@opensip-cli/external-tool-adapter 0.1.15

package/dist/__tests__/session-payload.test.js

@@ -0,0 +1,131 @@
+/**
+ * session-payload — the adapter-owned, dashboard-shaped session detail blob
+ * (A2: an adapter session must carry `summary` + grouped `checks[]` so the HTML
+ * report renders a secret/vuln scan's findings instead of falsely "clean").
+ *
+ * Proves the grouped shape AND the secret-hygiene invariant: every field is
+ * copied from an already-redacted signal, and `metadata` is narrowed to JSON
+ * scalars (the nested provenance object is dropped) — so NO raw credential reaches
+ * the persisted payload.
+ */
+import { createSignal } from '@opensip-cli/core';
+import { describe, expect, it } from 'vitest';
+import { buildAdapterSessionPayload } from '../session-payload.js';
+/** A `high`-severity (error-rung) secret signal carrying ONLY a redacted preview. */
+function leakSignal(overrides = {}) {
+    return createSignal({
+        source: 'gitleaks',
+        category: 'security',
+        severity: 'high',
+        ruleId: 'aws-access-token',
+        message: 'AWS Access Key',
+        code: { file: 'config/prod.env', line: 12, column: 19 },
+        // The provenance object + a redacted scalar preview — the raw secret is NEVER
+        // present (the ingest parser masked it). The provenance object must be dropped.
+        metadata: {
+            secretPreview: 'AKIA…',
+            entropy: 3.65,
+            provenance: { tool: 'gitleaks', adapterPackage: '@opensip-cli/tool-gitleaks' },
+        },
+        ...overrides,
+    });
+}
+describe('buildAdapterSessionPayload', () => {
+    it('groups signals by ruleId into checks[] with a populated summary (NOT clean)', () => {
+        const payload = buildAdapterSessionPayload([
+            leakSignal(),
+            leakSignal({ ruleId: 'aws-access-token', code: { file: 'a.env', line: 3 } }),
+            leakSignal({
+                ruleId: 'stripe-token',
+                message: 'Stripe Token',
+                code: { file: 'b.ts', line: 9 },
+            }),
+        ]);
+        expect(payload.__version).toBe(1);
+        // Two distinct rules → two checks; the aws rule grouped both occurrences.
+        expect(payload.checks).toHaveLength(2);
+        const aws = payload.checks.find((c) => c.checkSlug === 'aws-access-token');
+        expect(aws?.violationCount).toBe(2);
+        expect(aws?.findings).toHaveLength(2);
+        expect(aws?.passed).toBe(false); // error-rung findings ⇒ the rule failed
+        // The summary the dashboard reads for its clean/dirty decision — NOT clean.
+        expect(payload.summary).toEqual({
+            total: 2, // rules that fired
+            passed: 0,
+            failed: 2,
+            errors: 3, // high-severity signal count
+            warnings: 0,
+        });
+        // The dashboard's `clean = errors === 0 && warnings === 0` is therefore FALSE.
+        expect(payload.summary.errors === 0 && payload.summary.warnings === 0).toBe(false);
+    });
+    it('collapses 4-level severity to the dashboard 2-level bucket and marks a warning rule passed', () => {
+        const payload = buildAdapterSessionPayload([
+            leakSignal({ ruleId: 'low-rule', severity: 'low', message: 'minor' }),
+        ]);
+        const check = payload.checks[0];
+        expect(check?.findings[0]?.severity).toBe('warning');
+        // A rule with only warning-rung findings does NOT fail (fit/graph semantics).
+        expect(check?.passed).toBe(true);
+        expect(payload.summary).toMatchObject({ errors: 0, warnings: 1, passed: 1, failed: 0 });
+    });
+    it('an empty scan yields zero checks and a zeroed summary', () => {
+        const payload = buildAdapterSessionPayload([]);
+        expect(payload.checks).toHaveLength(0);
+        expect(payload.summary).toEqual({ total: 0, passed: 0, failed: 0, errors: 0, warnings: 0 });
+    });
+    it('carries per-finding file/line/column/suggestion and projects metadata to scalars', () => {
+        const payload = buildAdapterSessionPayload([
+            leakSignal({ suggestion: 'rotate the credential' }),
+        ]);
+        const finding = payload.checks[0]?.findings[0];
+        expect(finding?.filePath).toBe('config/prod.env');
+        expect(finding?.line).toBe(12);
+        expect(finding?.column).toBe(19);
+        expect(finding?.suggestion).toBe('rotate the credential');
+        // Scalar metadata survives; the nested provenance OBJECT is dropped.
+        expect(finding?.metadata).toEqual({ secretPreview: 'AKIA…', entropy: 3.65 });
+        expect((finding?.metadata).provenance).toBeUndefined();
+    });
+    it('omits absent optional fields and keeps structured repair guidance', () => {
+        // A "bare" signal (no code ⇒ no file/line/column, no scalar metadata, no
+        // suggestion) and a repair-carrying signal — exercises both arms of every
+        // optional spread and the empty-metadata path.
+        const bare = createSignal({
+            source: 'osv-scanner',
+            severity: 'high',
+            ruleId: 'r',
+            message: 'm',
+        });
+        const withRepair = createSignal({
+            source: 'osv-scanner',
+            severity: 'high',
+            ruleId: 'r2',
+            message: 'm2',
+            repair: { repairKind: 'manual', autofixable: false },
+        });
+        const payload = buildAdapterSessionPayload([bare, withRepair]);
+        const bareFinding = payload.checks.find((c) => c.checkSlug === 'r')?.findings[0];
+        expect(bareFinding?.filePath).toBe('');
+        expect(bareFinding?.line).toBeUndefined();
+        expect(bareFinding?.column).toBeUndefined();
+        expect(bareFinding?.suggestion).toBeUndefined();
+        expect(bareFinding?.metadata).toBeUndefined();
+        const repairFinding = payload.checks.find((c) => c.checkSlug === 'r2')?.findings[0];
+        expect(repairFinding?.repair).toEqual({ repairKind: 'manual', autofixable: false });
+    });
+    it('NEVER lets a raw secret or the Match key reach the serialized payload (redaction proof)', () => {
+        // The signal carries ONLY a masked preview (redaction happens at ingest, before
+        // the envelope/payload build). Prove the serialized blob the host persists holds
+        // no raw credential bytes and no `Match` field.
+        const RAW_SECRET = 'AKIAIOSFODNN7EXAMPLE';
+        const payload = buildAdapterSessionPayload([leakSignal()]);
+        const blob = JSON.stringify(payload);
+        expect(blob).not.toContain(RAW_SECRET);
+        expect(blob).not.toContain('"Match"');
+        expect(blob).not.toContain('"Secret"');
+        // The masked preview IS present (the finding stays identifiable).
+        expect(blob).toContain('AKIA…');
+    });
+});
+//# sourceMappingURL=session-payload.test.js.map

