@opensip-cli/external-tool-adapter 0.1.15

package/dist/session-payload.d.ts

@@ -0,0 +1,81 @@
+/**
+ * @fileoverview Adapter-owned session payload (ADR-0090; ADR-0011 session split).
+ *
+ * The host persists each adapter run's session row with an OPAQUE, tool-owned
+ * detail blob (`session_tool_payload.payload`). The dashboard's shared
+ * session-detail renderer groups `payload.checks[]` and computes
+ * `clean = errors === 0 && warnings === 0` from `payload.summary`. An adapter
+ * session that carried only a finding COUNT (no `checks`/`summary`) therefore
+ * rendered a secret/vuln scan as "No findings — this run was clean. Every rule
+ * passed" — actively misleading. This builder gives adapters the SAME
+ * rule-grouped detail shape graph and fitness own (`buildGraphSessionPayload` /
+ * `buildFitnessSessionPayload`), derived straight from the run's already-redacted,
+ * provenance-stamped `Signal[]`.
+ *
+ * Layer-legal: pure and substrate-local (no `cli`/datastore import — the host
+ * writes the row). The shape is tool-owned and opaque to `contracts`, exactly
+ * like graph/fitness own theirs.
+ *
+ * SECRET HYGIENE: every field here is copied from a signal that was redacted at
+ * INGEST (e.g. the gitleaks parser masks `Secret` to a non-reversible preview and
+ * never reads `Match`). No raw credential reaches this payload — and `metadata`
+ * is narrowed to JSON scalars, dropping the nested provenance object entirely.
+ * Proven by the substrate unit suite and each adapter's worker E2E.
+ */
+import type { JsonScalar, Signal, SignalRepair } from '@opensip-cli/core';
+/** Two-level severity the dashboard buckets on (`critical|high → error`). */
+export type AdapterFindingSeverity = 'error' | 'warning';
+/** A persisted finding row — the structural subset the dashboard renders. */
+export interface AdapterSessionFinding {
+    readonly ruleId: string;
+    readonly message: string;
+    readonly severity: AdapterFindingSeverity;
+    readonly filePath: string;
+    readonly line?: number;
+    readonly column?: number;
+    readonly suggestion?: string;
+    readonly metadata?: Readonly<Record<string, JsonScalar>>;
+    /** Structured repair guidance (ADR-0086) — round-trips through replay. */
+    readonly repair?: SignalRepair;
+}
+/** A persisted per-rule detail row — the structural subset the dashboard renders. */
+export interface AdapterSessionCheck {
+    readonly checkSlug: string;
+    readonly passed: boolean;
+    readonly violationCount: number;
+    readonly findings: readonly AdapterSessionFinding[];
+    readonly durationMs: number;
+}
+/**
+ * Opaque-to-contracts detail blob written for every adapter session. `checks` is
+ * the scanner's findings grouped by `ruleId` (one row per rule that fired); the
+ * dashboard's shared session-detail renderer reads `summary` and `checks`
+ * structurally.
+ */
+export interface AdapterSessionPayload {
+    /** Inner version per the payload schema evolution convention (v1 shape). */
+    readonly __version: 1;
+    readonly summary: {
+        /** Rules that fired (one `checks[]` row each). */
+        readonly total: number;
+        /** Rules with no error-severity finding. */
+        readonly passed: number;
+        /** Rules with ≥1 error-severity finding. */
+        readonly failed: number;
+        /** Error-severity (critical|high) finding count. */
+        readonly errors: number;
+        /** Warning-severity (medium|low) finding count. */
+        readonly warnings: number;
+    };
+    readonly checks: readonly AdapterSessionCheck[];
+}
+/**
+ * Build the adapter session payload directly from the run's redacted `Signal[]`.
+ *
+ * Groups by `ruleId` into the dashboard's rule-grouped detail (`checks[]`),
+ * collapsing the 4-level signal severity to the dashboard's two-level
+ * `error`/`warning` bucket. Per-rule `passed` follows fit/graph semantics
+ * (warnings alone do not fail a rule).
+ */
+export declare function buildAdapterSessionPayload(signals: readonly Signal[]): AdapterSessionPayload;
+//# sourceMappingURL=session-payload.d.ts.map

package/dist/session-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-payload.d.ts","sourceRoot":"","sources":["../src/session-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE;QAChB,kDAAkD;QAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,4CAA4C;QAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,4CAA4C;QAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,oDAAoD;QACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,mDAAmD;QACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACjD;AAsCD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,CAgB5F"}

package/dist/session-payload.js

@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Adapter-owned session payload (ADR-0090; ADR-0011 session split).
