@oculum/scanner 1.0.11 → 1.0.13

package/dist/postprocess/suppression/types.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Suppression System Types
+ * Defines types for the finding suppression/ignore system
+ */
+import type { VulnerabilityCategory, VulnerabilitySeverity } from '../../shared/types';
+/**
+ * Suppression configuration file structure
+ * Supports .oculum.yaml, .oculum.yml, oculum.config.json, .oculumrc
+ */
+export interface SuppressionConfig {
+    /** Config schema version */
+    version: 1;
+    /** Suppression rules */
+    suppressions?: {
+        /** Rule-based suppressions (by category) */
+        rules?: RuleSuppression[];
+        /** Finding-based suppressions (by hash) */
+        findings?: FindingSuppression[];
+    };
+    /** Path patterns to ignore entirely (glob format) */
+    ignore?: string[];
+}
+/**
+ * Suppress all findings of a specific category/rule
+ */
+export interface RuleSuppression {
+    /** Category to suppress (e.g., 'high_entropy_string') */
+    category: VulnerabilityCategory;
+    /** Reason for suppression (required for audit trail) */
+    reason: string;
+    /** Optional: Only suppress in specific files (glob patterns) */
+    paths?: string[];
+    /** Optional: Expiration date (ISO 8601 format) */
+    expires?: string;
+    /** Optional: Who added this suppression */
+    suppressedBy?: string;
+    /** Optional: When this was added (ISO 8601 format) */
+    suppressedAt?: string;
+}
+/**
+ * Suppress a specific finding by its hash
+ */
+export interface FindingSuppression {
+    /** Finding hash (computed from file path, content, and category) */
+    hash: string;
+    /** File path where the finding was detected */
+    file: string;
+    /** Line number (for reference, not used in matching) */
+    line?: number;
+    /** Reason for suppression (required for audit trail) */
+    reason: string;
+    /** Optional: Expiration date (ISO 8601 format) */
+    expires?: string;
+    /** Optional: Who added this suppression */
+    suppressedBy?: string;
+    /** Optional: When this was added (ISO 8601 format) */
+    suppressedAt?: string;
+}
+/**
+ * Inline suppression from code comments
+ */
+export interface InlineSuppression {
+    /** Line number this suppression applies to */
+    lineNumber: number;
+    /** Type of inline suppression */
+    type: 'next-line' | 'same-line' | 'block-start' | 'block-end';
+    /** Reason from the comment */
+    reason: string;
+    /** Optional: Specific rule/category to suppress */
+    ruleId?: VulnerabilityCategory;
+    /** Original comment text */
+    commentText: string;
+}
+/**
+ * Result of checking if a finding is suppressed
+ */
+export interface SuppressionMatch {
+    /** Whether the finding is suppressed */
+    suppressed: boolean;
+    /** The matching suppression (if any) */
+    match?: {
+        /** Type of suppression that matched */
+        type: 'inline' | 'config-finding' | 'config-rule';
+        /** Reason for suppression */
+        reason: string;
+        /** Expiration date (if any) */
+        expires?: string;
+        /** Whether the suppression is expired */
+        expired?: boolean;
+    };
+    /** Hash of the finding (always computed) */
+    hash: string;
+}
+/**
+ * Suppressed vulnerability with metadata
+ */
+export interface SuppressedVulnerability {
+    /** The original vulnerability */
+    vulnerability: {
+        id: string;
+        filePath: string;
+        lineNumber: number;
+        category: VulnerabilityCategory;
+        severity: VulnerabilitySeverity;
+        title: string;
+    };
+    /** Suppression details */
+    suppression: {
+        /** Type of suppression that matched */
+        type: 'inline' | 'config-finding' | 'config-rule';
+        /** Reason for suppression */
+        reason: string;
+        /** Expiration date (if any) */
+        expires?: string;
+        /** Finding hash */
+        hash: string;
+    };
+}
+/**
+ * Result of applying suppressions to findings
+ */
+export interface SuppressionResult {
+    /** Findings that passed through (not suppressed) */
+    findings: import('../../shared/types').Vulnerability[];
+    /** Findings that were suppressed */
+    suppressed: SuppressedVulnerability[];
+    /** Count of expired suppressions (findings reappear) */
+    expiredSuppressions: number;
+    /** Statistics */
+    stats: {
+        /** Total findings before suppression */
+        total: number;
+        /** Findings suppressed by inline comments */
+        inlineSuppressed: number;
+        /** Findings suppressed by config (finding hash) */
+        configFindingSuppressed: number;
+        /** Findings suppressed by config (rule) */
+        configRuleSuppressed: number;
+        /** Findings that would have been suppressed but suppression expired */
+        expired: number;
+    };
+}
+/**
+ * Suppression configuration file names (in order of priority)
+ */
+export declare const SUPPRESSION_CONFIG_FILES: readonly [".oculum.yaml", ".oculum.yml", "oculum.config.json", ".oculumrc"];
+/**
+ * Default suppression config (empty)
+ */
+export declare const DEFAULT_SUPPRESSION_CONFIG: SuppressionConfig;
+//# sourceMappingURL=types.d.ts.map

