@opensip-cli/external-tool-adapter 0.1.15

package/dist/__tests__/ingest-sarif.test.js

@@ -0,0 +1,283 @@
+import { createSignal } from '@opensip-cli/core';
+import { buildOpenSipSarif } from '@opensip-cli/output';
+import { describe, expect, it } from 'vitest';
+import { normalizedSignalShape } from '../acceptance-harness.js';
+import { messageHashFingerprintStrategy } from '../fingerprint.js';
+import { ingestSarif } from '../ingest-sarif.js';
+describe('ingestSarif — severity recovery from security-severity (the core job)', () => {
+    it('recovers critical from CVSS >= 9.0 even when level is the lossy "error"', () => {
+        const sarif = {
+            version: '2.1.0',
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: 'Trivy',
+                            rules: [{ id: 'CVE-2023-37920', properties: { 'security-severity': '9.8' } }],
+                        },
+                    },
+                    results: [
+                        {
+                            ruleId: 'CVE-2023-37920',
+                            ruleIndex: 0,
+                            level: 'error',
+                            message: { text: 'certifi: removal of e-Tugra root certificate' },
+                            locations: [
+                                {
+                                    physicalLocation: {
+                                        artifactLocation: { uri: 'requirements.txt' },
+                                        region: { startLine: 1, startColumn: 1 },
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        };
+        const [signal] = ingestSarif(sarif, { source: 'trivy' });
+        expect(signal.severity).toBe('critical');
+        expect(signal.ruleId).toBe('CVE-2023-37920');
+        expect(signal.filePath).toBe('requirements.txt');
+        expect(signal.line).toBe(1);
+        expect(signal.metadata.securitySeverity).toBe('9.8');
+        expect(signal.metadata.nativeLevel).toBe('error');
+        // host-stamped later — not at ingest time.
+        expect(signal.fingerprint).toBeUndefined();
+    });
+    it('applies CVSS bands across rules and joins ruleIndex→rules', () => {
+        const sarif = {
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: 'Trivy',
+                            rules: [
+                                { id: 'A', properties: { 'security-severity': '7.5' } },
+                                { id: 'B', properties: { 'security-severity': '5.0' } },
+                                { id: 'C', properties: { 'security-severity': '2.0' } },
+                            ],
+                        },
+                    },
+                    results: [
+                        {
+                            ruleIndex: 0,
+                            level: 'error',
+                            message: { text: 'a' },
+                            locations: [{ physicalLocation: { artifactLocation: { uri: 'f' } } }],
+                        },
+                        { ruleIndex: 1, level: 'warning', message: { text: 'b' }, locations: [] },
+                        { ruleIndex: 2, level: 'note', message: { text: 'c' } },
+                    ],
+                },
+            ],
+        };
+        const signals = ingestSarif(sarif);
+        expect(signals.map((s) => s.severity)).toEqual(['high', 'medium', 'low']);
+        expect(signals.map((s) => s.ruleId)).toEqual(['A', 'B', 'C']);
+    });
+    it('falls back to level when no security-severity is present (error→high, never critical)', () => {
+        const sarif = {
+            runs: [
+                {
+                    tool: { driver: { name: 'Gitleaks', rules: [{ id: 'R' }] } },
+                    results: [
+                        {
+                            ruleId: 'R',
+                            ruleIndex: 0,
+                            level: 'error',
+                            message: { text: 'm' },
+                            locations: [{ physicalLocation: { artifactLocation: { uri: 'x' } } }],
+                        },
+                    ],
+                },
+            ],
+        };
+        const [signal] = ingestSarif(sarif);
+        expect(signal.severity).toBe('high');
+    });
+});
+/**
+ * A Trivy-shaped result: the STABLE rule title in `shortDescription`, and a
+ * VERBOSE, version-volatile block in `result.message.text` (the `Installed
+ * Version:` line shifts on every dependency bump). `installed` parameterizes that
+ * volatile line.
+ */
+function trivyLikeSarif(installed) {
+    return {
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'Trivy',
+                        rules: [
+                            {
+                                id: 'CVE-2023-37920',
+                                shortDescription: { text: 'certifi: Removal of e-Tugra root certificate' },
+                                properties: { 'security-severity': '9.8' },
+                            },
+                        ],
+                    },
+                },
+                results: [
+                    {
+                        ruleId: 'CVE-2023-37920',
+                        ruleIndex: 0,
+                        level: 'error',
+                        message: {
+                            text: `Package: certifi\nInstalled Version: ${installed}\nVulnerability CVE-2023-37920\nSeverity: CRITICAL\nFixed Version: 2023.7.22\nLink: https://avd.aquasec.com/nvd/cve-2023-37920`,
+                        },
+                        locations: [
+                            {
+                                physicalLocation: {
+                                    artifactLocation: { uri: 'requirements.txt' },
+                                    region: { startLine: 1 },
+                                },
+                            },
+                        ],
+                    },
+                ],
+            },
+        ],
+    };
+}
+describe('ingestSarif — stable rule-title message (A9, version-invariant fingerprint basis)', () => {
+    it('uses the rule shortDescription as Signal.message and stashes the verbose block in metadata.detail', () => {
+        const [signal] = ingestSarif(trivyLikeSarif('2022.12.7'), { source: 'trivy' });
