@oculum/scanner 1.0.12 → 1.0.13

package/dist/validate/prompts/validation.d.ts

@@ -0,0 +1,18 @@
+/**
+ * High-Context Validation Prompt
+ *
+ * Comprehensive validation prompt with generalised security rules.
+ * Used for validating Layer 1/2 findings with full file context.
+ *
+ * Now backed by the modular prompt system. The monolithic constant is
+ * generated from all modules combined for backward compatibility.
+ */
+export { assembleValidationPrompt, getFullValidationPrompt } from './modules';
+/**
+ * Legacy backward-compatible constant.
+ * Equivalent to getFullValidationPrompt() — all modules combined.
+ * Kept so any code importing this constant continues to work.
+ */
+export { getFullValidationPrompt as _getFullPrompt } from './modules';
+export declare const HIGH_CONTEXT_VALIDATION_PROMPT: string;
+//# sourceMappingURL=validation.d.ts.map

package/dist/validate/prompts/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/validate/prompts/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAE7E;;;;GAIG;AACH,OAAO,EAAE,uBAAuB,IAAI,cAAc,EAAE,MAAM,WAAW,CAAA;AAErE,eAAO,MAAM,8BAA8B,QAA4B,CAAA"}

package/dist/validate/prompts/validation.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * High-Context Validation Prompt
+ *
+ * Comprehensive validation prompt with generalised security rules.
+ * Used for validating Layer 1/2 findings with full file context.
+ *
+ * Now backed by the modular prompt system. The monolithic constant is
+ * generated from all modules combined for backward compatibility.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HIGH_CONTEXT_VALIDATION_PROMPT = exports._getFullPrompt = exports.getFullValidationPrompt = exports.assembleValidationPrompt = void 0;
+var modules_1 = require("./modules");
+Object.defineProperty(exports, "assembleValidationPrompt", { enumerable: true, get: function () { return modules_1.assembleValidationPrompt; } });
+Object.defineProperty(exports, "getFullValidationPrompt", { enumerable: true, get: function () { return modules_1.getFullValidationPrompt; } });
+/**
+ * Legacy backward-compatible constant.
+ * Equivalent to getFullValidationPrompt() — all modules combined.
+ * Kept so any code importing this constant continues to work.
+ */
+var modules_2 = require("./modules");
+Object.defineProperty(exports, "_getFullPrompt", { enumerable: true, get: function () { return modules_2.getFullValidationPrompt; } });
+const modules_3 = require("./modules");
+exports.HIGH_CONTEXT_VALIDATION_PROMPT = (0, modules_3.getFullValidationPrompt)();
+//# sourceMappingURL=validation.js.map

package/dist/validate/prompts/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/validate/prompts/validation.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,qCAA6E;AAApE,mHAAA,wBAAwB,OAAA;AAAE,kHAAA,uBAAuB,OAAA;AAE1D;;;;GAIG;AACH,qCAAqE;AAA5D,yGAAA,uBAAuB,OAAkB;AAClD,uCAAmD;AACtC,QAAA,8BAA8B,GAAG,IAAA,iCAAuB,GAAE,CAAA"}

package/dist/validate/providers/anthropic.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Anthropic Provider Implementation
+ *
+ * Validation using Anthropic Claude 3.5 Haiku model.
+ */
+import type { Vulnerability, ScanFile } from '../../shared/types';
+import type { ContextEngineResult } from '../../model/taint-types';
+import type { ValidationStats, AIValidationResult } from '../types';
+/**
+ * Validate findings using Anthropic Claude 3.5 Haiku
+ */
+export declare function validateWithAnthropic(findings: Vulnerability[], files: ScanFile[], ceResult: ContextEngineResult | undefined, stats: ValidationStats, onProgress?: (progress: {
+    filesProcessed: number;
+    totalFiles: number;
+    status: string;
+}) => void): Promise<AIValidationResult>;
+//# sourceMappingURL=anthropic.d.ts.map

package/dist/validate/providers/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/validate/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAoB,MAAM,oBAAoB,CAAA;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAGlE,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAOnE;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,aAAa,EAAE,EACzB,KAAK,EAAE,QAAQ,EAAE,EACjB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,EACzC,KAAK,EAAE,eAAe,EACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,GAC9F,OAAO,CAAC,kBAAkB,CAAC,CA4R7B"}

