@oculum/scanner 1.0.11 → 1.0.13

package/dist/shared/types.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * Scanner Types and Interfaces
+ * Defines the core data structures for the security scanning engine
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCAN_MODE_DEFAULTS = exports.MAX_FILE_SIZE = exports.SPECIAL_FILES = exports.SCANNABLE_EXTENSIONS = void 0;
+exports.createCancellationToken = createCancellationToken;
+exports.createEmptyDetectorContext = createEmptyDetectorContext;
+/**
+ * Create a new cancellation token
+ *
+ * @example
+ * const token = createCancellationToken()
+ * process.on('SIGINT', () => token.cancel('User interrupted'))
+ * const result = await runScan(files, repo, { cancellationToken: token })
+ */
+function createCancellationToken() {
+    const cleanupCallbacks = [];
+    const token = {
+        cancelled: false,
+        reason: undefined,
+        cancel(reason) {
+            if (!token.cancelled) {
+                token.cancelled = true;
+                token.reason = reason;
+                // Run cleanup callbacks
+                cleanupCallbacks.forEach(cb => {
+                    try {
+                        cb();
+                    }
+                    catch (e) {
+                        // Ignore cleanup errors
+                    }
+                });
+            }
+        },
+        onCancel(callback) {
+            if (token.cancelled) {
+                callback(); // Already cancelled, run immediately
+            }
+            else {
+                cleanupCallbacks.push(callback);
+            }
+        }
+    };
+    return token;
+}
+/**
+ * Create an empty/default DetectorContext
+ * Useful for tests or when context isn't available
+ */
+function createEmptyDetectorContext() {
+    return {
+        auth: {
+            middleware: null,
+            authHelpers: {
+                hasThrowingHelpers: false,
+                throwingHelperNames: [],
+            },
+            publicEndpoints: [],
+        },
+        framework: {
+            primary: null,
+            frontend: null,
+            hasTypeScript: false,
+        },
+        dataAccess: {
+            orm: null,
+            hasRLS: false,
+            validationLib: null,
+        },
+        file: {
+            isServerOnly: false,
+            isClientBundled: false,
+            isTestFile: false,
+            isConfigFile: false,
+            isToolingDir: false,
+        },
+    };
+}
+// Supported file extensions for scanning
+exports.SCANNABLE_EXTENSIONS = [
+    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+    '.py', '.rb', '.php', '.go', '.java', '.cs',
+    '.env', '.yaml', '.yml', '.json', '.toml',
+    '.dockerfile', '.sh', '.bash',
+    '.md', // Agent skill files (SKILL.md, copilot-instructions.md, etc.)
+];
+// Files to always scan regardless of extension
+exports.SPECIAL_FILES = [
+    'Dockerfile',
+    'docker-compose.yml',
+    'docker-compose.yaml',
+    '.env',
+    '.env.local',
+    '.env.production',
+    '.env.development',
+    'package.json',
+    'requirements.txt',
+    'Gemfile',
+    'go.mod',
+    '.cursorrules',
+];
+// Max file size to scan (50KB as per PRD)
+exports.MAX_FILE_SIZE = 50 * 1024;
+/**
+ * Default configurations for each scan mode
+ */
+exports.SCAN_MODE_DEFAULTS = {
+    full: {
+        mode: 'full',
+        skipAIValidation: false,
+        skipLayer3: false,
+        maxAIValidationFiles: 50,
+        maxLayer3Files: 15,
+    },
+    incremental: {
+        mode: 'incremental',
+        skipAIValidation: false,
+        skipLayer3: true, // Skip expensive Layer 3 for incremental
+        maxAIValidationFiles: 20,
+        maxLayer3Files: 5,
+    },
+};
+//# sourceMappingURL=types.js.map

package/dist/shared/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAwHH,0DA8BC;AAoQD,gEA4BC;AAtUD;;;;;;;GAOG;AACH,SAAgB,uBAAuB;IACrC,MAAM,gBAAgB,GAAsB,EAAE,CAAA;IAE9C,MAAM,KAAK,GAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,MAAe;YACpB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;gBACtB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;gBACrB,wBAAwB;gBACxB,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;oBAC5B,IAAI,CAAC;wBACH,EAAE,EAAE,CAAA;oBACN,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,wBAAwB;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,QAAQ;YACf,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,QAAQ,EAAE,CAAA,CAAC,qCAAqC;YAClD,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAgQD;;;GAGG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE;gBACX,kBAAkB,EAAE,KAAK;gBACzB,mBAAmB,EAAE,EAAE;aACxB;YACD,eAAe,EAAE,EAAE;SACpB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,KAAK;SACrB;QACD,UAAU,EAAE;YACV,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,IAAI;SACpB;QACD,IAAI,EAAE;YACJ,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,KAAK;SACpB;KACF,CAAA;AACH,CAAC;AAED,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACzC,aAAa,EAAE,KAAK,EAAE,OAAO;IAC7B,KAAK,EAAG,8DAA8D;CACvE,CAAA;AAED,+CAA+C;AAClC,QAAA,aAAa,GAAG;IAC3B,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,cAAc;CACf,CAAA;AAED,0CAA0C;AAC7B,QAAA,aAAa,GAAG,EAAE,GAAG,IAAI,CAAA;AA4EtC;;GAEG;AACU,QAAA,kBAAkB,GAA8C;IAC3E,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,EAAE;KACnB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI,EAAE,yCAAyC;QAC3D,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,CAAC;KAClB;CACF,CAAA"}

