byte the same shape (`on:` + `jobs:`), so only the
+ *     directory (`.github` vs `.forgejo`) disambiguates them.
+ *   - Dockerfiles are matched by FILENAME — they aren't YAML/JSON, so
+ *     `detectTemplate` (which only knows Compose's `services:`) can't see them.
+ *   - Helm charts are a directory BUNDLE keyed by `Chart.yaml`; the helm checks
+ *     read `output.files`, so the whole chart is one AuditInput.
+ *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
+ *     Connector (`cnrm.cloud.google.com`) resources, so gcp must be tried first.
+ *   - aws/azure checks `JSON.parse` their input, so YAML/templated content is
+ *     normalized to a JSON string here.
+ */
+import type { LexiconPlugin } from "../lexicon.js";
+import type { AuditInput } from "./core.js";
+/** Lexicons the auditor knows how to detect and run checks for. */
+export declare const AUDIT_LEXICONS: readonly ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm"];
+/**
+ * Load the plugins used for detection. Each is loaded in isolation (no
+ * cross-lexicon conflict aggregation — detection only reads `detectTemplate`),
+ * and a lexicon that isn't installed is skipped rather than failing the audit.
+ * `init()` is intentionally not called: `detectTemplate` is a pure function of
+ * its input and needs no plugin setup.
+ */
+export declare function loadAuditPlugins(names?: readonly string[]): Promise<LexiconPlugin[]>;
+/** A repo file (relative POSIX path + content) — the unit both local and remote feed the classifier. */
+export interface RepoFile {
+    path: string;
+    content: string;
+}
+/**
+ * The minimal shape `classifyFiles` needs from a lexicon: its name and (for
+ * content-detected lexicons) its `detectTemplate`. Narrower than `LexiconPlugin`
+ * so an edge caller can build detectors from static `@…/detect` imports without
+ * loading the full plugin (which drags the TypeScript compiler — see #426).
+ */
+export interface DetectPlugin {
+    name: string;
+    detectTemplate?: (data: unknown) => boolean;
+}
+/**
+ * Whether a path is worth reading/fetching at all. Bounds the local walk and,
+ * crucially, the remote fetch (so we never pull a whole repo's contents).
+ */
+export declare function isCandidatePath(path: string): boolean;
+/**
+ * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
+ * (no fs, no network) so the local walk and the remote tree-fetch share exactly
+ * one detection path. Each file maps to at most one lexicon: CI by path,
+ * Dockerfiles by name, Helm charts as a bundle, everything else by the
+ * precedence-ordered content detectors (delegating to each plugin's
+ * `detectTemplate`). Lexicons whose plugin isn't provided are skipped.
+ */
+export declare function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[];
+/**
+ * Local discovery: one filesystem walk, candidate-filtered, read into memory,
+ * then handed to the shared `classifyFiles`. Detection is skipped for any
+ * lexicon whose plugin isn't provided, so a caller can scope discovery.
+ */
+export declare function discoverByDetection(root: string, plugins: LexiconPlugin[]): AuditInput[];
+//# sourceMappingURL=discover.d.ts.map

package/dist/audit/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,QAAQ,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,0FAA2F,CAAC;AAEvH;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAoJD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAUD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMrD;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,UAAU,EAAE,CAWxF"}

