@kevinrabun/judges 3.42.0 → 3.43.0

package/dist/commands/policy-audit.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Policy audit trail — record which rules/judges were active at evaluation
+ * time, creating an immutable local audit log for compliance proof.
+ *
+ * Enables SOC2/ISO27001 auditors to verify that security policies were
+ * enforced at the time of each evaluation. All data stays local.
+ */
+import type { TribunalVerdict, JudgesConfig } from "../types.js";
+export interface PolicySnapshot {
+    /** SHA-256 hash of the combined policy state */
+    policyHash: string;
+    /** ISO timestamp */
+    timestamp: string;
+    /** Config file path */
+    configPath: string;
+    /** Active preset(s) */
+    presets: string[];
+    /** Judges that were enabled */
+    enabledJudges: string[];
+    /** Judges that were disabled */
+    disabledJudges: string[];
+    /** Disabled rules */
+    disabledRules: string[];
+    /** Rule overrides */
+    ruleOverrides: Record<string, unknown>;
+    /** Min severity threshold */
+    minSeverity: string;
+    /** Git commit at evaluation time */
+    gitCommit?: string;
+    /** Evaluator version */
+    version: string;
+}
+export interface AuditEntry {
+    id: string;
+    timestamp: string;
+    policySnapshot: PolicySnapshot;
+    verdictSummary: {
+        verdict: string;
+        score: number;
+        criticalCount: number;
+        highCount: number;
+        totalFindings: number;
+    };
+    filesEvaluated: number;
+}
+export interface AuditLog {
+    entries: AuditEntry[];
+    version: string;
+}
+export declare function capturePolicySnapshot(config: JudgesConfig, configPath: string, enabledJudges: string[], version: string): PolicySnapshot;
+export declare function recordAuditEntry(policySnapshot: PolicySnapshot, verdict: TribunalVerdict, filesEvaluated: number): AuditEntry;
+export declare function runPolicyAudit(argv: string[]): void;
+//# sourceMappingURL=policy-audit.d.ts.map

package/dist/commands/policy-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-audit.d.ts","sourceRoot":"","sources":["../../src/commands/policy-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIjE,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qBAAqB;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,EAAE,MAAM,GACd,cAAc,CAoChB;AAuBD,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,eAAe,EACxB,cAAc,EAAE,MAAM,GACrB,UAAU,CA4BZ;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAgFnD"}

