@kirrosh/zond 0.23.0 → 0.26.0

package/src/core/probe/shared.ts

@@ -173,6 +173,32 @@ export function renderPath(
   });
 }
 
+/** ARV-244/ARV-245: percent-encode unsafe characters per path segment,
+ *  preserving anything already percent-encoded (`%XX`). Slashes, the
+ *  unreserved set, and a conservative slice of sub-delims are kept
+ *  verbatim. Used both for orphan-cleanup DELETE URLs and paste-ready
+ *  manual repro lines in the security-probe digest. */
+export function encodePathForRepro(deletePath: string): string {
+  const SAFE = /[A-Za-z0-9._~!$&'()*+,;=:@-]/;
+  return deletePath
+    .split("/")
+    .map((segment) => {
+      if (segment.length === 0) return segment;
+      let out = "";
+      for (let i = 0; i < segment.length; i++) {
+        const ch = segment.charAt(i);
+        if (ch === "%" && /^[0-9A-Fa-f]{2}$/.test(segment.slice(i + 1, i + 3))) {
+          out += segment.slice(i, i + 3);
+          i += 2;
+          continue;
+        }
+        out += SAFE.test(ch) ? ch : encodeURIComponent(ch);
+      }
+      return out;
+    })
+    .join("/");
+}
+
 export function isMutating(method: string): boolean {
   const m = method.toUpperCase();
   return m === "POST" || m === "PUT" || m === "PATCH";

package/src/core/probe/webhooks-probe.ts

@@ -34,10 +34,8 @@
  * categories, not contract bugs the API owner promised against.
  */
 import type { OpenAPIV3, OpenAPIV3_1 } from "openapi-types";
-import Ajv2020 from "ajv/dist/2020.js";
-import Ajv from "ajv";
-import addFormats from "ajv-formats";
 import type { ValidateFunction, ErrorObject } from "ajv";
+import { makeAjv } from "../util/ajv.ts";
 
 interface SingleSchemaValidator {
   validate(value: unknown): boolean;
@@ -48,10 +46,7 @@ interface SingleSchemaValidator {
  *  3.1-flavour by default (`webhooks:` is OpenAPI 3.1) but tolerates
  *  pre-3.1 specs using `x-webhooks` — they ship Draft-7-ish schemas. */
 function compileSingleSchema(schema: OpenAPIV3.SchemaObject, isV31: boolean): SingleSchemaValidator {
-  const ajv = isV31
-    ? new (Ajv2020 as unknown as typeof Ajv)({ strict: false, allErrors: true })
-    : new Ajv({ strict: false, allErrors: true });
-  addFormats(ajv);
+  const ajv = makeAjv(isV31, { strict: false, allErrors: true });
   const validate: ValidateFunction = ajv.compile(schema);
   return {
     validate(value) { return validate(value) as boolean; },
@@ -73,6 +68,9 @@ export interface WebhookFinding {
   event_type: string | null;
   message: string;
   evidence: Record<string, unknown>;
+  /** Reserved suppression trace (audit-trail). Currently unset — the
+   *  agent triages severity from the raw finding. */
+  suppressed_by?: { source: string; rule_index: number; reason: string };
 }
 
 export interface WebhookProbeResult {

package/src/core/runner/assertions.ts

@@ -30,7 +30,7 @@ function deepEquals(a: unknown, b: unknown): boolean {
   if (typeof a === "string" && typeof b === "number") return Number(a) === b;
   if (typeof a !== typeof b) return false;
   if (typeof a !== "object" || a === null || b === null) return false;
-  return JSON.stringify(a) === JSON.stringify(b);
+  return Bun.deepEquals(a, b);
 }
 
 function checkRule(path: string, rule: AssertionRule, actual: unknown): AssertionResult[] {

package/src/core/runner/executor.ts

@@ -9,15 +9,7 @@ import { evaluateExpr } from "./expr-eval.ts";
 import { applyTransform } from "./transforms.ts";
 import type { SchemaValidator } from "./schema-validator.ts";
 import { classifyFailure } from "../diagnostics/failure-class.ts";
-
-function buildUrl(baseUrl: string | undefined, path: string, query?: Record<string, string>): string {
-  let url = baseUrl ? `${baseUrl.replace(/\/+$/, "")}${path}` : path;
-  if (query && Object.keys(query).length > 0) {
-    const params = new URLSearchParams(query);
-    url += `?${params.toString()}`;
-  }
-  return url;
-}
+import { buildUrl } from "../util/url.ts";
 