package/dist/__tests__/session-payload.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-payload.test.js","sourceRoot":"","sources":["../../src/__tests__/session-payload.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,qFAAqF;AACrF,SAAS,UAAU,CAAC,YAAyD,EAAE;IAC7E,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvD,8EAA8E;QAC9E,gFAAgF;QAChF,QAAQ,EAAE;YACR,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,4BAA4B,EAAE;SAC/E;QACD,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,OAAO,GAAG,0BAA0B,CAAC;YACzC,UAAU,EAAE;YACZ,UAAU,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5E,UAAU,CAAC;gBACT,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,0EAA0E;QAC1E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,wCAAwC;QAEzE,4EAA4E;QAC5E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,CAAC,EAAE,mBAAmB;YAC7B,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,6BAA6B;YACxC,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,+EAA+E;QAC/E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,OAAO,GAAG,0BAA0B,CAAC;YACzC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,8EAA8E;QAC9E,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,OAAO,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,OAAO,GAAG,0BAA0B,CAAC;YACzC,UAAU,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC1D,qEAAqE;QACrE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,OAAO,EAAE,QAAoC,CAAA,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,IAAI,GAAG,YAAY,CAAC;YACxB,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,YAAY,CAAC;YAC9B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,0BAA0B,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,gFAAgF;QAChF,iFAAiF;QACjF,gDAAgD;QAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC;QAC1C,MAAM,OAAO,GAAG,0BAA0B,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/severity-map.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=severity-map.test.d.ts.map

package/dist/__tests__/severity-map.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/severity-map.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/severity-map.test.js