package/dist/validate/providers/anthropic.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Anthropic Provider Implementation
+ *
+ * Validation using Anthropic Claude 3.5 Haiku model.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateWithAnthropic = validateWithAnthropic;
+const project_context_1 = require("../../model/project-context");
+const clients_1 = require("../clients");
+const retry_1 = require("../utils/retry");
+const response_parser_1 = require("../utils/response-parser");
+const request_builder_1 = require("../request-builder");
+const validation_1 = require("../prompts/validation");
+/**
+ * Validate findings using Anthropic Claude 3.5 Haiku
+ */
+async function validateWithAnthropic(findings, files, ceResult, stats, onProgress) {
+    console.log('[AI Validation] Initializing Anthropic client...');
+    const client = (0, clients_1.getAnthropicClient)();
+    // Extract project context from CE result or build from scratch
+    const context = ceResult?.projectContext ?? (0, project_context_1.buildProjectContext)(files);
+    const fileTaintAnalyses = ceResult?.fileTaintAnalyses;
+    const routeMap = ceResult?.routeMap;
+    const frameworkAnalyses = ceResult?.frameworkAnalyses;
+    if (!ceResult) {
+        console.log('[AI Validation] No ContextEngineResult provided, built project context from scratch:', {
+            hasAuthMiddleware: context.auth.hasGlobalMiddleware,
+            authProvider: context.auth.authProvider,
+            orm: context.dataAccess.orm,
+            framework: context.frameworks.primary,
+        });
+    }
+    // Group findings by file for efficient validation
+    const findingsByFile = new Map();
+    for (const finding of findings) {
+        const existing = findingsByFile.get(finding.filePath) || [];
+        existing.push(finding);
+        findingsByFile.set(finding.filePath, existing);
+    }
+    const validatedFindings = [];
+    // Phase 2: Multi-file batching
+    const fileEntries = Array.from(findingsByFile.entries());
+    // Track metrics
+    let totalBatchWaitTime = 0;
+    let totalApiBatches = 0;
+    const totalFileBatches = Math.ceil(fileEntries.length / clients_1.FILES_PER_API_BATCH);
+    console.log(`[AI Validation] Phase 2: Processing ${fileEntries.length} files in ${totalFileBatches} API batch(es) (${clients_1.FILES_PER_API_BATCH} files/batch)`);
+    // Track files processed for progress reporting
+    let filesValidated = 0;
+    // Process files in batches - each batch is ONE API call with multiple files
+    for (let batchStart = 0; batchStart < fileEntries.length; batchStart += clients_1.FILES_PER_API_BATCH) {
+        const fileBatch = fileEntries.slice(batchStart, batchStart + clients_1.FILES_PER_API_BATCH);
+        const batchNum = Math.floor(batchStart / clients_1.FILES_PER_API_BATCH) + 1;
+        // Report progress before processing batch
+        if (onProgress) {
+            onProgress({
+                filesProcessed: filesValidated,
+                totalFiles: fileEntries.length,
+                status: `AI validating batch ${batchNum}/${totalFileBatches}`,
+            });
+        }
+        console.log(`[AI Validation] API Batch ${batchNum}/${totalFileBatches}: ${fileBatch.length} files`);
+        // Prepare file data for batch request
+        const fileDataList = [];
+        const filesWithoutContent = [];
+        for (const [filePath, fileFindings] of fileBatch) {
+            const file = files.find(f => f.path === filePath);
+            if (!file) {
+                filesWithoutContent.push({ filePath, findings: fileFindings });
+            }
+            else {
+                fileDataList.push({ file, findings: fileFindings, filePath });
+            }
+        }
+        // Handle files without content - mark as not validated
+        for (const { findings } of filesWithoutContent) {
+            for (const f of findings) {
+                validatedFindings.push({
+                    ...f,
+                    validatedByAI: false,
+                    validationStatus: 'not_validated',
+                    validationNotes: 'File content not available for validation',
+                });
+            }
+        }
+        // Skip API call if no files with content
+        if (fileDataList.length === 0) {
+            continue;
+        }
+        const batchStartTime = Date.now();
+        try {
+            // Build multi-file validation request with scoped context, taint data, and route map
+            const validationRequest = (0, request_builder_1.buildMultiFileValidationRequest)(fileDataList.map(({ file, findings }) => ({ file, findings })), context, { contextMode: 'scoped' }, fileTaintAnalyses, routeMap, ceResult?.crossFileTaintPaths, frameworkAnalyses);