 /** Shallow-merge suite-level и step-level provenance. Step перекрывает suite. */
 function mergeProvenance(
@@ -653,15 +645,8 @@ export async function runSuite(
     passed: steps.filter((s) => s.status === "pass").length,
     failed: steps.filter((s) => s.status === "fail").length,
     skipped: steps.filter((s) => s.status === "skip").length,
+    // ARV-318: surface error steps so total = passed+failed+skipped+errored.
+    errored: steps.filter((s) => s.status === "error").length,
     steps,
   };
 }
-
-export async function runSuites(
-  suites: TestSuite[],
-  env: Environment = {},
-  dryRun = false,
-  options: RunSuiteOptions = {},
-): Promise<TestRunResult[]> {
-  return Promise.all(suites.map((suite) => runSuite(suite, env, dryRun, options)));
-}

package/src/core/runner/form-encode.ts

@@ -29,23 +29,13 @@ export function encodeFormBody(body: Record<string, unknown>): string {
   return params.toString();
 }
 
-/** Flatten a nested JS object to a `Record<string, string>` using bracket
- *  notation, suitable for the YAML runner's `form:` step (which is typed
- *  as `Record<string, string>` and serialised via `URLSearchParams`). */
+/** Flatten a nested JS object to a `Record<string, string>` using the same
+ *  bracket-notation walk as `encodeFormBody`, suitable for the YAML
+ *  runner's `form:` step (which is typed as `Record<string, string>` and
+ *  serialised via `URLSearchParams`). */
 export function flattenToFormFields(body: unknown): Record<string, string> {
-  const out: Record<string, string> = {};
-  const walk = (value: unknown, key: string): void => {
-    if (value === null || value === undefined) return;
-    if (Array.isArray(value)) {
-      for (let i = 0; i < value.length; i++) walk(value[i], key ? `${key}[${i}]` : String(i));
-    } else if (typeof value === "object") {
-      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-        walk(v, key ? `${key}[${k}]` : k);
-      }
-    } else if (key) {
-      out[key] = String(value);
-    }
-  };
-  if (body && typeof body === "object") walk(body, "");
-  return out;
+  if (!body || typeof body !== "object") return {};
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(body as Record<string, unknown>)) appendFormParam(params, k, v);
+  return Object.fromEntries(params.entries());
 }

package/src/core/runner/http-client.ts

@@ -1,6 +1,34 @@
 import type { HttpRequest, HttpResponse } from "./types.ts";
 import { type RateLimiter, parseRetryAfter, parseRateLimitHeaders } from "./rate-limiter.ts";
 
+/**
+ * ARV-265: module-level audit hook for commands that don't drive their
+ * HTTP through the suite runner. Each `executeRequest` call fires the
+ * registered recorder with the final outcome (or the swallowed network
+ * error if the call exhausted its retry budget). Recorders MUST NOT
+ * throw — the http client treats them as fire-and-forget telemetry.
+ *
+ * Convention: a command sets the recorder before the live work begins,
+ * unsets it in a `finally` block. There can be at most one recorder at
+ * a time; nesting is a bug (we surface it on stderr but keep the inner
+ * recorder so the live command's results take precedence).
+ */
+export interface AuditRecord {
+  request: HttpRequest;
+  response?: HttpResponse;
+  durationMs: number;
+  error?: string;
+}
+
+let _auditRecorder: ((rec: AuditRecord) => void) | null = null;
+
+export function setHttpAuditRecorder(recorder: ((rec: AuditRecord) => void) | null): void {
+  if (recorder && _auditRecorder) {
+    process.stderr.write("zond: nested HTTP audit recorder — overriding the outer scope.\n");
+  }
+  _auditRecorder = recorder;
+}
+
 export interface FetchOptions {
   timeout: number;
   retries: number;
@@ -153,7 +181,7 @@ export async function executeRequest(
         }
       }
 
