@kevinrabun/judges 3.115.0 → 3.115.2

package/dist/commands/privilege-path.js

@@ -0,0 +1,233 @@
+/**
+ * Privilege path — model authorization flows to find privilege-escalation paths.
+ */
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, extname } from "path";
+// ─── File Collection ────────────────────────────────────────────────────────
+const CODE_EXTS = new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", ".rs"]);
+function collectFiles(dir, max = 300) {
+    const files = [];
+    function walk(d) {
+        if (files.length >= max)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(d);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (files.length >= max)
+                return;
+            if (e.startsWith(".") || e === "node_modules" || e === "dist" || e === "build")
+                continue;
+            const full = join(d, e);
+            try {
+                if (statSync(full).isDirectory())
+                    walk(full);
+                else if (CODE_EXTS.has(extname(full)))
+                    files.push(full);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    walk(dir);
+    return files;
+}
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeFile(filepath) {
+    const issues = [];
+    let content;
+    try {
+        content = readFileSync(filepath, "utf-8");
+    }
+    catch {
+        return issues;
+    }
+    const lines = content.split("\n");
+    const fullText = content;
+    // Detect route/endpoint definitions
+    const isRouteFile = /(?:router|app)\.\s*(?:get|post|put|delete|patch|all)\s*\(|@(?:GET|POST|PUT|DELETE|PATCH|Controller|RequestMapping)/i.test(fullText);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Route without auth middleware
+        if (/(?:router|app)\.\s*(?:get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]/.test(line)) {
+            const routeMatch = line.match(/(?:router|app)\.\s*(?:get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]/);
+            if (routeMatch) {
+                const route = routeMatch[1];
+                const block = lines.slice(i, Math.min(i + 3, lines.length)).join("\n");
+                // Skip public routes
+                if (!/(?:health|status|ping|public|login|register|signup|webhook|callback)/i.test(route)) {
+                    if (!/auth|authenticate|authorize|requireAuth|isAuthenticated|passport|guard|protect|jwt|token|session/i.test(block)) {
+                        issues.push({
+                            file: filepath,
+                            line: i + 1,
+                            issue: "Route without authentication middleware",
+                            severity: "high",
+                            detail: `${route} — no auth middleware detected; endpoint may be publicly accessible`,
+                        });
+                    }
+                }
+            }
+        }
+        // IDOR: user ID from request used directly in query
+        if (/(?:req\.params|req\.query|req\.body|request\.\w+)\.\s*(?:id|userId|user_id)/i.test(line)) {
+            const block = lines.slice(i, Math.min(i + 8, lines.length)).join("\n");
+            if (/(?:findById|findOne|where|SELECT|DELETE|UPDATE)\s*\(/i.test(block)) {
+                if (!/req\.user|currentUser|session\.user|token\.sub|auth\.user/i.test(block)) {
+                    issues.push({
+                        file: filepath,
+                        line: i + 1,
+                        issue: "Potential IDOR — user ID from request without ownership check",
+                        severity: "high",
+                        detail: "User-supplied ID used in query without verifying ownership — attacker can access other users' data",
+                    });
+                }
+            }
+        }
+        // Role check using string comparison (fragile)
+        if (/role\s*===?\s*['"]admin['"]|role\s*===?\s*['"]superadmin['"]/i.test(line)) {
+            if (!/enum|const\s+ROLES|Role\./i.test(fullText)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Role check with magic string",
+                    severity: "medium",
+                    detail: "Role comparison uses magic string — use enum/constant to prevent typo-based bypass",
+                });
+            }
+        }
+        // Privilege escalation: self-assign role
+        if (/role|isAdmin|is_admin|permissions/i.test(line) && /req\.body|request\.body/i.test(line)) {
+            issues.push({
+                file: filepath,
+                line: i + 1,
+                issue: "Role/permission from user input",
+                severity: "high",
+                detail: "Role or permission value taken from request body — user can self-escalate privileges",
+            });
+        }
+        // Missing authorization on destructive operations
+        if (/\.(?:delete|destroy|remove|drop|truncate)\s*\(/i.test(line) && isRouteFile) {
+            const contextBlock = lines.slice(Math.max(0, i - 10), i + 1).join("\n");
