@nimiplatform/nimi-coding 0.3.0 → 0.4.0

package/cli/lib/authority/query.mjs

@@ -0,0 +1,162 @@
+import { Buffer } from "node:buffer";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+
+import { compileAuthorityPath } from "./compile.mjs";
+import { compareText, makeDiagnostic, portablePath } from "./diagnostics.mjs";
+
+const PACKET_FORMAT = "nimicoding.authority-context/v1";
+const CLOSURE_CATEGORIES = ["applies_to", "supersedes"];
+
+async function inputLocation(inputPath) {
+  const absolute = path.resolve(inputPath);
+  const info = await stat(absolute);
+  return {
+    basePath: info.isDirectory() ? absolute : path.dirname(absolute),
+    label: info.isDirectory() ? "." : path.basename(absolute),
+  };
+}
+
+function queryDiagnostic(location, code, id, reason, repair, mapped = null) {
+  return makeDiagnostic({
+    code,
+    file: mapped ? portablePath(mapped.file, location.basePath) : location.label,
+    range: mapped?.range ?? { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: "/id",
+    reason: `${reason}: ${id}`,
+    repair,
+  });
+}
+
+function mappedId(compiled, unitIndex) {
+  return compiled.sourceMap.fields[`/units/${unitIndex}/id`] ?? null;
+}
+
+function buildPacket(compiled, selectedIds, rootId, closure, basePath) {
+  const sourceIndices = compiled.ir.units
+    .map((unit, index) => ({ unit, index }))
+    .filter(({ unit }) => selectedIds.has(unit.id))
+    .sort((left, right) => compareText(left.unit.id, right.unit.id));
+  const fields = {};
+  sourceIndices.forEach(({ index: sourceIndex }, packetIndex) => {
+    const prefix = `/units/${sourceIndex}`;
+    for (const [pointer, mapped] of Object.entries(compiled.sourceMap.fields)) {
+      if (pointer !== prefix && !pointer.startsWith(`${prefix}/`)) continue;
+      const suffix = pointer.slice(prefix.length);
+      fields[`/units/${packetIndex}${suffix}`] = {
+        ...mapped,
+        file: portablePath(mapped.file, basePath),
+      };
+    }
+  });
+  return {
+    format: PACKET_FORMAT,
+    root: rootId,
+    closure,
+    units: sourceIndices.map(({ unit }) => unit),
+    sourceMap: { fields },
+  };
+}
+
+export function canonicalPacketBytes(packet) {
+  return Buffer.byteLength(JSON.stringify(packet), "utf8");
+}
+
+function failedResult(compiled, diagnostics = compiled.diagnostics) {
+  return {
+    ok: false,
+    diagnostics,
+    fileCount: compiled.fileCount,
+    unitCount: 0,
+    packetBytes: 0,
+    packet: null,
+  };
+}
+
+function boundedPacketResult(compiled, packet, maxBytes, rootIndex, location) {
+  const packetBytes = canonicalPacketBytes(packet);
+  if (packetBytes > maxBytes) return failedResult(compiled, [queryDiagnostic(
+    location,
+    "AUTH_CONTEXT_BUDGET",
+    packet.root,
+    `complete canonical packet requires ${packetBytes} UTF-8 bytes but max-bytes is ${maxBytes}`,
+    "increase the explicit byte budget or choose a narrower exact root; partial context is forbidden",
+    mappedId(compiled, rootIndex),
+  )]);
+  return {
+    ok: true,
+    diagnostics: [],
+    fileCount: compiled.fileCount,
+    unitCount: packet.units.length,
+    packetBytes,
+    packet,
+  };
+}
+
+export async function queryAuthorityPath(inputPath, id, { maxBytes }) {
+  const compiled = await compileAuthorityPath(inputPath);
+  if (!compiled.ok) return failedResult(compiled);
+  const location = await inputLocation(inputPath);
+  const unitIndex = compiled.ir.units.findIndex((unit) => unit.id === id);
+  if (unitIndex < 0) return failedResult(compiled, [queryDiagnostic(
+    location,
+    "AUTH_QUERY_NOT_FOUND",
+    id,
+    "authority identity does not resolve",
+    "use an exact admitted authority ID; do not infer a near match",
+  )]);
+  const packet = buildPacket(compiled, new Set([id]), id, {
+    direction: "exact",
+    relationCategories: [],
+    maxBytes,
+    complete: true,
+  }, location.basePath);
+  return boundedPacketResult(compiled, packet, maxBytes, unitIndex, location);
+}
+
+export async function contextAuthorityPath(inputPath, id, { maxUnits, maxBytes }) {