+ *
+ * The host persists each adapter run's session row with an OPAQUE, tool-owned
+ * detail blob (`session_tool_payload.payload`). The dashboard's shared
+ * session-detail renderer groups `payload.checks[]` and computes
+ * `clean = errors === 0 && warnings === 0` from `payload.summary`. An adapter
+ * session that carried only a finding COUNT (no `checks`/`summary`) therefore
+ * rendered a secret/vuln scan as "No findings — this run was clean. Every rule
+ * passed" — actively misleading. This builder gives adapters the SAME
+ * rule-grouped detail shape graph and fitness own (`buildGraphSessionPayload` /
+ * `buildFitnessSessionPayload`), derived straight from the run's already-redacted,
+ * provenance-stamped `Signal[]`.
+ *
+ * Layer-legal: pure and substrate-local (no `cli`/datastore import — the host
+ * writes the row). The shape is tool-owned and opaque to `contracts`, exactly
+ * like graph/fitness own theirs.
+ *
+ * SECRET HYGIENE: every field here is copied from a signal that was redacted at
+ * INGEST (e.g. the gitleaks parser masks `Secret` to a non-reversible preview and
+ * never reads `Match`). No raw credential reaches this payload — and `metadata`
+ * is narrowed to JSON scalars, dropping the nested provenance object entirely.
+ * Proven by the substrate unit suite and each adapter's worker E2E.
+ */
+import { isErrorSignal, projectJsonScalarMetadata } from '@opensip-cli/core';
+/** Map one redacted signal to its persisted finding row (2-level severity bucket). */
+function toSessionFinding(s) {
+    const metadata = projectJsonScalarMetadata(s.metadata);
+    return {
+        ruleId: s.ruleId,
+        message: s.message,
+        severity: isErrorSignal(s) ? 'error' : 'warning',
+        filePath: s.filePath,
+        ...(s.line === undefined ? {} : { line: s.line }),
+        ...(s.column === undefined ? {} : { column: s.column }),
+        ...(s.suggestion === undefined ? {} : { suggestion: s.suggestion }),
+        ...(metadata ? { metadata } : {}),
+        ...(s.repair === undefined ? {} : { repair: s.repair }),
+    };
+}
+/** Group findings by `ruleId` into one `checks[]` row per rule (fit/graph semantics). */
+function groupByRule(signals) {
+    const byRule = new Map();
+    for (const s of signals) {
+        const arr = byRule.get(s.ruleId);
+        if (arr)
+            arr.push(toSessionFinding(s));
+        else
+            byRule.set(s.ruleId, [toSessionFinding(s)]);
+    }
+    return [...byRule].map(([checkSlug, findings]) => ({
+        checkSlug,
+        passed: findings.every((f) => f.severity !== 'error'),
+        violationCount: findings.length,
+        findings,
+        // Per-rule `durationMs` is 0 — a scanner reports one wall-clock duration for the
+        // whole run (carried separately on the session payload), not per rule, exactly
+        // as graph does for its rule groups.
+        durationMs: 0,
+    }));
+}
+/**
+ * Build the adapter session payload directly from the run's redacted `Signal[]`.
+ *
+ * Groups by `ruleId` into the dashboard's rule-grouped detail (`checks[]`),
+ * collapsing the 4-level signal severity to the dashboard's two-level
+ * `error`/`warning` bucket. Per-rule `passed` follows fit/graph semantics
+ * (warnings alone do not fail a rule).
+ */
+export function buildAdapterSessionPayload(signals) {
+    const checks = groupByRule(signals);
+    const errors = signals.filter(isErrorSignal).length;
+    const warnings = signals.length - errors;
+    return {
+        __version: 1,
+        summary: {
+            total: checks.length,
+            passed: checks.filter((c) => c.passed).length,
+            failed: checks.filter((c) => !c.passed).length,
+            errors,
+            warnings,
+        },
+        checks,
+    };
+}
+//# sourceMappingURL=session-payload.js.map

package/dist/session-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-payload.js","sourceRoot":"","sources":["../src/session-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAsD7E,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAChD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,OAA0B;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,SAAS;QACT,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACrD,cAAc,EAAE,QAAQ,CAAC,MAAM;QAC/B,QAAQ;QACR,iFAAiF;QACjF,+EAA+E;QAC/E,qCAAqC;QACrC,UAAU,EAAE,CAAC;KACd,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0B;IACnE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC9C,MAAM;YACN,QAAQ;SACT;QACD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/severity-map.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview Severity mapping for external-scanner ingestion (ADR-0091).