package/dist/tiers.d.ts

@@ -10,7 +10,7 @@
  * - Makes it explicit which detectors are safe to expose in cheap scans
  * - Avoids "accidental promotion" of an experimental heuristic to production output
  */
-import type { VulnerabilityCategory } from './types';
+import type { VulnerabilityCategory } from './shared/types';
 /**
  * Detector tiers control visibility and trust level:
  *
@@ -56,7 +56,7 @@ export declare const LAYER1_CATEGORY_TO_DETECTOR: Partial<Record<VulnerabilityCa
 /**
  * Layer 2 detector names (internal identifiers matching detector function names)
  */
-export type Layer2DetectorName = 'dangerous_functions' | 'byok_patterns' | 'ai_execution_sinks' | 'ai_agent_tools' | 'auth_antipatterns' | 'data_exposure' | 'ai_fingerprinting' | 'ai_prompt_hygiene' | 'logic_gates' | 'variables' | 'risky_imports' | 'framework_checks' | 'ai_rag_safety' | 'ai_endpoint_protection' | 'ai_schema_validation' | 'ai_package_hallucination' | 'ai_mcp_security' | 'model_supply_chain';
+export type Layer2DetectorName = 'dangerous_functions' | 'byok_patterns' | 'ai_execution_sinks' | 'ai_agent_tools' | 'auth_antipatterns' | 'data_exposure' | 'ai_fingerprinting' | 'ai_prompt_hygiene' | 'logic_gates' | 'variables' | 'risky_imports' | 'framework_checks' | 'ai_rag_safety' | 'ai_endpoint_protection' | 'ai_schema_validation' | 'ai_package_hallucination' | 'ai_mcp_security' | 'model_supply_chain' | 'security_headers' | 'ssrf_detection' | 'log_injection' | 'xxe_detection';
 /**
  * Layer 2 tier assignments
  *
@@ -106,11 +106,11 @@ export declare function getLayer2DetectorTier(detector: Layer2DetectorName): Det
 /**
  * Check if a tier should be visible at a given scan depth
  */
-export declare function isTierVisibleAtDepth(tier: DetectorTier, depth: 'cheap' | 'validated' | 'deep'): boolean;
+export declare function isTierVisibleAtDepth(tier: DetectorTier, depth: 'local' | 'verified' | 'deep'): boolean;
 /**
  * Check if a tier should go through AI validation at a given scan depth
  */
-export declare function shouldValidateWithAI(tier: DetectorTier, depth: 'cheap' | 'validated' | 'deep'): boolean;
+export declare function shouldValidateWithAI(tier: DetectorTier, depth: 'local' | 'verified' | 'deep'): boolean;
 /**
  * Compute tier statistics from an array of vulnerabilities
  */

package/dist/tiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tiers.d.ts","sourceRoot":"","sources":["../src/tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,aAAa,GAAG,cAAc,CAAA;AAElE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,CAAA;AAEjB;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,EAAE,YAAY,CAQ1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CASlG,CAAA;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,WAAW,GACX,eAAe,GACf,kBAAkB,GAElB,eAAe,GACf,wBAAwB,GACxB,sBAAsB,GAEtB,0BAA0B,GAC1B,iBAAiB,GAEjB,oBAAoB,CAAA;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,EAAE,YAAY,CA6B1E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CA2DlG,CAAA;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GACf,YAAY,CAoBd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,GACpC,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,GACpC,OAAO,CAUT;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;CAAE,CAAC,GAC5E,SAAS,CAaX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAExD"}
+{"version":3,"file":"tiers.d.ts","sourceRoot":"","sources":["../src/tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,aAAa,GAAG,cAAc,CAAA;AAElE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,CAAA;AAEjB;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,EAAE,YAAY,CAQ1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CASlG,CAAA;AAMD;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,WAAW,GACX,eAAe,GACf,kBAAkB,GAElB,eAAe,GACf,wBAAwB,GACxB,sBAAsB,GAEtB,0BAA0B,GAC1B,iBAAiB,GAEjB,oBAAoB,GAEpB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,eAAe,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,EAAE,YAAY,CAmC1E,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAiElG,CAAA;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GACf,YAAY,CAoBd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,YAAY,CAEhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GACnC,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GACnC,OAAO,CAUT;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;CAAE,CAAC,GAC5E,SAAS,CAaX;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAExD"}

package/dist/tiers.js

@@ -105,6 +105,11 @@ exports.LAYER2_DETECTOR_TIERS = {
     ai_mcp_security: 'core', // Tier A - MCP tool security is critical for AI agents
     // AI Detection Roadmap Phase 2
     model_supply_chain: 'core', // Tier A - Model supply chain risks are critical (RCE)
+    // OWASP Workstream 1
+    security_headers: 'ai_assisted', // Tier B - Context-dependent (CDN/proxy may add headers)
+    ssrf_detection: 'core', // Tier A - SSRF is high-impact with clear signals
+    log_injection: 'ai_assisted', // Tier B - Context-dependent (structured logging may be fine)
+    xxe_detection: 'core', // Tier A - XXE is high-impact with clear signals
 };
 /**
  * Mapping from vulnerability category to Layer 2 detector name
@@ -169,6 +174,11 @@ exports.LAYER2_CATEGORY_TO_DETECTOR = {
     ai_unverified_model: 'model_supply_chain',
     ai_unsafe_finetuning: 'model_supply_chain',
     ai_excessive_agency: 'ai_agent_tools', // Extended in ai-agent-tools.ts
+    // OWASP Workstream 1 categories
+    missing_security_headers: 'security_headers',
+    ssrf: 'ssrf_detection',
+    log_injection: 'log_injection',
+    xxe: 'xxe_detection',
 };
 // ============================================================================
 // Tier Lookup Helpers
@@ -213,14 +223,14 @@ function getLayer2DetectorTier(detector) {
  */
 function isTierVisibleAtDepth(tier, depth) {
     switch (depth) {
-        case 'cheap':
-            // Only Tier A (core) findings are visible in cheap scans
+        case 'local':
+            // Only Tier A (core) findings are visible in local scans
             return tier === 'core';
-        case 'validated':
+        case 'verified':
             // Tier A always visible, Tier B visible after AI validation
             return tier === 'core' || tier === 'ai_assisted';
         case 'deep':
-            // Same as validated for visibility (deep adds Layer 3, not more tiers)
+            // Same as verified for visibility (deep adds Layer 3, not more tiers)
             return tier === 'core' || tier === 'ai_assisted';
     }
 }
@@ -228,11 +238,11 @@ function isTierVisibleAtDepth(tier, depth) {
  * Check if a tier should go through AI validation at a given scan depth
  */
 function shouldValidateWithAI(tier, depth) {
-    // Cheap scans skip AI validation entirely
-    if (depth === 'cheap') {
+    // Local scans skip AI validation entirely
+    if (depth === 'local') {
         return false;
     }
-    // In validated/deep, Tier B findings should go through AI validation
+    // In verified/deep, Tier B findings should go through AI validation
     // Tier A is high-precision and doesn't need AI validation
     // Tier C is hidden anyway
     return tier === 'ai_assisted';