-      return {
+      const httpResp: HttpResponse = {
         status: response.status,
         headers,
         body: bodyText,
@@ -161,6 +189,11 @@ export async function executeRequest(
         duration_ms,
         network_retry_count: networkRetryCount,
       };
+      if (_auditRecorder) {
+        try { _auditRecorder({ request, response: httpResp, durationMs: duration_ms }); }
+        catch { /* recorder is fire-and-forget */ }
+      }
+      return httpResp;
     } catch (err) {
       lastError = err instanceof Error ? err : new Error(String(err));
       const isNet = isTransientNetworkError(lastError);
@@ -181,6 +214,10 @@ export async function executeRequest(
         await Bun.sleep(opts.retry_delay);
         continue;
       }
+      if (_auditRecorder) {
+        try { _auditRecorder({ request, durationMs: 0, error: lastError.message }); }
+        catch { /* recorder is fire-and-forget */ }
+      }
       throw lastError;
     }
   }

package/src/core/runner/preflight-vars.ts

@@ -16,7 +16,7 @@ function scanRefs(value: unknown, out: Set<string>): void {
   }
 }
 
-function collectCapturesAndSets(step: TestStep, out: Set<string>): void {
+export function collectCapturesAndSets(step: TestStep, out: Set<string>): void {
   if (step.set) {
     for (const k of Object.keys(step.set)) out.add(k);
   }
@@ -57,6 +57,23 @@ export interface MissingVarHit {
  * forward references inside the suite are tolerated (correctness requires
  * runtime ordering checks anyway).
  */
+/** All non-generator {{var}} references a step reads (path, headers, body,
+ *  query, skip_if, retry_until, set, for_each). Excludes `$generators`. */
+export function collectStepRefs(step: TestStep): Set<string> {
+  const refs = new Set<string>();
+  scanRefs(step.path, refs);
+  scanRefs(step.headers, refs);
+  scanRefs(step.json, refs);
+  scanRefs(step.form, refs);
+  scanRefs(step.multipart, refs);
+  scanRefs(step.query, refs);
+  if (step.skip_if) scanRefs(step.skip_if, refs);
+  if (step.retry_until) scanRefs(step.retry_until.condition, refs);
+  if (step.set) scanRefs(step.set, refs);
+  if (step.for_each) scanRefs(step.for_each.in, refs);
+  return refs;
+}
+
 export function preflightCheckVars(
   suites: TestSuite[],
   env: Record<string, string>,
@@ -71,20 +88,7 @@ export function preflightCheckVars(
     }
     for (const step of suite.tests) collectCapturesAndSets(step, known);
 
-    const scanStepRefs = (step: TestStep): Set<string> => {
-      const refs = new Set<string>();
-      scanRefs(step.path, refs);
-      scanRefs(step.headers, refs);
-      scanRefs(step.json, refs);
-      scanRefs(step.form, refs);
-      scanRefs(step.multipart, refs);
-      scanRefs(step.query, refs);
-      if (step.skip_if) scanRefs(step.skip_if, refs);
-      if (step.retry_until) scanRefs(step.retry_until.condition, refs);
-      if (step.set) scanRefs(step.set, refs);
-      if (step.for_each) scanRefs(step.for_each.in, refs);
-      return refs;
-    };
+    const scanStepRefs = collectStepRefs;
 
     const suiteRefs = new Set<string>();
     if (suite.base_url) scanRefs(suite.base_url, suiteRefs);

package/src/core/runner/rate-limiter.ts

@@ -58,13 +58,19 @@ function applyResetPause(prevNextAvailable: number, meta: RateLimitMeta, now: nu
 
 class IntervalRateLimiter implements RateLimiter {
   private nextAvailable = 0;
+  /** 0 means adaptive: no proactive throttling until a policy is learned
+   *  from a response (matches the original AdaptiveRateLimiter behaviour). */
   private intervalMs: number;
 