+            // Assemble category-aware prompt for this batch
+            const batchCategories = [...new Set(fileBatch.flatMap(([, fileFindings]) => fileFindings.map(f => f.category)))];
+            const systemPrompt = (0, validation_1.assembleValidationPrompt)(batchCategories);
+            // Use Anthropic prompt caching with multi-file request
+            const response = await (0, retry_1.makeAnthropicRequestWithRetry)(() => client.messages.create({
+                model: 'claude-3-5-haiku-20241022',
+                max_tokens: 16384, // Must accommodate 8 files × multiple findings with full validation fields
+                system: [
+                    {
+                        type: 'text',
+                        text: systemPrompt,
+                        cache_control: { type: 'ephemeral' }, // Cache for 5 minutes
+                    },
+                ],
+                messages: [{ role: 'user', content: validationRequest }],
+            }));
+            // Track API call stats
+            stats.apiCalls++;
+            totalApiBatches++;
+            // Extract cache metrics from usage
+            const usage = response.usage;
+            if (usage) {
+                // DEBUG: Log full usage object to understand token breakdown
+                console.log(`[DEBUG] Batch ${batchNum} - Full API Response Usage:`);
+                console.log(JSON.stringify(usage, null, 2));
+                console.log(`[DEBUG] Breakdown:`);
+                console.log(`  - input_tokens: ${usage.input_tokens || 0}`);
+                console.log(`  - output_tokens: ${usage.output_tokens || 0}`);
+                // @ts-ignore
+                console.log(`  - cache_creation_input_tokens: ${usage.cache_creation_input_tokens || 0}`);
+                // @ts-ignore
+                console.log(`  - cache_read_input_tokens: ${usage.cache_read_input_tokens || 0}`);
+                stats.estimatedInputTokens += usage.input_tokens || 0;
+                stats.estimatedOutputTokens += usage.output_tokens || 0;
+                // @ts-ignore - cache fields not in types yet
+                const cacheCreation = usage.cache_creation_input_tokens || 0;
+                // @ts-ignore
+                const cacheRead = usage.cache_read_input_tokens || 0;
+                stats.cacheCreationTokens += cacheCreation;
+                stats.cacheReadTokens += cacheRead;
+            }
+            const textContent = response.content.find((block) => block.type === 'text');
+            if (!textContent || textContent.type !== 'text') {
+                // No valid response - mark all findings as not validated
+                for (const { findings } of fileDataList) {
+                    for (const f of findings) {
+                        validatedFindings.push({
+                            ...f,
+                            validatedByAI: false,
+                            validationStatus: 'not_validated',
+                            validationNotes: 'No valid response from AI',
+                        });
+                    }
+                }
+                continue;
+            }
+            // Parse multi-file response
+            const expectedFiles = fileDataList.map(({ filePath }) => filePath);
+            const validationResultsMap = (0, response_parser_1.parseMultiFileValidationResponse)(textContent.text, expectedFiles);
+            // Apply results per file
+            for (const { filePath, findings } of fileDataList) {
+                const fileResults = validationResultsMap.get(filePath);
+                if (!fileResults || fileResults.length === 0) {
+                    // No results for this file - try single-file parsing as fallback
+                    const singleFileResults = (0, response_parser_1.parseValidationResponse)(textContent.text);
+                    if (singleFileResults.length > 0 && fileDataList.length === 1) {
+                        // Single file in batch, use single-file parsing
+                        const { processed: processedFindings, dismissedCount } = (0, response_parser_1.applyValidationResults)(findings, singleFileResults);
+                        stats.validatedFindings += processedFindings.length + dismissedCount;
+                        stats.dismissedFindings += dismissedCount;
+                        for (const processed of processedFindings) {
+                            if (processed.validationStatus === 'confirmed') {
+                                stats.confirmedFindings++;
+                            }
