@opensip-cli/external-tool-adapter 0.1.15

package/dist/__tests__/run-loop-artifact.test.js

@@ -0,0 +1,186 @@
+/**
+ * Artifact-lifecycle behavior of the scan run loop (External Tool Adapter
+ * A1 / A3 / A11). The run loop is the IO orchestration excluded from coverage;
+ * these tests drive it directly with a stub `ToolCliContext` + stub IO deps and
+ * assert the artifact-lifecycle guarantees the fake binaries' `mkdir -p` used to
+ * mask:
+ *
+ *   - A1: the per-run artifact dir is ensured through the HOST seam BEFORE the
+ *     scanner subprocess runs (a real scanner does a bare `open(--report-path)`).
+ *   - A3: the substrate injects each adapter's declared exclusion (flag and/or a
+ *     host-written config file) so the scanner never re-walks `.runtime/`.
+ *   - A11: an invalid file-backed report (empty / garbage / oversize) FAULTS even
+ *     under an `ok`/`findings` exit verdict, and is NEVER overwritten by the empty
+ *     read buffer (the scanner's report on disk survives the fault).
+ *
+ * Each test FAILS without the fix: pre-fix the loop never calls `ensureArtifactDir`
+ * (A1), ignores `excludeScan` (A3), and `writeArtifact(path, '')` overwrites the
+ * report while emitting a clean 0-findings pass (A11).
+ */
+import { describe, expect, it, vi } from 'vitest';
+import { messageHashFingerprintStrategy } from '../fingerprint.js';
+import { runScanLoop } from '../run-loop.js';
+/** A `ToolCliContext` stub that records the ORDER of seam calls. */
+function makeCli() {
+    const order = [];
+    const spies = {
+        ensureArtifactDir: vi.fn((path) => {
+            order.push(`ensureArtifactDir:${path}`);
+            return Promise.resolve();
+        }),
+        writeArtifact: vi.fn((path) => {
+            order.push(`writeArtifact:${path}`);
+            return Promise.resolve();
+        }),
+        deliverSignals: vi.fn(() => Promise.resolve({ cloudAccepted: 0 })),
+        emitEnvelope: vi.fn(),
+        render: vi.fn(() => Promise.resolve()),
+    };
+    const cli = {
+        ...spies,
+        saveBaseline: vi.fn(() => Promise.resolve()),
+        compareBaseline: vi.fn(() => Promise.resolve({ added: [], resolved: [], unchanged: [], degraded: false })),
+        reportFailure: vi.fn(() => Promise.resolve()),
+        logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+        scope: {
+            toolConfig: {},
+            projectContext: { projectRoot: '/proj', configPath: '/proj/opensip-cli.config.yml' },
+            runId: 'RUN_test',
+        },
+    };
+    return { cli, order, spies };
+}
+const BINARY = { command: 'examplescan', versionArgs: ['version'] };
+/** IO-deps stub: a found binary; `code`/`artifact`/sizes per case. */
+function makeDeps(opts) {
+    return {
+        binaryDeps: { existsSync: () => true, which: () => '/usr/bin/examplescan' },
+        runProcess: () => {
+            opts.order?.push('runProcess');
+            return Promise.resolve({ code: opts.code, stdout: '', stderr: 'boom', timedOut: false });
+        },
+        probeVersion: () => '1.2.3',
+        readFile: () => opts.artifact,
+        fileSize: () => opts.fileSize ?? opts.artifact.length,
+        env: {},
+        ...(opts.maxBuffer === undefined ? {} : { maxBuffer: opts.maxBuffer }),
+    };
+}
+function input(cli, cmd, opts = {}) {
+    return {
+        cli,
+        tool: 'examplescan',
+        adapterPackage: '@opensip-cli/tool-example',
+        command: cmd,
+        binary: BINARY,
+        fingerprintStrategy: messageHashFingerprintStrategy,
+        opts,
+    };
+}
+/** gitleaks-shaped JSON command (0 clean, 1 findings, >=2 fault). */
+function jsonCommand(extra = {}) {
+    return {
+        name: 'scan',
+        args: (ctx) => ['detect', '--report-path', ctx.artifactPath('scan.json')],
+        output: { kind: 'json', path: 'scan.json' },
+        exitCodes: { ok: [0], findings: [1], errorFrom: 2 },
+        parse: () => [],
+        ...extra,
+    };
+}
+/** trivy-shaped SARIF command: ONLY 0 is clean, no findings code, any nonzero faults. */
+function sarifCommand(extra = {}) {
+    return {
+        name: 'scan',
+        args: (ctx) => ['fs', '--output', ctx.artifactPath('scan.sarif'), ctx.projectRoot],
+        output: { kind: 'sarif', path: 'scan.sarif' },
+        exitCodes: { ok: [0], findings: [], errorFrom: 1 },
+        ...extra,
+    };
+}
+const VALID_SARIF = '{"version":"2.1.0","runs":[]}';
+const ARTIFACT_JSON = '/proj/opensip-cli/.runtime/artifacts/examplescan/RUN_test/scan.json';
+describe('runScanLoop — A1: per-run dir ensured via the host seam before the scan', () => {
+    it('calls cli.ensureArtifactDir(artifactPath) BEFORE runProcess', async () => {
+        const { cli, order, spies } = makeCli();
+        await runScanLoop(input(cli, jsonCommand()), makeDeps({ code: 0, artifact: '[]', order }));
+        expect(spies.ensureArtifactDir).toHaveBeenCalledWith(ARTIFACT_JSON);
+        // Ordering: the dir is created (host seam) strictly before the scanner runs and
+        // before the host re-writes the report at 0600.