+  const compiled = await compileAuthorityPath(inputPath);
+  if (!compiled.ok) return failedResult(compiled);
+  const location = await inputLocation(inputPath);
+  const byId = new Map(compiled.ir.units.map((unit, index) => [unit.id, { unit, index }]));
+  const root = byId.get(id);
+  if (!root) return failedResult(compiled, [queryDiagnostic(
+    location,
+    "AUTH_QUERY_NOT_FOUND",
+    id,
+    "context root does not resolve",
+    "use an exact admitted authority ID; do not infer a near match",
+  )]);
+
+  const selected = new Set();
+  const pending = [id];
+  while (pending.length > 0) {
+    const currentId = pending.shift();
+    if (selected.has(currentId)) continue;
+    selected.add(currentId);
+    const current = byId.get(currentId).unit;
+    const targets = current.relations
+      .filter((relation) => CLOSURE_CATEGORIES.includes(relation.type))
+      .map((relation) => relation.target)
+      .sort(compareText);
+    for (const target of targets) if (!selected.has(target)) pending.push(target);
+  }
+
+  if (selected.size > maxUnits) return failedResult(compiled, [queryDiagnostic(
+    location,
+    "AUTH_CONTEXT_BUDGET",
+    id,
+    `complete context requires ${selected.size} units but max-units is ${maxUnits}`,
+    "increase the explicit unit budget or choose a narrower exact root; partial context is forbidden",
+    mappedId(compiled, root.index),
+  )]);
+
+  const packet = buildPacket(compiled, selected, id, {
+    direction: "outgoing_recursive",
+    relationCategories: CLOSURE_CATEGORIES,
+    maxUnits,
+    maxBytes,
+    complete: true,
+  }, location.basePath);
+  return boundedPacketResult(compiled, packet, maxBytes, root.index, location);
+}

package/cli/lib/authority/repository-corpus.mjs

@@ -0,0 +1,37 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+
+// The repository-bound report products -- anchors, consumers, terms and
+// closed-sets -- read a repository and the authority that governs it, then
+// report one against the other. Their guard used to be "somewhere inside this
+// Git repository", which let a fixture directory stand in as the canonical
+// corpus and still produce a report marked complete. The corpus for these
+// products is one exact location.
+//
+// This does not apply to fmt, check, diff, compile or impact: those accept an
+// arbitrary path on purpose, because they read history snapshots and migration
+// inputs that are not the working corpus.
+export const REPOSITORY_CORPUS_SEGMENTS = [".nimi", "spec"];
+export const REPOSITORY_CORPUS_RELATIVE = REPOSITORY_CORPUS_SEGMENTS.join("/");
+
+export async function resolveRepositoryCorpus(repositoryPath, specPath, label) {
+  const repository = await realpath(path.resolve(repositoryPath));
+  const absolute = path.resolve(specPath);
+  let metadata;
+  try {
+    metadata = await lstat(absolute);
+  } catch (error) {
+    throw new Error(`${label} corpus is not readable: ${error.message}`);
+  }
+  if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+    throw new Error(`${label} corpus must be one regular non-symlink directory`);
+  }
+  const resolved = await realpath(absolute);
+  const expected = path.join(repository, ...REPOSITORY_CORPUS_SEGMENTS);
+  if (resolved !== expected) {
+    throw new Error(
+      `${label} corpus must be the repository authority corpus at ${REPOSITORY_CORPUS_RELATIVE}`,
+    );
+  }
+  return { path: resolved, directory: true, relative: REPOSITORY_CORPUS_RELATIVE };
+}

package/cli/lib/authority/repository-inventory.mjs

@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+
+import { compareText } from "./diagnostics.mjs";
+import { listGitTrackedFiles } from "./git-snapshot.mjs";
+
+const REPOSITORY_INVENTORY_FORMAT = "nimicoding.repository-inventory/v1";
+
+function trackedPathSetDigest(files) {
+  const ordered = [...new Set(files)].sort(compareText);
+  // The SHA-256 preimage is exactly the UTF-8 encoding of this compact JSON:
+  // {"format":"nimicoding.repository-inventory/v1","files":[<ordered paths>]}
+  // where paths are the unique Git-decoded tracked paths sorted by compareText.