+ *
+ * Pure functions only. Two jobs:
+ *   1. CVSS number → OpenSIP four-bucket severity (FIRST/NVD v3 bands).
+ *   2. SARIF `level` → severity FALLBACK (lossy — the OpenSIP SARIF writer
+ *      collapses `critical` AND `high` to `error`, so a level-only inverse can
+ *      never recover `critical`; `error → high`).
+ *
+ * Native severity is always preserved on `Signal.metadata` beside the mapped
+ * four-bucket `Signal.severity` (the four-bucket set is `critical|high|medium|low`
+ * — there is no info/unknown rung).
+ */
+import type { SignalSeverity } from '@opensip-cli/core';
+/** SARIF v2.1.0 levels. */
+export type SarifLevel = 'error' | 'warning' | 'note' | 'none';
+/**
+ * Map a CVSS base score to the OpenSIP four-bucket severity using the FIRST/NVD
+ * v3 bands: `>= 9.0` critical · `7.0–8.9` high · `4.0–6.9` medium ·
+ * `0.1–3.9` low · `0`/non-finite → low.
+ */
+export declare function cvssToSeverity(score: number): SignalSeverity;
+/**
+ * Parse a CVSS number out of a value that may be a number or a numeric string
+ * (e.g. SARIF `security-severity` `"9.8"`, OSV `groups[].max_severity` `"7.5"`).
+ * A CVSS *vector* string (`"CVSS:3.1/AV:N/…"`) has no leading number and returns
+ * `undefined`. Returns `undefined` for anything non-numeric.
+ */
+export declare function parseCvss(raw: unknown): number | undefined;
+/**
+ * SARIF `level` → severity FALLBACK (used only when a CVSS `security-severity`
+ * is absent). `error → high` (NEVER critical), `warning → medium`,
+ * `note → low`, `none → low`. An absent/unknown level defaults to the SARIF
+ * default rung (`warning` → medium).
+ */
+export declare function sarifLevelToSeverity(level: string | undefined): SignalSeverity;
+/**
+ * Merge the scanner's NATIVE severity label/number onto a metadata bag under
+ * `nativeSeverity` (preserved beside the mapped four-bucket `Signal.severity`).
+ * `null` records "the scanner emits no severity" (e.g. stock gitleaks).
+ */
+export declare function withNativeSeverity(metadata: Readonly<Record<string, unknown>>, nativeSeverity: unknown): Record<string, unknown>;
+//# sourceMappingURL=severity-map.d.ts.map

package/dist/severity-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.d.ts","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAU1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAkB9E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,cAAc,EAAE,OAAO,GACtB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}

package/dist/severity-map.js

@@ -0,0 +1,84 @@
+/**
+ * @fileoverview Severity mapping for external-scanner ingestion (ADR-0091).
+ *
+ * Pure functions only. Two jobs:
+ *   1. CVSS number → OpenSIP four-bucket severity (FIRST/NVD v3 bands).
+ *   2. SARIF `level` → severity FALLBACK (lossy — the OpenSIP SARIF writer
+ *      collapses `critical` AND `high` to `error`, so a level-only inverse can
+ *      never recover `critical`; `error → high`).
+ *
+ * Native severity is always preserved on `Signal.metadata` beside the mapped
+ * four-bucket `Signal.severity` (the four-bucket set is `critical|high|medium|low`
+ * — there is no info/unknown rung).
+ */
+/**
+ * Map a CVSS base score to the OpenSIP four-bucket severity using the FIRST/NVD
+ * v3 bands: `>= 9.0` critical · `7.0–8.9` high · `4.0–6.9` medium ·
+ * `0.1–3.9` low · `0`/non-finite → low.
+ */
+export function cvssToSeverity(score) {
+    if (!Number.isFinite(score) || score <= 0)
+        return 'low';
+    if (score >= 9)
+        return 'critical';
+    if (score >= 7)
+        return 'high';
+    if (score >= 4)
+        return 'medium';
+    return 'low';
+}
+/**
+ * Parse a CVSS number out of a value that may be a number or a numeric string
+ * (e.g. SARIF `security-severity` `"9.8"`, OSV `groups[].max_severity` `"7.5"`).