package/dist/tiers.js.map

@@ -1 +1 @@
-{"version":3,"file":"tiers.js","sourceRoot":"","sources":["../src/tiers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAgPH,gDAuBC;AAKD,sDAEC;AAKD,sDAEC;AAKD,oDAeC;AAKD,oDAaC;AAKD,4CAeC;AAKD,0CAEC;AAhTD;;;;;;;;;;;;;;;GAeG;AACU,QAAA,qBAAqB,GAA6C;IAC7E,aAAa,EAAE,MAAM;IACrB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;IACtB,OAAO,EAAE,aAAa;IACtB,YAAY,EAAE,aAAa;IAC3B,UAAU,EAAE,aAAa,EAAG,4CAA4C;IACxE,WAAW,EAAE,cAAc;CAC5B,CAAA;AAED;;;GAGG;AACU,QAAA,2BAA2B,GAA+D;IACrG,gBAAgB,EAAE,eAAe;IACjC,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,gBAAgB;IAC/B,mBAAmB,EAAE,SAAS;IAC9B,eAAe,EAAE,cAAc;IAC/B,cAAc,EAAE,cAAc;IAC9B,cAAc,EAAE,YAAY;IAC5B,UAAU,EAAE,aAAa,EAAG,0CAA0C;CACvE,CAAA;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,qBAAqB,GAA6C;IAC7E,iCAAiC;IACjC,mBAAmB,EAAE,MAAM;IAC3B,aAAa,EAAE,MAAM;IACrB,kBAAkB,EAAE,MAAM;IAC1B,cAAc,EAAE,MAAM;IAEtB,kCAAkC;IAClC,iBAAiB,EAAE,aAAa;IAChC,aAAa,EAAE,aAAa;IAC5B,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,aAAa;IAEhC,qCAAqC;IACrC,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,cAAc;IAC7B,gBAAgB,EAAE,cAAc;IAEhC,2BAA2B;IAC3B,aAAa,EAAE,MAAM,EAAY,gDAAgD;IACjF,sBAAsB,EAAE,MAAM,EAAG,uDAAuD;IACxF,oBAAoB,EAAE,aAAa,EAAE,0DAA0D;IAE/F,+BAA+B;IAC/B,wBAAwB,EAAE,MAAM,EAAG,6CAA6C;IAChF,eAAe,EAAE,MAAM,EAAY,uDAAuD;IAC1F,+BAA+B;IAC/B,kBAAkB,EAAE,MAAM,EAAS,uDAAuD;CAC3F,CAAA;AAED;;;;;;;;;;GAUG;AACU,QAAA,2BAA2B,GAA+D;IACrG,kCAAkC;IAClC,kBAAkB,EAAE,qBAAqB;IACzC,aAAa,EAAE,qBAAqB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,sBAAsB,EAAE,gBAAgB;IAExC,oBAAoB;IACpB,YAAY,EAAE,mBAAmB;IACjC,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,mBAAmB;IAExC,6EAA6E;IAC7E,+DAA+D;IAC/D,8CAA8C;IAC9C,iEAAiE;IACjE,yFAAyF;IACzF,qEAAqE;IACrE,UAAU,EAAE,mBAAmB;IAE/B,oBAAoB;IACpB,eAAe,EAAE,aAAa;IAC9B,kBAAkB,EAAE,WAAW;IAC/B,kBAAkB,EAAE,eAAe;IACnC,qBAAqB,EAAE,kBAAkB;IACzC,6DAA6D;IAC7D,sFAAsF;IACtF,eAAe,EAAE,kBAAkB;IAEnC,4BAA4B;IAC5B,mBAAmB,EAAE,eAAe;IACpC,uBAAuB,EAAE,wBAAwB;IACjD,kBAAkB,EAAE,sBAAsB;IAE1C,0CAA0C;IAC1C,wBAAwB,EAAE,0BAA0B;IACpD,uBAAuB,EAAE,eAAe,EAAK,wBAAwB;IACrE,kBAAkB,EAAE,eAAe,EAAU,wBAAwB;IACrE,qBAAqB,EAAE,iBAAiB;IACxC,uBAAuB,EAAE,iBAAiB;IAC1C,sBAAsB,EAAE,iBAAiB;IAEzC,yCAAyC;IACzC,4BAA4B,EAAE,iBAAiB;IAC/C,uBAAuB,EAAE,iBAAiB;IAC1C,qBAAqB,EAAE,iBAAiB,EAAO,wCAAwC;IACvF,yBAAyB,EAAE,iBAAiB,EAAG,yBAAyB;IACxE,sBAAsB,EAAE,eAAe;IACvC,0BAA0B,EAAE,eAAe;IAC3C,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAEhD,0CAA0C;IAC1C,oBAAoB,EAAE,oBAAoB;IAC1C,mBAAmB,EAAE,oBAAoB;IACzC,oBAAoB,EAAE,oBAAoB;IAC1C,mBAAmB,EAAE,gBAAgB,EAAG,gCAAgC;CACzE,CAAA;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,kBAAkB,CAChC,QAA+B,EAC/B,KAAgB;IAEhB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oFAAoF;IACpF,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,QAA4B;IAChE,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,QAA4B;IAChE,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAkB,EAClB,KAAqC;IAErC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,yDAAyD;YACzD,OAAO,IAAI,KAAK,MAAM,CAAA;QACxB,KAAK,WAAW;YACd,4DAA4D;YAC5D,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,CAAA;QAClD,KAAK,MAAM;YACT,uEAAuE;YACvE,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,CAAA;IACpD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAkB,EAClB,KAAqC;IAErC,0CAA0C;IAC1C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,0BAA0B;IAC1B,OAAO,IAAI,KAAK,aAAa,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,eAA6E;IAE7E,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;IACf,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAgB;IAC9C,OAAO,eAAe,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,YAAY,GAAG,CAAA;AACzG,CAAC"}
