@maverick006/security-engine 1.0.2 → 1.0.4

package/dist/deduplication.d.ts

@@ -0,0 +1,16 @@
+import { NormalizedFinding } from '@maverick006/types';
+/**
+ * Options for finding deduplication.
+ */
+export interface DeduplicationOptions {
+    lineTolerance?: number;
+}
+/**
+ * Deduplicates findings across multiple scanners:
+ * 1. Exact duplicates (same scanner, file, rule, line).
+ * 2. Cross-scanner duplicates (e.g. Trivy & npm-audit reporting the same CVE or package vuln).
+ * 3. Line shift tolerance (+/- 3 lines) to handle minor offset differences.
+ * 4. Preserves distinct vulnerabilities on the same file/line.
+ */
+export declare function deduplicateFindings(findings: NormalizedFinding[], options?: DeduplicationOptions): NormalizedFinding[];
+//# sourceMappingURL=deduplication.d.ts.map

package/dist/deduplication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deduplication.d.ts","sourceRoot":"","sources":["../src/deduplication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,MAAM,oBAAoB,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAuDD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,EAAE,CA6CrB"}

package/dist/deduplication.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deduplicateFindings = deduplicateFindings;
+/**
+ * Normalizes a rule or CVE identifier to detect cross-scanner duplicates.
+ */
+function normalizeIdentifier(finding) {
+    // If CVE or CWE is present, prioritize that as universal identifier
+    const cveMatch = (finding.ruleId || finding.title || finding.description || '').match(/CVE-\d{4}-\d+/i);
+    if (cveMatch) {
+        return cveMatch[0].toUpperCase();
+    }
+    // If package-based vulnerability, match package + cwe/rule
+    if (finding.package) {
+        const pkg = finding.package.toLowerCase();
+        const cwe = finding.cwe ? finding.cwe.toLowerCase() : '';
+        return `pkg:${pkg}:${cwe || finding.ruleId || 'vuln'}`;
+    }
+    // Generic rule ID fallback
+    return (finding.ruleId || finding.title || 'unknown').toLowerCase().trim();
+}
+/**
+ * Normalizes file paths for reliable cross-platform comparison.
+ */
+function normalizeFilePath(filePath) {
+    if (!filePath)
+        return '';
+    return filePath.replace(/\\/g, '/').toLowerCase().trim();
+}
+/**
+ * Merges two findings for the same vulnerability, retaining the highest confidence and most complete metadata.
+ */
+function mergeFindings(primary, secondary) {
+    return {
+        ...primary,
+        // Keep the more severe or primary severity
+        severity: primary.severity || secondary.severity,
+        confidence: primary.confidence || secondary.confidence,
+        cwe: primary.cwe || secondary.cwe,
+        owasp: primary.owasp || secondary.owasp,
+        remediation: primary.remediation || secondary.remediation,
+        codeSnippet: primary.codeSnippet || secondary.codeSnippet,
+        package: primary.package || secondary.package,
+        packageVersion: primary.packageVersion || secondary.packageVersion,
+        fixedVersion: primary.fixedVersion || secondary.fixedVersion,
+        references: Array.from(new Set([...(primary.references || []), ...(secondary.references || [])])),
+        // Note in scanner if multiple scanners detected it
+        scanner: primary.scanner.includes(secondary.scanner)
+            ? primary.scanner
+            : `${primary.scanner}, ${secondary.scanner}`
+    };
+}
+/**
+ * Deduplicates findings across multiple scanners:
+ * 1. Exact duplicates (same scanner, file, rule, line).
+ * 2. Cross-scanner duplicates (e.g. Trivy & npm-audit reporting the same CVE or package vuln).
+ * 3. Line shift tolerance (+/- 3 lines) to handle minor offset differences.
+ * 4. Preserves distinct vulnerabilities on the same file/line.
+ */
+function deduplicateFindings(findings, options = {}) {
+    const lineTolerance = options.lineTolerance ?? 3;
+    const deduplicated = [];
+    for (const candidate of findings) {
+        const candidateFile = normalizeFilePath(candidate.file);
+        const candidateId = normalizeIdentifier(candidate);
+        const candidateLine = candidate.line || 0;
+        let matchedIndex = -1;
+        for (let i = 0; i < deduplicated.length; i++) {
+            const existing = deduplicated[i];
+            const existingFile = normalizeFilePath(existing.file);
+            const existingId = normalizeIdentifier(existing);
+            const existingLine = existing.line || 0;
+            // Check for same file & same vulnerability identity
+            const isSameFile = candidateFile && existingFile ? candidateFile === existingFile : true;
+            const isSameVuln = candidateId === existingId;
+            if (isSameFile && isSameVuln) {
+                // If line numbers exist, check line tolerance
+                if (candidateLine > 0 && existingLine > 0) {
+                    if (Math.abs(candidateLine - existingLine) <= lineTolerance) {
+                        matchedIndex = i;
+                        break;
+                    }
+                }
+                else {
+                    // If either lacks line numbers (e.g. package/repo level), treat as match
+                    matchedIndex = i;
+                    break;
+                }
+            }
+        }
+        if (matchedIndex >= 0) {
+            // Merge with existing finding
+            deduplicated[matchedIndex] = mergeFindings(deduplicated[matchedIndex], candidate);
+        }
+        else {
+            deduplicated.push({ ...candidate });
+        }
+    }
+    return deduplicated;
+}
+//# sourceMappingURL=deduplication.js.map