+        const ensureIdx = order.findIndex((e) => e.startsWith('ensureArtifactDir:'));
+        const runIdx = order.indexOf('runProcess');
+        const writeIdx = order.findIndex((e) => e.startsWith('writeArtifact:'));
+        expect(ensureIdx).toBeGreaterThanOrEqual(0);
+        expect(runIdx).toBeGreaterThan(ensureIdx);
+        expect(writeIdx).toBeGreaterThan(runIdx);
+    });
+});
+describe('runScanLoop — A3: the substrate injects each adapter exclusion', () => {
+    it('appends excludeScan args to the scanner argv (run-context-supplied path)', async () => {
+        const { cli } = makeCli();
+        const runProcess = vi.fn((_input) => Promise.resolve({ code: 0, stdout: '', stderr: '', timedOut: false }));
+        await runScanLoop(input(cli, sarifCommand({
+            excludeScan: ({ excludePath }) => ({ args: ['--skip-dirs', excludePath] }),
+        })), { ...makeDeps({ code: 0, artifact: VALID_SARIF }), runProcess });
+        const args = runProcess.mock.calls[0][0].args;
+        // The exclusion targets the project's `.runtime` store, not a user flag.
+        expect(args).toContain('--skip-dirs');
+        expect(args).toContain('/proj/opensip-cli/.runtime');
+    });
+    it('writes an excludeScan configFile through the host writeArtifact seam and references it', async () => {
+        const { cli, order, spies } = makeCli();
+        const runProcess = vi.fn((_input) => {
+            order.push('runProcess');
+            return Promise.resolve({ code: 0, stdout: '', stderr: '', timedOut: false });
+        });
+        await runScanLoop(input(cli, jsonCommand({
+            excludeScan: ({ configPath }) => {
+                const path = configPath('exclude.toml');
+                return { args: ['--config', path], configFile: { path, contents: 'allowlist' } };
+            },
+        })), { ...makeDeps({ code: 0, artifact: '[]' }), runProcess });
+        // The config is written via the HOST seam (never a raw substrate fs write) and
+        // BEFORE the scanner runs.
+        expect(spies.writeArtifact).toHaveBeenCalledWith('/proj/opensip-cli/.runtime/artifacts/examplescan/RUN_test/exclude.toml', 'allowlist');
+        const args = runProcess.mock.calls[0][0].args;
+        expect(args).toContain('--config');
+        const cfgWriteIdx = order.indexOf('writeArtifact:/proj/opensip-cli/.runtime/artifacts/examplescan/RUN_test/exclude.toml');
+        expect(cfgWriteIdx).toBeGreaterThanOrEqual(0);
+        expect(cfgWriteIdx).toBeLessThan(order.indexOf('runProcess'));
+    });
+});
+describe('runScanLoop — A11: invalid file-backed report ⇒ fault, report not destroyed', () => {
+    it('trivy-model exit 0 + EMPTY report faults (no silent clean pass) and never overwrites it', async () => {
+        const { cli, spies } = makeCli();
+        await expect(runScanLoop(input(cli, sarifCommand()), makeDeps({ code: 0, artifact: '' }))).rejects.toMatchObject({ code: 'ADAPTER.ARTIFACT.INVALID' });
+        // The empty read buffer is NEVER written back over the scanner's report (A11).