-  constructor(reqPerSec: number) {
-    if (!Number.isFinite(reqPerSec) || reqPerSec <= 0) {
-      throw new Error(`Invalid rate limit: ${reqPerSec}`);
+  constructor(reqPerSec?: number) {
+    if (reqPerSec === undefined) {
+      this.intervalMs = 0;
+    } else {
+      if (!Number.isFinite(reqPerSec) || reqPerSec <= 0) {
+        throw new Error(`Invalid rate limit: ${reqPerSec}`);
+      }
+      this.intervalMs = 1000 / reqPerSec;
     }
-    this.intervalMs = 1000 / reqPerSec;
   }
 
   async acquire(): Promise<void> {
@@ -89,30 +95,6 @@ class IntervalRateLimiter implements RateLimiter {
   }
 }
 
-class AdaptiveRateLimiter implements RateLimiter {
-  private nextAvailable = 0;
-  /** Learned from RateLimit-Policy. 0 until a policy is seen — until then,
-   *  parallel acquires are not spaced (matches the original adaptive
-   *  behaviour). Once known, every acquire reserves a slot of `intervalMs`. */
-  private intervalMs = 0;
-
-  async acquire(): Promise<void> {
-    const now = Date.now();
-    const slot = Math.max(now, this.nextAvailable);
-    const waitMs = slot - now;
-    this.nextAvailable = slot + this.intervalMs;
-    if (waitMs > 0) await Bun.sleep(waitMs);
-  }
-
-  note(meta: RateLimitMeta, now: number = Date.now()): void {
-    if (meta.intervalMs !== undefined && meta.intervalMs > this.intervalMs) {
-      this.nextAvailable += meta.intervalMs - this.intervalMs;
-      this.intervalMs = meta.intervalMs;
-    }
-    this.nextAvailable = applyResetPause(this.nextAvailable, meta, now);
-  }
-}
-
 export function createRateLimiter(reqPerSec: number | undefined): RateLimiter | undefined {
   if (reqPerSec === undefined || reqPerSec === null) return undefined;
   if (!Number.isFinite(reqPerSec) || reqPerSec <= 0) return undefined;
@@ -128,7 +110,7 @@ export function createRateLimiter(reqPerSec: number | undefined): RateLimiter |
  * from blowing through small windows (e.g. 5-req/1-sec policies).
  */
 export function createAdaptiveRateLimiter(): RateLimiter {
-  return new AdaptiveRateLimiter();
+  return new IntervalRateLimiter();
 }
 
 /**

package/src/core/runner/run-kind.ts

@@ -16,12 +16,18 @@
  *   - `check`   — every suite path lives under `apis/<api>/checks/`. Mirrors
  *                 the same logic: conformance checks don't reflect endpoint
  *                 coverage breadth.
+ *   - `request` — a single ad-hoc `zond request` invocation persisted into
+ *                 the session DB (ARV-265). Excluded from `pass-coverage`
+ *                 but counted toward `audit-coverage`.
+ *   - `fixture` — `prepare-fixtures --cascade` discovery list-calls
+ *                 (ARV-265). Pure HTTP touches in service of fixture
+ *                 derivation; audit-coverage only.
  *   - `regular` — anything else, including mixed runs (probe + smoke). A
  *                 mixed run is treated as regular because at least one
  *                 suite contributed real coverage signal.
  */
 