package/dist/deduplication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deduplication.js","sourceRoot":"","sources":["../src/deduplication.ts"],"names":[],"mappings":";;AAqEA,kDAgDC;AA5GD;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAA0B;IACrD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxG,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,2DAA2D;IAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,GAAG,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,2BAA2B;IAC3B,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAiB;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,OAA0B,EAAE,SAA4B;IAC7E,OAAO;QACL,GAAG,OAAO;QACV,2CAA2C;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ;QAChD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU;QACtD,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG;QACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK;QACvC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW;QACzD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW;QACzD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;QAC7C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc;QAClE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY;QAC5D,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,mDAAmD;QACnD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CACjC,QAA6B,EAC7B,UAAgC,EAAE;IAElC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IACjD,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC;QAE1C,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;YAExC,oDAAoD;YACpD,MAAM,UAAU,GAAG,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,MAAM,UAAU,GAAG,WAAW,KAAK,UAAU,CAAC;YAE9C,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;gBAC7B,8CAA8C;gBAC9C,IAAI,aAAa,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,YAAY,CAAC,IAAI,aAAa,EAAE,CAAC;wBAC5D,YAAY,GAAG,CAAC,CAAC;wBACjB,MAAM;oBACR,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,yEAAyE;oBACzE,YAAY,GAAG,CAAC,CAAC;oBACjB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACtB,8BAA8B;YAC9B,YAAY,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './scanner';
 export * from './orchestrator';
 export * from './scoring';
+export * from './deduplication';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./scanner"), exports);
 __exportStar(require("./orchestrator"), exports);
 __exportStar(require("./scoring"), exports);
+__exportStar(require("./deduplication"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,iDAA+B;AAC/B,4CAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,iDAA+B;AAC/B,4CAA0B;AAC1B,kDAAgC"}

package/dist/orchestrator.d.ts

@@ -1,18 +1,23 @@
-import { ScanInput, ScannerResult } from '@maverick006/types';
+import { ScanInput, ScannerResult, ScannerCoverage } from '@maverick006/types';
 import { SecurityScanner } from './scanner';
+export interface OrchestratorOptions {
+    concurrencyLimit?: number;
+    timeoutMs?: number;
+}
+export interface OrchestratedScanResult extends ScannerResult {
+    scannerResults: ScannerResult[];
+    coverage: ScannerCoverage;
+}
 /**
  * Orchestrates the execution of multiple security scanners and aggregates/deduplicates their findings.
  */
 export declare class Orchestrator {
     private scanners;
-    constructor(scanners: SecurityScanner[]);
-    /**
-     * Executes all registered scanners against the given input.
-     */
-    runScan(input: ScanInput): Promise<ScannerResult>;
+    private options;
+    constructor(scanners: SecurityScanner[], options?: OrchestratorOptions);
     /**
-     * Deduplicates findings based on a fingerprint generated from ruleId, file, line, and column.
+     * Executes registered scanners using a bounded concurrency pool.
      */
-    private deduplicateFindings;
+    runScan(input: ScanInput): Promise<OrchestratedScanResult>;
 }
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAyB;gBAE7B,QAAQ,EAAE,eAAe,EAAE;IAIvC;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAsCvD;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAiB5B"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,SAAS,EAAE,aAAa,EAAgB,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AA+CD;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,OAAO,CAAsB;gBAEzB,QAAQ,EAAE,eAAe,EAAE,EAAE,OAAO,GAAE,mBAAwB;IAQ1E;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAsIjE"}