+        expect(spies.writeArtifact).not.toHaveBeenCalled();
+        expect(spies.deliverSignals).not.toHaveBeenCalled();
+        expect(spies.emitEnvelope).not.toHaveBeenCalled();
+    });
+    it('exit 0 + GARBAGE (unparseable) report faults', async () => {
+        const { cli, spies } = makeCli();
+        await expect(runScanLoop(input(cli, sarifCommand()), makeDeps({ code: 0, artifact: 'not json <<<' }))).rejects.toMatchObject({ code: 'ADAPTER.ARTIFACT.INVALID' });
+        expect(spies.writeArtifact).not.toHaveBeenCalled();
+    });
+    it('OVERSIZE report (over the maxBuffer cap) faults with a size-distinguished message', async () => {
+        const { cli, spies } = makeCli();
+        await expect(runScanLoop(input(cli, sarifCommand()), makeDeps({
+            code: 0,
+            artifact: VALID_SARIF,
+            fileSize: 100 * 1024 * 1024,
+            maxBuffer: 1024 * 1024,
+        }))).rejects.toMatchObject({
+            code: 'ADAPTER.ARTIFACT.INVALID',
+            message: expect.stringContaining('MiB cap'),
+        });
+        expect(spies.writeArtifact).not.toHaveBeenCalled();
+    });
+    it('a VALID report under the same trivy model still passes (no false fault)', async () => {
+        const { cli, spies } = makeCli();
+        const completion = await runScanLoop(input(cli, sarifCommand()), makeDeps({ code: 0, artifact: VALID_SARIF }));
+        expect(completion?.envelope.verdict.passed).toBe(true);
+        expect(spies.writeArtifact).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=run-loop-artifact.test.js.map

package/dist/__tests__/run-loop-artifact.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-artifact.test.js","sourceRoot":"","sources":["../../src/__tests__/run-loop-artifact.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAyC,MAAM,gBAAgB,CAAC;AAIpF,oEAAoE;AACpE,SAAS,OAAO;IAWd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG;QACZ,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;YACxC,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC;QACF,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;YACpC,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC;QACF,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;KACvC,CAAC;IACF,MAAM,GAAG,GAAG;QACV,GAAG,KAAK;QACR,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC1B,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC7E;QACD,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;QACxE,KAAK,EAAE;YACL,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,8BAA8B,EAAE;YACpF,KAAK,EAAE,UAAU;SAClB;KAC2B,CAAC;IAC/B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;AAUhF,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO;QACL,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC3E,UAAU,EAAE,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO;QAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ;QAC7B,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;QACrD,GAAG,EAAE,EAAE;QACP,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,GAAmB,EACnB,GAAwB,EACxB,OAAgC,EAAE;IAElC,OAAO;QACL,GAAG;QACH,IAAI,EAAE,aAAa;QACnB,cAAc,EAAE,2BAA2B;QAC3C,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,MAAM;QACd,mBAAmB,EAAE,8BAA8B;QACnD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,QAAsC,EAAE;IAC3D,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;QAC3C,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;QACnD,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE;QACf,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,YAAY,CAAC,QAAsC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC;QAClF,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE;QAC7C,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;QAClD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,aAAa,GAAG,qEAAqE,CAAC;AAE5F,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACxC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE3F,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpE,gFAAgF;QAChF,gDAAgD;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC9E,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,MAA4C,EAAE,EAAE,CACxE,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACtE,CAAC;QACF,MAAM,WAAW,CACf,KAAK,CACH,GAAG,EACH,YAAY,CAAC;YACX,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;SAC3E,CAAC,CACH,EACD,EAAE,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAChE,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAgB,CAAC;QAC1D,yEAAyE;QACzE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,MAA4C,EAAE,EAAE;YACxE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,MAAM,WAAW,CACf,KAAK,CACH,GAAG,EACH,WAAW,CAAC;YACV,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;YACnF,CAAC;SACF,CAAC,CACH,EACD,EAAE,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CACzD,CAAC;QACF,+EAA+E;QAC/E,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAC9C,wEAAwE,EACxE,WAAW,CACZ,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAgB,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAC/B,sFAAsF,CACvF,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6EAA6E,EAAE,GAAG,EAAE;IAC3F,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,CACV,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAC7E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAE9D,+EAA+E;QAC/E,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,CACV,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,CACzF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,CACV,WAAW,CACT,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAC1B,QAAQ,CAAC;YACP,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC3B,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,CAAC,CACH,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAC1B,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAC7C,CAAC;QACF,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/run-loop-exit.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Exit-model REACTION branch of the scan run loop (ADR-0091 Phase-0 decision 4).