-export type RunKind = "regular" | "probe" | "check";
+export type RunKind = "regular" | "probe" | "check" | "request" | "fixture";
 
 const PROBE_SEGMENT_RE = /(^|\/)probes(\/|$)/;
 const CHECK_SEGMENT_RE = /(^|\/)checks(\/|$)/;

package/src/core/runner/schema-validator.ts

@@ -1,8 +1,7 @@
-import Ajv2020 from "ajv/dist/2020.js";
 import Ajv from "ajv";
-import addFormats from "ajv-formats";
 import type { ErrorObject, ValidateFunction, AnySchema } from "ajv";
 import type { OpenAPIV3 } from "openapi-types";
+import { makeAjv } from "../util/ajv.ts";
 import { specPathToRegex } from "../generator/coverage-scanner.ts";
 import type { AssertionResult } from "./types.ts";
 
@@ -32,10 +31,7 @@ export function createSchemaValidator(doc: OpenAPIV3.Document): SchemaValidator
   // OpenAPI 3.1 → JSON Schema Draft 2020-12; 3.0 → Draft 4/7-ish.
   // verbose:true exposes parentSchema on each error so humanize() can render
   // the full required-set alongside the missing field name (TASK-277).
-  const ajv = isV31
-    ? new (Ajv2020 as unknown as typeof Ajv)({ strict: false, allErrors: true, verbose: true })
-    : new Ajv({ strict: false, allErrors: true, verbose: true });
-  addFormats(ajv);
+  const ajv = makeAjv(isV31, { strict: false, allErrors: true, verbose: true });
   applyStrictFormats(ajv);
 
   const endpoints: EndpointEntry[] = [];

package/src/core/runner/send-request.ts

@@ -3,11 +3,7 @@ import { loadEnvironment, substituteString, substituteDeep } from "../parser/var
 import { getDb } from "../../db/schema.ts";
 import { findCollectionByNameOrId } from "../../db/queries.ts";
 import { encodeFormBody } from "./form-encode.ts";
-
-function hasHeaderCI(headers: Record<string, string>, name: string): boolean {
-  const lower = name.toLowerCase();
-  return Object.keys(headers).some((k) => k.toLowerCase() === lower);
-}
+import { hasHeaderCI } from "../util/headers.ts";
 
 export function extractByPath(obj: unknown, path: string): unknown {
   return extractByPathWithDiagnostic(obj, path).value;
@@ -31,9 +27,18 @@ export function extractByPathWithDiagnostic(
       return { value: undefined, resolved, failedAt: seg, reason: "previous segment resolved to null/undefined" };
     }
     if (Array.isArray(current)) {
+      // ARV-207: `length` resolves to the array length (jq-style). This
+      // lets `--json-path data.items.length` answer "is the list non-empty?"
+      // in one call — the harvest flow needs it ('length>0 → has data;
+      // length==0 → seed') and previously had to shell out to jq.
+      if (seg === "length") {
+        current = current.length;
+        resolved.push(seg);
+        continue;
+      }
       const idx = parseInt(seg, 10);
       if (isNaN(idx)) {
-        return { value: undefined, resolved, failedAt: seg, reason: `expected an array index, got non-numeric segment "${seg}"` };
+        return { value: undefined, resolved, failedAt: seg, reason: `expected an array index, got non-numeric segment "${seg}" (hint: use 'length' for array size)` };
       }
       if (idx < 0 || idx >= current.length) {
         return { value: undefined, resolved, failedAt: seg, reason: `array index ${idx} out of bounds (length ${current.length})` };

package/src/core/runner/types.ts

@@ -84,5 +84,11 @@ export interface TestRunResult {
   passed: number;
   failed: number;
   skipped: number;
+  /** ARV-318: steps whose status is "error" (couldn't execute — env_issue,
+   *  network, etc.). Previously counted in `total` but in none of
+   *  passed/failed/skipped, so `total === passed+failed+skipped` silently
+   *  broke and error steps reconciled into no bucket. Optional for back-compat
+   *  with older result literals; the runner always sets it. */
+  errored?: number;
   steps: StepResult[];
 }