package/dist/audit/fetch.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Remote fetch — pull a repo's candidate files (all lexicons) from a git host so
+ * the auditor can run on a URL, not just a local path. This is the ONLY audit
+ * module that touches the network; the core stays pure.
+ *
+ * SSRF posture: only an allowlisted set of hosts is accepted; request URLs are
+ * built from the parsed owner/repo (never a user-controlled host); redirects
+ * are refused; and file count / size / total bytes / time are all capped.
+ */
+import type { AuditLexicon } from "./core.js";
+export interface FetchOptions {
+    /** Branch/tag/sha; defaults to the repo's default branch. */
+    ref?: string;
+    /** Server-side token (lifts rate limits). Never surfaced to callers. */
+    token?: string;
+    /** Max number of files to fetch (default 50). */
+    maxFiles?: number;
+    /** Max bytes for a single file; larger files are skipped (default 256 KiB). */
+    maxBytesPerFile?: number;
+    /** Max total bytes across all files; exceeding throws (default 2 MiB). */
+    maxTotalBytes?: number;
+    /** Per-request timeout in ms (default 10000). */
+    timeoutMs?: number;
+    /** Injectable fetch for testing. Defaults to the global fetch. */
+    fetchImpl?: typeof fetch;
+}
+type HostKind = "github" | "forgejo" | "gitlab";
+interface HostConfig {
+    kind: HostKind;
+    api: string;
+    lexicon: AuditLexicon;
+}
+export declare class FetchError extends Error {
+}
+interface ParsedRepo {
+    host: HostConfig;
+    owner: string;
+    repo: string;
+}
+/** Parse and validate a repo URL against the host allowlist (SSRF guard). */
+export declare function parseRepoUrl(url: string): ParsedRepo;
+/**
+ * Fetch every candidate file in a repo (all lexicons), so a URL audit covers the
+ * same ground as a local one. Returns raw {path, content}; classification (which
+ * needs the lexicon plugins) is the caller's job via `classifyFiles`.
+ */
+export declare function fetchRepoFiles(url: string, opts?: FetchOptions): Promise<Array<{
+    path: string;
+    content: string;
+}>>;
+/**
+ * Resolve an action ref (e.g. action="actions/checkout", ref="v4") to its
+ * commit SHA via the GitHub API. Returns undefined on any failure — pinning
+ * degrades gracefully to guidance. Actions are GitHub-hosted slugs, so this
+ * queries api.github.com regardless of the audited repo's host.
+ */
+export declare function resolveActionSha(action: string, ref: string, opts?: {
+    token?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<string | undefined>;
+interface ImageRef {
+    registry: string;
+    repository: string;
+    tag: string;
+}
+/** Parse a Docker/OCI image reference. Returns undefined if already digested. */
+export declare function parseImageRef(ref: string): ImageRef | undefined;
+/**
+ * Resolve a container image `name:tag` to its `sha256:...` digest via the OCI
+ * registry v2 API (anonymous bearer-token challenge). Returns undefined on any
+ * failure or for a non-allowlisted registry. The image ref is untrusted, so we
+ * only ever contact allowlisted public registries (SSRF guard).
+ */
+export declare function resolveImageDigest(image: string, opts?: {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<string | undefined>;
+/**
+ * Resolve the audited repo's current commit SHA (best-effort) for the report
+ * snapshot, so findings are anchored to an exact commit. Returns undefined on
+ * any failure.
+ */
+export declare function resolveRepoCommit(url: string, opts?: {
+    token?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<string | undefined>;
+export {};
+//# sourceMappingURL=fetch.d.ts.map

package/dist/audit/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/audit/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AASD,KAAK,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAQD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,UAAU,UAAU;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBpD;AAmHD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA6B5H;AAID;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;AAeD,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAsB/D;AAkBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B"}

package/dist/audit/proof.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Proof of minimal change — for a deterministic (fixKind: "deterministic")
+ * finding, produce a minimal patched YAML + unified diff so a PR can show it
+ * changes exactly the flagged line and nothing else.
+ *
+ * No LLM, no API key — purely mechanical text edits. Findings that need
+ * judgment (fixKind: "guidance") are NOT auto-fixed here; they return
+ * `applied: false` with the catalog remediation as guidance. Any LLM-assisted
+ * apply of a guidance fix is a separate, optional, local concern.
+ *
+ * Edits are applied directly to the YAML text (not via a model round-trip), so
+ * the patched output differs only where intended — the diff proves it.
+ */
+export interface ProveOptions {
+    /** Resolve an action ref (e.g. "actions/checkout@v4") to a 40-char SHA. */
+    resolveSha?: (action: string, ref: string) => string | undefined;
+    /** Resolve a container image (e.g. "node:20") to a "sha256:..." digest. */
+    resolveDigest?: (image: string) => string | undefined;
+}
+export interface ProofResult {
+    checkId: string;
+    /** True when a deterministic fix was produced. */
+    applied: boolean;
+    /** Full patched content (only when applied). */
+    patched?: string;
+    /** Unified diff of the change (only when applied). */
+    diff?: string;
+    /** Guidance/explanation when not applied (guidance fix, no-op, or needs-sha). */
+    note?: string;
+    /**
+     * Why the result is what it is:
+     *  - applied: a fix was produced
+     *  - noop: nothing to fix (issue absent, or already resolved by a prior fix)
+     *  - needs-input: deterministic but blocked on external input (e.g. a SHA)
+     *  - guidance: not auto-fixable; needs human judgement
+     */
+    reason: "applied" | "noop" | "needs-input" | "guidance";
+}
+/** Extract unpinned `uses: action@ref` references (deduped) from workflow YAML. */
+export declare function extractUnpinnedActions(content: string): Array<{
+    action: string;
+    ref: string;
+}>;
+/** Extract unpinned `image:` references (deduped) from CI YAML. */
+export declare function extractUnpinnedImages(content: string): string[];
+/**
+ * Produce a deterministic fix + diff for a finding, if one is mechanical.
+ * Returns `applied: false` with guidance for non-deterministic findings.
+ */
+export declare function proveFix(checkId: string, content: string, opts?: ProveOptions): ProofResult;
+/** Render a unified diff with up to `context` equal lines around changes. */
+export declare function unifiedDiff(oldStr: string, newStr: string, context?: number): string;
+//# sourceMappingURL=proof.d.ts.map