+                            else if (processed.validationStatus === 'downgraded') {
+                                stats.downgradedFindings++;
+                            }
+                            validatedFindings.push(processed);
+                        }
+                    }
+                    else {
+                        // No validation results - REJECT all findings for this file (conservative approach)
+                        console.warn(`[AI Validation] No results for ${filePath} - REJECTING ${findings.length} findings`);
+                        stats.validatedFindings += findings.length;
+                        stats.dismissedFindings += findings.length;
+                        // Don't add to validatedFindings - findings are rejected
+                    }
+                }
+                else {
+                    // Apply validation results for this file
+                    const { processed: processedFindings, dismissedCount } = (0, response_parser_1.applyValidationResults)(findings, fileResults);
+                    stats.validatedFindings += processedFindings.length + dismissedCount;
+                    stats.dismissedFindings += dismissedCount;
+                    for (const processed of processedFindings) {
+                        if (processed.validationStatus === 'confirmed') {
+                            stats.confirmedFindings++;
+                        }
+                        else if (processed.validationStatus === 'downgraded') {
+                            stats.downgradedFindings++;
+                        }
+                        validatedFindings.push(processed);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.error(`[AI Validation] Error in batch ${batchNum}:`, error);
+            // Fallback: keep all findings but mark as not validated
+            for (const { findings } of fileDataList) {
+                for (const f of findings) {
+                    validatedFindings.push({
+                        ...f,
+                        validatedByAI: false,
+                        validationStatus: 'not_validated',
+                        validationNotes: 'Validation failed due to API error',
+                    });
+                }
+            }
+        }
+        const batchDuration = Date.now() - batchStartTime;
+        totalBatchWaitTime += batchDuration;
+        // Update files validated counter
+        filesValidated += fileBatch.length;
+        // Report progress after batch completion
+        if (onProgress) {
+            onProgress({
+                filesProcessed: filesValidated,
+                totalFiles: fileEntries.length,
+                status: `AI validation complete for batch ${batchNum}/${totalFileBatches}`,
+            });
+        }
+    }
+    // Calculate cache hit rate
+    const totalCacheableTokens = stats.cacheCreationTokens + stats.cacheReadTokens;
+    stats.cacheHitRate = totalCacheableTokens > 0
+        ? stats.cacheReadTokens / totalCacheableTokens
+        : 0;
+    // Calculate estimated cost with cache pricing
+    const freshInputCost = (stats.estimatedInputTokens * clients_1.HAIKU_PRICING.input) / 1000000;
+    const cacheWriteCost = (stats.cacheCreationTokens * clients_1.HAIKU_PRICING.cacheWrite) / 1000000;
+    const cacheReadCost = (stats.cacheReadTokens * clients_1.HAIKU_PRICING.cacheRead) / 1000000;
+    const outputCost = (stats.estimatedOutputTokens * clients_1.HAIKU_PRICING.output) / 1000000;
+    stats.estimatedCost = freshInputCost + cacheWriteCost + cacheReadCost + outputCost;
+    // Log validation stats with cache metrics and performance
+    console.log(`[AI Validation] Stats:`);
+    console.log(`  - Total findings: ${stats.totalFindings}`);
+    console.log(`  - AI validated: ${stats.validatedFindings}`);
+    console.log(`  - Confirmed: ${stats.confirmedFindings}`);
+    console.log(`  - Dismissed: ${stats.dismissedFindings}`);
+    console.log(`  - Downgraded: ${stats.downgradedFindings}`);
+    console.log(`  - API calls: ${stats.apiCalls}`);
+    console.log(`  - Performance:`);
+    console.log(`    - Total duration: ${(totalBatchWaitTime / 1000).toFixed(1)}s`);
+    console.log(`    - Total API batches: ${totalApiBatches}`);
+    console.log(`    - Avg time per file: ${fileEntries.length > 0 ? (totalBatchWaitTime / fileEntries.length).toFixed(0) : 0}ms`);
+    console.log(`  - Cache metrics:`);
+    console.log(`    - Cache writes: ${stats.cacheCreationTokens.toLocaleString()} tokens`);
+    console.log(`    - Cache reads: ${stats.cacheReadTokens.toLocaleString()} tokens`);
+    console.log(`    - Cache hit rate: ${(stats.cacheHitRate * 100).toFixed(1)}%`);