+ * A CVSS *vector* string (`"CVSS:3.1/AV:N/…"`) has no leading number and returns
+ * `undefined`. Returns `undefined` for anything non-numeric.
+ */
+export function parseCvss(raw) {
+    if (typeof raw === 'number')
+        return Number.isFinite(raw) ? raw : undefined;
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    // Reject CVSS vector strings (they start with "CVSS:" and carry no base score
+    // we can read without computing it).
+    if (/^cvss:/i.test(trimmed))
+        return undefined;
+    const value = Number.parseFloat(trimmed);
+    return Number.isFinite(value) ? value : undefined;
+}
+/**
+ * SARIF `level` → severity FALLBACK (used only when a CVSS `security-severity`
+ * is absent). `error → high` (NEVER critical), `warning → medium`,
+ * `note → low`, `none → low`. An absent/unknown level defaults to the SARIF
+ * default rung (`warning` → medium).
+ */
+export function sarifLevelToSeverity(level) {
+    switch (level) {
+        case 'error': {
+            return 'high';
+        }
+        case 'warning': {
+            return 'medium';
+        }
+        case 'note': {
+            return 'low';
+        }
+        case 'none': {
+            return 'low';
+        }
+        default: {
+            return 'medium';
+        }
+    }
+}
+/**
+ * Merge the scanner's NATIVE severity label/number onto a metadata bag under
+ * `nativeSeverity` (preserved beside the mapped four-bucket `Signal.severity`).
+ * `null` records "the scanner emits no severity" (e.g. stock gitleaks).
+ */
+export function withNativeSeverity(metadata, nativeSeverity) {
+    return { ...metadata, nativeSeverity: nativeSeverity ?? null };
+}
+//# sourceMappingURL=severity-map.js.map

package/dist/severity-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.js","sourceRoot":"","sources":["../src/severity-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,8EAA8E;IAC9E,qCAAqC;IACrC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA2C,EAC3C,cAAuB;IAEvB,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC;AACjE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,228 @@
+/**
+ * @fileoverview Shared contract types for the External Tool Adapter substrate
+ * (ADR-0090 / ADR-0091 / ADR-0092).
+ *
+ * An "external tool adapter" wraps a user-installed CLI scanner (gitleaks,
+ * osv-scanner, trivy, …) as an ordinary opensip-cli `Tool`. The author declares
+ * identity + a binary + per-command descriptors; the substrate owns the run
+ * loop (resolve → execFile → capture → interpret exit → ingest → normalize →
+ * persist), the standardized `doctor`/`version` commands, and provenance.
+ *
+ * These are pure data shapes — no runtime, no IO — so the file is a kernel-safe
+ * type surface the rest of the substrate imports.
+ */
+import type { Logger, ManifestOptionDescriptor, Signal, SignalSeverity, ToolConfigContribution, ToolIdentity } from '@opensip-cli/core';
+/**
+ * The network posture an adapter declares (ADR-0092). The host displays it
+ * (`doctor`, `tools list`) and the manifest generator forward-maps it onto
+ * `opensipTools.requires` via {@link deriveAdapterManifestRequires}: `subprocess` +
+ * `filesystem` always; `network` when `networked`/`auth-required`. The mapping is
+ * DERIVED (not hand-authored), so flipping an adapter to a networked posture
+ * produces a `--check` drift the gate catches — the §4.8 honest-labeling guarantee.
+ * `requires` enforcement (a sandbox) is still deferred (ADR-0061); declaration +
+ * the honest label land now.
+ */
+export type NetworkPosture = 'local-only' | 'networked' | 'auth-required';
+/** The native output shape a scanner command produces. */
+export type ScannerOutputKind = 'sarif' | 'json' | 'stdout';
+/**
+ * Per-command exit-code model (ADR-0091). Separates "scanner found problems"
+ * (a verdict) from "scanner broke" (a fault). Interpreted by {@link interpretExit}.