package/dist/postprocess/suppression/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/postprocess/suppression/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAEtF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,4BAA4B;IAC5B,OAAO,EAAE,CAAC,CAAA;IAEV,wBAAwB;IACxB,YAAY,CAAC,EAAE;QACb,4CAA4C;QAC5C,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;QACzB,2CAA2C;QAC3C,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAA;KAChC,CAAA;IAED,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,iCAAiC;IACjC,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,CAAA;IAC7D,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,UAAU,EAAE,OAAO,CAAA;IACnB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QACN,uCAAuC;QACvC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,GAAG,aAAa,CAAA;QACjD,6BAA6B;QAC7B,MAAM,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;IACD,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,aAAa,EAAE;QACb,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,qBAAqB,CAAA;QAC/B,QAAQ,EAAE,qBAAqB,CAAA;QAC/B,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACD,0BAA0B;IAC1B,WAAW,EAAE;QACX,uCAAuC;QACvC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,GAAG,aAAa,CAAA;QACjD,6BAA6B;QAC7B,MAAM,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,mBAAmB;QACnB,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,QAAQ,EAAE,OAAO,oBAAoB,EAAE,aAAa,EAAE,CAAA;IACtD,oCAAoC;IACpC,UAAU,EAAE,uBAAuB,EAAE,CAAA;IACrC,wDAAwD;IACxD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,iBAAiB;IACjB,KAAK,EAAE;QACL,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,6CAA6C;QAC7C,gBAAgB,EAAE,MAAM,CAAA;QACxB,mDAAmD;QACnD,uBAAuB,EAAE,MAAM,CAAA;QAC/B,2CAA2C;QAC3C,oBAAoB,EAAE,MAAM,CAAA;QAC5B,uEAAuE;QACvE,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,6EAK3B,CAAA;AAEV;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAOxC,CAAA"}

package/dist/postprocess/suppression/types.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Suppression System Types
+ * Defines types for the finding suppression/ignore system
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SUPPRESSION_CONFIG = exports.SUPPRESSION_CONFIG_FILES = void 0;
+/**
+ * Suppression configuration file names (in order of priority)
+ */
+exports.SUPPRESSION_CONFIG_FILES = [
+    '.oculum.yaml',
+    '.oculum.yml',
+    'oculum.config.json',
+    '.oculumrc',
+];
+/**
+ * Default suppression config (empty)
+ */
+exports.DEFAULT_SUPPRESSION_CONFIG = {
+    version: 1,
+    suppressions: {
+        rules: [],
+        findings: [],
+    },
+    ignore: [],
+};
+//# sourceMappingURL=types.js.map

package/dist/postprocess/suppression/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/postprocess/suppression/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAsJH;;GAEG;AACU,QAAA,wBAAwB,GAAG;IACtC,cAAc;IACd,aAAa;IACb,oBAAoB;IACpB,WAAW;CACH,CAAA;AAEV;;GAEG;AACU,QAAA,0BAA0B,GAAsB;IAC3D,OAAO,EAAE,CAAC;IACV,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE;KACb;IACD,MAAM,EAAE,EAAE;CACX,CAAA"}