package/dist/orchestrator.js

@@ -1,67 +1,182 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Orchestrator = void 0;
+const types_1 = require("@maverick006/types");
+const deduplication_1 = require("./deduplication");
+/**
+ * Runs tasks with a bounded concurrency pool (no unlimited Promise.all).
+ */
+async function runWithConcurrencyLimit(items, limit, fn) {
+    const results = new Array(items.length);
+    let currentIndex = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (currentIndex < items.length) {
+            const index = currentIndex++;
+            results[index] = await fn(items[index]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * Wraps a promise with a timeout.
+ */
+function withTimeout(promise, timeoutMs, scannerName) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            const err = new Error(`Scanner ${scannerName} timed out after ${timeoutMs}ms`);
+            err.code = 'ETIMEDOUT';
+            reject(err);
+        }, timeoutMs);
+        promise
+            .then(val => {
+            clearTimeout(timer);
+            resolve(val);
+        })
+            .catch(err => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
 /**
  * Orchestrates the execution of multiple security scanners and aggregates/deduplicates their findings.
  */
 class Orchestrator {
     scanners = [];
-    constructor(scanners) {
+    options;
+    constructor(scanners, options = {}) {
         this.scanners = scanners;
+        this.options = {
+            concurrencyLimit: options.concurrencyLimit ?? 3,
+            timeoutMs: options.timeoutMs ?? 120_000
+        };
     }
     /**
-     * Executes all registered scanners against the given input.
+     * Executes registered scanners using a bounded concurrency pool.
      */
     async runScan(input) {
         const startTime = new Date();
-        // Execute all scanners concurrently
-        const scanPromises = this.scanners.map(scanner => scanner.scan(input));
-        const results = await Promise.allSettled(scanPromises);
+        const concurrency = this.options.concurrencyLimit ?? 3;
+        const timeout = this.options.timeoutMs ?? 120_000;
+        const executeScanner = async (scanner) => {
+            const scanStart = new Date();
+            // Check applicability if scanner provides capability detection
+            if (scanner.capabilities?.detectApplicability) {
+                try {
+                    const isApplicable = await scanner.capabilities.detectApplicability(input.repositoryPath, input);
+                    if (!isApplicable) {
+                        const scanEnd = new Date();
+                        return {
+                            scanner: scanner.name,
+                            success: true,
+                            state: types_1.ScannerState.SKIPPED,
+                            reason: `Skipped: Not applicable to repository or target`,
+                            findings: [],
+                            startTime: scanStart,
+                            endTime: scanEnd,
+                            durationMs: scanEnd.getTime() - scanStart.getTime()
+                        };
+                    }
+                }
+                catch (err) {
+                    console.warn(`Applicability check error for ${scanner.name}:`, err.message);
+                }
+            }
+            try {
+                const scanPromise = scanner.scan(input);
+                const result = await withTimeout(scanPromise, timeout, scanner.name);
+                const scanEnd = new Date();
+                return {
+                    ...result,
+                    state: result.state || (result.success ? types_1.ScannerState.SUCCESS : types_1.ScannerState.FAILED),
+                    durationMs: scanEnd.getTime() - scanStart.getTime(),
+                    endTime: scanEnd
+                };
+            }
+            catch (err) {
+                const scanEnd = new Date();
+                const durationMs = scanEnd.getTime() - scanStart.getTime();
+                if (err.code === 'ETIMEDOUT') {
+                    return {
+                        scanner: scanner.name,
+                        success: false,
+                        state: types_1.ScannerState.TIMEOUT,
+                        error: err.message,
+                        reason: `Execution exceeded timeout of ${timeout}ms`,
+                        findings: [],
+                        startTime: scanStart,
+                        endTime: scanEnd,
+                        durationMs
+                    };
+                }
+                if (err.code === 'ENOENT') {
+                    return {
+                        scanner: scanner.name,
+                        success: false,
+                        state: types_1.ScannerState.NOT_INSTALLED,
+                        error: err.message,
+                        reason: `Scanner executable was not found on PATH`,