+{"version":3,"file":"tiers.js","sourceRoot":"","sources":["../src/tiers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAiQH,gDAuBC;AAKD,sDAEC;AAKD,sDAEC;AAKD,oDAeC;AAKD,oDAaC;AAKD,4CAeC;AAKD,0CAEC;AAjUD;;;;;;;;;;;;;;;GAeG;AACU,QAAA,qBAAqB,GAA6C;IAC7E,aAAa,EAAE,MAAM;IACrB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;IACtB,OAAO,EAAE,aAAa;IACtB,YAAY,EAAE,aAAa;IAC3B,UAAU,EAAE,aAAa,EAAG,4CAA4C;IACxE,WAAW,EAAE,cAAc;CAC5B,CAAA;AAED;;;GAGG;AACU,QAAA,2BAA2B,GAA+D;IACrG,gBAAgB,EAAE,eAAe;IACjC,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,gBAAgB;IAC/B,mBAAmB,EAAE,SAAS;IAC9B,eAAe,EAAE,cAAc;IAC/B,cAAc,EAAE,cAAc;IAC9B,cAAc,EAAE,YAAY;IAC5B,UAAU,EAAE,aAAa,EAAG,0CAA0C;CACvE,CAAA;AAqCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,qBAAqB,GAA6C;IAC7E,iCAAiC;IACjC,mBAAmB,EAAE,MAAM;IAC3B,aAAa,EAAE,MAAM;IACrB,kBAAkB,EAAE,MAAM;IAC1B,cAAc,EAAE,MAAM;IAEtB,kCAAkC;IAClC,iBAAiB,EAAE,aAAa;IAChC,aAAa,EAAE,aAAa;IAC5B,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,aAAa;IAEhC,qCAAqC;IACrC,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,cAAc;IAC7B,gBAAgB,EAAE,cAAc;IAEhC,2BAA2B;IAC3B,aAAa,EAAE,MAAM,EAAY,gDAAgD;IACjF,sBAAsB,EAAE,MAAM,EAAG,uDAAuD;IACxF,oBAAoB,EAAE,aAAa,EAAE,0DAA0D;IAE/F,+BAA+B;IAC/B,wBAAwB,EAAE,MAAM,EAAG,6CAA6C;IAChF,eAAe,EAAE,MAAM,EAAY,uDAAuD;IAC1F,+BAA+B;IAC/B,kBAAkB,EAAE,MAAM,EAAS,uDAAuD;IAE1F,qBAAqB;IACrB,gBAAgB,EAAE,aAAa,EAAK,yDAAyD;IAC7F,cAAc,EAAE,MAAM,EAAc,kDAAkD;IACtF,aAAa,EAAE,aAAa,EAAQ,8DAA8D;IAClG,aAAa,EAAE,MAAM,EAAe,iDAAiD;CACtF,CAAA;AAED;;;;;;;;;;GAUG;AACU,QAAA,2BAA2B,GAA+D;IACrG,kCAAkC;IAClC,kBAAkB,EAAE,qBAAqB;IACzC,aAAa,EAAE,qBAAqB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,oBAAoB;IACzC,sBAAsB,EAAE,gBAAgB;IAExC,oBAAoB;IACpB,YAAY,EAAE,mBAAmB;IACjC,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,mBAAmB;IAExC,6EAA6E;IAC7E,+DAA+D;IAC/D,8CAA8C;IAC9C,iEAAiE;IACjE,yFAAyF;IACzF,qEAAqE;IACrE,UAAU,EAAE,mBAAmB;IAE/B,oBAAoB;IACpB,eAAe,EAAE,aAAa;IAC9B,kBAAkB,EAAE,WAAW;IAC/B,kBAAkB,EAAE,eAAe;IACnC,qBAAqB,EAAE,kBAAkB;IACzC,6DAA6D;IAC7D,sFAAsF;IACtF,eAAe,EAAE,kBAAkB;IAEnC,4BAA4B;IAC5B,mBAAmB,EAAE,eAAe;IACpC,uBAAuB,EAAE,wBAAwB;IACjD,kBAAkB,EAAE,sBAAsB;IAE1C,0CAA0C;IAC1C,wBAAwB,EAAE,0BAA0B;IACpD,uBAAuB,EAAE,eAAe,EAAK,wBAAwB;IACrE,kBAAkB,EAAE,eAAe,EAAU,wBAAwB;IACrE,qBAAqB,EAAE,iBAAiB;IACxC,uBAAuB,EAAE,iBAAiB;IAC1C,sBAAsB,EAAE,iBAAiB;IAEzC,yCAAyC;IACzC,4BAA4B,EAAE,iBAAiB;IAC/C,uBAAuB,EAAE,iBAAiB;IAC1C,qBAAqB,EAAE,iBAAiB,EAAO,wCAAwC;IACvF,yBAAyB,EAAE,iBAAiB,EAAG,yBAAyB;IACxE,sBAAsB,EAAE,eAAe;IACvC,0BAA0B,EAAE,eAAe;IAC3C,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,0BAA0B;IAChD,oBAAoB,EAAE,0BAA0B;IAEhD,0CAA0C;IAC1C,oBAAoB,EAAE,oBAAoB;IAC1C,mBAAmB,EAAE,oBAAoB;IACzC,oBAAoB,EAAE,oBAAoB;IAC1C,mBAAmB,EAAE,gBAAgB,EAAG,gCAAgC;IAExE,gCAAgC;IAChC,wBAAwB,EAAE,kBAAkB;IAC5C,IAAI,EAAE,gBAAgB;IACtB,aAAa,EAAE,eAAe;IAC9B,GAAG,EAAE,eAAe;CACrB,CAAA;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,kBAAkB,CAChC,QAA+B,EAC/B,KAAgB;IAEhB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oFAAoF;IACpF,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,QAA4B;IAChE,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,QAA4B;IAChE,OAAO,6BAAqB,CAAC,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAkB,EAClB,KAAoC;IAEpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,yDAAyD;YACzD,OAAO,IAAI,KAAK,MAAM,CAAA;QACxB,KAAK,UAAU;YACb,4DAA4D;YAC5D,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,CAAA;QAClD,KAAK,MAAM;YACT,sEAAsE;YACtE,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,CAAA;IACpD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,IAAkB,EAClB,KAAoC;IAEpC,0CAA0C;IAC1C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oEAAoE;IACpE,0DAA0D;IAC1D,0BAA0B;IAC1B,OAAO,IAAI,KAAK,aAAa,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,eAA6E;IAE7E,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;IACf,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAgB;IAC9C,OAAO,eAAe,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,YAAY,GAAG,CAAA;AACzG,CAAC"}