+            if (!/authorize|permission|role|isAdmin|canDelete|allowed/i.test(contextBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Destructive operation without authorization check",
+                    severity: "high",
+                    detail: "Delete/destroy called without prior authorization — any authenticated user may execute it",
+                });
+            }
+        }
+        // JWT token without signature verification
+        if (/jwt\.decode\s*\(/.test(line)) {
+            if (!/jwt\.verify|jsonwebtoken.*verify/i.test(fullText)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "JWT decoded without verification",
+                    severity: "high",
+                    detail: "jwt.decode() does NOT verify signature — use jwt.verify() to prevent token forgery",
+                });
+            }
+        }
+        // Hardcoded secrets/tokens in auth logic
+        if (/(?:secret|password|token|apiKey|api_key)\s*[:=]\s*['"][^'"]{8,}['"]/i.test(line)) {
+            if (!/test|spec|mock|fixture|example|sample/i.test(filepath)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Hardcoded credential in auth logic",
+                    severity: "high",
+                    detail: "Secret/token hardcoded in source — extract to environment variable or secret manager",
+                });
+            }
+        }
+        // Session fixation: session ID not regenerated after login
+        if (/login|authenticate|signIn/i.test(line) && /function|=>|async/.test(line)) {
+            const funcBlock = lines.slice(i, Math.min(i + 30, lines.length)).join("\n");
+            if (/session/i.test(funcBlock) && !/regenerate|destroy.*session|req\.session\s*=\s*null/i.test(funcBlock)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "Session not regenerated after login",
+                    severity: "medium",
+                    detail: "Session ID persists across auth boundary — regenerate to prevent session fixation",
+                });
+            }
+        }
+        // CORS: wildcard origin with credentials
+        if (/origin\s*:\s*['"]\*['"]|origin\s*:\s*true/.test(line)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join("\n");
+            if (/credentials\s*:\s*true/i.test(block)) {
+                issues.push({
+                    file: filepath,
+                    line: i + 1,
+                    issue: "CORS wildcard with credentials",
+                    severity: "high",
+                    detail: "Wildcard origin with credentials allows any site to make authenticated requests",
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runPrivilegePath(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges privilege-path — Model authorization flows to find escalation paths
+
+Usage:
+  judges privilege-path [dir]
+  judges privilege-path src/ --format json
+
+Options:
+  [dir]                 Directory to scan (default: .)
+  --format json         JSON output
+  --help, -h            Show this help
+
+Checks: routes without auth, IDOR patterns, magic-string role checks, self-assigned roles,
+unprotected destructive ops, JWT decode without verify, hardcoded secrets, session fixation, CORS.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const dir = argv.find((a) => !a.startsWith("-") && argv.indexOf(a) > 0) || ".";
+    const files = collectFiles(dir);
+    const allIssues = [];
+    for (const f of files)
+        allIssues.push(...analyzeFile(f));
+    const highCount = allIssues.filter((i) => i.severity === "high").length;
+    const medCount = allIssues.filter((i) => i.severity === "medium").length;
+    const score = Math.max(0, 100 - highCount * 10 - medCount * 4);
+    if (format === "json") {
+        console.log(JSON.stringify({
+            issues: allIssues,
+            score,
+            summary: { high: highCount, medium: medCount, total: allIssues.length },
+            timestamp: new Date().toISOString(),
+        }, null, 2));
+    }
+    else {
+        const badge = score >= 80 ? "✅ SECURE" : score >= 50 ? "⚠️  GAPS" : "❌ EXPOSED";
+        console.log(`\n  Privilege Safety: ${badge} (${score}/100)\n  ─────────────────────────────`);
+        if (allIssues.length === 0) {
+            console.log("    No privilege escalation paths detected.\n");
+            return;
+        }
+        for (const issue of allIssues.slice(0, 25)) {
+            const icon = issue.severity === "high" ? "🔴" : issue.severity === "medium" ? "🟡" : "🔵";
+            console.log(`    ${icon} ${issue.issue}`);
+            console.log(`        ${issue.file}:${issue.line}`);
+            console.log(`        ${issue.detail}`);
+        }
+        if (allIssues.length > 25)
+            console.log(`    ... and ${allIssues.length - 25} more`);
+        console.log(`\n    Total: ${allIssues.length} | High: ${highCount} | Medium: ${medCount} | Score: ${score}/100\n`);
+    }
+}

package/dist/commands/profile.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Performance profiling — track evaluation time per judge/evaluator.