+  // The repository root is intentionally absent: it locates the inventory but
+  // is not part of the state two reports compare.
+  //
+  // This digest covers the tracked path SET and nothing else - not blob
+  // contents, not the commit, not worktree cleanliness. Two commits whose
+  // files were all rewritten but none renamed produce the same digest. The
+  // name says so on purpose: a field called inventoryDigest would be read as
+  // "these reports describe the same repository state", which this value does
+  // not establish. Content identity is a separate, additive field.
+  const preimage = JSON.stringify({ format: REPOSITORY_INVENTORY_FORMAT, files: ordered });
+  return createHash("sha256").update(preimage, "utf8").digest("hex");
+}
+
+export async function repositoryInventory(repositoryPath) {
+  const inventory = await listGitTrackedFiles(repositoryPath);
+  return {
+    ...inventory,
+    trackedPathSetDigest: trackedPathSetDigest(inventory.files),
+  };
+}
+
+export { REPOSITORY_INVENTORY_FORMAT, trackedPathSetDigest };

package/cli/lib/authority/review.mjs

@@ -0,0 +1,222 @@
+import { Buffer } from "node:buffer";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { auditAuthorityPath } from "./audit.mjs";
+import { compileAuthorityPath } from "./compile.mjs";
+import { makeDiagnostic, portablePath, sortDiagnostics } from "./diagnostics.mjs";
+import { diffAuthorityPaths } from "./diff.mjs";
+import { AuthorityInputError } from "./format.mjs";
+import {
+  AuthorityReviewRefusal,
+  authorityReviewRefusalDiagnostic,
+  captureStableRegularFile,
+  withGitAuthoritySnapshots,
+} from "./git-snapshot.mjs";
+import { impactAuthorityPaths } from "./impact.mjs";
+
+const REVIEW_FORMAT = "nimicoding.authority-review/v1";
+
+function validBudget(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+
+function refused(diagnostics, reviewBytes = 0) {
+  return {
+    ok: false,
+    diagnostics: sortDiagnostics(diagnostics),
+    fileCount: 0,
+    unitCount: 0,
+    reviewBytes,
+    review: null,
+    partial: false,
+  };
+}
+
+function reviewBudgetDiagnostic(requiredBytes, maxBytes) {
+  return makeDiagnostic({
+    code: "AUTH_REVIEW_BUDGET",
+    file: ".",
+    range: { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: "",
+    reason: `complete authority review requires ${requiredBytes} UTF-8 bytes but max-bytes is ${maxBytes}`,
+    repair: "increase the explicit review byte budget; partial change review is forbidden",
+  });
+}
+
+function normalizePath(file, root, side) {
+  const relative = portablePath(file, root);
+  const safe = path.isAbsolute(relative) ? path.basename(relative) : relative;
+  return path.posix.join(side, safe || ".");
+}
+
+function normalizeCompilerDiagnostics(diagnostics, root, side) {
+  return diagnostics.map((diagnostic) => ({
+    ...diagnostic,
+    path: normalizePath(diagnostic.path, root, side),
+    related: diagnostic.related.map((related) => ({
+      ...related,
+      path: normalizePath(related.path, root, side),
+    })),
+  }));
+}
+
+function corpusInputDiagnostic(error, root, side) {
+  const portableRoot = root.split(path.sep).join(path.posix.sep);
+  const reason = error.message
+    .split(root).join(side)
+    .split(portableRoot).join(side)
+    .split(path.sep).join(path.posix.sep);
+  return makeDiagnostic({
+    code: "AUTH_REVIEW_CORPUS_INVALID",
+    file: side,
+    range: { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: "",
+    reason,
+    repair: "provide one complete canonical authority corpus; unsupported or partial inputs are refused",
+  });
+}
+
+async function compileSnapshot(root, side) {
+  try {
+    const result = await compileAuthorityPath(root);
+    if (result.ok) return { result, diagnostics: [] };
+    return { result: null, diagnostics: normalizeCompilerDiagnostics(result.diagnostics, root, side) };
+  } catch (error) {