+                        findings: [],
+                        startTime: scanStart,
+                        endTime: scanEnd,
+                        durationMs
+                    };
+                }
+                return {
+                    scanner: scanner.name,
+                    success: false,
+                    state: types_1.ScannerState.FAILED,
+                    error: err.message || String(err),
+                    findings: [],
+                    startTime: scanStart,
+                    endTime: scanEnd,
+                    durationMs
+                };
+            }
+        };
+        // Execute through bounded concurrency worker pool
+        const scannerResults = await runWithConcurrencyLimit(this.scanners, concurrency, executeScanner);
         let allFindings = [];
         const rawOutputs = {};
-        for (let i = 0; i < results.length; i++) {
-            const result = results[i];
-            const scannerName = this.scanners[i].name;
-            if (result.status === 'fulfilled') {
-                const data = result.value;
+        for (const data of scannerResults) {
+            if (data.findings && data.findings.length > 0) {
                 allFindings = allFindings.concat(data.findings);
-                if (data.rawOutput) {
-                    rawOutputs[scannerName] = data.rawOutput;
-                }
             }
-            else {
-                // Log scanner failure safely (in production this would use a proper logger)
-                console.error(`Scanner ${scannerName} failed:`, result.reason);
+            if (data.rawOutput) {
+                rawOutputs[data.scanner] = data.rawOutput;
             }
         }
-        const deduplicatedFindings = this.deduplicateFindings(allFindings);
+        // High-precision deduplication across scanners with line tolerance
+        const deduplicatedFindings = (0, deduplication_1.deduplicateFindings)(allFindings);
+        // Standardize finding IDs to VG-FIND-001, VG-FIND-002, etc.
+        deduplicatedFindings.forEach((finding, index) => {
+            finding.id = `VG-FIND-${String(index + 1).padStart(3, '0')}`;
+        });
+        // Compute coverage matrix based on successful scanner executions
+        const coverage = {
+            code: scannerResults.some(r => r.scanner.toLowerCase().includes('semgrep') && r.state === types_1.ScannerState.SUCCESS),
+            dependencies: scannerResults.some(r => (r.scanner.toLowerCase().includes('npm') || r.scanner.toLowerCase().includes('audit') || r.scanner.toLowerCase().includes('trivy')) && r.state === types_1.ScannerState.SUCCESS),
+            secrets: scannerResults.some(r => r.scanner.toLowerCase().includes('gitleaks') && r.state === types_1.ScannerState.SUCCESS),
+            containers: scannerResults.some(r => r.scanner.toLowerCase().includes('trivy') && r.state === types_1.ScannerState.SUCCESS),
+            iac: scannerResults.some(r => r.scanner.toLowerCase().includes('checkov') && r.state === types_1.ScannerState.SUCCESS),
+            web: scannerResults.some(r => r.scanner.toLowerCase().includes('zap') && r.state === types_1.ScannerState.SUCCESS),
+            cloud: scannerResults.some(r => (r.scanner.toLowerCase().includes('prowler') || r.scanner.toLowerCase().includes('cspm')) && r.state === types_1.ScannerState.SUCCESS)
+        };
+        const endTime = new Date();
         return {
             scanner: 'VibeGuard_Orchestrator',
-            success: true,
+            success: scannerResults.some(r => r.state === types_1.ScannerState.SUCCESS),
+            state: types_1.ScannerState.SUCCESS,
+            durationMs: endTime.getTime() - startTime.getTime(),
             findings: deduplicatedFindings,
-            rawOutput: JSON.stringify(rawOutputs), // Aggregate raw outputs
+            scannerResults,
+            coverage,
+            rawOutput: JSON.stringify(rawOutputs),
             startTime,
-            endTime: new Date()
+            endTime
         };
     }
-    /**
-     * Deduplicates findings based on a fingerprint generated from ruleId, file, line, and column.
-     */
-    deduplicateFindings(findings) {
-        const unique = new Map();
-        for (const finding of findings) {
-            // Create a unique fingerprint for the finding
-            const fingerprint = `${finding.ruleId}-${finding.file}-${finding.line}-${finding.column}`;
-            if (!unique.has(fingerprint)) {
-                unique.set(fingerprint, finding);
-            }
-            else {
-                // If it already exists, we might want to merge information, but for now we keep the first one
-                // Optionally, if the new one has higher confidence, we could replace it.
-            }
-        }
-        return Array.from(unique.values());
-    }
 }
 exports.Orchestrator = Orchestrator;
 //# sourceMappingURL=orchestrator.js.map