package/dist/commands/policy-audit.js

@@ -0,0 +1,161 @@
+/**
+ * Policy audit trail — record which rules/judges were active at evaluation
+ * time, creating an immutable local audit log for compliance proof.
+ *
+ * Enables SOC2/ISO27001 auditors to verify that security policies were
+ * enforced at the time of each evaluation. All data stays local.
+ */
+import { createHash } from "crypto";
+// ─── Policy Snapshot ────────────────────────────────────────────────────────
+export function capturePolicySnapshot(config, configPath, enabledJudges, version) {
+    const { execSync } = require("child_process");
+    let gitCommit;
+    try {
+        gitCommit = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+    }
+    catch {
+        /* not in git */
+    }
+    const snapshot = {
+        policyHash: "",
+        timestamp: new Date().toISOString(),
+        configPath,
+        presets: config.preset ? [config.preset] : [],
+        enabledJudges,
+        disabledJudges: config.disabledJudges || [],
+        disabledRules: config.disabledRules || [],
+        ruleOverrides: config.ruleOverrides || {},
+        minSeverity: config.minSeverity || "info",
+        gitCommit,
+        version,
+    };
+    // Compute deterministic hash of policy state
+    const hashInput = JSON.stringify({
+        presets: snapshot.presets,
+        enabledJudges: snapshot.enabledJudges.sort(),
+        disabledJudges: snapshot.disabledJudges.sort(),
+        disabledRules: snapshot.disabledRules.sort(),
+        ruleOverrides: snapshot.ruleOverrides,
+        minSeverity: snapshot.minSeverity,
+    });
+    snapshot.policyHash = createHash("sha256").update(hashInput).digest("hex").slice(0, 16);
+    return snapshot;
+}
+// ─── Audit Log Management ──────────────────────────────────────────────────
+const AUDIT_FILE = ".judges-audit.json";
+function loadAuditLog() {
+    const { readFileSync, existsSync } = require("fs");
+    if (existsSync(AUDIT_FILE)) {
+        try {
+            return JSON.parse(readFileSync(AUDIT_FILE, "utf-8"));
+        }
+        catch {
+            /* corrupt file */
+        }
+    }
+    return { entries: [], version: "1.0" };
+}
+function saveAuditLog(log) {
+    const { writeFileSync } = require("fs");
+    writeFileSync(AUDIT_FILE, JSON.stringify(log, null, 2), "utf-8");
+}
+export function recordAuditEntry(policySnapshot, verdict, filesEvaluated) {
+    const entry = {
+        id: createHash("sha256")
+            .update(policySnapshot.timestamp + policySnapshot.policyHash)
+            .digest("hex")
+            .slice(0, 12),
+        timestamp: policySnapshot.timestamp,
+        policySnapshot,
+        verdictSummary: {
+            verdict: verdict.overallVerdict,
+            score: verdict.overallScore,
+            criticalCount: verdict.criticalCount,
+            highCount: verdict.highCount,
+            totalFindings: verdict.findings.length,
+        },
+        filesEvaluated,
+    };
+    const log = loadAuditLog();
+    log.entries.push(entry);
+    // Keep last 1000 entries
+    if (log.entries.length > 1000) {
+        log.entries = log.entries.slice(-1000);
+    }
+    saveAuditLog(log);
+    return entry;
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export function runPolicyAudit(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges policy-audit — View and manage the policy audit trail
+
+Usage:
+  judges policy-audit                       Show recent audit entries
+  judges policy-audit --last 10             Show last 10 entries
+  judges policy-audit --diff                Compare current policy to last evaluation
+  judges policy-audit --export audit.json   Export full audit log
+
+Options:
+  --last <n>           Show last N entries (default: 5)
+  --diff               Show policy changes since last evaluation
+  --export <path>      Export audit log to file
+  --format json        JSON output
+  --help, -h           Show this help
+
+The audit trail records which rules, judges, and configs were active at
+each evaluation time. Useful for SOC2/ISO27001 compliance proof.
+`);
+        return;
+    }
+    const { readFileSync, existsSync, writeFileSync } = require("fs");
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const lastN = parseInt(argv.find((_a, i) => argv[i - 1] === "--last") || "5", 10);
+    const exportPath = argv.find((_a, i) => argv[i - 1] === "--export");
+    if (!existsSync(AUDIT_FILE)) {
+        console.log("\n  No audit trail found. Run an evaluation first.\n");
+        return;
+    }
+    const log = JSON.parse(readFileSync(AUDIT_FILE, "utf-8"));
+    if (exportPath) {
+        writeFileSync(exportPath, JSON.stringify(log, null, 2), "utf-8");
+        console.log(`  Exported ${log.entries.length} audit entries to ${exportPath}`);
+        return;
+    }
+    const entries = log.entries.slice(-lastN);
+    if (format === "json") {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    if (argv.includes("--diff") && log.entries.length >= 2) {
+        const prev = log.entries[log.entries.length - 2].policySnapshot;
+        const curr = log.entries[log.entries.length - 1].policySnapshot;
+        console.log("\n  Policy Diff (last two evaluations)\n");
+        if (prev.policyHash !== curr.policyHash) {
+            console.log("  ⚠️  Policy changed!\n");
+            const addedJudges = curr.enabledJudges.filter((j) => !prev.enabledJudges.includes(j));
+            const removedJudges = prev.enabledJudges.filter((j) => !curr.enabledJudges.includes(j));
+            if (addedJudges.length)
+                console.log(`  + Added judges: ${addedJudges.join(", ")}`);
+            if (removedJudges.length)
+                console.log(`  - Removed judges: ${removedJudges.join(", ")}`);
+            if (prev.minSeverity !== curr.minSeverity)
+                console.log(`  ~ Severity: ${prev.minSeverity} → ${curr.minSeverity}`);
+        }
+        else {
+            console.log("  ✅ No policy changes\n");
+        }
+        console.log("");
+        return;
+    }
+    console.log(`\n  Policy Audit Trail (last ${entries.length} of ${log.entries.length})\n`);
+    for (const e of entries) {
+        const v = e.verdictSummary;
+        console.log(`  ${e.id}  ${e.timestamp}`);
+        console.log(`    Policy: ${e.policySnapshot.policyHash}  Judges: ${e.policySnapshot.enabledJudges.length}  Commit: ${e.policySnapshot.gitCommit?.slice(0, 8) || "N/A"}`);
+        console.log(`    Verdict: ${v.verdict}  Score: ${v.score}  Critical: ${v.criticalCount}  High: ${v.highCount}  Findings: ${v.totalFindings}`);
+        console.log("");
+    }
+}
+//# sourceMappingURL=policy-audit.js.map