+ *
+ * `interpretExit`'s classification is unit-tested directly (exit-model.test.ts) and
+ * per-adapter (each tool.test.ts). What those do NOT cover is how `runScanLoop`
+ * REACTS: the §4.12 acceptance row "verdict/exit correct for clean / findings /
+ * scanner-error exit codes". The findings row is proven end-to-end by every
+ * adapter's worker E2E; this fills the other two at the substrate level (the run
+ * loop is substrate-owned — adapters only declare the exit-model data):
+ *   - a scanner-ERROR exit FAULTS (throws ADAPTER.SCAN.FAULT) — it must NOT silently
+ *     emit a clean 0-findings envelope (the highest-risk misclassification, §4.6);
+ *   - the gitleaks disambiguation (exit 1 + missing/garbage artifact) also faults;
+ *   - a CLEAN exit (0 findings) emits a passing envelope through the host seams,
+ *     never a fault.
+ *
+ * Drives `runScanLoop` directly with a stub `ToolCliContext` + stub IO deps — the
+ * same substrate-unit pattern as run-loop-gate.test.ts (run-loop.ts is excluded
+ * from coverage as IO orchestration; this asserts behavior, not coverage).
+ */
+export {};
+//# sourceMappingURL=run-loop-exit.test.d.ts.map

package/dist/__tests__/run-loop-exit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-exit.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/run-loop-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/__tests__/run-loop-exit.test.js

@@ -0,0 +1,123 @@
+/**
+ * Exit-model REACTION branch of the scan run loop (ADR-0091 Phase-0 decision 4).
+ *
+ * `interpretExit`'s classification is unit-tested directly (exit-model.test.ts) and
+ * per-adapter (each tool.test.ts). What those do NOT cover is how `runScanLoop`
+ * REACTS: the §4.12 acceptance row "verdict/exit correct for clean / findings /
+ * scanner-error exit codes". The findings row is proven end-to-end by every
+ * adapter's worker E2E; this fills the other two at the substrate level (the run
+ * loop is substrate-owned — adapters only declare the exit-model data):
+ *   - a scanner-ERROR exit FAULTS (throws ADAPTER.SCAN.FAULT) — it must NOT silently
+ *     emit a clean 0-findings envelope (the highest-risk misclassification, §4.6);
+ *   - the gitleaks disambiguation (exit 1 + missing/garbage artifact) also faults;
+ *   - a CLEAN exit (0 findings) emits a passing envelope through the host seams,
+ *     never a fault.
+ *
+ * Drives `runScanLoop` directly with a stub `ToolCliContext` + stub IO deps — the
+ * same substrate-unit pattern as run-loop-gate.test.ts (run-loop.ts is excluded
+ * from coverage as IO orchestration; this asserts behavior, not coverage).
+ */
+import { createSignal } from '@opensip-cli/core';
+import { describe, expect, it, vi } from 'vitest';
+import { messageHashFingerprintStrategy } from '../fingerprint.js';
+import { runScanLoop } from '../run-loop.js';
+function makeCli() {
+    const spies = {
+        deliverSignals: vi.fn(() => Promise.resolve({ cloudAccepted: 0 })),
+        render: vi.fn(() => Promise.resolve()),
+        emitEnvelope: vi.fn(),
+        reportFailure: vi.fn(() => Promise.resolve()),
+        writeArtifact: vi.fn(() => Promise.resolve()),
+        ensureArtifactDir: vi.fn(() => Promise.resolve()),
+        saveBaseline: vi.fn(() => Promise.resolve()),
+        compareBaseline: vi.fn(() => Promise.resolve({ added: [], resolved: [], unchanged: [], degraded: false })),
+    };
+    const cli = {
+        ...spies,
+        logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+        scope: {
+            toolConfig: {},
+            projectContext: { projectRoot: '/proj', configPath: '/proj/opensip-cli.config.yml' },