+ *
+ * Wraps tribunal evaluation and reports timing data for each judge,
+ * helping identify bottlenecks and optimize CI pipeline duration.
+ */
+export interface JudgeTiming {
+    judgeId: string;
+    durationMs: number;
+    findingCount: number;
+}
+export interface ProfilingReport {
+    totalMs: number;
+    judges: JudgeTiming[];
+    slowest: string;
+    fastest: string;
+    avgMs: number;
+}
+/**
+ * Create a profiling wrapper around a function.
+ */
+export declare function profileFn<T>(fn: () => T): {
+    result: T;
+    durationMs: number;
+};
+/**
+ * Create a profiling wrapper around an async function.
+ */
+export declare function profileAsync<T>(fn: () => Promise<T>): Promise<{
+    result: T;
+    durationMs: number;
+}>;
+/**
+ * Build a profiling report from timing data collected during evaluation.
+ */
+export declare function buildProfilingReport(timings: JudgeTiming[]): ProfilingReport;
+export declare function runProfile(argv: string[]): void;

package/dist/commands/profile.js

@@ -0,0 +1,101 @@
+/**
+ * Performance profiling — track evaluation time per judge/evaluator.
+ *
+ * Wraps tribunal evaluation and reports timing data for each judge,
+ * helping identify bottlenecks and optimize CI pipeline duration.
+ */
+// ─── Profiling ──────────────────────────────────────────────────────────────
+/**
+ * Create a profiling wrapper around a function.
+ */
+export function profileFn(fn) {
+    const start = performance.now();
+    const result = fn();
+    return { result, durationMs: Math.round(performance.now() - start) };
+}
+/**
+ * Create a profiling wrapper around an async function.
+ */
+export async function profileAsync(fn) {
+    const start = performance.now();
+    const result = await fn();
+    return { result, durationMs: Math.round(performance.now() - start) };
+}
+/**
+ * Build a profiling report from timing data collected during evaluation.
+ */
+export function buildProfilingReport(timings) {
+    if (timings.length === 0) {
+        return { totalMs: 0, judges: [], slowest: "N/A", fastest: "N/A", avgMs: 0 };
+    }
+    const sorted = [...timings].sort((a, b) => b.durationMs - a.durationMs);
+    const totalMs = sorted.reduce((sum, t) => sum + t.durationMs, 0);
+    return {
+        totalMs,
+        judges: sorted,
+        slowest: sorted[0].judgeId,
+        fastest: sorted[sorted.length - 1].judgeId,
+        avgMs: Math.round(totalMs / sorted.length),
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runProfile(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges profile — Performance profiling for judge evaluations
+
+Usage:
+  judges profile <file>               Profile evaluation of a file
+  judges profile --report <path>      Display a saved profiling report
+
+Options:
+  --format json          JSON output
+  --threshold <ms>       Highlight judges slower than threshold (default: 500)
+  --help, -h             Show this help
+
+Note: This command wraps the normal evaluation pipeline with timing
+instrumentation. Each judge's execution time is measured individually.
+`);
+        return;
+    }
+    const { readFileSync, existsSync } = require("fs");
+    const reportPath = argv.find((_a, i) => argv[i - 1] === "--report");
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const thresholdStr = argv.find((_a, i) => argv[i - 1] === "--threshold");
+    const threshold = thresholdStr ? parseInt(thresholdStr, 10) : 500;
+    if (reportPath && existsSync(reportPath)) {
+        const report = JSON.parse(readFileSync(reportPath, "utf-8"));
+        printReport(report, format, threshold);
+        return;
+    }
+    // Without a saved report, show instructions
+    console.log(`
+  Profiling requires running an evaluation first.
+
+  Run with JUDGES_PROFILE=1 to enable profiling during eval:
+
+    JUDGES_PROFILE=1 judges eval --file src/app.ts --format json > results.json
+
+  Then view the profiling data:
+
+    judges profile --report .judges-profile.json
+
+  The profiling data is saved to .judges-profile.json automatically
+  when JUDGES_PROFILE=1 is set.