package/dist/audit/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/audit/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;CACzD;AAUD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9F;AA4BD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAY/D;AAwCD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,WAAW,CA4C/F;AAqCD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,CAwD/E"}

package/dist/audit/report-html.d.ts

@@ -0,0 +1,32 @@
+/**
+ * HTML report generator (the "expanded" mode) — a self-contained, presentable
+ * report rendered from the shared report model. Inline CSS, no external assets;
+ * opens in a browser and is shareable as a single file. Also the natural output
+ * for the future hosted service.
+ *
+ * Customization: a default template with `{{placeholder}}` slots, overridable
+ * via `template`, plus theme knobs (title, logo, accent, footer).
+ */
+import type { AuditFinding } from "./core.js";
+import { type AuditSnapshot, type BuildModelOptions } from "./report-model.js";
+export type { AuditSnapshot } from "./report-model.js";
+/** Customizable theme knobs filled into the template. */
+export interface ReportTheme {
+    title?: string;
+    /** Logo: a URL (rendered as <img>) or inline text/SVG. */
+    logo?: string;
+    /** CSS color for accents. */
+    accent?: string;
+    /** Footer HTML (defaults to attribution). */
+    footer?: string;
+}
+export interface RenderHtmlOptions extends BuildModelOptions {
+    snapshot?: AuditSnapshot;
+    theme?: ReportTheme;
+    /** Full template override; `{{title}} {{accent}} {{logo}} {{meta}} {{body}} {{footer}}` slots. */
+    template?: string;
+    notes?: string[];
+}
+/** Render an audit report as a self-contained HTML document. */
+export declare function renderHtml(findings: AuditFinding[], opts?: RenderHtmlOptions): string;
+//# sourceMappingURL=report-html.d.ts.map

package/dist/audit/report-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-html.d.ts","sourceRoot":"","sources":["../../src/audit/report-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAqC,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAoF,MAAM,gBAAgB,CAAC;AAEjM,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAgJD,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAoCzF"}

package/dist/audit/report-model.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Shared report model — turns raw findings into the structured shape both the
+ * Markdown and HTML renderers consume, so they can never drift. Computes the
+ * tier split, de-noising, per-file quick-win patches (combined unified diff via
+ * proof.ts), guidance clusters, and severity counts.
+ */
+import type { AuditFinding } from "./core.js";
+import { type Authority, type Category, type FixKind, type RuleMeta, type Tier } from "./catalog.js";
+import { type ProveOptions } from "./proof.js";
+import type { Severity } from "../lint/rule.js";
+/**
+ * Version of the machine-readable JSON report. Stability contract: additive
+ * changes (new fields) keep the same major; renamed/removed fields bump the
+ * major. Consumers should check the major and ignore unknown fields. See
+ * `docs/cli/audit`.
+ */
+export declare const REPORT_SCHEMA_VERSION = "1.0";
+export declare const SEVERITY_WEIGHT: Record<Severity, number>;
+export interface EnrichedFinding extends AuditFinding {
+    meta: RuleMeta;
+}
+/** A per-file quick-win: a combined patch plus any findings still needing input. */
+export interface QuickWinFile {
+    file: string;
+    /** Combined unified diff of the deterministic fixes applied to this file. */
+    diff?: string;
+    /** Rules the diff addresses. */
+    addressed: RuleMeta[];
+    /** Deduped findings that are deterministic but blocked on a value (e.g. a SHA). */
+    needsInput: EnrichedFinding[];
+}
+/** Guidance findings grouped by their primary authority. */
+export interface GuidanceCluster {
+    name: string;
+    url?: string;
+    rules: Array<{
+        meta: RuleMeta;
+        findings: EnrichedFinding[];
+    }>;
+}
+export interface ReportCounts {
+    total: number;
+    quickWin: number;
+    needsReview: number;
+    reportOnly: number;
+    errors: number;
+    warnings: number;
+    infos: number;
+    /** Findings by category (#415) — what kind of issue, not how confident the fix. */
+    security: number;
+    correctness: number;
+    bestPractice: number;
+}
+export interface ReportModel {
+    counts: ReportCounts;
+    quickWins: QuickWinFile[];
+    needsReview: GuidanceCluster[];
+    reportOnly: EnrichedFinding[];
+    /** All shown findings (after de-noise), flat and sorted — for serialization. */
+    findings: EnrichedFinding[];
+}
+/** Provenance snapshot of what was audited (anchors findings to a commit). */
+export interface AuditSnapshot {
+    target: string;
+    host?: string;
+    repo?: string;
+    ref?: string;
+    commit?: string;
+    files: string[];
+    generatedAt: string;
+    toolVersion: string;
+}
+/** A finding flattened for the machine-readable JSON report. */
+export interface SerializedFinding {
+    checkId: string;
+    severity: Severity;
+    message: string;
+    file: string;
+    entity?: string;
+    lexicon: string;
+    tier: Tier;
+    fixKind: FixKind;
+    /** What kind of finding this is (security / correctness / best-practice). */
+    category: Category;
+    title: string;
+    remediation: string;
+    authority: Authority[];
+    /** Link to this rule's entry in the audit rules reference. */
+    docUrl: string;
+}
+/** The versioned machine-readable audit report. */
+export interface AuditReportJson {
+    schemaVersion: string;
+    tool: {
+        name: string;
+        version: string;
+    };
+    snapshot?: AuditSnapshot;
+    summary: ReportCounts;
+    findings: SerializedFinding[];
+}
+export declare function metaFor(id: string): RuleMeta;
+export declare function sortFindings(a: EnrichedFinding, b: EnrichedFinding): number;
+export interface BuildModelOptions {
+    files?: Array<{
+        path: string;
+        content: string;
+    }>;
+    resolveSha?: ProveOptions["resolveSha"];
+    resolveDigest?: ProveOptions["resolveDigest"];
+}
+/** Build the structured report model from raw findings. */
+export declare function buildReportModel(findings: AuditFinding[], opts?: BuildModelOptions): ReportModel;
+/** Build the versioned, machine-readable JSON report (stable contract). */
+export declare function buildReportJson(findings: AuditFinding[], opts?: {
+    snapshot?: AuditSnapshot;
+    toolVersion?: string;
+}): AuditReportJson;
+//# sourceMappingURL=report-model.d.ts.map