+        expect(signal.message).toBe('certifi: Removal of e-Tugra root certificate');
+        expect(signal.metadata.detail).toContain('Package: certifi');
+        expect(signal.metadata.detail).toContain('Installed Version: 2022.12.7');
+    });
+    it('keeps the message-hash fingerprint STABLE when only the verbose Installed Version line churns', () => {
+        const [oldVer] = ingestSarif(trivyLikeSarif('2022.12.7'), { source: 'trivy' });
+        const [newVer] = ingestSarif(trivyLikeSarif('2023.5.7'), { source: 'trivy' });
+        // The verbose detail differs across the dependency bump...
+        expect(oldVer.metadata.detail).not.toBe(newVer.metadata.detail);
+        // ...but the stable title (and thus the message-hash fingerprint basis) does not,
+        // so the baseline does NOT churn — message-hash's whole reason for being.
+        expect(oldVer.message).toBe(newVer.message);
+        expect(messageHashFingerprintStrategy.fingerprint(oldVer)).toBe(messageHashFingerprintStrategy.fingerprint(newVer));
+    });
+    it('falls back to result.message.text when the rule has no shortDescription (no detail stashed)', () => {
+        const [signal] = ingestSarif({
+            runs: [
+                {
+                    tool: { driver: { name: 'X', rules: [{ id: 'R' }] } },
+                    results: [
+                        {
+                            ruleId: 'R',
+                            ruleIndex: 0,
+                            message: { text: 'verbose only' },
+                            locations: [{ physicalLocation: { artifactLocation: { uri: 'f' } } }],
+                        },
+                    ],
+                },
+            ],
+        });
+        expect(signal.message).toBe('verbose only');
+        expect(signal.metadata.detail).toBeUndefined();
+    });
+});
+describe('ingestSarif — defensive over foreign output', () => {
+    it('preserves guid / fingerprints / helpUri / extra-locations on metadata', () => {
+        const sarif = {
+            runs: [
+                {
+                    tool: { driver: { name: 'X', rules: [{ id: 'R', helpUri: 'https://help' }] } },
+                    results: [
+                        {
+                            ruleId: 'R',
+                            ruleIndex: 0,
+                            guid: 'abc-guid',
+                            fingerprints: { primary: 'fp1' },
+                            message: { text: 'm' },
+                            locations: [
+                                { physicalLocation: { artifactLocation: { uri: 'a' }, region: { startLine: 3 } } },
+                                { physicalLocation: { artifactLocation: { uri: 'b' } } },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        };
+        const [signal] = ingestSarif(sarif);
+        expect(signal.metadata.nativeFingerprint).toBe('abc-guid');
+        expect(signal.metadata.helpUri).toBe('https://help');
+        expect(signal.metadata.additionalLocations).toBe(1);
+        expect(signal.filePath).toBe('a');
+        expect(signal.line).toBe(3);
+    });
+    it('handles multiple runs, missing rules, and a ruleId without a descriptor', () => {
+        const sarif = {
+            runs: [
+                {
+                    tool: { driver: { name: 'one' } },
+                    results: [{ ruleId: 'NoRule', message: { text: 'm1' } }],
+                },
+                { results: [{ message: { text: 'm2' } }] },
+            ],
+        };
+        const signals = ingestSarif(sarif);
+        expect(signals).toHaveLength(2);
+        expect(signals[0].ruleId).toBe('NoRule');
+        expect(signals[1].ruleId).toBe('unknown');
+    });
+    it('tolerates empty / runless logs', () => {
+        expect(ingestSarif({})).toEqual([]);
+        expect(ingestSarif({ runs: [] })).toEqual([]);
+        expect(ingestSarif({ runs: [{}] })).toEqual([]);
+    });
+    it('derives the source from the driver name when none is supplied', () => {
+        const [signal] = ingestSarif({
+            runs: [
+                { tool: { driver: { name: 'Trivy' } }, results: [{ ruleId: 'r', message: { text: 'm' } }] },
+            ],
+        });
+        expect(signal.source).toBe('trivy');
+    });
+});
+describe('ingestSarif — round-trip against buildOpenSipSarif (the writer is the inverse)', () => {
+    it('is identity on ruleId/message/file/line/column for high/medium/low signals', () => {
+        const inputs = [
+            createSignal({
+                source: 'trivy',
+                severity: 'high',
+                ruleId: 'CVE-1',
+                message: 'high finding',
+                code: { file: 'a.txt', line: 3, column: 2 },
+            }),
+            createSignal({
+                source: 'trivy',
+                severity: 'medium',
+                ruleId: 'CVE-2',
+                message: 'medium finding',
+                code: { file: 'b.txt', line: 10 },
+            }),
+            createSignal({
+                source: 'trivy',
+                severity: 'low',
+                ruleId: 'CVE-3',
+                message: 'low finding',
+                code: { file: 'c.txt' },
+            }),
+        ];
+        const sarif = JSON.parse(buildOpenSipSarif(inputs, { name: 'opensip-cli-trivy', version: '1.0.0' }));
+        const out = ingestSarif(sarif, { source: 'trivy' });
+        expect(out.map(normalizedSignalShape)).toEqual(inputs.map(normalizedSignalShape));
+    });
+    it('documents the lossy collapse: a critical writes as SARIF error and reads back as high', () => {
+        const input = createSignal({
+            source: 'trivy',
+            severity: 'critical',
+            ruleId: 'CVE-X',
+            message: 'crit',
+            code: { file: 'd.txt', line: 1 },
+        });
+        const sarif = JSON.parse(buildOpenSipSarif([input], { name: 'opensip-cli-trivy', version: '1.0.0' }));
+        const [out] = ingestSarif(sarif);
+        // No security-severity in the writer's output → level-only fallback → high (never critical).
+        expect(out.severity).toBe('high');
+        expect(out.ruleId).toBe('CVE-X');
+    });
+});
+//# sourceMappingURL=ingest-sarif.test.js.map