package/dist/postprocess/validation-cap.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validation Cap — Per-file cap on AI validation candidates for cost control.
+ *
+ * Prioritizes findings by confidence score, severity, and category importance.
+ */
+import type { Vulnerability } from '../shared/types';
+/** Maximum candidates per file to send to AI validation (cost control) */
+export declare const MAX_VALIDATION_CANDIDATES_PER_FILE = 10;
+/**
+ * Cap validation candidates per file to control AI costs
+ * Prioritizes by:
+ * 1. Confidence score (higher score = more likely a real finding)
+ * 2. Severity (critical > high > medium > low > info)
+ * 3. Category importance (secrets/URLs/auth before cosmetic patterns)
+ */
+export declare function capValidationCandidatesPerFile(vulnerabilities: Vulnerability[], maxPerFile?: number): Vulnerability[];
+//# sourceMappingURL=validation-cap.d.ts.map

package/dist/postprocess/validation-cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-cap.d.ts","sourceRoot":"","sources":["../../src/postprocess/validation-cap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIpD,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,KAAK,CAAA;AAEpD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,eAAe,EAAE,aAAa,EAAE,EAChC,UAAU,GAAE,MAA2C,GACtD,aAAa,EAAE,CA0CjB"}

package/dist/postprocess/validation-cap.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Validation Cap — Per-file cap on AI validation candidates for cost control.
+ *
+ * Prioritizes findings by confidence score, severity, and category importance.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_VALIDATION_CANDIDATES_PER_FILE = void 0;
+exports.capValidationCandidatesPerFile = capValidationCandidatesPerFile;
+const parsed_file_1 = require("../shared/parsed-file");
+/** Maximum candidates per file to send to AI validation (cost control) */
+exports.MAX_VALIDATION_CANDIDATES_PER_FILE = 10;
+/**
+ * Cap validation candidates per file to control AI costs
+ * Prioritizes by:
+ * 1. Confidence score (higher score = more likely a real finding)
+ * 2. Severity (critical > high > medium > low > info)
+ * 3. Category importance (secrets/URLs/auth before cosmetic patterns)
+ */
+function capValidationCandidatesPerFile(vulnerabilities, maxPerFile = exports.MAX_VALIDATION_CANDIDATES_PER_FILE) {
+    // Group by file
+    const byFile = new Map();
+    for (const vuln of vulnerabilities) {
+        const existing = byFile.get(vuln.filePath) || [];
+        existing.push(vuln);
+        byFile.set(vuln.filePath, existing);
+    }
+    const result = [];
+    for (const [, fileVulns] of byFile) {
+        // Sort by priority: confidence score descending, then severity, then category
+        const sorted = [...fileVulns].sort((a, b) => {
+            // Confidence score comparison (higher = higher priority for validation)
+            const aScore = a.confidence_score?.score ?? (a.baseConfidence ?? 0.35);
+            const bScore = b.confidence_score?.score ?? (b.baseConfidence ?? 0.35);
+            const scoreDiff = bScore - aScore;
+            if (Math.abs(scoreDiff) > 0.01)
+                return scoreDiff;
+            // Severity comparison (higher severity = higher priority)
+            const severityDiff = (0, parsed_file_1.severityRank)(b.severity) - (0, parsed_file_1.severityRank)(a.severity);
+            if (severityDiff !== 0)
+                return severityDiff;
+            // Category importance (secrets/URLs/auth before AI patterns)
+            const categoryPriority = (v) => {
+                if (v.category === 'hardcoded_secret')
+                    return 10;
+                if (v.category === 'high_entropy_string')
+                    return 9;
+                if (v.category === 'sensitive_url')
+                    return 8;
+                if (v.category === 'missing_auth')
+                    return 7;
+                if (v.category === 'ai_pattern')
+                    return 3;
+                return 5;
+            };
+            return categoryPriority(b) - categoryPriority(a);
+        });
+        // Take top N per file
+        const capped = sorted.slice(0, maxPerFile);
+        result.push(...capped);
+    }
+    return result;
+}
+//# sourceMappingURL=validation-cap.js.map