+`);
+}
+function printReport(report, format, threshold) {
+    if (format === "json") {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    console.log(`\n  ⏱️  Judges Evaluation Profile\n`);
+    console.log(`  Total: ${report.totalMs}ms | Avg: ${report.avgMs}ms | Judges: ${report.judges.length}\n`);
+    const maxLen = Math.max(...report.judges.map((j) => j.judgeId.length));
+    for (const j of report.judges) {
+        const bar = "█".repeat(Math.max(1, Math.round((j.durationMs / report.totalMs) * 40)));
+        const warn = j.durationMs > threshold ? " ⚠️ SLOW" : "";
+        console.log(`  ${j.judgeId.padEnd(maxLen)}  ${String(j.durationMs).padStart(6)}ms  ${bar}  (${j.findingCount} findings)${warn}`);
+    }
+    console.log(`\n  Slowest: ${report.slowest} | Fastest: ${report.fastest}\n`);
+}

package/dist/commands/prompt-replay.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Prompt replay — reverse-engineer the probable AI prompt that generated
+ * flagged code and suggest improved prompts that produce compliant output.
+ *
+ * Turns Judges into a prompt engineering coach.
+ */
+export declare function runPromptReplay(argv: string[]): void;

package/dist/commands/prompt-replay.js

@@ -0,0 +1,176 @@
+/**
+ * Prompt replay — reverse-engineer the probable AI prompt that generated
+ * flagged code and suggest improved prompts that produce compliant output.
+ *
+ * Turns Judges into a prompt engineering coach.
+ */
+import { readFileSync, existsSync } from "fs";
+// ─── Pattern → Prompt Map ───────────────────────────────────────────────────
+const PATTERN_PROMPTS = [
+    {
+        pattern: /sql.?inject|string\s+concat.*query|`\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE)/i,
+        category: "SQL Injection",
+        probablePrompt: "Generate a function to query the database for user records",
+        improvedPrompt: "Generate a function to query the database for user records using parameterized queries. Use prepared statements, never string concatenation for SQL. Include input validation.",
+        rationale: "AI models default to string interpolation for SQL unless explicitly told to use parameterized queries",
+    },
+    {
+        pattern: /innerHTML|dangerouslySetInnerHTML|document\.write/i,
+        category: "XSS Vulnerability",
+        probablePrompt: "Create a component that renders user content",
+        improvedPrompt: "Create a component that renders user content. Sanitize all user inputs using DOMPurify before rendering. Never use innerHTML or dangerouslySetInnerHTML with unsanitized data.",
+        rationale: "AI models use innerHTML for simplicity unless instructed to sanitize",
+    },
+    {
+        pattern: /hardcoded.?(secret|password|key|token)|['"][A-Za-z0-9+/]{20,}['"]/i,
+        category: "Hardcoded Secrets",
+        probablePrompt: "Set up API authentication with the service",
+        improvedPrompt: "Set up API authentication with the service. Read all secrets from environment variables or a secrets manager. Never hardcode API keys, passwords, or tokens in source code.",
+        rationale: "AI models often embed placeholder credentials that developers forget to replace",
+    },
+    {
+        pattern: /eval\s*\(|new\s+Function\s*\(/i,
+        category: "Code Injection via eval",
+        probablePrompt: "Create a dynamic expression evaluator",
+        improvedPrompt: "Create a dynamic expression evaluator. Do NOT use eval() or new Function(). Use a safe expression parser library (e.g., mathjs, expr-eval) or a whitelist-based approach.",
+        rationale: "AI models reach for eval() as the shortest path to dynamic execution",
+    },
+    {
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        category: "Empty Catch Blocks",
+        probablePrompt: "Add error handling to this function",
+        improvedPrompt: "Add error handling to this function. Every catch block must either log the error, re-throw it, or return a meaningful error response. Never swallow exceptions silently.",
+        rationale: "AI models often add empty try/catch to 'handle errors' without actual handling",
+    },
+    {
+        pattern: /console\.(log|debug)\s*\(.*(?:password|token|secret|key|credential)/i,
+        category: "Sensitive Data Logging",
+        probablePrompt: "Add logging to track authentication flow",
+        improvedPrompt: "Add logging to track authentication flow. Never log passwords, tokens, secrets, or PII. Use structured logging with severity levels. Redact sensitive fields.",