+ */
+export interface ScannerExitModel {
+    /** Clean run, no findings (e.g. `[0]`). */
+    readonly ok: readonly number[];
+    /** Ran fine, found issues (e.g. `[1]`) — NOT a fault. */
+    readonly findings: readonly number[];
+    /** `>= this` ⇒ a genuine scanner error (e.g. `2`). Any unmodeled nonzero is also a fault. */
+    readonly errorFrom?: number;
+}
+/**
+ * How the substrate resolves the scanner binary (ADR-0090 §4.3): a layered,
+ * deterministic order, first hit wins. `config` reads the operator pin
+ * (`binaries.<tool>.path` in the namespaced config or the `OPENSIP_<TOOL>_BIN`
+ * env var); `path` is the system `PATH` lookup. A missing binary yields a
+ * `doctor` install hint, never a fetch.
+ */
+export type BinaryResolutionLayer = 'config' | 'env' | 'path';
+/** The wrapped-binary declaration. */
+export interface BinarySpec {
+    /** PATH lookup name (e.g. `'gitleaks'`). */
+    readonly command: string;
+    /** Args that print the version (e.g. `['version']`), for `doctor` + provenance. */
+    readonly versionArgs: readonly string[];
+    /** Parse the version stdout to a semver-ish string. Defaults to `stdout.trim()`. */
+    readonly versionParse?: (stdout: string) => string;
+    /** `doctor` warns when the resolved version is below this. */
+    readonly minVersion?: string;
+    /** Resolution order (default `['config', 'path']`). */
+    readonly resolution?: readonly Exclude<BinaryResolutionLayer, 'env'>[];
+    /**
+     * Env var that pins the binary path. Defaults to `OPENSIP_<TOOL>_BIN`
+     * (uppercased identity name, `-`→`_`).
+     */
+    readonly envVar?: string;
+    /** Platform-agnostic install hint surfaced by `doctor` when the binary is missing. */
+    readonly installHint?: string;
+}
+/** The parsed native scanner output handed to a command's `parse`. */
+export interface ParsedScannerOutput {
+    readonly kind: ScannerOutputKind;
+    /** Raw bytes/text exactly as the scanner wrote them. */
+    readonly raw: string;
+    /** Parsed JSON value when `kind` is `'json'`/`'sarif'` and parsing succeeded. */
+    readonly json?: unknown;
+}
+/**
+ * The resolved, per-run context the substrate hands a command's `args(ctx)` /
+ * `parse(raw, ctx)` (ADR-0090 §4.2 / Phase-0 decision 8). Built from the
+ * `ToolCliContext` with NO `cli` import (paths via core `resolveProjectPaths`).
+ */
+export interface AdapterRunContext {
+    /** The adapter's identity name (`'gitleaks'`). */
+    readonly tool: string;
+    /** The adapter's npm package name, stamped into provenance. */
+    readonly adapterPackage?: string;
+    /** The resolved targeting root the scanner runs against. */
+    readonly projectRoot: string;
+    /** This invocation's run id (the artifact run-segment, ADR-0091). */
+    readonly runId: string;
+    /** The shared structured logger. */
+    readonly logger: Logger;
+    /** The adapter's resolved, namespaced config block (`scope.toolConfig?.<tool>`). */
+    readonly config: Readonly<Record<string, unknown>>;
+    /** The resolved binary (path/layer/version). */
+    readonly binary: ResolvedBinary;
+    /** The config file path (when one was read), for provenance. */
+    readonly configPath?: string;
+    /** Resolve a host-owned artifact path under `.runtime/artifacts/<tool>/<runId>/<name>`. */
+    artifactPath(name: string): string;
+}
+/** A successfully resolved scanner binary. */
+export interface ResolvedBinary {
+    readonly path: string;
+    readonly layer: BinaryResolutionLayer;
+    readonly version?: string;
+}
+/**
+ * One scanner command descriptor. The substrate owns the run loop; the author
+ * supplies args + (for non-SARIF) a `parse`.
+ */
+export interface ExternalCommandSpec {
+    /** The verb (`'scan'` is the conventional primary). */
+    readonly name: string;
+    readonly description?: string;
+    /** Build the scanner argv (no shell). */
+    readonly args: (ctx: AdapterRunContext) => readonly string[];
+    /** Where the scanner writes its native output. `path` is the artifact basename for file outputs. */
+    readonly output: {
+        readonly kind: ScannerOutputKind;
+        readonly path?: string;
+    };
+    /** The exit-code model. Defaults to `{ ok: [0], findings: [1], errorFrom: 2 }`. */
+    readonly exitCodes?: ScannerExitModel;
+    /**
+     * Native output → normalized signals. A `'sarif'` command MAY omit this — the
+     * substrate's shared `ingestSarif` handles it.