package/dist/commands/policy-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-audit.js","sourceRoot":"","sources":["../../src/commands/policy-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAiDpC,+EAA+E;AAE/E,MAAM,UAAU,qBAAqB,CACnC,MAAoB,EACpB,UAAkB,EAClB,aAAuB,EACvB,OAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IAED,MAAM,QAAQ,GAAmB;QAC/B,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7C,aAAa;QACb,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM;QACzC,SAAS;QACT,OAAO;KACR,CAAC;IAEF,6CAA6C;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE;QAC5C,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE;QAC9C,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE;QAC5C,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAExF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC,SAAS,YAAY;IACnB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,GAAa;IACjC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,cAA8B,EAC9B,OAAwB,EACxB,cAAsB;IAEtB,MAAM,KAAK,GAAe;QACxB,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,cAAc,CAAC,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC;aAC5D,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACf,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,cAAc;QACd,cAAc,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;SACvC;QACD,cAAc;KACf,CAAC;IAEF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAExB,yBAAyB;IACzB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;CAkBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAEpF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAa,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpE,IAAI,UAAU,EAAE,CAAC;QACf,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,OAAO,CAAC,MAAM,qBAAqB,UAAU,EAAE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAE1C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;QAEhE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,WAAW,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnF,IAAI,aAAa,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,WAAW,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,eAAe,CAAC,CAAC,cAAc,CAAC,UAAU,aAAa,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,MAAM,aAAa,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAC5J,CAAC;QACF,OAAO,CAAC,GAAG,CACT,gBAAgB,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,SAAS,eAAe,CAAC,CAAC,aAAa,EAAE,CACjI,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/regression-alert.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Regression alerting — compare current scan results against a saved
+ * baseline snapshot to detect quality regressions.
+ *
+ * Snapshots are stored locally in .judges-baseline.json.
+ */
+import type { Finding } from "../types.js";
+export interface BaselineSnapshot {
+    timestamp: string;
+    gitCommit?: string;
+    gitBranch?: string;
+    totalFindings: number;
+    bySeverity: Record<string, number>;
+    byRule: Record<string, number>;
+    findingIds: string[];
+}
+export interface RegressionReport {
+    status: "improved" | "stable" | "regressed";
+    newFindings: string[];
+    fixedFindings: string[];
+    delta: number;
+    severityDelta: Record<string, number>;
+    ruleDelta: Record<string, number>;
+    baseline: BaselineSnapshot;
+    current: BaselineSnapshot;
+}
+export declare function buildSnapshot(findings: Finding[]): BaselineSnapshot;
+export declare function saveBaseline(snapshot: BaselineSnapshot, file?: string): void;
+export declare function loadBaseline(file?: string): BaselineSnapshot | null;
+export declare function compareSnapshots(baseline: BaselineSnapshot, current: BaselineSnapshot): RegressionReport;
+export declare function runRegressionAlert(argv: string[]): Promise<void>;
+//# sourceMappingURL=regression-alert.d.ts.map