+    console.log(`  - Token usage:`);
+    console.log(`    - Input (total): ${stats.estimatedInputTokens.toLocaleString()} tokens`);
+    console.log(`    - Output: ${stats.estimatedOutputTokens.toLocaleString()} tokens`);
+    console.log(`  - Estimated cost: $${stats.estimatedCost.toFixed(4)}`);
+    return { vulnerabilities: validatedFindings, stats };
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/validate/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/validate/providers/anthropic.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAgBH,sDAkSC;AA7SD,iEAAiE;AAEjE,wCAAmF;AACnF,0CAA8D;AAC9D,8DAA4H;AAC5H,wDAAoE;AACpE,sDAAgE;AAEhE;;GAEG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAyB,EACzB,KAAiB,EACjB,QAAyC,EACzC,KAAsB,EACtB,UAA+F;IAE/F,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAA,4BAAkB,GAAE,CAAA;IAEnC,+DAA+D;IAC/D,MAAM,OAAO,GAAmB,QAAQ,EAAE,cAAc,IAAI,IAAA,qCAAmB,EAAC,KAAK,CAAC,CAAA;IACtF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,iBAAiB,CAAA;IACrD,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAA;IACnC,MAAM,iBAAiB,GAAG,QAAQ,EAAE,iBAAiB,CAAA;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sFAAsF,EAAE;YAClG,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB;YACnD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;YAC3B,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAA;IACzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC3D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,iBAAiB,GAAoB,EAAE,CAAA;IAE7C,+BAA+B;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAA;IAExD,gBAAgB;IAChB,IAAI,kBAAkB,GAAG,CAAC,CAAA;IAC1B,IAAI,eAAe,GAAG,CAAC,CAAA;IAEvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,6BAAmB,CAAC,CAAA;IAC5E,OAAO,CAAC,GAAG,CAAC,uCAAuC,WAAW,CAAC,MAAM,aAAa,gBAAgB,mBAAmB,6BAAmB,eAAe,CAAC,CAAA;IAExJ,+CAA+C;IAC/C,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,4EAA4E;IAC5E,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,IAAI,6BAAmB,EAAE,CAAC;QAC5F,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,6BAAmB,CAAC,CAAA;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,6BAAmB,CAAC,GAAG,CAAC,CAAA;QAEjE,0CAA0C;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC;gBACT,cAAc,EAAE,cAAc;gBAC9B,UAAU,EAAE,WAAW,CAAC,MAAM;gBAC9B,MAAM,EAAE,uBAAuB,QAAQ,IAAI,gBAAgB,EAAE;aAC9D,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,6BAA6B,QAAQ,IAAI,gBAAgB,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAA;QAEnG,sCAAsC;QACtC,MAAM,YAAY,GAA2E,EAAE,CAAA;QAC/F,MAAM,mBAAmB,GAA2D,EAAE,CAAA;QAEtF,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,mBAAmB,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,iBAAiB,CAAC,IAAI,CAAC;oBACrB,GAAG,CAAC;oBACJ,aAAa,EAAE,KAAK;oBACpB,gBAAgB,EAAE,eAAmC;oBACrD,eAAe,EAAE,2CAA2C;iBAC7D,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAQ;QACV,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEjC,IAAI,CAAC;YACH,qFAAqF;YACrF,MAAM,iBAAiB,GAAG,IAAA,iDAA+B,EACvD,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAC9D,OAAO,EACP,EAAE,WAAW,EAAE,QAAQ,EAAE,EACzB,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAAE,mBAAmB,EAC7B,iBAAiB,CAClB,CAAA;YAED,gDAAgD;YAChD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CACjC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC3E,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,IAAA,qCAAwB,EAAC,eAAe,CAAC,CAAA;YAE9D,uDAAuD;YACvD,MAAM,QAAQ,GAAG,MAAM,IAAA,qCAA6B,EAAC,GAAG,EAAE,CACxD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrB,KAAK,EAAE,2BAA2B;gBAClC,UAAU,EAAE,KAAK,EAAE,2EAA2E;gBAC9F,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,YAAY;wBAClB,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,sBAAsB;qBAC7D;iBACF;gBACD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;aACzD,CAAC,CACH,CAAA;YAED,uBAAuB;YACvB,KAAK,CAAC,QAAQ,EAAE,CAAA;YAChB,eAAe,EAAE,CAAA;YAEjB,mCAAmC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;YAC5B,IAAI,KAAK,EAAE,CAAC;gBACV,6DAA6D;gBAC7D,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,6BAA6B,CAAC,CAAA;gBACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBACjC,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC3D,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC7D,aAAa;gBACb,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,2BAA2B,IAAI,CAAC,EAAE,CAAC,CAAA;gBACzF,aAAa;gBACb,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC,CAAA;gBAEjF,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAA;gBACrD,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,CAAA;gBAEvD,6CAA6C;gBAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,2BAA2B,IAAI,CAAC,CAAA;gBAC5D,aAAa;gBACb,MAAM,SAAS,GAAG,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAA;gBAEpD,KAAK,CAAC,mBAAmB,IAAI,aAAa,CAAA;gBAC1C,KAAK,CAAC,eAAe,IAAI,SAAS,CAAA;YACpC,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;YAC7F,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAChD,yDAAyD;gBACzD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;oBACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACzB,iBAAiB,CAAC,IAAI,CAAC;4BACrB,GAAG,CAAC;4BACJ,aAAa,EAAE,KAAK;4BACpB,gBAAgB,EAAE,eAAmC;4BACrD,eAAe,EAAE,2BAA2B;yBAC7C,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,4BAA4B;YAC5B,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;YAClE,MAAM,oBAAoB,GAAG,IAAA,kDAAgC,EAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAE9F,yBAAyB;YACzB,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;gBAClD,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAEtD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7C,iEAAiE;oBACjE,MAAM,iBAAiB,GAAG,IAAA,yCAAuB,EAAC,WAAW,CAAC,IAAI,CAAC,CAAA;oBAEnE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC9D,gDAAgD;wBAChD,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,IAAA,wCAAsB,EAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAA;wBAC5G,KAAK,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,cAAc,CAAA;wBACpE,KAAK,CAAC,iBAAiB,IAAI,cAAc,CAAA;wBACzC,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;4BAC1C,IAAI,SAAS,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;gCAC/C,KAAK,CAAC,iBAAiB,EAAE,CAAA;4BAC3B,CAAC;iCAAM,IAAI,SAAS,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;gCACvD,KAAK,CAAC,kBAAkB,EAAE,CAAA;4BAC5B,CAAC;4BACD,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;wBACnC,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,oFAAoF;wBACpF,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,gBAAgB,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAA;wBAClG,KAAK,CAAC,iBAAiB,IAAI,QAAQ,CAAC,MAAM,CAAA;wBAC1C,KAAK,CAAC,iBAAiB,IAAI,QAAQ,CAAC,MAAM,CAAA;wBAC1C,yDAAyD;oBAC3D,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,yCAAyC;oBACzC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,IAAA,wCAAsB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;oBACtG,KAAK,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,cAAc,CAAA;oBACpE,KAAK,CAAC,iBAAiB,IAAI,cAAc,CAAA;oBACzC,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;wBAC1C,IAAI,SAAS,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;4BAC/C,KAAK,CAAC,iBAAiB,EAAE,CAAA;wBAC3B,CAAC;6BAAM,IAAI,SAAS,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;4BACvD,KAAK,CAAC,kBAAkB,EAAE,CAAA;wBAC5B,CAAC;wBACD,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACnC,CAAC;gBACH,CAAC;YACH,CAAC;QAEH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAA;YACnE,wDAAwD;YACxD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,iBAAiB,CAAC,IAAI,CAAC;wBACrB,GAAG,CAAC;wBACJ,aAAa,EAAE,KAAK;wBACpB,gBAAgB,EAAE,eAAmC;wBACrD,eAAe,EAAE,oCAAoC;qBACtD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;QACjD,kBAAkB,IAAI,aAAa,CAAA;QAEnC,iCAAiC;QACjC,cAAc,IAAI,SAAS,CAAC,MAAM,CAAA;QAElC,yCAAyC;QACzC,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC;gBACT,cAAc,EAAE,cAAc;gBAC9B,UAAU,EAAE,WAAW,CAAC,MAAM;gBAC9B,MAAM,EAAE,oCAAoC,QAAQ,IAAI,gBAAgB,EAAE;aAC3E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,oBAAoB,GAAG,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC,eAAe,CAAA;IAC9E,KAAK,CAAC,YAAY,GAAG,oBAAoB,GAAG,CAAC;QAC3C,CAAC,CAAC,KAAK,CAAC,eAAe,GAAG,oBAAoB;QAC9C,CAAC,CAAC,CAAC,CAAA;IAEL,8CAA8C;IAC9C,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,uBAAa,CAAC,KAAK,CAAC,GAAG,OAAS,CAAA;IACrF,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,mBAAmB,GAAG,uBAAa,CAAC,UAAU,CAAC,GAAG,OAAS,CAAA;IACzF,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,uBAAa,CAAC,SAAS,CAAC,GAAG,OAAS,CAAA;IACnF,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,qBAAqB,GAAG,uBAAa,CAAC,MAAM,CAAC,GAAG,OAAS,CAAA;IAEnF,KAAK,CAAC,aAAa,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,GAAG,UAAU,CAAA;IAElF,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxD,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC/E,OAAO,CAAC,GAAG,CAAC,4BAA4B,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO,CAAC,GAAG,CAAC,4BAA4B,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9H,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,mBAAmB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IAClF,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,oBAAoB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACzF,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,qBAAqB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACnF,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAErE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAA;AACtD,CAAC"}