package/dist/orchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":";;;AAGA;;GAEG;AACH,MAAa,YAAY;IACf,QAAQ,GAAsB,EAAE,CAAC;IAEzC,YAAY,QAA2B;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAAgB;QAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,oCAAoC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAEvD,IAAI,WAAW,GAAwB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAE9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1C,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC1B,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,4EAA4E;gBAC5E,OAAO,CAAC,KAAK,CAAC,WAAW,WAAW,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEnE,OAAO;YACL,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,oBAAoB;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,wBAAwB;YAC/D,SAAS;YACT,OAAO,EAAE,IAAI,IAAI,EAAE;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,QAA6B;QACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QAEpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAE1F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,8FAA8F;gBAC9F,yEAAyE;YAC3E,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AApED,oCAoEC"}
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":";;;AAAA,8CAAgH;AAEhH,mDAAsD;AAYtD;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,KAAU,EACV,KAAa,EACb,EAA2B;IAE3B,MAAM,OAAO,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/E,OAAO,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,SAAiB,EAAE,WAAmB;IACjF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,WAAW,oBAAoB,SAAS,IAAI,CAAC,CAAC;YAC9E,GAAW,CAAC,IAAI,GAAG,WAAW,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,OAAO;aACJ,IAAI,CAAC,GAAG,CAAC,EAAE;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACX,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAa,YAAY;IACf,QAAQ,GAAsB,EAAE,CAAC;IACjC,OAAO,CAAsB;IAErC,YAAY,QAA2B,EAAE,UAA+B,EAAE;QACxE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,KAAgB;QAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QAElD,MAAM,cAAc,GAAG,KAAK,EAAE,OAAwB,EAA0B,EAAE;YAChF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAE7B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;oBACjG,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;wBAC3B,OAAO;4BACL,OAAO,EAAE,OAAO,CAAC,IAAI;4BACrB,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,oBAAY,CAAC,OAAO;4BAC3B,MAAM,EAAE,iDAAiD;4BACzD,QAAQ,EAAE,EAAE;4BACZ,SAAS,EAAE,SAAS;4BACpB,OAAO,EAAE,OAAO;4BAChB,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;yBACpD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;gBAE3B,OAAO;oBACL,GAAG,MAAM;oBACT,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAY,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAY,CAAC,MAAM,CAAC;oBACpF,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;oBACnD,OAAO,EAAE,OAAO;iBACjB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;gBAE3D,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC7B,OAAO;wBACL,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oBAAY,CAAC,OAAO;wBAC3B,KAAK,EAAE,GAAG,CAAC,OAAO;wBAClB,MAAM,EAAE,iCAAiC,OAAO,IAAI;wBACpD,QAAQ,EAAE,EAAE;wBACZ,SAAS,EAAE,SAAS;wBACpB,OAAO,EAAE,OAAO;wBAChB,UAAU;qBACX,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO;wBACL,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oBAAY,CAAC,aAAa;wBACjC,KAAK,EAAE,GAAG,CAAC,OAAO;wBAClB,MAAM,EAAE,0CAA0C;wBAClD,QAAQ,EAAE,EAAE;wBACZ,SAAS,EAAE,SAAS;wBACpB,OAAO,EAAE,OAAO;wBAChB,UAAU;qBACX,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,IAAI;oBACrB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,oBAAY,CAAC,MAAM;oBAC1B,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;oBACjC,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,SAAS;oBACpB,OAAO,EAAE,OAAO;oBAChB,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,kDAAkD;QAClD,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAEjG,IAAI,WAAW,GAAwB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAE9C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,MAAM,oBAAoB,GAAG,IAAA,mCAAmB,EAAC,WAAW,CAAC,CAAC;QAE9D,4DAA4D;QAC5D,oBAAoB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9C,OAAO,CAAC,EAAE,GAAG,WAAW,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,MAAM,QAAQ,GAAoB;YAChC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YAC/G,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YAC/M,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YACnH,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YACnH,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YAC9G,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YAC1G,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;SAC/J,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAY,CAAC,OAAO,CAAC;YACnE,KAAK,EAAE,oBAAY,CAAC,OAAO;YAC3B,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;YACnD,QAAQ,EAAE,oBAAoB;YAC9B,cAAc;YACd,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACrC,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AArJD,oCAqJC"}