+            runId: 'RUN_test',
+        },
+    };
+    return { cli, spies };
+}
+/** gitleaks-shaped model: 0 clean, 1 findings, >=2 fault. */
+const GITLEAKS_MODEL = { ok: [0], findings: [1], errorFrom: 2 };
+function command(parse) {
+    return {
+        name: 'scan',
+        args: (ctx) => ['scan', ctx.projectRoot],
+        output: { kind: 'json', path: 'scan.json' },
+        exitCodes: GITLEAKS_MODEL,
+        parse,
+    };
+}
+const BINARY = { command: 'examplescan', versionArgs: ['version'] };
+/** IO-deps stub: a found binary; `code`/`artifact` per case. */
+function makeDeps(code, artifact) {
+    return {
+        binaryDeps: { existsSync: () => true, which: () => '/usr/bin/examplescan' },
+        runProcess: () => Promise.resolve({ code, stdout: '', stderr: 'boom', timedOut: false }),
+        probeVersion: () => '1.2.3',
+        readFile: () => artifact,
+        fileSize: () => artifact.length,
+        env: {},
+    };
+}
+function input(cli, cmd, opts = {}) {
+    return {
+        cli,
+        tool: 'examplescan',
+        adapterPackage: '@opensip-cli/tool-example',
+        command: cmd,
+        binary: BINARY,
+        fingerprintStrategy: messageHashFingerprintStrategy,
+        opts,
+    };
+}
+const ONE_FINDING = [
+    createSignal({
+        source: 'examplescan',
+        severity: 'high',
+        ruleId: 'aws-key',
+        message: 'AWS Access Key',
+        code: { file: 'config/prod.env', line: 12 },
+    }),
+];
+describe('runScanLoop — scanner-error exit ⇒ fault (never a silent clean scan)', () => {
+    it('a fault exit code (>= errorFrom) throws ADAPTER.SCAN.FAULT and emits nothing', async () => {
+        const { cli, spies } = makeCli();
+        // A parse that WOULD return zero findings — proving the fault path is taken on
+        // the exit code, not silently turned into a clean 0-findings emit.
+        await expect(runScanLoop(input(cli, command(() => [])), makeDeps(2, '[]'))).rejects.toMatchObject({ code: 'ADAPTER.SCAN.FAULT' });
+        expect(spies.writeArtifact).not.toHaveBeenCalled();
+        expect(spies.deliverSignals).not.toHaveBeenCalled();
+        expect(spies.emitEnvelope).not.toHaveBeenCalled();
+        expect(spies.render).not.toHaveBeenCalled();
+    });
+    it('the gitleaks disambiguation: exit 1 + missing/garbage artifact ⇒ fault', async () => {
+        const { cli, spies } = makeCli();
+        // Exit 1 is the `findings` code, but an empty/unparseable artifact downgrades
+        // it to a fault — it must NOT be reported as findings.
+        await expect(runScanLoop(input(cli, command(() => ONE_FINDING)), makeDeps(1, ''))).rejects.toMatchObject({ code: 'ADAPTER.SCAN.FAULT' });
+        expect(spies.writeArtifact).not.toHaveBeenCalled();
+        expect(spies.deliverSignals).not.toHaveBeenCalled();
+    });
+});
+describe('runScanLoop — clean exit ⇒ passing envelope through the host seams', () => {
+    it('exit 0 with zero findings persists the artifact and delivers a passing verdict (no fault)', async () => {
+        const { cli, spies } = makeCli();
+        const completion = await runScanLoop(input(cli, command(() => [])), makeDeps(0, '[]'));
+        expect(spies.reportFailure).not.toHaveBeenCalled();
+        expect(spies.writeArtifact).toHaveBeenCalledTimes(1);
+        expect(completion?.envelope.tool).toBe('examplescan');
+        expect(completion?.envelope.verdict.passed).toBe(true);
+        expect(completion?.session.payload.findings).toBe(0);
+        // No-gate, no-json path: human summary, delivered without a runFailed override.