package/dist/validate/providers/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * AI Providers Index
+ *
+ * Re-exports all AI provider implementations.
+ */
+export { validateWithOpenAI } from './openai';
+export { validateWithAnthropic } from './anthropic';
+//# sourceMappingURL=index.d.ts.map

package/dist/validate/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/validate/providers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA"}

package/dist/validate/providers/index.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * AI Providers Index
+ *
+ * Re-exports all AI provider implementations.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateWithAnthropic = exports.validateWithOpenAI = void 0;
+var openai_1 = require("./openai");
+Object.defineProperty(exports, "validateWithOpenAI", { enumerable: true, get: function () { return openai_1.validateWithOpenAI; } });
+var anthropic_1 = require("./anthropic");
+Object.defineProperty(exports, "validateWithAnthropic", { enumerable: true, get: function () { return anthropic_1.validateWithAnthropic; } });
+//# sourceMappingURL=index.js.map

package/dist/validate/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validate/providers/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,mCAA6C;AAApC,4GAAA,kBAAkB,OAAA;AAC3B,yCAAmD;AAA1C,kHAAA,qBAAqB,OAAA"}

package/dist/validate/providers/openai.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OpenAI Provider Implementation
+ *
+ * Validation using OpenAI GPT-5-mini model.
+ */
+import type { Vulnerability, ScanFile } from '../../shared/types';
+import type { ContextEngineResult } from '../../model/taint-types';
+import type { ValidationStats, AIValidationResult } from '../types';
+/**
+ * Validate findings using OpenAI GPT-5-mini
+ * This mirrors the Anthropic validation flow but uses OpenAI's API
+ */
+export declare function validateWithOpenAI(findings: Vulnerability[], files: ScanFile[], ceResult: ContextEngineResult | undefined, stats: ValidationStats): Promise<AIValidationResult>;
+//# sourceMappingURL=openai.d.ts.map

package/dist/validate/providers/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/validate/providers/openai.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAoB,MAAM,oBAAoB,CAAA;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAGlE,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAoB,MAAM,UAAU,CAAA;AAQrF;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,aAAa,EAAE,EACzB,KAAK,EAAE,QAAQ,EAAE,EACjB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,EACzC,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAwW7B"}