package/dist/postprocess/validation-cap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-cap.js","sourceRoot":"","sources":["../../src/postprocess/validation-cap.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAgBH,wEA6CC;AAzDD,uDAAoD;AAEpD,0EAA0E;AAC7D,QAAA,kCAAkC,GAAG,EAAE,CAAA;AAEpD;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAC5C,eAAgC,EAChC,aAAqB,0CAAkC;IAEvD,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAChD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,8EAA8E;QAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC1C,wEAAwE;YACxE,MAAM,MAAM,GAAI,CAAmB,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,CAAA;YACzF,MAAM,MAAM,GAAI,CAAmB,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,CAAA;YACzF,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAA;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI;gBAAE,OAAO,SAAS,CAAA;YAEhD,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAA,0BAAY,EAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAA,0BAAY,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;YACxE,IAAI,YAAY,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAA;YAE3C,6DAA6D;YAC7D,MAAM,gBAAgB,GAAG,CAAC,CAAgB,EAAU,EAAE;gBACpD,IAAI,CAAC,CAAC,QAAQ,KAAK,kBAAkB;oBAAE,OAAO,EAAE,CAAA;gBAChD,IAAI,CAAC,CAAC,QAAQ,KAAK,qBAAqB;oBAAE,OAAO,CAAC,CAAA;gBAClD,IAAI,CAAC,CAAC,QAAQ,KAAK,eAAe;oBAAE,OAAO,CAAC,CAAA;gBAC5C,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc;oBAAE,OAAO,CAAC,CAAA;gBAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY;oBAAE,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,CAAA;YACV,CAAC,CAAA;YACD,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;IACxB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/report/build-result.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Report Builder — Composes the final ScanResult from processed findings.
+ *
+ * Encapsulates sorting, counting, suppressed-summary building, and result
+ * object construction.
+ */
+import type { ScanResult, Vulnerability } from '../shared/types';
+import type { ValidationStats } from '../validate';
+import type { SuppressionResult } from '../postprocess/suppression/types';
+import type { FilterPipeline } from '../postprocess/filtering/pipeline';
+export interface BuildScanResultInput {
+    repoInfo: {
+        name: string;
+        url: string;
+        branch: string;
+    };
+    files: {
+        length: number;
+    };
+    findings: Vulnerability[];
+    suppressionResult: SuppressionResult;
+    startTime: number;
+    validationStats?: ValidationStats;
+    showSuppressed?: boolean;
+    filterPipeline?: FilterPipeline;
+    cancelled?: boolean;
+    cancelReason?: string;
+}
+/**
+ * Build the final ScanResult from postprocessed findings.
+ */
+export declare function buildScanResult(input: BuildScanResultInput): ScanResult;
+//# sourceMappingURL=build-result.d.ts.map

package/dist/report/build-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-result.d.ts","sourceRoot":"","sources":["../../src/report/build-result.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAEd,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAGvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CA4DvE"}