package/dist/scanner.d.ts

@@ -1,4 +1,9 @@
 import { ScanInput, ScannerResult } from '@maverick006/types';
+export interface ScannerCapability {
+    category: 'code' | 'dependencies' | 'secrets' | 'containers' | 'iac' | 'web' | 'cloud';
+    requiresCredentials?: boolean;
+    detectApplicability?: (repoPath: string, input?: ScanInput) => Promise<boolean> | boolean;
+}
 /**
  * Base interface that all VibeGuard scanners must implement.
  * This provides the core abstraction allowing new scanners to be added
@@ -13,6 +18,10 @@ export interface SecurityScanner {
      * The version of the scanner, if known/applicable.
      */
     version?: string;
+    /**
+     * Optional capability metadata and applicability detection.
+     */
+    capabilities?: ScannerCapability;
     /**
      * Executes the scanner against the given input.
      *

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChD"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IACvF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3F;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChD"}

package/dist/scoring.d.ts

@@ -1,7 +1,5 @@
-import { NormalizedFinding } from '@maverick006/types';
-export interface ScoreResult {
-    score: number;
-    grade: 'A' | 'B' | 'C' | 'D' | 'F';
+import { NormalizedFinding, ScannerCoverage, DeterministicScore } from '@maverick006/types';
+export interface ScoreResult extends DeterministicScore {
     metrics: {
         critical: number;
         high: number;
@@ -10,15 +8,23 @@ export interface ScoreResult {
     };
 }
 /**
- * Calculates a deterministic security score and grade based on the volume and severity of findings.
- * Weights: CRITICAL=100, HIGH=20, MEDIUM=5, LOW=1
+ * Calculates a deterministic, reproducible security score (0 to 100) and grade
+ * based on the volume and severity of unique findings.
  *
- * Grade thresholds:
- * A: <= 10  (e.g., up to 2 mediums, or 10 lows)
- * B: <= 30  (e.g., 1 high, or several mediums)
- * C: <= 70  (e.g., 3 highs)
- * D: <= 150 (e.g., many highs, but no criticals. Or 1 critical and nothing else = 100, wait, 1 critical is auto F)
- * F: > 150 OR any CRITICAL finding.
+ * Rules:
+ * - Base score: 100
+ * - Critical: -30 points per finding (any critical forces Grade F and caps score at <= 49)
+ * - High: -10 points per finding
+ * - Medium: -3 points per finding
+ * - Low: -1 point per finding
+ * - Info: 0 points
+ *
+ * Grades:
+ * A: 90 - 100
+ * B: 80 - 89
+ * C: 70 - 79
+ * D: 50 - 69
+ * F: < 50 OR any CRITICAL finding
  */
-export declare function calculateScore(findings: NormalizedFinding[]): ScoreResult;
+export declare function calculateScore(findings: NormalizedFinding[], coverage?: Partial<ScannerCoverage>): ScoreResult;
 //# sourceMappingURL=scoring.d.ts.map

package/dist/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,MAAM,oBAAoB,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnC,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAsDzE"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,eAAe,EAAE,kBAAkB,EAAmB,MAAM,oBAAoB,CAAC;AAEvH,MAAM,WAAW,WAAY,SAAQ,kBAAkB;IACrD,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAClC,WAAW,CA0Hb"}