package/dist/audit/report-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-model.d.ts","sourceRoot":"","sources":["../../src/audit/report-model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAA4B,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5H,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;GAKG;AAGH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAqC,CAAC;AAO3F,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,mFAAmF;IACnF,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAW5C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAK3E;AAiFD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;CAC/C;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,WAAW,CAuCpG;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,eAAe,CAwBxI"}

package/dist/audit/report.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Markdown report generator (the "minimized" mode) — renders the shared
+ * report model as Markdown that pastes cleanly into a PR or issue.
+ *
+ *  - **Quick wins (deterministic)** lead, per file, with one combined unified
+ *    diff so the report doubles as a ready-to-apply patch.
+ *  - **Needs review (guidance)** and **Report-only (hygiene)** collapse into
+ *    `<details>` so a pasted report opens on the actionable fix.
+ *
+ * For a presentable/branded report, see `renderHtml` (report-html.ts).
+ */
+import type { AuditFinding } from "./core.js";
+import type { ProveOptions } from "./proof.js";
+export interface RenderOptions {
+    /** Repo URL or path shown in the header. */
+    target?: string;
+    /** Audited file contents (path → YAML), enabling inline fix diffs. */
+    files?: Array<{
+        path: string;
+        content: string;
+    }>;
+    /** Resolve an action ref to a SHA so pin fixes can be diffed. */
+    resolveSha?: ProveOptions["resolveSha"];
+    /** Resolve a container image to a digest so image-pin fixes can be diffed. */
+    resolveDigest?: ProveOptions["resolveDigest"];
+    /** Coverage caveats shown near the top (e.g. unresolved GitLab includes). */
+    notes?: string[];
+}
+/** Render an audit report as Markdown. */
+export declare function renderMarkdown(findings: AuditFinding[], opts?: RenderOptions): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/audit/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/audit/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAc5C,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,iEAAiE;IACjE,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAmDD,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAqCzF"}

package/dist/audit/rules-doc.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generator for the audit rules reference docs page. The page is derived from
+ * RULE_CATALOG so report rule-id links always have a target, and a sync test
+ * (rules-doc.test.ts) keeps the committed page in step with the catalog.
+ *
+ * Each rule gets an `### <ID>` heading, which Starlight slugifies to `#<id>`
+ * (lowercased) — the anchor `ruleDocUrl()` links to.
+ */
+/** Render the full audit rules reference page (frontmatter + body). */
+export declare function renderRulesReference(): string;
+//# sourceMappingURL=rules-doc.d.ts.map

package/dist/audit/rules-doc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-doc.d.ts","sourceRoot":"","sources":["../../src/audit/rules-doc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,CAmB7C"}