+    if (error instanceof AuthorityInputError) return { result: null, diagnostics: [corpusInputDiagnostic(error, root, side)] };
+    throw error;
+  }
+}
+
+function inputLabel(file, repository, fallback) {
+  const absolute = path.resolve(process.cwd(), file);
+  const relative = path.relative(repository, absolute);
+  if (relative && !relative.startsWith("..") && !path.isAbsolute(relative)) return relative.split(path.sep).join(path.posix.sep);
+  return path.basename(absolute) || fallback;
+}
+
+async function captureReviewInput(file, temporaryRoot, name, label) {
+  let bytes;
+  try {
+    bytes = await captureStableRegularFile(file, label);
+  } catch (error) {
+    if (error instanceof AuthorityReviewRefusal) {
+      if (error.code === "AUTH_REVIEW_CAPTURE_CHANGED") throw error;
+      throw new AuthorityReviewRefusal("AUTH_REVIEW_INPUT_INVALID", `${name} must be one readable regular non-symlink file`, label);
+    }
+    throw error;
+  }
+  const directory = path.join(temporaryRoot, "inputs");
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  const target = path.join(directory, `${name}.yaml`);
+  await writeFile(target, bytes, { flag: "wx", mode: 0o600 });
+  return target;
+}
+
+function invalidDisposition(result) {
+  return result.diagnostics.some((diagnostic) => diagnostic.code === "AUTH_IMPACT_DISPOSITION_INVALID");
+}
+
+export function canonicalReviewBytes(review) {
+  return Buffer.byteLength(JSON.stringify(review), "utf8");
+}
+
+function component(operationStatus, complete) {
+  return { operationStatus, complete };
+}
+
+async function composeReview(snapshot, bindingsPath, dispositionsPath, budgets) {
+  const bindingsLabel = inputLabel(bindingsPath, snapshot.repository, "bindings.yaml");
+  const dispositionsLabel = inputLabel(dispositionsPath, snapshot.repository, "dispositions.yaml");
+  const capturedBindings = await captureReviewInput(bindingsPath, snapshot.temporaryRoot, "bindings", bindingsLabel);
+  const capturedDispositions = await captureReviewInput(dispositionsPath, snapshot.temporaryRoot, "dispositions", dispositionsLabel);
+  const [baseCompiled, worktreeCompiled] = await Promise.all([
+    compileSnapshot(snapshot.base.root, "base"),
+    compileSnapshot(snapshot.worktree.root, "worktree"),
+  ]);
+  const compilerDiagnostics = [...baseCompiled.diagnostics, ...worktreeCompiled.diagnostics];
+  if (compilerDiagnostics.length > 0) return refused(compilerDiagnostics);
+  if (baseCompiled.result.fileCount !== snapshot.base.fileCount || worktreeCompiled.result.fileCount !== snapshot.worktree.fileCount) {
+    throw new Error("captured authority file counts do not match complete compiler admission");
+  }
+
+  const [diffResult, impactResult, auditResult] = await Promise.all([
+    diffAuthorityPaths(snapshot.base.root, snapshot.worktree.root, { maxBytes: budgets.maxBytes }),
+    impactAuthorityPaths(snapshot.base.root, snapshot.worktree.root, capturedDispositions, { maxBytes: budgets.maxBytes, dispositionLabel: dispositionsLabel }),
+    auditAuthorityPath(snapshot.worktree.root, capturedBindings, { ...budgets, bindingLabel: bindingsLabel }),
+  ]);
+  if (!diffResult.ok || diffResult.diff === null) return refused(diffResult.diagnostics);
+  if (impactResult.impact === null || invalidDisposition(impactResult)) return refused(impactResult.diagnostics);
+  if (auditResult.audit === null) return refused(auditResult.diagnostics);
+  if (JSON.stringify(diffResult.diff) !== JSON.stringify(impactResult.diff)) throw new Error("diff and impact oracles returned different semantic diffs for immutable snapshots");
+
+  const complete = impactResult.impact.complete && auditResult.audit.complete;
+  const policyStatus = auditResult.audit.policyStatus === "blocked"
+    ? "blocked"
+    : complete ? "passed" : "indeterminate";
+  const review = {
+    format: REVIEW_FORMAT,
+    operationStatus: "completed",
+    policyStatus,