+        rationale: "AI models log everything requested without considering data sensitivity",
+    },
+    {
+        pattern: /(?:http:\/\/|fetch\s*\(['"]http:)/i,
+        category: "Insecure HTTP",
+        probablePrompt: "Fetch data from the API endpoint",
+        improvedPrompt: "Fetch data from the API endpoint using HTTPS. Never use plain HTTP for API calls. Validate SSL certificates. Set appropriate timeouts.",
+        rationale: "AI models sometimes use http:// in examples without upgrading to https://",
+    },
+    {
+        pattern: /Math\.random\s*\(\)|crypto\.createHash\s*\(\s*['"]md5['"]\)/i,
+        category: "Weak Cryptography",
+        probablePrompt: "Generate a unique token/hash for the user session",
+        improvedPrompt: "Generate a unique token for the user session using crypto.randomUUID() or crypto.randomBytes(). For hashing, use SHA-256 or bcrypt. Never use Math.random() for security or MD5 for hashing.",
+        rationale: "AI models default to Math.random() or MD5 which are cryptographically insecure",
+    },
+    {
+        pattern: /\.exec\s*\(|child_process|spawn\s*\(.*\$|execSync\s*\(.*\+/i,
+        category: "Command Injection",
+        probablePrompt: "Execute a system command with user-provided parameters",
+        improvedPrompt: "Execute a system command with user-provided parameters. Use an allowlist of permitted commands. Pass arguments as an array (spawn), never via string concatenation. Validate and sanitize all inputs.",
+        rationale: "AI models concatenate user input into shell commands without sanitization",
+    },
+    {
+        pattern: /cors\(\s*\)|Access-Control-Allow-Origin.*\*/i,
+        category: "Permissive CORS",
+        probablePrompt: "Enable CORS for the API",
+        improvedPrompt: "Enable CORS for the API. Specify allowed origins explicitly (never use '*' in production). Set appropriate methods, headers, and credentials options.",
+        rationale: "AI models default to permissive CORS (allow all) for simplicity",
+    },
+    {
+        pattern: /(?:app|router)\.(get|post|put|delete)\s*\([^)]*(?!.*(?:auth|middleware|protect|guard))/i,
+        category: "Missing Auth Middleware",
+        probablePrompt: "Create REST API endpoints for the resource",
+        improvedPrompt: "Create REST API endpoints for the resource. Apply authentication middleware to all routes. Use authorization checks for role-based access. Apply rate limiting to prevent abuse.",
+        rationale: "AI models create routes without auth middleware unless explicitly instructed",
+    },
+    {
+        pattern: /(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\*\s+FROM/i,
+        category: "SELECT * Usage",
+        probablePrompt: "Query all records from the table",
+        improvedPrompt: "Query records from the table. Select only the specific columns needed, never use SELECT *. Add pagination with LIMIT/OFFSET. Include proper WHERE clauses.",
+        rationale: "AI models use SELECT * for convenience, which exposes unnecessary data and hurts performance",
+    },
+];
+// ─── Analysis ───────────────────────────────────────────────────────────────
+function analyzeCode(content) {
+    const suggestions = [];
+    const seen = new Set();
+    for (const entry of PATTERN_PROMPTS) {
+        if (entry.pattern.test(content) && !seen.has(entry.category)) {
+            seen.add(entry.category);
+            suggestions.push({
+                findingPattern: entry.category,
+                probablePrompt: entry.probablePrompt,
+                improvedPrompt: entry.improvedPrompt,
+                rationale: entry.rationale,
+            });
+        }
+    }
+    return suggestions;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runPromptReplay(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges prompt-replay — Reverse-engineer AI prompts and suggest improvements
+
+Usage:
+  judges prompt-replay <file>
+  judges prompt-replay src/api.ts --format json
+  judges prompt-replay --demo
+
+Options:
+  <file>               File to analyze for AI-generated anti-patterns
+  --demo               Run with built-in demo code
+  --format json        JSON output
+  --help, -h           Show this help
+
+Detects AI-generated anti-patterns and suggests improved prompts that
+would produce compliant code on the first try.