package/src/core/setup-api.ts

@@ -14,6 +14,7 @@ import {
   serializeApiFixtureManifest,
 } from "./generator/index.ts";
 import { decycleSchema } from "./generator/schema-utils.ts";
+import { mergeOpenApiDocs } from "./spec/merge-specs.ts";
 import { schemeVarName } from "./generator/suite-generator.ts";
 import type { SecuritySchemeInfo } from "./generator/types.ts";
 import { hashSpec } from "./meta/meta-store.ts";
@@ -179,11 +180,17 @@ function toYaml(vars: Record<string, string>): string {
 export interface SetupApiOptions {
   name?: string;
   spec?: string;
+  /** ARV-375: additional specs to union into one merged document. When
+   *  set (length > 1), takes precedence over `spec`; the specs are
+   *  dereferenced individually then merged deterministically (last-wins on
+   *  path/component collision, collisions surfaced as warnings). */
+  specs?: string[];
   dir?: string;
   envVars?: Record<string, string>;
   dbPath?: string;
   force?: boolean;
   insecure?: boolean;
+  caPath?: string;
 }
 
 export interface SetupApiResult {
@@ -221,7 +228,13 @@ function deriveAuthVarNames(schemes: SecuritySchemeInfo[]): string[] {
 }
 
 export async function setupApi(options: SetupApiOptions): Promise<SetupApiResult> {
-  const { spec, dbPath } = options;
+  const { dbPath } = options;
+  // ARV-375: `--spec` may be repeated. `specs` (from the variadic CLI
+  // collector) wins; fall back to the single `spec` for back-compat.
+  const specList = options.specs && options.specs.length > 0
+    ? options.specs
+    : (options.spec ? [options.spec] : []);
+  const spec = specList[0];
 
   getDb(dbPath);
 
@@ -238,22 +251,47 @@ export async function setupApi(options: SetupApiOptions): Promise<SetupApiResult
   // a self-contained file — no external $ref resolution at runtime.
   let dereferencedDoc: unknown = null;
   let authVarNames: string[] = [];
-  if (spec) {
-    const doc = await readOpenApiSpec(spec, { insecure: options.insecure });
-    // Validate the document looks like OpenAPI/Swagger before we snapshot it.
-    // dereference() happily round-trips arbitrary JSON (e.g. a marketing-site
-    // landing payload), so without this guard `zond add api foo --spec
-    // https://example.com` silently registers a 0-endpoint API.
-    const docAny = doc as any;
-    const hasOpenApiField = typeof docAny?.openapi === "string";
-    const hasSwaggerField = typeof docAny?.swagger === "string";
-    if (!hasOpenApiField && !hasSwaggerField) {
-      throw new Error(
-        `Spec at ${spec} is not an OpenAPI/Swagger document — missing top-level 'openapi' (3.x) or 'swagger' (2.x) field. Check the URL points to the JSON spec, not the API root.`,
-      );
+  if (specList.length > 0) {
+    // Read + validate each spec independently. dereference() happily
+    // round-trips arbitrary JSON (e.g. a marketing-site landing payload),
+    // so without this guard `zond add api foo --spec https://example.com`
+    // silently registers a 0-endpoint API.
+    const loaded: { source: string; doc: any }[] = [];
+    for (const s of specList) {
+      const d = await readOpenApiSpec(s, { insecure: options.insecure, caPath: options.caPath });
+      const dAny = d as any;
+      if (typeof dAny?.openapi !== "string" && typeof dAny?.swagger !== "string") {
+        throw new Error(
+          `Spec at ${s} is not an OpenAPI/Swagger document — missing top-level 'openapi' (3.x) or 'swagger' (2.x) field. Check the URL points to the JSON spec, not the API root.`,
+        );
+      }
+      loaded.push({ source: s, doc: d });
+    }
+
+    let doc: any;
+    if (loaded.length === 1) {
+      doc = loaded[0]!.doc;
+      openapiSpec = spec!;
+    } else {
+      // ARV-375: deterministic union of N specs into one audit target.
+      const { merged, summary } = mergeOpenApiDocs(loaded);
+      doc = merged;
+      openapiSpec = null; // no single source path — rely on the local snapshot
+      const per = summary.sources.map((s) => `${s.paths} from ${s.source}`).join(", ");
+      warnings.push(`Merged ${summary.sources.length} specs → ${summary.totalPaths} paths (${per}).`);
+      if (summary.pathCollisions.length > 0) {
+        warnings.push(
+          `${summary.pathCollisions.length} path collision(s) — later spec wins: ${summary.pathCollisions.join(", ")}.`,
+        );
+      }
+      if (summary.schemaConflicts.length > 0) {
+        warnings.push(
+          `${summary.schemaConflicts.length} component collision(s) with differing shapes (later wins, verify): ${summary.schemaConflicts.join(", ")}.`,
+        );
+      }
     }
     dereferencedDoc = doc;
-    openapiSpec = spec;
+    const docAny = doc as any;
     if ((doc as any).servers?.[0]?.url) {
       baseUrl = (doc as any).servers[0].url;
       // Resolve OpenAPI server variables (e.g. {region}) using their declared defaults.