package/dist/report/build-result.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Report Builder — Composes the final ScanResult from processed findings.
+ *
+ * Encapsulates sorting, counting, suppressed-summary building, and result
+ * object construction.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildScanResult = buildScanResult;
+const summary_1 = require("./summary");
+/**
+ * Build the final ScanResult from postprocessed findings.
+ */
+function buildScanResult(input) {
+    const { repoInfo, files, findings, suppressionResult, startTime, validationStats, showSuppressed, filterPipeline, cancelled, cancelReason, } = input;
+    // Use the filtered findings (after suppression)
+    const afterSuppression = suppressionResult.findings;
+    // Sort by severity
+    const sortedVulnerabilities = (0, summary_1.sortBySeverity)(afterSuppression);
+    // Compute issue-mix counts (based on unsuppressed findings)
+    const severityCounts = (0, summary_1.computeSeverityCounts)(sortedVulnerabilities);
+    const categoryCounts = (0, summary_1.computeCategoryCounts)(sortedVulnerabilities);
+    const hasBlockingIssues = severityCounts.critical > 0 || severityCounts.high > 0;
+    // Build suppressed vulnerabilities summary (for --show-suppressed)
+    const suppressedVulnerabilities = showSuppressed
+        ? suppressionResult.suppressed.map(s => ({
+            hash: s.suppression.hash,
+            filePath: s.vulnerability.filePath,
+            lineNumber: s.vulnerability.lineNumber,
+            category: s.vulnerability.category,
+            severity: s.vulnerability.severity,
+            title: s.vulnerability.title,
+            suppressionType: s.suppression.type,
+            suppressionReason: s.suppression.reason,
+            expires: s.suppression.expires,
+        }))
+        : undefined;
+    return {
+        repoName: repoInfo.name,
+        repoUrl: repoInfo.url,
+        branch: repoInfo.branch,
+        filesScanned: files.length,
+        filesSkipped: 0, // TODO: track skipped files
+        vulnerabilities: sortedVulnerabilities,
+        severityCounts,
+        categoryCounts,
+        hasBlockingIssues: cancelled ? false : hasBlockingIssues,
+        scanDuration: Date.now() - startTime,
+        timestamp: new Date().toISOString(),
+        validationStats,
+        suppressionStats: suppressionResult.suppressed.length > 0 || suppressionResult.expiredSuppressions > 0
+            ? suppressionResult.stats
+            : undefined,
+        suppressedVulnerabilities,
+        filterAuditTrail: filterPipeline?.isEnabled ? filterPipeline.getAuditTrail() : undefined,
+        ...(cancelled ? { cancelled: true, cancelReason } : {}),
+    };
+}
+//# sourceMappingURL=build-result.js.map

package/dist/report/build-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-result.js","sourceRoot":"","sources":["../../src/report/build-result.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,0CA4DC;AA9ED,uCAAwF;AAexF;;GAEG;AACH,SAAgB,eAAe,CAAC,KAA2B;IACzD,MAAM,EACJ,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,GACb,GAAG,KAAK,CAAA;IAET,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,CAAA;IAEnD,mBAAmB;IACnB,MAAM,qBAAqB,GAAG,IAAA,wBAAc,EAAC,gBAAgB,CAAC,CAAA;IAE9D,4DAA4D;IAC5D,MAAM,cAAc,GAAG,IAAA,+BAAqB,EAAC,qBAAqB,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG,IAAA,+BAAqB,EAAC,qBAAqB,CAAC,CAAA;IACnE,MAAM,iBAAiB,GAAG,cAAc,CAAC,QAAQ,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,CAAA;IAEhF,mEAAmE;IACnE,MAAM,yBAAyB,GAAiD,cAAc;QAC5F,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI;YACxB,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ;YAClC,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,UAAU;YACtC,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ;YAClC,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ;YAClC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK;YAC5B,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI;YACnC,iBAAiB,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM;YACvC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO;SAC/B,CAAC,CAAC;QACL,CAAC,CAAC,SAAS,CAAA;IAEb,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,YAAY,EAAE,CAAC,EAAE,4BAA4B;QAC7C,eAAe,EAAE,qBAAqB;QACtC,cAAc;QACd,cAAc;QACd,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QACxD,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,eAAe;QACf,gBAAgB,EAAE,iBAAiB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,mBAAmB,GAAG,CAAC;YACpG,CAAC,CAAC,iBAAiB,CAAC,KAAK;YACzB,CAAC,CAAC,SAAS;QACb,yBAAyB;QACzB,gBAAgB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;QACxF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;AACH,CAAC"}

package/dist/report/enrichment.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Report Enrichment — Adds rule registry metadata and framework-specific fixes to findings.
+ *
+ * Extracted from the orchestrator. Runs after detection + aggregation, before scoring.
+ */
+import type { Vulnerability } from '../shared/types';
+import type { ProjectContext } from '../model/project-context';
+/**
+ * Enrich findings with metadata from the rule registry (PRO-82)
+ * Sets default impact, evidence, fixSteps, and references from registry
+ *
+ * PRO-83: When projectContext is provided, uses framework-aware fix suggestions
+ * that are tailored to the user's detected tech stack (e.g., Prisma-specific
+ * SQL injection fixes instead of generic advice).
+ *
+ * These can be overridden later by AI-generated content
+ */
+export declare function enrichWithMetadata(findings: Vulnerability[], projectContext?: ProjectContext): Vulnerability[];
+//# sourceMappingURL=enrichment.d.ts.map