package/dist/__tests__/ingest-sarif.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-sarif.test.js","sourceRoot":"","sources":["../../src/__tests__/ingest-sarif.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,CAAC;yBAC9E;qBACF;oBACD,OAAO,EAAE;wBACP;4BACE,MAAM,EAAE,gBAAgB;4BACxB,SAAS,EAAE,CAAC;4BACZ,KAAK,EAAE,OAAO;4BACd,OAAO,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE;4BACjE,SAAS,EAAE;gCACT;oCACE,gBAAgB,EAAE;wCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE;wCAC7C,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;qCACzC;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,2CAA2C;QAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,KAAK,GAAa;YACtB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE;gCACvD,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE;gCACvD,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE;6BACxD;yBACF;qBACF;oBACD,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,CAAC;4BACZ,KAAK,EAAE,OAAO;4BACd,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;4BACtB,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;yBACtE;wBACD,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;wBACzE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;qBACxD;iBACF;aACF;SACF,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,KAAK,GAAa;YACtB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;oBAC5D,OAAO,EAAE;wBACP;4BACE,MAAM,EAAE,GAAG;4BACX,SAAS,EAAE,CAAC;4BACZ,KAAK,EAAE,OAAO;4BACd,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;4BACtB,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;yBACtE;qBACF;iBACF;aACF;SACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO;QACL,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL;gCACE,EAAE,EAAE,gBAAgB;gCACpB,gBAAgB,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE;gCAC1E,UAAU,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;6BAC3C;yBACF;qBACF;iBACF;gBACD,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,gBAAgB;wBACxB,SAAS,EAAE,CAAC;wBACZ,KAAK,EAAE,OAAO;wBACd,OAAO,EAAE;4BACP,IAAI,EAAE,wCAAwC,SAAS,gIAAgI;yBACxL;wBACD,SAAS,EAAE;4BACT;gCACE,gBAAgB,EAAE;oCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE;oCAC7C,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;iCACzB;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,mFAAmF,EAAE,GAAG,EAAE;IACjG,EAAE,CAAC,mGAAmG,EAAE,GAAG,EAAE;QAC3G,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,kFAAkF;QAClF,0EAA0E;QAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,8BAA8B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAC7D,8BAA8B,CAAC,WAAW,CAAC,MAAM,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC;YAC3B,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;oBACrD,OAAO,EAAE;wBACP;4BACE,MAAM,EAAE,GAAG;4BACX,SAAS,EAAE,CAAC;4BACZ,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;4BACjC,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;yBACtE;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAa;YACtB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE;oBAC9E,OAAO,EAAE;wBACP;4BACE,MAAM,EAAE,GAAG;4BACX,SAAS,EAAE,CAAC;4BACZ,IAAI,EAAE,UAAU;4BAChB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;4BAChC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;4BACtB,SAAS,EAAE;gCACT,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;gCAClF,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;6BACzD;yBACF;qBACF;iBACF;aACF;SACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,KAAK,GAAa;YACtB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;oBACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;iBACzD;gBACD,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;aAC3C;SACF,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC;YAC3B,IAAI,EAAE;gBACJ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE;aAC5F;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAAG;YACb,YAAY,CAAC;gBACX,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;aAC5C,CAAC;YACF,YAAY,CAAC;gBACX,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,gBAAgB;gBACzB,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;aAClC,CAAC;YACF,YAAY,CAAC;gBACX,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aACxB,CAAC;SACH,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,iBAAiB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC;QACd,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,KAAK,GAAG,YAAY,CAAC;YACzB,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAChE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,6FAA6F;QAC7F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/manifest-commands.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=manifest-commands.test.d.ts.map