+     */
+    readonly parse?: (raw: ParsedScannerOutput, ctx: AdapterRunContext) => readonly Signal[];
+    /** Optional raw-label → severity overrides consulted by the adapter's `parse`. */
+    readonly severityMap?: Readonly<Record<string, SignalSeverity>>;
+    /**
+     * A3: declare how THIS scanner excludes a directory from its walk, so the
+     * substrate can keep it from re-scanning opensip's own persisted reports under
+     * `.runtime/` (which would mint a net-new fingerprint every run and permanently
+     * degrade `--gate-compare`). The substrate calls this with `excludePath` set to
+     * the project's `.runtime` dir and appends the returned `args` to the scanner
+     * argv — so every adapter inherits the guard WITHOUT a user-facing flag (the
+     * mounted command's options are unchanged; the manifest does not regen).
+     *
+     * Scanners spell exclusion differently: trivy `--skip-dirs <path>`; gitleaks has
+     * NO CLI path-exclude and needs a `--config` allowlist file, so this may also
+     * return a `configFile` — the substrate writes it (through the host `writeArtifact`
+     * seam, never a raw substrate fs write) into the per-run dir via `configPath(name)`
+     * and the `args` reference it. A scanner that only parses recognized lockfiles
+     * (osv-scanner) never re-detects a JSON report and may omit this entirely.
+     *
+     * VERIFY-against-installed-binary: the exact exclude-flag / config semantics per
+     * scanner version.
+     */
+    readonly excludeScan?: (input: {
+        /** Absolute path the scanner must NOT walk (the project `.runtime` dir). */
+        readonly excludePath: string;
+        /** Compose a per-run artifact path for an ephemeral config file. */
+        readonly configPath: (name: string) => string;
+    }) => {
+        /** Extra scanner argv appended verbatim (e.g. `['--skip-dirs', excludePath]`). */
+        readonly args?: readonly string[];
+        /** An ephemeral config the substrate writes (host seam) before the scan. */
+        readonly configFile?: {
+            readonly path: string;
+            readonly contents: string;
+        };
+    };
+}
+/**
+ * The fingerprint strategy choice (ADR-0091 §4.5). `message-hash` is the adapter
+ * default (line-shift tolerant — scanner output is line-volatile). Stamped
+ * worker-side when the envelope is built; the host ratchet only reads
+ * `signal.fingerprint`.
+ */
+export type FingerprintStrategyChoice = 'message-hash' | 'rule-location';
+/** The author surface of {@link defineExternalToolAdapter}. */
+export interface ExternalToolAdapterSpec {
+    readonly identity: ToolIdentity;
+    readonly metadata: {
+        /** Stable UUID (ADR-0048). */
+        readonly id: string;
+        readonly description: string;
+        /** Package version stamped into the Tool metadata + provenance. Defaults to `'0.0.0'`. */
+        readonly version?: string;
+        /** npm package name for provenance (e.g. `'@opensip-cli/tool-gitleaks'`). */
+        readonly adapterPackage?: string;
+    };
+    readonly binary: BinarySpec;
+    readonly network: NetworkPosture;
+    readonly commands: readonly ExternalCommandSpec[];
+    /** Adapter default `'message-hash'` (ADR-0091 §4.5). */
+    readonly fingerprintStrategy?: FingerprintStrategyChoice;
+    /**
+     * Optional namespaced config contribution. OMIT it for the standard behaviour:
+     * the substrate DEFAULTS to a claimed namespace ({@link defaultAdapterConfigSchema}
+     * — the `binaries.<tool>.path` operator pin + the reserved verdict-policy keys),
+     * so the binary pin resolves and the gate thresholds are configurable like a
+     * bundled tool. Supply a custom contribution only to claim extra keys; doing so
+     * opts out of the auto-generated static config descriptor (its validation then
+     * defers entirely to the worker deep pass).
+     */
+    readonly config?: Omit<ToolConfigContribution, 'namespace'>;
+    /** Optional per-tool contract version marker (ADR-0046). */
+    readonly contractVersion?: string;
+}
+/** Adapter provenance stamped onto every signal's `metadata.provenance` (ADR-0090 §8). */
+export interface AdapterProvenance {
+    readonly tool: string;
+    readonly adapterPackage?: string;
+    readonly binaryPath: string;
+    readonly binaryVersion?: string;
+    readonly args: readonly string[];
+    readonly configPath?: string;
+}
+/**
+ * A serializable command shell — the data a generator writes into an adapter's
+ * `package.json#opensipTools.commands` so the static manifest matches the
+ * runtime `commandSpecs` (the `assertCommandNamesMatch` parity mechanism).