package/dist/report/enrichment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrichment.d.ts","sourceRoot":"","sources":["../../src/report/enrichment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAI9D;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,cAAc,CAAC,EAAE,cAAc,GAC9B,aAAa,EAAE,CA2BjB"}

package/dist/report/enrichment.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Report Enrichment — Adds rule registry metadata and framework-specific fixes to findings.
+ *
+ * Extracted from the orchestrator. Runs after detection + aggregation, before scoring.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrichWithMetadata = enrichWithMetadata;
+const rules_1 = require("../shared/rules");
+const framework_fixes_1 = require("../shared/rules/framework-fixes");
+/**
+ * Enrich findings with metadata from the rule registry (PRO-82)
+ * Sets default impact, evidence, fixSteps, and references from registry
+ *
+ * PRO-83: When projectContext is provided, uses framework-aware fix suggestions
+ * that are tailored to the user's detected tech stack (e.g., Prisma-specific
+ * SQL injection fixes instead of generic advice).
+ *
+ * These can be overridden later by AI-generated content
+ */
+function enrichWithMetadata(findings, projectContext) {
+    return findings.map(f => {
+        const metadata = (0, rules_1.getRuleMetadata)(f.category);
+        if (!metadata)
+            return f;
+        // PRO-83: Check for framework-specific fix suggestions
+        let fixSteps = metadata.fixSteps;
+        if (projectContext) {
+            const frameworkFix = (0, framework_fixes_1.getFrameworkFix)(f.category, projectContext.frameworks, projectContext.dataAccess);
+            if (frameworkFix) {
+                fixSteps = frameworkFix.fixSteps;
+            }
+        }
+        return {
+            ...f,
+            // Set defaults from registry (AI can override later)
+            impact: f.impact || metadata.whyItMatters,
+            evidence: f.evidence || metadata.evidence,
+            fixSteps: f.fixSteps || fixSteps,
+            references: f.references || metadata.references,
+        };
+    });
+}
+//# sourceMappingURL=enrichment.js.map

package/dist/report/enrichment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrichment.js","sourceRoot":"","sources":["../../src/report/enrichment.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAiBH,gDA8BC;AA3CD,2CAAiD;AACjD,qEAAiE;AAEjE;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,QAAyB,EACzB,cAA+B;IAE/B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACtB,MAAM,QAAQ,GAAG,IAAA,uBAAe,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAA;QAEvB,uDAAuD;QACvD,IAAI,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAChC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,YAAY,GAAG,IAAA,iCAAe,EAClC,CAAC,CAAC,QAAQ,EACV,cAAc,CAAC,UAAU,EACzB,cAAc,CAAC,UAAU,CAC1B,CAAA;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAA;YAClC,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,CAAC;YACJ,qDAAqD;YACrD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,QAAQ;YAChC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;SAChD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/report/formatters/ai-context.d.ts

@@ -0,0 +1,23 @@
+/**
+ * AI Context Formatter
+ * Generates structured markdown for AI coding assistants to consume and fix security findings
+ */
+import type { ScanResult } from '../../shared/types';
+/**
+ * Options for AI context formatting
+ */
+export interface AIContextOptions {
+    /** Maximum findings to include in detail (default: 20) */
+    maxFindings?: number;
+    /** Include reference URLs (default: true) */
+    includeReferences?: boolean;
+}
+/**
+ * Format scan result as AI-ready context markdown
+ *
+ * @param result - The scan result to format
+ * @param options - Formatting options
+ * @returns Markdown string for AI consumption
+ */
+export declare function formatAIContext(result: ScanResult, options?: AIContextOptions): string;
+//# sourceMappingURL=ai-context.d.ts.map

package/dist/report/formatters/ai-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-context.d.ts","sourceRoot":"","sources":["../../../src/report/formatters/ai-context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAwC,MAAM,oBAAoB,CAAA;AAG1F;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AA2MD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA2E1F"}