+        expect(spies.emitEnvelope).not.toHaveBeenCalled();
+        expect((spies.deliverSignals.mock.calls[0]?.[1]).runFailed).toBeUndefined();
+    });
+});
+//# sourceMappingURL=run-loop-exit.test.js.map

package/dist/__tests__/run-loop-exit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-exit.test.js","sourceRoot":"","sources":["../../src/__tests__/run-loop-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAoC,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAyC,MAAM,gBAAgB,CAAC;AAIpF,SAAS,OAAO;IAad,MAAM,KAAK,GAAG;QACZ,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjD,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC1B,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC7E;KACF,CAAC;IACF,MAAM,GAAG,GAAG;QACV,GAAG,KAAK;QACR,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;QACxE,KAAK,EAAE;YACL,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,8BAA8B,EAAE;YACpF,KAAK,EAAE,UAAU;SAClB;KAC2B,CAAC;IAC/B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,6DAA6D;AAC7D,MAAM,cAAc,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAW,CAAC;AAEzE,SAAS,OAAO,CAAC,KAAmC;IAClD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;QACxC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;QAC3C,SAAS,EAAE,cAAc;QACzB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;AAEhF,gEAAgE;AAChE,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,OAAO;QACL,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC3E,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxF,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO;QAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM;QAC/B,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,GAAmB,EACnB,GAAwB,EACxB,OAAgC,EAAE;IAElC,OAAO;QACL,GAAG;QACH,IAAI,EAAE,aAAa;QACnB,cAAc,EAAE,2BAA2B;QAC3C,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,MAAM;QACd,mBAAmB,EAAE,8BAA8B;QACnD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAsB;IACrC,YAAY,CAAC;QACX,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;KAC5C,CAAC;CACH,CAAC;AAEF,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACpF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,+EAA+E;QAC/E,mEAAmE;QACnE,MAAM,MAAM,CACV,WAAW,CACT,KAAK,CACH,GAAG,EACH,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAClB,EACD,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAClB,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,MAAM,CACV,WAAW,CACT,KAAK,CACH,GAAG,EACH,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAC3B,EACD,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAChB,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC,KAAK,CACH,GAAG,EACH,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAClB,EACD,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAClB,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,gFAAgF;QAChF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,CACJ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAA6B,CAAA,CAAC,SAAS,CAC/E,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/run-loop-gate.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Gate-ratchet branch of the scan run loop (ADR-0036). The run loop itself is the
+ * IO orchestration excluded from coverage; these tests drive its `--gate-save` /
+ * `--gate-compare` decision branch directly with a stub `ToolCliContext` + stub IO
+ * deps, asserting the host baseline seams + the runFailed exit override are wired
+ * the same way fit's `runGateMode` wires them. The full ratchet over a REAL forked
+ * worker lives in tool-gitleaks's worker E2E (§4.12).
+ */
+export {};
+//# sourceMappingURL=run-loop-gate.test.d.ts.map

package/dist/__tests__/run-loop-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-gate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/run-loop-gate.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/__tests__/run-loop-gate.test.js

@@ -0,0 +1,159 @@
+/**
+ * Gate-ratchet branch of the scan run loop (ADR-0036). The run loop itself is the
+ * IO orchestration excluded from coverage; these tests drive its `--gate-save` /
+ * `--gate-compare` decision branch directly with a stub `ToolCliContext` + stub IO
+ * deps, asserting the host baseline seams + the runFailed exit override are wired
+ * the same way fit's `runGateMode` wires them. The full ratchet over a REAL forked
+ * worker lives in tool-gitleaks's worker E2E (§4.12).
+ */
+import { EXIT_CODES } from '@opensip-cli/contracts';
+import { createSignal, } from '@opensip-cli/core';
+import { describe, expect, it, vi } from 'vitest';
+import { messageHashFingerprintStrategy } from '../fingerprint.js';
+import { runScanLoop } from '../run-loop.js';
+const TWO_FINDINGS = [
+    createSignal({
+        source: 'examplescan',
+        severity: 'high',
+        ruleId: 'aws-key',
+        message: 'AWS Access Key',
+        code: { file: 'config/prod.env', line: 12 },
+    }),
+    createSignal({
+        source: 'examplescan',
+        severity: 'high',
+        ruleId: 'gitlab-pat',
+        message: 'GitLab PAT',
+        code: { file: 'src/client.ts', line: 4 },
+    }),
+];
+function makeCli(compareResult) {
+    const spies = {
+        saveBaseline: vi.fn(() => Promise.resolve()),
+        compareBaseline: vi.fn(() => Promise.resolve(compareResult ?? { added: [], resolved: [], unchanged: [], degraded: false })),