+ */
+export interface ManifestCommandShell {
+    readonly name: string;
+    readonly description: string;
+    readonly aliases: readonly string[];
+    readonly commonFlags: readonly string[];
+    /** Tool-specific options (e.g. the gate flags), MINUS the non-serializable `parse` closure. */
+    readonly options?: readonly ManifestOptionDescriptor[];
+    readonly scope: 'project' | 'none';
+    readonly output: string;
+    readonly parent?: string;
+    readonly rawStreamReason?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,MAAM,EACN,wBAAwB,EACxB,MAAM,EACN,cAAc,EACd,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;AAE1E,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9D,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACnD,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC;IACvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2FAA2F;IAC3F,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,SAAS,MAAM,EAAE,CAAC;IAC7D,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,KAAK,SAAS,MAAM,EAAE,CAAC;IACzF,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAC7B,4EAA4E;QAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,oEAAoE;QACpE,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;KAC/C,KAAK;QACJ,kFAAkF;QAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,4EAA4E;QAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5E,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG,eAAe,CAAC;AAEzE,+DAA+D;AAC/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE;QACjB,8BAA8B;QAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,0FAA0F;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,6EAA6E;QAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IAC5D,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/types.js

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview Shared contract types for the External Tool Adapter substrate
+ * (ADR-0090 / ADR-0091 / ADR-0092).
+ *
+ * An "external tool adapter" wraps a user-installed CLI scanner (gitleaks,
+ * osv-scanner, trivy, …) as an ordinary opensip-cli `Tool`. The author declares
+ * identity + a binary + per-command descriptors; the substrate owns the run
+ * loop (resolve → execFile → capture → interpret exit → ingest → normalize →
+ * persist), the standardized `doctor`/`version` commands, and provenance.
+ *
+ * These are pure data shapes — no runtime, no IO — so the file is a kernel-safe
+ * type surface the rest of the substrate imports.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/version-command.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @fileoverview The standardized `version` command (ADR-0090 §4.9).
+ *
+ * Resolves + probes the wrapped binary and prints its version (and path).
+ * Output mode `raw-stream`/`'diagnostic-gate'` for the same reason as `doctor`
+ * (a structured `--json` shape AND a human line): the handler owns its output.
+ * The probe runs worker-side for an installed adapter.
+ */
+import type { DoctorProbeDeps } from './doctor-command.js';
+import type { BinaryResolutionLayer, BinarySpec } from './types.js';
+import type { ToolCliContext, ToolCommandSpecInput } from '@opensip-cli/core';
+/** The structured payload `version --json` emits. */
+export interface AdapterVersionReport {
+    readonly tool: string;
+    readonly found: boolean;
+    readonly command: string;
+    readonly path?: string;
+    readonly layer?: BinaryResolutionLayer;
+    readonly version?: string;
+}
+/** The inputs to {@link probeVersionReport}: the tool identity, binary spec, and resolved config. */
+export interface VersionProbeInput {
+    readonly tool: string;
+    readonly binary: BinarySpec;
+    readonly config: Readonly<Record<string, unknown>>;
+}
+/** Resolve + probe the binary into an {@link AdapterVersionReport}. Pure given deps. */
+export declare function probeVersionReport(input: VersionProbeInput, deps: DoctorProbeDeps): AdapterVersionReport;
+/** The inputs to {@link buildVersionCommand}: the tool identity and binary spec. */
+export interface VersionCommandInput {
+    readonly tool: string;
+    readonly binary: BinarySpec;
+}
+/** Build the nested `version` command (prints the resolved binary version). */
+export declare function buildVersionCommand(input: VersionCommandInput, probeDeps?: DoctorProbeDeps): ToolCommandSpecInput<unknown, ToolCliContext>;
+//# sourceMappingURL=version-command.d.ts.map

package/dist/version-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-command.d.ts","sourceRoot":"","sources":["../src/version-command.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAI9E,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,eAAe,GACpB,oBAAoB,CAyBtB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,SAAS,CAAC,EAAE,eAAe,GAC1B,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,CA8B/C"}