+    complete,
+    partial: false,
+    snapshots: {
+      base: {
+        commitOid: snapshot.baseOid,
+        contentIdentity: snapshot.base.contentIdentity,
+        counts: {
+          files: snapshot.base.fileCount,
+          units: baseCompiled.result.unitCount,
+          bytes: snapshot.base.byteCount,
+        },
+      },
+      worktree: {
+        contentIdentity: snapshot.worktree.contentIdentity,
+        counts: {
+          files: snapshot.worktree.fileCount,
+          units: worktreeCompiled.result.unitCount,
+          bytes: snapshot.worktree.byteCount,
+        },
+      },
+    },
+    components: {
+      snapshots: component("completed", true),
+      diff: component("completed", true),
+      impact: component("completed", impactResult.impact.complete),
+      audit: component(auditResult.audit.operationStatus, auditResult.audit.complete),
+    },
+    diff: diffResult.diff,
+    impact: impactResult.impact,
+    audit: auditResult.audit,
+    budgets,
+  };
+  const reviewBytes = canonicalReviewBytes(review);
+  if (reviewBytes > budgets.maxBytes) return refused([reviewBudgetDiagnostic(reviewBytes, budgets.maxBytes)], reviewBytes);
+  return {
+    ok: true,
+    diagnostics: sortDiagnostics(impactResult.diagnostics),
+    fileCount: snapshot.base.fileCount + snapshot.worktree.fileCount,
+    unitCount: worktreeCompiled.result.unitCount,
+    reviewBytes,
+    review,
+    partial: false,
+  };
+}
+
+export async function reviewAuthorityRepository(repositoryPath, baseRef, bindingsPath, dispositionsPath, budgets, options = {}) {
+  if (![budgets?.maxUnits, budgets?.maxEdges, budgets?.maxBytes].every(validBudget)) {
+    return refused([reviewBudgetDiagnostic(1, budgets?.maxBytes ?? 0)]);
+  }
+  try {
+    return await withGitAuthoritySnapshots({
+      repositoryPath,
+      baseRef,
+      hooks: options.snapshotHooks ?? null,
+    }, (snapshot) => composeReview(snapshot, bindingsPath, dispositionsPath, budgets));
+  } catch (error) {
+    if (error instanceof AuthorityReviewRefusal) return refused([authorityReviewRefusalDiagnostic(error)]);
+    throw error;
+  }
+}
+
+export { REVIEW_FORMAT };

package/cli/lib/authority/sarif.mjs

@@ -0,0 +1,181 @@
+const SARIF_SCHEMA =
+  "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";
+const SARIF_VERSION = "2.1.0";
+const TOOL_NAME = "@nimiplatform/nimi-coding";
+const FINGERPRINT_KEY = "nimicoding.semanticFingerprint/v1";
+
+function copy(value) {
+  return value === undefined ? undefined : structuredClone(value);
+}
+
+function portableUri(file) {
+  return String(file)
+    .replaceAll("\\", "/")
+    .split("/")
+    .map((segment) => encodeURIComponent(segment))
+    .join("/");
+}
+
+function physicalLocation(location) {
+  const file = location?.file ?? location?.path;
+  if (typeof file !== "string" || !location?.range) return null;
+  const value = {
+    artifactLocation: { uri: portableUri(file) },
+    region: {
+      startLine: location.range.start.line,
+      startColumn: location.range.start.column,
+      endLine: location.range.end.line,
+      endColumn: location.range.end.column,
+    },
+  };
+  const sourcePointer = location.sourcePointer ?? location.pointer;
+  if (typeof sourcePointer === "string") value.properties = { sourcePointer };
+  return value;
+}
+
+function primaryLocation(location) {
+  const physical = physicalLocation(location);
+  return physical ? [{ physicalLocation: physical }] : [];
+}
+
+function relatedLocations(values = []) {
+  return values.flatMap((entry, index) => {
+    const physical = physicalLocation(entry.location ?? entry);
+    if (!physical) return [];
+    const role = entry.role ?? entry.location?.role;
+    const related = {
+      id: index + 1,
+      physicalLocation: physical,
+    };
+    if (typeof role === "string") {
+      related.message = { text: role };
+      related.properties = { role };