package/dist/__tests__/manifest-commands.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-commands.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/manifest-commands.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/manifest-commands.test.js

@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest';
+import { defineExternalToolAdapter } from '../define-external-tool-adapter.js';
+import { deriveAdapterManifestCommands } from '../manifest-commands.js';
+const spec = {
+    identity: { name: 'examplescan', aliases: ['ex'] },
+    metadata: {
+        id: 'c0ffee00-1234-4abc-8def-0123456789ab',
+        description: 'Example scanner',
+        version: '1.2.3',
+    },
+    binary: { command: 'examplescan', versionArgs: ['version'] },
+    network: 'local-only',
+    commands: [
+        {
+            name: 'scan',
+            args: (ctx) => [ctx.projectRoot],
+            output: { kind: 'sarif', path: 'example.sarif' },
+        },
+    ],
+};
+describe('deriveAdapterManifestCommands', () => {
+    it('derives serializable scan/doctor/version shells matching the runtime commandSpecs', () => {
+        const tool = defineExternalToolAdapter(spec);
+        const shells = deriveAdapterManifestCommands(tool);
+        expect(shells.map((s) => s.name)).toEqual(['examplescan', 'doctor', 'version']);
+        const primary = shells[0];
+        expect(primary).toEqual({
+            name: 'examplescan',
+            description: 'Example scanner',
+            aliases: ['ex'],
+            commonFlags: ['json', 'cwd', 'quiet', 'verbose', 'debug', 'reportTo', 'apiKey', 'open'],
+            // The scan command carries the inherited gate flags (minus the `parse` closure).
+            options: [
+                {
+                    flag: '--gate-save',
+                    description: 'Architecture-gate: save current findings as baseline in the project SQLite store (mutually exclusive with --gate-compare)',
+                    default: false,
+                },
+                {
+                    flag: '--gate-compare',
+                    description: 'Architecture-gate: compare current findings against the saved baseline; exit 1 on regression',
+                    default: false,
+                },
+            ],
+            scope: 'project',
+            output: 'raw-stream',
+            rawStreamReason: 'runtime-render-dispatch',
+        });
+        const doctor = shells[1];
+        expect(doctor).toMatchObject({
+            name: 'doctor',
+            parent: 'examplescan',
+            scope: 'none',
+            output: 'raw-stream',
+            rawStreamReason: 'diagnostic-gate',
+            commonFlags: ['json', 'cwd'],
+        });
+        // doctor/version take no gate flags — they carry no options shell.
+        expect(doctor.options).toBeUndefined();
+        // The whole thing is JSON-serializable (it is written into package.json).
+        expect(() => JSON.stringify(shells)).not.toThrow();
+    });
+    it('returns an empty list for a tool with no commandSpecs', () => {
+        expect(deriveAdapterManifestCommands({ commandSpecs: undefined })).toEqual([]);
+    });
+});
+//# sourceMappingURL=manifest-commands.test.js.map