package/dist/types.d.ts

@@ -3,7 +3,7 @@
  * Defines the core data structures for the security scanning engine
  */
 export type VulnerabilitySeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
-export type VulnerabilityCategory = 'hardcoded_secret' | 'high_entropy_string' | 'sensitive_variable' | 'security_bypass' | 'dangerous_function' | 'sql_injection' | 'xss' | 'command_injection' | 'insecure_config' | 'missing_auth' | 'suspicious_package' | 'cors_misconfiguration' | 'root_container' | 'dangerous_file' | 'ai_pattern' | 'sensitive_url' | 'weak_crypto' | 'data_exposure' | 'ai_prompt_injection' | 'ai_unsafe_execution' | 'ai_overpermissive_tool' | 'ai_rag_exfiltration' | 'ai_endpoint_unprotected' | 'ai_schema_mismatch' | 'ai_package_hallucination' | 'ai_rag_corpus_poisoning' | 'ai_rag_pii_leakage' | 'ai_mcp_tool_poisoning' | 'ai_mcp_credential_issue' | 'ai_mcp_confused_deputy' | 'ai_mcp_description_injection' | 'ai_mcp_server_shadowing' | 'ai_mcp_config_secrets' | 'ai_mcp_config_permissions' | 'ai_rag_query_injection' | 'ai_rag_embedding_poisoning' | 'ai_rag_chunk_injection' | 'ai_package_typosquat' | 'ai_package_malicious' | 'ai_unsafe_model_load' | 'ai_unverified_model' | 'ai_unsafe_finetuning' | 'ai_excessive_agency';
+export type VulnerabilityCategory = 'hardcoded_secret' | 'high_entropy_string' | 'sensitive_variable' | 'security_bypass' | 'dangerous_function' | 'sql_injection' | 'xss' | 'command_injection' | 'insecure_config' | 'missing_auth' | 'suspicious_package' | 'cors_misconfiguration' | 'root_container' | 'dangerous_file' | 'ai_pattern' | 'sensitive_url' | 'weak_crypto' | 'data_exposure' | 'ai_prompt_injection' | 'ai_unsafe_execution' | 'ai_overpermissive_tool' | 'ai_rag_exfiltration' | 'ai_endpoint_unprotected' | 'ai_schema_mismatch' | 'ai_package_hallucination' | 'ai_rag_corpus_poisoning' | 'ai_rag_pii_leakage' | 'ai_mcp_tool_poisoning' | 'ai_mcp_credential_issue' | 'ai_mcp_confused_deputy' | 'ai_mcp_description_injection' | 'ai_mcp_server_shadowing' | 'ai_mcp_config_secrets' | 'ai_mcp_config_permissions' | 'ai_rag_query_injection' | 'ai_rag_embedding_poisoning' | 'ai_rag_chunk_injection' | 'ai_package_typosquat' | 'ai_package_malicious' | 'ai_unsafe_model_load' | 'ai_unverified_model' | 'ai_unsafe_finetuning' | 'ai_excessive_agency' | 'missing_security_headers' | 'ssrf' | 'log_injection' | 'xxe';
 export type ValidationStatus = 'confirmed' | 'downgraded' | 'dismissed' | 'not_validated';
 export interface Vulnerability {
     id: string;
@@ -150,6 +150,8 @@ export interface ScanResult {
             title: string;
         }>;
     };
+    /** Filter audit trail (when includeFilterAudit option is enabled) */
+    filterAuditTrail?: import('./filtering/pipeline').AnnotatedFinding[];
 }
 export interface ScanProgress {
     status: 'fetching' | 'scanning_layer1' | 'scanning_layer2' | 'scanning_layer3' | 'complete' | 'failed';
@@ -194,6 +196,74 @@ export interface AIFinding {
     description: string;
     suggestedFix: string;
 }
+/**
+ * DetectorContext provides rich context information to Layer 2 detectors
+ * This allows detectors to make smarter decisions based on:
+ * - Project-level auth configuration
+ * - Framework detection
+ * - Per-file context (server vs client, test vs production)
+ */
+export interface DetectorContext {
+    auth: {
+        /** Middleware configuration (if detected) */
+        middleware: MiddlewareAuthContextSummary | null;
+        /** Auth helpers detected in the project */
+        authHelpers: AuthHelperContextSummary;
+        /** Public endpoint patterns (health, webhook, etc.) */
+        publicEndpoints: string[];
+    };
+    framework: {
+        /** Primary backend framework detected */
+        primary: 'nextjs' | 'express' | 'fastify' | 'koa' | 'hono' | 'nestjs' | 'django' | 'flask' | 'rails' | 'unknown' | null;
+        /** Frontend framework detected */
+        frontend: 'react' | 'vue' | 'svelte' | 'angular' | 'unknown' | null;
+        /** Whether the project uses TypeScript */
+        hasTypeScript: boolean;
+    };
+    dataAccess: {
+        /** ORM/query builder detected */
+        orm: 'prisma' | 'drizzle' | 'typeorm' | 'sequelize' | 'knex' | null;
+        /** Whether RLS (Row-Level Security) is detected */
+        hasRLS: boolean;
+        /** Validation library detected */
+        validationLib: 'zod' | 'yup' | 'joi' | 'valibot' | null;
+    };
+    file: {
+        /** Whether this file is server-only (not bundled to client) */
+        isServerOnly: boolean;
+        /** Whether this file is client-bundled (exposed to browser) */
+        isClientBundled: boolean;
+        /** Whether this file is a test/mock/fixture file */
+        isTestFile: boolean;
+        /** Whether this file is a config file */
+        isConfigFile: boolean;
+        /** Whether this file is in a tooling directory */
+        isToolingDir: boolean;
+    };
+}
+/** Simplified middleware auth config for DetectorContext */
+export interface MiddlewareAuthContextSummary {
+    /** Whether auth middleware was detected */
+    hasAuthMiddleware: boolean;
+    /** The type of auth detected */
+    authType: 'clerk' | 'nextauth' | 'auth0' | 'custom' | 'unknown' | null;
+    /** Protected path patterns */
+    protectedPaths: string[];
+    /** Public/excluded path patterns */
+    publicPaths: string[];
+}
+/** Simplified auth helper context for DetectorContext */
+export interface AuthHelperContextSummary {
+    /** Whether the project has throwing auth helpers */
+    hasThrowingHelpers: boolean;
+    /** Names of throwing auth helpers */
+    throwingHelperNames: string[];