package/src/core/severity/index.ts

@@ -13,14 +13,6 @@
 
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
 
-export const SEVERITY_ORDER: readonly Severity[] = [
-  "critical",
-  "high",
-  "medium",
-  "low",
-  "info",
-] as const;
-
 const SEVERITY_RANK: Record<Severity, number> = {
   critical: 0,
   high: 1,
@@ -29,65 +21,10 @@ const SEVERITY_RANK: Record<Severity, number> = {
   info: 4,
 };
 
-/**
- * Strength of evidence backing a finding. Drives the severity cap
- * applied at finding-emission time.
- *
- * - `end_to_end`: zond demonstrated the impact itself (read another
- *   user's data, executed action without auth, file read confirmed).
- *   Required for CRITICAL.
- * - `evidence_chain`: ≥2 requests prove the finding (storage +
- *   reflection found, follow-up GET shows persistence, OOB callback
- *   received). Required for HIGH.
- * - `single_signal`: one request/response indicates an anomaly but
- *   no follow-up confirms impact (server accepted CRLF / 169.254 /
- *   is_admin field — outcome unknown). Capped at LOW.
- * - `static`: spec-lint, style, naming, missing additionalProperties.
- *   No runtime evidence. Capped at INFO.
- */
-export type ProofKind = "end_to_end" | "evidence_chain" | "single_signal" | "static";
-
-const PROOF_CAP: Record<ProofKind, Severity> = {
-  end_to_end: "critical",
-  evidence_chain: "high",
-  single_signal: "low",
-  static: "info",
-};
-
-/**
- * Caps a claimed severity by the strength of evidence behind it.
- * Producers should pass their natural severity claim and the proof
- * kind; the cap function downgrades if claim exceeds what evidence
- * supports.
- *
- * Example: mass-assignment probe wants HIGH (dangerous field), but
- * only has single-signal proof (server returned 200, didn't verify
- * persistence). Cap returns LOW. To get HIGH, probe must escalate
- * proof to evidence_chain by doing follow-up GET.
- */
-export function capSeverityByProof(claim: Severity, proof: ProofKind): Severity {
-  const cap = PROOF_CAP[proof];
-  return rankSeverity(claim) < rankSeverity(cap) ? cap : claim;
-}
-
 export function rankSeverity(s: Severity): number {
   return SEVERITY_RANK[s];
 }
 
-/** True iff `a` is at least as severe as `b`. */
-export function isAtLeast(a: Severity, b: Severity): boolean {
-  return rankSeverity(a) <= rankSeverity(b);
-}
-
-/** Highest severity among inputs; returns 'info' on empty list. */
-export function maxSeverity(items: readonly Severity[]): Severity {
-  let best: Severity = "info";
-  for (const s of items) {
-    if (rankSeverity(s) < rankSeverity(best)) best = s;
-  }
-  return best;
-}
-
 /**
  * Empty severity-bucket map. Use as starting tally; downstream code
  * increments per finding.