package/dist/__tests__/manifest-commands.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-commands.test.js","sourceRoot":"","sources":["../../src/__tests__/manifest-commands.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAIxE,MAAM,IAAI,GAA4B;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE;IAClD,QAAQ,EAAE;QACR,EAAE,EAAE,sCAAsC;QAC1C,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,OAAO;KACjB;IACD,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE;IAC5D,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE;QACR;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAChC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE;SACjD;KACF;CACF,CAAC;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAEhF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,iBAAiB;YAC9B,OAAO,EAAE,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;YACvF,iFAAiF;YACjF,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EACT,2HAA2H;oBAC7H,OAAO,EAAE,KAAK;iBACf;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EACT,8FAA8F;oBAChG,OAAO,EAAE,KAAK;iBACf;aACF;YACD,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,YAAY;YACpB,eAAe,EAAE,yBAAyB;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,YAAY;YACpB,eAAe,EAAE,iBAAiB;YAClC,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAEvC,0EAA0E;QAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,6BAA6B,CAAC,EAAE,YAAY,EAAE,SAAS,EAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/provenance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provenance.test.d.ts.map

package/dist/__tests__/provenance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/provenance.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/provenance.test.js

@@ -0,0 +1,48 @@
+import { createSignal } from '@opensip-cli/core';
+import { describe, expect, it } from 'vitest';
+import { stampProvenance, stampProvenanceAll } from '../provenance.js';
+const provenance = {
+    tool: 'gitleaks',
+    adapterPackage: '@opensip-cli/tool-gitleaks',
+    binaryPath: '/usr/bin/gitleaks',
+    binaryVersion: '8.18.0',
+    args: ['detect', '--no-git'],
+    configPath: '/proj/opensip-cli.config.yml',
+};
+describe('stampProvenance', () => {
+    it('adds tool/adapterPackage/binary/args/configPath under metadata.provenance', () => {
+        const signal = createSignal({
+            source: 'gitleaks',
+            severity: 'high',
+            ruleId: 'aws',
+            message: 'm',
+            metadata: { x: 1 },
+        });
+        const out = stampProvenance(signal, provenance);
+        expect(out.metadata.x).toBe(1);
+        expect(out.metadata.provenance).toEqual({
+            tool: 'gitleaks',
+            adapterPackage: '@opensip-cli/tool-gitleaks',
+            binaryPath: '/usr/bin/gitleaks',
+            binaryVersion: '8.18.0',
+            args: ['detect', '--no-git'],
+            configPath: '/proj/opensip-cli.config.yml',
+        });
+    });
+    it('drops undefined optional fields and never mutates the input', () => {
+        const signal = createSignal({ source: 'trivy', severity: 'low', ruleId: 'r', message: 'm' });
+        const out = stampProvenance(signal, { tool: 'trivy', binaryPath: '/bin/trivy', args: [] });
+        expect(out.metadata.provenance).toEqual({ tool: 'trivy', binaryPath: '/bin/trivy', args: [] });
+        expect(signal.metadata.provenance).toBeUndefined();
+    });
+    it('stampProvenanceAll maps a batch', () => {
+        const signals = [
+            createSignal({ source: 'g', severity: 'high', ruleId: 'a', message: 'm1' }),
+            createSignal({ source: 'g', severity: 'low', ruleId: 'b', message: 'm2' }),
+        ];
+        const out = stampProvenanceAll(signals, provenance);
+        expect(out).toHaveLength(2);
+        expect(out.every((s) => s.metadata.provenance !== undefined)).toBe(true);
+    });
+});
+//# sourceMappingURL=provenance.test.js.map