package/dist/commands/regression-alert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regression-alert.d.ts","sourceRoot":"","sources":["../../src/commands/regression-alert.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAI3C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAqBD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAqBnE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,SAAgB,GAAG,IAAI,CAEnF;AAED,wBAAgB,YAAY,CAAC,IAAI,SAAgB,GAAG,gBAAgB,GAAG,IAAI,CAG1E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAmCxG;AAID,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6ItE"}

package/dist/commands/regression-alert.js

@@ -0,0 +1,216 @@
+/**
+ * Regression alerting — compare current scan results against a saved
+ * baseline snapshot to detect quality regressions.
+ *
+ * Snapshots are stored locally in .judges-baseline.json.
+ */
+import { readFileSync, writeFileSync, existsSync } from "fs";
+const BASELINE_FILE = ".judges-baseline.json";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function makeFindingId(f) {
+    return `${f.ruleId}::${f.title}`;
+}
+function getGitInfo() {
+    try {
+        const { execSync } = require("child_process");
+        const commit = execSync("git rev-parse --short HEAD", { encoding: "utf-8" }).trim();
+        const branch = execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+        return { commit, branch };
+    }
+    catch {
+        return {};
+    }
+}
+export function buildSnapshot(findings) {
+    const git = getGitInfo();
+    const bySeverity = {};
+    const byRule = {};
+    const findingIds = [];
+    for (const f of findings) {
+        bySeverity[f.severity] = (bySeverity[f.severity] || 0) + 1;
+        byRule[f.ruleId] = (byRule[f.ruleId] || 0) + 1;
+        findingIds.push(makeFindingId(f));
+    }
+    return {
+        timestamp: new Date().toISOString(),
+        gitCommit: git.commit,
+        gitBranch: git.branch,
+        totalFindings: findings.length,
+        bySeverity,
+        byRule,
+        findingIds,
+    };
+}
+export function saveBaseline(snapshot, file = BASELINE_FILE) {
+    writeFileSync(file, JSON.stringify(snapshot, null, 2));
+}
+export function loadBaseline(file = BASELINE_FILE) {
+    if (!existsSync(file))
+        return null;
+    return JSON.parse(readFileSync(file, "utf-8"));
+}
+export function compareSnapshots(baseline, current) {
+    const baseSet = new Set(baseline.findingIds);
+    const currSet = new Set(current.findingIds);
+    const newFindings = current.findingIds.filter((id) => !baseSet.has(id));
+    const fixedFindings = baseline.findingIds.filter((id) => !currSet.has(id));
+    const delta = current.totalFindings - baseline.totalFindings;
+    const severityDelta = {};
+    const allSeverities = new Set([...Object.keys(baseline.bySeverity), ...Object.keys(current.bySeverity)]);
+    for (const sev of allSeverities) {
+        severityDelta[sev] = (current.bySeverity[sev] || 0) - (baseline.bySeverity[sev] || 0);
+    }
+    const ruleDelta = {};
+    const allRules = new Set([...Object.keys(baseline.byRule), ...Object.keys(current.byRule)]);
+    for (const rule of allRules) {
+        const d = (current.byRule[rule] || 0) - (baseline.byRule[rule] || 0);
+        if (d !== 0)
+            ruleDelta[rule] = d;
+    }
+    let status = "stable";
+    if (delta > 0 || newFindings.length > 0)
+        status = "regressed";
+    else if (delta < 0 || fixedFindings.length > 0)
+        status = "improved";
+    return {
+        status,
+        newFindings,
+        fixedFindings,
+        delta,
+        severityDelta,
+        ruleDelta,
+        baseline,
+        current,
+    };
+}
+// ─── CLI ────────────────────────────────────────────────────────────────────
+export async function runRegressionAlert(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(`
+judges regression-alert — Detect quality regressions between scans
+
+Usage:
+  judges regression-alert --save --input results.json     Save current results as baseline
+  judges regression-alert --check --input results.json    Compare current results against baseline
+  judges regression-alert --show                          Show current baseline
+
+Options:
+  --save                Save current results as the baseline
+  --check               Compare against saved baseline
+  --show                Display stored baseline info
+  --input <path>        Results JSON file
+  --fail-on-regression  Exit with code 1 if regressions detected (CI mode)
+  --threshold <n>       Only alert if >= n new findings (default: 1)
+  --format json         JSON output
+  --help, -h            Show this help
+`);
+        return;