+        deliverSignals: vi.fn(() => Promise.resolve({ cloudAccepted: 0 })),
+        render: vi.fn(() => Promise.resolve()),
+        emitEnvelope: vi.fn(),
+        reportFailure: vi.fn(() => Promise.resolve()),
+        writeArtifact: vi.fn(() => Promise.resolve()),
+        ensureArtifactDir: vi.fn(() => Promise.resolve()),
+    };
+    const cli = {
+        ...spies,
+        logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+        scope: {
+            toolConfig: {},
+            projectContext: { projectRoot: '/proj', configPath: '/proj/opensip-cli.config.yml' },
+            runId: 'RUN_test',
+        },
+    };
+    return { cli, spies };
+}
+const COMMAND = {
+    name: 'scan',
+    args: (ctx) => ['scan', ctx.projectRoot],
+    output: { kind: 'json', path: 'scan.json' },
+    exitCodes: { ok: [0], findings: [1], errorFrom: 2 },
+    parse: () => TWO_FINDINGS,
+};
+const BINARY = { command: 'examplescan', versionArgs: ['version'] };
+/** IO-deps stub: a found binary, a findings exit, a valid (non-empty) artifact. */
+function makeDeps() {
+    return {
+        binaryDeps: { existsSync: () => true, which: () => '/usr/bin/examplescan' },
+        runProcess: () => Promise.resolve({ code: 1, stdout: '', stderr: '', timedOut: false }),
+        probeVersion: () => '1.2.3',
+        readFile: () => '[{"RuleID":"aws-key"},{"RuleID":"gitlab-pat"}]',
+        fileSize: () => 42,
+        env: {},
+    };
+}
+function input(cli, opts) {
+    return {
+        cli,
+        tool: 'examplescan',
+        adapterPackage: '@opensip-cli/tool-example',
+        command: COMMAND,
+        binary: BINARY,
+        fingerprintStrategy: messageHashFingerprintStrategy,
+        opts,
+    };
+}
+describe('runScanLoop — gate-ratchet branch (ADR-0036)', () => {
+    it('rejects --gate-save + --gate-compare together (mutual exclusion → reportFailure, no scan)', async () => {
+        const { cli, spies } = makeCli();
+        const runProcess = vi.fn(() => Promise.resolve({ code: 0, stdout: '', stderr: '', timedOut: false }));
+        const completion = await runScanLoop(input(cli, { gateSave: true, gateCompare: true }), {
+            ...makeDeps(),
+            runProcess,
+        });
+        expect(completion).toBeUndefined();
+        expect(spies.reportFailure).toHaveBeenCalledWith(expect.objectContaining({ exitCode: EXIT_CODES.CONFIGURATION_ERROR }));
+        // Fail-fast: the scanner subprocess never ran, and no baseline seam was touched.
+        expect(runProcess).not.toHaveBeenCalled();
+        expect(spies.saveBaseline).not.toHaveBeenCalled();
+        expect(spies.compareBaseline).not.toHaveBeenCalled();
+    });
+    it('--gate-save saves the baseline, renders gate-done, and delivers without a runFailed override', async () => {
+        const { cli, spies } = makeCli();
+        const completion = await runScanLoop(input(cli, { gateSave: true }), makeDeps());
+        expect(spies.saveBaseline).toHaveBeenCalledWith('examplescan', expect.objectContaining({ tool: 'examplescan' }));
+        expect(spies.render).toHaveBeenCalledWith(expect.objectContaining({
+            type: 'gate-done',
+            lines: expect.arrayContaining([expect.stringContaining('baseline saved')]),
+        }));
+        // gate-save omits runFailed → the host derives the findings exit from the verdict.
+        expect(spies.deliverSignals).toHaveBeenCalledTimes(1);
+        expect(spies.deliverSignals.mock.calls[0][1].runFailed).toBeUndefined();
+        // A gate run still persists a session.
+        expect(completion?.session.tool).toBe('examplescan');
+        expect(completion?.session.payload.findings).toBe(2);
+    });
+    it('--gate-compare clean (not degraded) renders the diff and delivers runFailed=false', async () => {
+        const { cli, spies } = makeCli({
+            added: [],
+            resolved: [],
+            unchanged: [...TWO_FINDINGS],
+            degraded: false,
+        });
+        await runScanLoop(input(cli, { gateCompare: true }), makeDeps());
+        expect(spies.compareBaseline).toHaveBeenCalledWith('examplescan', expect.objectContaining({ tool: 'examplescan' }));
+        expect(spies.render).toHaveBeenCalledWith(expect.objectContaining({ type: 'gate-done', lines: expect.any(Array) }));
+        expect(spies.deliverSignals.mock.calls[0][1].runFailed).toBe(false);
+        expect(spies.saveBaseline).not.toHaveBeenCalled();
+    });
+    it('--gate-compare degraded (net-new finding) delivers runFailed=true', async () => {
+        const newFinding = createSignal({
+            source: 'examplescan',
+            severity: 'high',
+            ruleId: 'stripe-key',
+            message: 'Stripe key',
+            code: { file: 'src/pay.ts', line: 1 },
+        });
+        const { cli, spies } = makeCli({
+            added: [newFinding],
+            resolved: [],
+            unchanged: [...TWO_FINDINGS],
+            degraded: true,
+        });
+        await runScanLoop(input(cli, { gateCompare: true }), makeDeps());
+        expect(spies.deliverSignals.mock.calls[0][1].runFailed).toBe(true);
+    });
+    it('the no-gate path is unaffected: emits the envelope (--json) and delivers without runFailed', async () => {
+        const { cli, spies } = makeCli();