+    }
+    return [related];
+  });
+}
+
+function itemLevel(kind, item) {
+  if (kind === "observation") return "note";
+  if (kind === "gap") return "error";
+  return item.policy === "blocking" ? "error" : "warning";
+}
+
+function auditItemResult(kind, item) {
+  const result = {
+    ruleId: item.code,
+    level: itemLevel(kind, item),
+    message: { text: item.message },
+    locations: primaryLocation(item.primaryLocation),
+    relatedLocations: relatedLocations(item.relatedLocations),
+    partialFingerprints: { [FINGERPRINT_KEY]: item.fingerprint },
+    properties: {
+      kind,
+      code: item.code,
+      fingerprint: item.fingerprint,
+      detector: item.detector,
+      binding: item.binding,
+      premise: item.premise,
+      basis: item.basis,
+      policy: item.policy,
+      authorityRefs: copy(item.authorityRefs),
+      witness: copy(item.witness),
+    },
+  };
+  if (typeof item.target === "string") result.properties.target = item.target;
+  if (result.locations.length === 0) delete result.locations;
+  if (result.relatedLocations.length === 0) delete result.relatedLocations;
+  return result;
+}
+
+function diagnosticResult(diagnostic) {
+  const result = {
+    ruleId: diagnostic.code,
+    level: "error",
+    message: { text: diagnostic.reason },
+    locations: primaryLocation({
+      path: diagnostic.path,
+      range: diagnostic.range,
+      pointer: diagnostic.pointer,
+    }),
+    relatedLocations: relatedLocations(diagnostic.related),
+    properties: {
+      kind: "diagnostic",
+      code: diagnostic.code,
+      severity: diagnostic.severity,
+      pointer: diagnostic.pointer,
+      repair: diagnostic.repair,
+    },
+  };
+  if (result.locations.length === 0) delete result.locations;
+  if (result.relatedLocations.length === 0) delete result.relatedLocations;
+  return result;
+}
+
+function rulesFor(results) {
+  const codes = [...new Set(results.map((result) => result.ruleId))].sort();
+  return codes.map((code) => ({
+    id: code,
+    shortDescription: { text: code },
+  }));
+}
+
+function invocationProperties(result) {
+  if (!result.audit) {
+    return {
+      operationStatus: "refused",
+      policyStatus: "indeterminate",
+      complete: false,
+    };
+  }
+  return {
+    format: result.audit.format,
+    operationStatus: result.audit.operationStatus,
+    policyStatus: result.audit.policyStatus,
+    complete: result.audit.complete,
+    counts: copy(result.audit.counts),
+    budgets: copy(result.audit.budgets),
+  };
+}
+
+export function authorityAuditResultToSarif(result, { toolVersion }) {
+  if (!result || typeof result !== "object")
+    throw new TypeError("authority audit result must be an object");
+  if (typeof toolVersion !== "string" || toolVersion.length === 0)
+    throw new TypeError("toolVersion must be a non-empty string");
+
+  const results = result.audit
+    ? [
+        ...(result.audit.observations ?? []).map((item) => auditItemResult("observation", item)),
+        ...(result.audit.findings ?? []).map((item) => auditItemResult("finding", item)),
+        ...(result.audit.gaps ?? []).map((item) => auditItemResult("gap", item)),
+      ]
+    : (result.diagnostics ?? []).map(diagnosticResult);
+  const rules = rulesFor(results);
+  const ruleIndexes = new Map(rules.map((rule, index) => [rule.id, index]));
+  for (const entry of results) entry.ruleIndex = ruleIndexes.get(entry.ruleId);
+
+  return {
+    $schema: SARIF_SCHEMA,
+    version: SARIF_VERSION,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: TOOL_NAME,
+            version: toolVersion,
+            rules,
+          },
+        },
+        columnKind: "unicodeCodePoints",
+        invocations: [
+          {
+            executionSuccessful: result.ok === true,
+            properties: invocationProperties(result),
+          },
+        ],
+        results,
+      },
+    ],
+  };
+}