+    }
+    const format = argv.find((_a, i) => argv[i - 1] === "--format") || "text";
+    const inputPath = argv.find((_a, i) => argv[i - 1] === "--input");
+    const failOnRegression = argv.includes("--fail-on-regression");
+    const thresholdStr = argv.find((_a, i) => argv[i - 1] === "--threshold");
+    const threshold = thresholdStr ? parseInt(thresholdStr, 10) : 1;
+    // Show baseline
+    if (argv.includes("--show")) {
+        const baseline = loadBaseline();
+        if (!baseline) {
+            console.log("\n  No baseline saved. Run with --save first.\n");
+            return;
+        }
+        if (format === "json") {
+            console.log(JSON.stringify(baseline, null, 2));
+        }
+        else {
+            console.log(`
+  Baseline Snapshot
+  ─────────────────
+  Saved:     ${baseline.timestamp}
+  Commit:    ${baseline.gitCommit || "unknown"}
+  Branch:    ${baseline.gitBranch || "unknown"}
+  Findings:  ${baseline.totalFindings}
+`);
+            for (const [sev, count] of Object.entries(baseline.bySeverity)) {
+                console.log(`    ${sev.padEnd(10)} ${count}`);
+            }
+            console.log("");
+        }
+        return;
+    }
+    // Both --save and --check need input
+    if (!inputPath) {
+        console.error("Error: --input <path> required");
+        process.exit(1);
+    }
+    if (!existsSync(inputPath)) {
+        console.error(`Error: file not found: ${inputPath}`);
+        process.exit(1);
+    }
+    const data = JSON.parse(readFileSync(inputPath, "utf-8"));
+    const findings = data.evaluations
+        ? data.evaluations.flatMap((e) => e.findings || [])
+        : data.findings || data;
+    const snapshot = buildSnapshot(findings);
+    // Save baseline
+    if (argv.includes("--save")) {
+        saveBaseline(snapshot);
+        if (format === "json") {
+            console.log(JSON.stringify(snapshot, null, 2));
+        }
+        else {
+            console.log(`\n  Baseline saved: ${snapshot.totalFindings} findings (${snapshot.gitCommit || "no git"})\n`);
+        }
+        return;
+    }
+    // Check against baseline
+    if (argv.includes("--check")) {
+        const baseline = loadBaseline();
+        if (!baseline) {
+            console.error("Error: No baseline saved. Run with --save first.");
+            process.exit(1);
+        }
+        const report = compareSnapshots(baseline, snapshot);
+        if (format === "json") {
+            console.log(JSON.stringify(report, null, 2));
+        }
+        else {
+            const icon = report.status === "improved" ? "✅" : report.status === "regressed" ? "🚨" : "➖";
+            console.log(`\n  ${icon} Status: ${report.status.toUpperCase()} (delta: ${report.delta >= 0 ? "+" : ""}${report.delta})`);
+            console.log(`  Baseline: ${baseline.totalFindings} findings (${baseline.gitCommit || "?"})`);
+            console.log(`  Current:  ${snapshot.totalFindings} findings (${snapshot.gitCommit || "?"})\n`);
+            if (report.newFindings.length > 0) {
+                console.log(`  New findings (${report.newFindings.length}):`);
+                for (const id of report.newFindings.slice(0, 20)) {
+                    console.log(`    + ${id}`);
+                }
+                if (report.newFindings.length > 20) {
+                    console.log(`    ... and ${report.newFindings.length - 20} more`);
+                }
+            }
+            if (report.fixedFindings.length > 0) {
+                console.log(`\n  Fixed findings (${report.fixedFindings.length}):`);
+                for (const id of report.fixedFindings.slice(0, 20)) {
+                    console.log(`    - ${id}`);
+                }
+                if (report.fixedFindings.length > 20) {
+                    console.log(`    ... and ${report.fixedFindings.length - 20} more`);
+                }
+            }
+            if (Object.keys(report.severityDelta).length > 0) {
+                console.log("\n  By severity:");
+                for (const [sev, d] of Object.entries(report.severityDelta)) {
+                    if (d !== 0)
+                        console.log(`    ${sev.padEnd(10)} ${d >= 0 ? "+" : ""}${d}`);
+                }
+            }
+            console.log("");
+        }
+        if (failOnRegression && report.newFindings.length >= threshold) {
+            console.error(`  ❌ Regression detected: ${report.newFindings.length} new finding(s) (threshold: ${threshold})`);
+            process.exit(1);
+        }
+        return;
+    }
+    console.log("Use --save, --check, or --show. See --help for details.");
+}
+//# sourceMappingURL=regression-alert.js.map