+}
+/**
+ * Create an empty/default DetectorContext
+ * Useful for tests or when context isn't available
+ */
+export declare function createEmptyDetectorContext(): DetectorContext;
 export declare const SCANNABLE_EXTENSIONS: string[];
 export declare const SPECIAL_FILES: string[];
 export declare const MAX_FILE_SIZE: number;
@@ -207,13 +277,13 @@ export type ScanMode = 'full' | 'incremental';
 /**
  * Scan depth controls AI usage independent of full vs incremental mode
  *
- * - cheap: Layer 1 + Layer 2 only. No AI validation, no Layer 3.
+ * - local: Layer 1 + Layer 2 only. No AI validation, no Layer 3.
  *          Only Tier A (core) findings are surfaced.
  *          Target: <5s for typical PR scans.
  *
- * - validated: Layer 1 + Layer 2 + AI validation on selected findings. No Layer 3.
- *              Tier A is surfaced directly, Tier B goes through AI validation.
- *              Target: <15s with <10 AI calls.
+ * - verified: Layer 1 + Layer 2 + AI validation on selected findings. No Layer 3.
+ *             Tier A is surfaced directly, Tier B goes through AI validation.
+ *             Target: <15s with <10 AI calls.
  *
  * - deep: Layer 1 + Layer 2 + AI validation + Layer 3 semantic analysis.
  *         Full analysis for initial onboarding or deep security audits.
@@ -223,13 +293,13 @@ export type ScanMode = 'full' | 'incremental';
  *
  * | Workflow       | Default Depth | Rationale                            |
  * |----------------|---------------|--------------------------------------|
- * | GitHub PR      | cheap         | Fast feedback, high-signal findings  |
- * | VS Code        | validated     | Interactive, balance depth + speed   |
- * | CLI (default)  | cheap         | Fast local scans                     |
+ * | GitHub PR      | local         | Fast feedback, high-signal findings  |
+ * | VS Code        | verified      | Interactive, balance depth + speed   |
+ * | CLI (default)  | local         | Fast local scans                     |
  * | CLI --deep     | deep          | Thorough analysis when requested     |
  * | Onboarding     | deep          | Full picture on first scan           |
  */
-export type ScanDepth = 'cheap' | 'validated' | 'deep';
+export type ScanDepth = 'local' | 'verified' | 'deep';
 export interface ScanModeConfig {
     /** The scan mode */
     mode: ScanMode;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAEnF,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,KAAK,GACL,mBAAmB,GACnB,iBAAiB,GACjB,cAAc,GACd,oBAAoB,GACpB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,YAAY,GACZ,eAAe,GACf,aAAa,GACb,eAAe,GAEf,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,GAExB,qBAAqB,GACrB,yBAAyB,GACzB,oBAAoB,GAEpB,0BAA0B,GAC1B,yBAAyB,GACzB,oBAAoB,GACpB,uBAAuB,GACvB,yBAAyB,GACzB,wBAAwB,GAExB,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,2BAA2B,GAC3B,wBAAwB,GACxB,4BAA4B,GAC5B,wBAAwB,GACxB,sBAAsB,GACtB,sBAAsB,GAEtB,sBAAsB,GACtB,qBAAqB,GACrB,sBAAsB,GACtB,qBAAqB,CAAA;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,CAAA;AAEzF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;IACrC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAG9B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IAGxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAA;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CA8B3D;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAGD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3E,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC7C,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,eAAe;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,YAAY;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,4BAA4B;IAC5B,eAAe,EAAE,QAAQ,GAAG,gBAAgB,GAAG,aAAa,CAAA;IAC5D,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAA;IACzB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,aAAa,EAAE,CAAA;IAGhC,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,iBAAiB,EAAE,OAAO,CAAA;IAE1B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IAGjB,eAAe,CAAC,EAAE;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,iBAAiB,EAAE,MAAM,CAAA;QACzB,iBAAiB,EAAE,MAAM,CAAA;QACzB,iBAAiB,EAAE,MAAM,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,oBAAoB,EAAE,MAAM,CAAA;QAC5B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,EAAE,MAAM,CAAA;QAChB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,eAAe,EAAE,MAAM,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IAGD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IAGrB,gBAAgB,CAAC,EAAE;QACjB,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,6CAA6C;QAC7C,gBAAgB,EAAE,MAAM,CAAA;QACxB,mDAAmD;QACnD,uBAAuB,EAAE,MAAM,CAAA;QAC/B,2CAA2C;QAC3C,oBAAoB,EAAE,MAAM,CAAA;QAC5B,uEAAuE;QACvE,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,kEAAkE;IAClE,yBAAyB,CAAC,EAAE,8BAA8B,EAAE,CAAA;IAG5D,YAAY,CAAC,EAAE;QACb,oCAAoC;QACpC,iBAAiB,EAAE,MAAM,CAAA;QACzB,gDAAgD;QAChD,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,+CAA+C;QAC/C,QAAQ,EAAE,MAAM,CAAA;QAChB,6DAA6D;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,4CAA4C;QAC5C,aAAa,EAAE,MAAM,CAAA;QACrB,4CAA4C;QAC5C,aAAa,EAAE,KAAK,CAAC;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,QAAQ,EAAE,MAAM,CAAA;YAChB,UAAU,EAAE,MAAM,CAAA;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,QAAQ,EAAE,MAAM,CAAA;YAChB,KAAK,EAAE,MAAM,CAAA;SACd,CAAC,CAAA;KACH,CAAA;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAA;IACtG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;CACpB;AAGD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,eAAe,EAAE,CAAA;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAGD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;CACpB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAGD,eAAO,MAAM,oBAAoB,UAKhC,CAAA;AAGD,eAAO,MAAM,aAAa,UAYzB,CAAA;AAGD,eAAO,MAAM,aAAa,QAAY,CAAA;AAMtC;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAA;AAEtD,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,IAAI,EAAE,QAAQ,CAAA;IAEd,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAA;IAEpB,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAexE,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAEnF,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,KAAK,GACL,mBAAmB,GACnB,iBAAiB,GACjB,cAAc,GACd,oBAAoB,GACpB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,YAAY,GACZ,eAAe,GACf,aAAa,GACb,eAAe,GAEf,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,GAExB,qBAAqB,GACrB,yBAAyB,GACzB,oBAAoB,GAEpB,0BAA0B,GAC1B,yBAAyB,GACzB,oBAAoB,GACpB,uBAAuB,GACvB,yBAAyB,GACzB,wBAAwB,GAExB,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,2BAA2B,GAC3B,wBAAwB,GACxB,4BAA4B,GAC5B,wBAAwB,GACxB,sBAAsB,GACtB,sBAAsB,GAEtB,sBAAsB,GACtB,qBAAqB,GACrB,sBAAsB,GACtB,qBAAqB,GAErB,0BAA0B,GAC1B,MAAM,GACN,eAAe,GACf,KAAK,CAAA;AAET,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,CAAA;AAEzF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;IACrC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAG9B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IAGxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAA;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CA8B3D;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAGD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3E,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC7C,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,eAAe;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,YAAY;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,4BAA4B;IAC5B,eAAe,EAAE,QAAQ,GAAG,gBAAgB,GAAG,aAAa,CAAA;IAC5D,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAA;IACzB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,aAAa,EAAE,CAAA;IAGhC,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,iBAAiB,EAAE,OAAO,CAAA;IAE1B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IAGjB,eAAe,CAAC,EAAE;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,iBAAiB,EAAE,MAAM,CAAA;QACzB,iBAAiB,EAAE,MAAM,CAAA;QACzB,iBAAiB,EAAE,MAAM,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,oBAAoB,EAAE,MAAM,CAAA;QAC5B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,EAAE,MAAM,CAAA;QAChB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,eAAe,EAAE,MAAM,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;IAGD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IAGrB,gBAAgB,CAAC,EAAE;QACjB,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,6CAA6C;QAC7C,gBAAgB,EAAE,MAAM,CAAA;QACxB,mDAAmD;QACnD,uBAAuB,EAAE,MAAM,CAAA;QAC/B,2CAA2C;QAC3C,oBAAoB,EAAE,MAAM,CAAA;QAC5B,uEAAuE;QACvE,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,kEAAkE;IAClE,yBAAyB,CAAC,EAAE,8BAA8B,EAAE,CAAA;IAG5D,YAAY,CAAC,EAAE;QACb,oCAAoC;QACpC,iBAAiB,EAAE,MAAM,CAAA;QACzB,gDAAgD;QAChD,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,+CAA+C;QAC/C,QAAQ,EAAE,MAAM,CAAA;QAChB,6DAA6D;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,4CAA4C;QAC5C,aAAa,EAAE,MAAM,CAAA;QACrB,4CAA4C;QAC5C,aAAa,EAAE,KAAK,CAAC;YACnB,IAAI,EAAE,MAAM,CAAA;YACZ,QAAQ,EAAE,MAAM,CAAA;YAChB,UAAU,EAAE,MAAM,CAAA;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,QAAQ,EAAE,MAAM,CAAA;YAChB,KAAK,EAAE,MAAM,CAAA;SACd,CAAC,CAAA;KACH,CAAA;IAED,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,EAAE,CAAA;CACrE;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAA;IACtG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;CACpB;AAGD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,eAAe,EAAE,CAAA;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAGD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;CACpB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAE9B,IAAI,EAAE;QACJ,6CAA6C;QAC7C,UAAU,EAAE,4BAA4B,GAAG,IAAI,CAAA;QAC/C,2CAA2C;QAC3C,WAAW,EAAE,wBAAwB,CAAA;QACrC,uDAAuD;QACvD,eAAe,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;IAGD,SAAS,EAAE;QACT,yCAAyC;QACzC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAA;QACvH,kCAAkC;QAClC,QAAQ,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAA;QACnE,0CAA0C;QAC1C,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IAGD,UAAU,EAAE;QACV,iCAAiC;QACjC,GAAG,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,IAAI,CAAA;QACnE,mDAAmD;QACnD,MAAM,EAAE,OAAO,CAAA;QACf,kCAAkC;QAClC,aAAa,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,IAAI,CAAA;KACxD,CAAA;IAGD,IAAI,EAAE;QACJ,+DAA+D;QAC/D,YAAY,EAAE,OAAO,CAAA;QACrB,+DAA+D;QAC/D,eAAe,EAAE,OAAO,CAAA;QACxB,oDAAoD;QACpD,UAAU,EAAE,OAAO,CAAA;QACnB,yCAAyC;QACzC,YAAY,EAAE,OAAO,CAAA;QACrB,kDAAkD;QAClD,YAAY,EAAE,OAAO,CAAA;KACtB,CAAA;CACF;AAED,4DAA4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,2CAA2C;IAC3C,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gCAAgC;IAChC,QAAQ,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAA;IACtE,8BAA8B;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oCAAoC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,oDAAoD;IACpD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,eAAe,CA4B5D;AAGD,eAAO,MAAM,oBAAoB,UAKhC,CAAA;AAGD,eAAO,MAAM,aAAa,UAYzB,CAAA;AAGD,eAAO,MAAM,aAAa,QAAY,CAAA;AAMtC;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAA;AAErD,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,IAAI,EAAE,QAAQ,CAAA;IAEd,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAA;IAEpB,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAE1B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAexE,CAAA"}