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const isDemo = argv.includes("--demo");
+    let content;
+    if (isDemo) {
+        content = `
+const query = "SELECT * FROM users WHERE id = " + userId;
+document.innerHTML = userInput;
+const apiKey = "sk-1234567890abcdef";
+try { riskyOperation(); } catch (e) {}
+console.log("Auth token: " + token);
+fetch("http://api.example.com/data");
+const sessionId = Math.random().toString(36);
+app.get("/admin/users", (req, res) => { res.json(users); });
+`;
+    }
+    else {
+        const file = argv.find((a) => !a.startsWith("-")) || "";
+        if (!file || !existsSync(file)) {
+            console.error("  Specify a file to analyze or use --demo");
+            return;
+        }
+        content = readFileSync(file, "utf-8");
+    }
+    const suggestions = analyzeCode(content);
+    if (format === "json") {
+        console.log(JSON.stringify({ suggestions, total: suggestions.length, timestamp: new Date().toISOString() }, null, 2));
+    }
+    else {
+        console.log(`\n  Prompt Replay — ${suggestions.length} AI prompt improvement(s) found\n  ──────────────────────────`);
+        if (suggestions.length === 0) {
+            console.log("  ✅ No common AI anti-patterns detected");
+        }
+        else {
+            for (const s of suggestions) {
+                console.log(`\n    🔍 ${s.findingPattern}`);
+                console.log(`        Probable AI prompt: "${s.probablePrompt}"`);
+                console.log(`        💡 Improved prompt:  "${s.improvedPrompt}"`);
+                console.log(`        📝 ${s.rationale}`);
+            }
+        }
+        console.log("");
+    }
+}

package/dist/commands/quality-gate.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `judges quality-gate` — Configurable composite quality gates.
+ *
+ * Defines and evaluates multi-dimensional quality gates for CI pipelines.
+ * Goes beyond simple severity counts — supports score thresholds, specific
+ * rule requirements, trend-based gates, and custom composite conditions.
+ *
+ * Usage:
+ *   judges quality-gate --file src/app.ts                    # Evaluate default gate
+ *   judges quality-gate --file src/app.ts --gate strict      # Named gate definition
+ *   judges quality-gate --file src/app.ts --json             # JSON output
+ *
+ * Configuration in .judgesrc:
+ * ```json
+ * {
+ *   "qualityGates": {
+ *     "default": {
+ *       "maxFindings": { "critical": 0, "high": 2 },
+ *       "minScore": 70,
+ *       "requiredJudges": ["cybersecurity", "data-security"],
+ *       "maxFpRate": 0.3
+ *     },
+ *     "strict": {
+ *       "maxFindings": { "critical": 0, "high": 0, "medium": 5 },
+ *       "minScore": 85,
+ *       "requiredJudges": ["cybersecurity", "data-security", "authentication"]
+ *     }
+ *   }
+ * }
+ * ```
+ */
+import type { Severity, TribunalVerdict } from "../types.js";
+export interface QualityGateDefinition {
+    /** Maximum allowed findings by severity — exceeding any triggers failure */
+    maxFindings?: Partial<Record<Severity, number>>;
+    /** Minimum aggregated score (0-100) */
+    minScore?: number;
+    /** Judge IDs that must participate in evaluation */
+    requiredJudges?: string[];
+    /** Maximum false-positive rate allowed (0-1) — requires feedback data */
+    maxFpRate?: number;
+    /** Required rules that must not be violated — listing a rule ID means zero violations */
+    blockerRules?: string[];
+    /** Minimum percentage of findings that must have auto-fix patches */
+    minFixRate?: number;
+    /** Minimum average confidence score for findings (0-1) */
+    minConfidence?: number;
+}
+export interface QualityGateResult {
+    /** Overall pass/fail */
+    passed: boolean;
+    /** Named gate that was evaluated */
+    gateName: string;
+    /** Individual check results */
+    checks: QualityGateCheck[];
+    /** Verdict summary */
+    summary: string;
+}
+export interface QualityGateCheck {
+    /** Check name */
+    name: string;
+    /** Pass/fail */
+    passed: boolean;
+    /** Descriptive message */
+    message: string;
+}
+export declare function evaluateQualityGate(gate: QualityGateDefinition, gateName: string, verdict: TribunalVerdict, fpRateByRule?: Map<string, number>): QualityGateResult;
+export declare function parseQualityGateConfig(obj: Record<string, unknown>): Record<string, QualityGateDefinition> | undefined;
+export declare function runQualityGate(argv: string[]): void;