+        const completion = await runScanLoop(input(cli, { json: true }), makeDeps());
+        expect(spies.emitEnvelope).toHaveBeenCalledTimes(1);
+        expect(spies.saveBaseline).not.toHaveBeenCalled();
+        expect(spies.compareBaseline).not.toHaveBeenCalled();
+        expect(spies.deliverSignals.mock.calls[0][1].runFailed).toBeUndefined();
+        expect(completion?.envelope.tool).toBe('examplescan');
+    });
+    it('the no-gate, no-json path renders the human summary and delivers without runFailed', async () => {
+        const { cli, spies } = makeCli();
+        await runScanLoop(input(cli, {}), makeDeps());
+        expect(spies.emitEnvelope).not.toHaveBeenCalled();
+        expect(spies.render).toHaveBeenCalledWith(expect.objectContaining({ type: 'text-lines', title: 'examplescan scan' }));
+        expect(spies.deliverSignals.mock.calls[0][1].runFailed).toBeUndefined();
+    });
+});
+//# sourceMappingURL=run-loop-gate.test.js.map

package/dist/__tests__/run-loop-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/run-loop-gate.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EACL,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAyC,MAAM,gBAAgB,CAAC;AAIpF,MAAM,YAAY,GAAsB;IACtC,YAAY,CAAC;QACX,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;KAC5C,CAAC;IACF,YAAY,CAAC;QACX,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE;KACzC,CAAC;CACH,CAAC;AAEF,SAAS,OAAO,CAAC,aAAiC;IAahD,MAAM,KAAK,GAAG;QACZ,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC1B,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC9F;QACD,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;QACrB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;KAClD,CAAC;IACF,MAAM,GAAG,GAAG;QACV,GAAG,KAAK;QACR,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;QACxE,KAAK,EAAE;YACL,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,8BAA8B,EAAE;YACpF,KAAK,EAAE,UAAU;SAClB;KAC2B,CAAC;IAC/B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,GAAwB;IACnC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IACnD,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY;CAC1B,CAAC;AAEF,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;AAEhF,mFAAmF;AACnF,SAAS,QAAQ;IACf,OAAO;QACL,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC3E,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvF,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO;QAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,gDAAgD;QAChE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;QAClB,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,IAA6B;IAC/D,OAAO;QACL,GAAG;QACH,IAAI,EAAE,aAAa;QACnB,cAAc,EAAE,2BAA2B;QAC3C,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,MAAM;QACd,mBAAmB,EAAE,8BAA8B;QACnD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC5B,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACtE,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE;YACtF,GAAG,QAAQ,EAAE;YACb,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAC9C,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,mBAAmB,EAAE,CAAC,CACtE,CAAC;QACF,iFAAiF;QACjF,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAC7C,aAAa,EACb,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CACjD,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;SAC3E,CAAC,CACH,CAAC;QACF,mFAAmF;QACnF,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CACH,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC,SAAS,CAC7E,CAAC,aAAa,EAAE,CAAC;QAClB,uCAAuC;QACvC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;YAC7B,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,CAAC,GAAG,YAAY,CAAC;YAC5B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAChD,aAAa,EACb,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CACjD,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAC;QACF,MAAM,CAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC,SAAS,CAAC,CAAC,IAAI,CACvF,KAAK,CACN,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,UAAU,GAAG,YAAY,CAAC;YAC9B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;YAC7B,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,CAAC,GAAG,YAAY,CAAC;YAC5B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,MAAM,CAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACrD,MAAM,CACH,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC,SAAS,CAC7E,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,CACH,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC,SAAS,CAC7E,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session-payload.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * session-payload — the adapter-owned, dashboard-shaped session detail blob
+ * (A2: an adapter session must carry `summary` + grouped `checks[]` so the HTML
+ * report renders a secret/vuln scan's findings instead of falsely "clean").
+ *
+ * Proves the grouped shape AND the secret-hygiene invariant: every field is
+ * copied from an already-redacted signal, and `metadata` is narrowed to JSON
+ * scalars (the nested provenance object is dropped) — so NO raw credential reaches
+ * the persisted payload.
+ */
+export {};
+//# sourceMappingURL=session-payload.test.d.ts.map

package/dist/__tests__/session-payload.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-payload.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-payload.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}