package/dist/types.js

@@ -6,6 +6,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SCAN_MODE_DEFAULTS = exports.MAX_FILE_SIZE = exports.SPECIAL_FILES = exports.SCANNABLE_EXTENSIONS = void 0;
 exports.createCancellationToken = createCancellationToken;
+exports.createEmptyDetectorContext = createEmptyDetectorContext;
 /**
  * Create a new cancellation token
  *
@@ -45,6 +46,39 @@ function createCancellationToken() {
     };
     return token;
 }
+/**
+ * Create an empty/default DetectorContext
+ * Useful for tests or when context isn't available
+ */
+function createEmptyDetectorContext() {
+    return {
+        auth: {
+            middleware: null,
+            authHelpers: {
+                hasThrowingHelpers: false,
+                throwingHelperNames: [],
+            },
+            publicEndpoints: [],
+        },
+        framework: {
+            primary: null,
+            frontend: null,
+            hasTypeScript: false,
+        },
+        dataAccess: {
+            orm: null,
+            hasRLS: false,
+            validationLib: null,
+        },
+        file: {
+            isServerOnly: false,
+            isClientBundled: false,
+            isTestFile: false,
+            isConfigFile: false,
+            isToolingDir: false,
+        },
+    };
+}
 // Supported file extensions for scanning
 exports.SCANNABLE_EXTENSIONS = [
     '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA2GH,0DA8BC;AAtCD;;;;;;;GAOG;AACH,SAAgB,uBAAuB;IACrC,MAAM,gBAAgB,GAAsB,EAAE,CAAA;IAE9C,MAAM,KAAK,GAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,MAAe;YACpB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;gBACtB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;gBACrB,wBAAwB;gBACxB,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;oBAC5B,IAAI,CAAC;wBACH,EAAE,EAAE,CAAA;oBACN,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,wBAAwB;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,QAAQ;YACf,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,QAAQ,EAAE,CAAA,CAAC,qCAAqC;YAClD,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AA8KD,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACzC,aAAa,EAAE,KAAK,EAAE,OAAO;CAC9B,CAAA;AAED,+CAA+C;AAClC,QAAA,aAAa,GAAG;IAC3B,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,SAAS;IACT,QAAQ;CACT,CAAA;AAED,0CAA0C;AAC7B,QAAA,aAAa,GAAG,EAAE,GAAG,IAAI,CAAA;AA4EtC;;GAEG;AACU,QAAA,kBAAkB,GAA8C;IAC3E,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,EAAE;KACnB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI,EAAE,yCAAyC;QAC3D,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,CAAC;KAClB;CACF,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAgHH,0DA8BC;AAkQD,gEA4BC;AApUD;;;;;;;GAOG;AACH,SAAgB,uBAAuB;IACrC,MAAM,gBAAgB,GAAsB,EAAE,CAAA;IAE9C,MAAM,KAAK,GAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,MAAe;YACpB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;gBACtB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;gBACrB,wBAAwB;gBACxB,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;oBAC5B,IAAI,CAAC;wBACH,EAAE,EAAE,CAAA;oBACN,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,wBAAwB;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,QAAQ;YACf,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,QAAQ,EAAE,CAAA,CAAC,qCAAqC;YAClD,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AA8PD;;;GAGG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE;gBACX,kBAAkB,EAAE,KAAK;gBACzB,mBAAmB,EAAE,EAAE;aACxB;YACD,eAAe,EAAE,EAAE;SACpB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,KAAK;SACrB;QACD,UAAU,EAAE;YACV,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,IAAI;SACpB;QACD,IAAI,EAAE;YACJ,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,KAAK;SACpB;KACF,CAAA;AACH,CAAC;AAED,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IACzC,aAAa,EAAE,KAAK,EAAE,OAAO;CAC9B,CAAA;AAED,+CAA+C;AAClC,QAAA,aAAa,GAAG;IAC3B,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,SAAS;IACT,QAAQ;CACT,CAAA;AAED,0CAA0C;AAC7B,QAAA,aAAa,GAAG,EAAE,GAAG,IAAI,CAAA;AA4EtC;;GAEG;AACU,QAAA,kBAAkB,GAA8C;IAC3E,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,EAAE;KACnB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI,EAAE,yCAAyC;QAC3D,oBAAoB,EAAE,EAAE;QACxB,cAAc,EAAE,CAAC;KAClB;CACF,CAAA"}

package/dist/utils/code-analysis.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared Code Analysis Utilities
+ *
+ * ParsedFile-aware versions of control flow analysis and context extraction.
+ * Consolidates duplicated logic from control-flow.ts and various detectors.
+ */
+import { ParsedFile } from './parsed-file';
+/**
+ * Check if a line is inside a try-catch block.
+ * Tracks brace depth from the start of the file to the target line.
+ */
+export declare function isInsideTryCatch(file: ParsedFile, lineNumber: number): boolean;
+/**
+ * Simpler heuristic: check if there's a try-catch in the same function scope.
+ * Looks for try { before the line and } catch after, within reasonable bounds.
+ */
+export declare function hasTryCatchNearby(file: ParsedFile, lineNumber: number, windowSize?: number): boolean;
+/**
+ * Extract function context where a call is being made.
+ * Looks backwards from the current line to find enclosing function name.
+ * Returns lowercase function name or null if not found.
+ */
+export declare function extractFunctionContext(file: ParsedFile, lineNumber: number): string | null;
+/**
+ * Search surrounding lines for any of the given patterns.
+ * Consolidates the ±N line search pattern used across 55+ occurrences.
+ *
+ * @param file ParsedFile to search in
+ * @param lineIndex 0-based center line
+ * @param patterns RegExp patterns to search for
+ * @param windowSize number of lines before and after to search
+ * @returns found: true if any pattern matched, with matched line and pattern
+ */
+export declare function searchSurroundingLines(file: ParsedFile, lineIndex: number, patterns: RegExp[], windowSize: number): {
+    found: boolean;
+    matchedLine?: number;
+    matchedPattern?: RegExp;
+};
+//# sourceMappingURL=code-analysis.d.ts.map

package/dist/utils/code-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-analysis.d.ts","sourceRoot":"","sources":["../../src/utils/code-analysis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAG1C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CA2C9E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CAgCxG;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6C1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,EAClB,UAAU,EAAE,MAAM,GACjB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAcnE"}