package/dist/commands/regression-alert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regression-alert.js","sourceRoot":"","sources":["../../src/commands/regression-alert.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AA0B7D,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,+EAA+E;AAE/E,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC/C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU;QACV,MAAM;QACN,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA0B,EAAE,IAAI,GAAG,aAAa;IAC3E,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAI,GAAG,aAAa;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,OAAyB;IACpF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IAE7D,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzG,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,MAAM,GAA+B,QAAQ,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,WAAW,CAAC;SACzD,IAAI,KAAK,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,GAAG,UAAU,CAAC;IAEpE,OAAO;QACL,MAAM;QACN,WAAW;QACX,aAAa;QACb,KAAK;QACL,aAAa;QACb,SAAS;QACT,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;CAiBf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,gBAAgB;IAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC;;;eAGH,QAAQ,CAAC,SAAS;eAClB,QAAQ,CAAC,SAAS,IAAI,SAAS;eAC/B,QAAQ,CAAC,SAAS,IAAI,SAAS;eAC/B,QAAQ,CAAC,aAAa;CACpC,CAAC,CAAC;YACG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAc,IAAI,CAAC,WAAW;QAC1C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAA2B,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC7E,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEzC,gBAAgB;IAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,aAAa,cAAc,QAAQ,CAAC,SAAS,IAAI,QAAQ,KAAK,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7F,OAAO,CAAC,GAAG,CACT,OAAO,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,CAC7G,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,aAAa,cAAc,QAAQ,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,aAAa,cAAc,QAAQ,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC;YAE/F,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;gBACpE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACnD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC5D,IAAI,CAAC,KAAK,CAAC;wBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,WAAW,CAAC,MAAM,+BAA+B,SAAS,GAAG,CAAC,CAAC;YAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;AACzE,CAAC"}

package/dist/commands/remediation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Remediation guides — provide step-by-step fix guidance for common
+ * finding categories, linked from finding output.
+ *
+ * Each guide includes: description, risk level, fix steps,
+ * code examples (before/after), and references.
+ */
+export interface RemediationGuide {
+    rulePrefix: string;
+    title: string;
+    category: string;
+    risk: string;
+    steps: string[];
+    beforeCode?: string;
+    afterCode?: string;
+    references: string[];
+}
+export declare function findGuide(ruleId: string): RemediationGuide | undefined;
+export declare function listGuides(): RemediationGuide[];
+export declare function runRemediationGuide(argv: string[]): void;
+//# sourceMappingURL=remediation.d.ts.map

package/dist/commands/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/commands/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AA6KD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAGtE;AAED,wBAAgB,UAAU,IAAI,gBAAgB,EAAE,CAE/C;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAmFxD"}