package/dist/__tests__/provenance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.test.js","sourceRoot":"","sources":["../../src/__tests__/provenance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAIvE,MAAM,UAAU,GAAsB;IACpC,IAAI,EAAE,UAAU;IAChB,cAAc,EAAE,4BAA4B;IAC5C,UAAU,EAAE,mBAAmB;IAC/B,aAAa,EAAE,QAAQ;IACvB,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC5B,UAAU,EAAE,8BAA8B;CAC3C,CAAC;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YACtC,IAAI,EAAE,UAAU;YAChB,cAAc,EAAE,4BAA4B;YAC5C,UAAU,EAAE,mBAAmB;YAC/B,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5B,UAAU,EAAE,8BAA8B;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG;YACd,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SAC3E,CAAC;QACF,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/redact.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redact.test.d.ts.map

package/dist/__tests__/redact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/redact.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/redact.test.js

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest';
+import { redactSecret, secretHash } from '../redact.js';
+describe('redactSecret', () => {
+    it('returns a first-4 preview and NEVER the raw secret', () => {
+        const secret = 'AKIAIOSFODNN7EXAMPLE';
+        const preview = redactSecret(secret);
+        expect(preview).toBe('AKIA…');
+        expect(preview).not.toContain('IOSFODNN7EXAMPLE');
+        expect(preview).not.toBe(secret);
+    });
+    it('collapses short values so the raw is never returned', () => {
+        expect(redactSecret('abcd')).toBe('…');
+        expect(redactSecret('ab')).toBe('…');
+        expect(redactSecret('abcde')).not.toBe('abcde');
+    });
+    it('handles empty / nullish', () => {
+        expect(redactSecret('')).toBe('');
+        expect(redactSecret(undefined)).toBe('');
+        expect(redactSecret(null)).toBe('');
+    });
+});
+describe('secretHash', () => {
+    it('is stable, short, and reveals nothing of the value', () => {
+        const a = secretHash('AKIAIOSFODNN7EXAMPLE');
+        const b = secretHash('AKIAIOSFODNN7EXAMPLE');
+        expect(a).toBe(b);
+        expect(a).toHaveLength(12);
+        expect(a).toMatch(/^[0-9a-f]{12}$/);
+        expect(secretHash('other')).not.toBe(a);
+    });
+    it('handles empty / nullish', () => {
+        expect(secretHash('')).toBe('');
+        expect(secretHash(undefined)).toBe('');
+        expect(secretHash(null)).toBe('');
+    });
+});
+//# sourceMappingURL=redact.test.js.map

package/dist/__tests__/redact.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.js","sourceRoot":"","sources":["../../src/__tests__/redact.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAExD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/run-loop-artifact.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Artifact-lifecycle behavior of the scan run loop (External Tool Adapter
+ * A1 / A3 / A11). The run loop is the IO orchestration excluded from coverage;
+ * these tests drive it directly with a stub `ToolCliContext` + stub IO deps and
+ * assert the artifact-lifecycle guarantees the fake binaries' `mkdir -p` used to
+ * mask:
+ *
+ *   - A1: the per-run artifact dir is ensured through the HOST seam BEFORE the
+ *     scanner subprocess runs (a real scanner does a bare `open(--report-path)`).
+ *   - A3: the substrate injects each adapter's declared exclusion (flag and/or a
+ *     host-written config file) so the scanner never re-walks `.runtime/`.
+ *   - A11: an invalid file-backed report (empty / garbage / oversize) FAULTS even
+ *     under an `ok`/`findings` exit verdict, and is NEVER overwritten by the empty
+ *     read buffer (the scanner's report on disk survives the fault).
+ *
+ * Each test FAILS without the fix: pre-fix the loop never calls `ensureArtifactDir`
+ * (A1), ignores `excludeScan` (A3), and `writeArtifact(path, '')` overwrites the
+ * report while emitting a clean 0-findings pass (A11).
+ */
+export {};
+//# sourceMappingURL=run-loop-artifact.test.d.ts.map

package/dist/__tests__/run-loop-artifact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-artifact.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/run-loop-artifact.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}