@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import { cvssToSeverity, parseCvss, sarifLevelToSeverity, withNativeSeverity, } from '../severity-map.js';
+describe('cvssToSeverity (FIRST/NVD v3 bands)', () => {
+    it('maps the band boundaries', () => {
+        expect(cvssToSeverity(9)).toBe('critical');
+        expect(cvssToSeverity(9.8)).toBe('critical');
+        expect(cvssToSeverity(10)).toBe('critical');
+        expect(cvssToSeverity(8.9)).toBe('high');
+        expect(cvssToSeverity(7)).toBe('high');
+        expect(cvssToSeverity(6.9)).toBe('medium');
+        expect(cvssToSeverity(4)).toBe('medium');
+        expect(cvssToSeverity(3.9)).toBe('low');
+        expect(cvssToSeverity(0.1)).toBe('low');
+    });
+    it('treats 0 / negative / non-finite as low', () => {
+        expect(cvssToSeverity(0)).toBe('low');
+        expect(cvssToSeverity(-1)).toBe('low');
+        expect(cvssToSeverity(Number.NaN)).toBe('low');
+        // Non-finite is treated defensively as low (not a real CVSS score).
+        expect(cvssToSeverity(Number.POSITIVE_INFINITY)).toBe('low');
+    });
+});
+describe('parseCvss', () => {
+    it('reads numbers and numeric strings', () => {
+        expect(parseCvss(7.5)).toBe(7.5);
+        expect(parseCvss('9.8')).toBe(9.8);
+        expect(parseCvss('  4.0 ')).toBe(4);
+    });
+    it('rejects vectors, empty, and non-numeric', () => {
+        expect(parseCvss('CVSS:3.1/AV:N/AC:L')).toBeUndefined();
+        expect(parseCvss('')).toBeUndefined();
+        expect(parseCvss('  ')).toBeUndefined();
+        expect(parseCvss('not-a-number')).toBeUndefined();
+        expect(parseCvss(undefined)).toBeUndefined();
+        expect(parseCvss(Number.NaN)).toBeUndefined();
+        expect(parseCvss({})).toBeUndefined();
+    });
+});
+describe('sarifLevelToSeverity (lossy fallback)', () => {
+    it('maps error to high (never critical), warning to medium, note/none to low', () => {
+        expect(sarifLevelToSeverity('error')).toBe('high');
+        expect(sarifLevelToSeverity('warning')).toBe('medium');
+        expect(sarifLevelToSeverity('note')).toBe('low');
+        expect(sarifLevelToSeverity('none')).toBe('low');
+    });
+    it('defaults an absent/unknown level to the warning rung (medium)', () => {
+        expect(sarifLevelToSeverity(undefined)).toBe('medium');
+        expect(sarifLevelToSeverity('bogus')).toBe('medium');
+    });
+});
+describe('withNativeSeverity', () => {
+    it('records the raw label and null for missing', () => {
+        expect(withNativeSeverity({ a: 1 }, 'HIGH')).toEqual({ a: 1, nativeSeverity: 'HIGH' });
+        expect(withNativeSeverity({}, undefined)).toEqual({ nativeSeverity: null });
+    });
+});
+//# sourceMappingURL=severity-map.test.js.map

package/dist/__tests__/severity-map.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity-map.test.js","sourceRoot":"","sources":["../../src/__tests__/severity-map.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,oEAAoE;QACpE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/acceptance-harness.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @fileoverview A reusable, framework-agnostic acceptance harness (ADR-0090
+ * §4.12). Given a frozen golden (the scanner's native output) it runs the
+ * substrate's parse → normalize → envelope path and returns the produced signals
+ * + the built `SignalEnvelope`, so an adapter's test asserts on *data* instead of
+ * re-scaffolding the pipeline. The real worker E2E lives in each adapter's tests
+ * (D6 Tier 2); this covers the in-process normalization tier (D6 Tier 1).
+ *
+ * Pure: no test framework, no IO, deterministic `runId`/`createdAt`.
+ */
+import type { AdapterRunContext, FingerprintStrategyChoice, ParsedScannerOutput, ScannerOutputKind } from './types.js';
+import type { SignalEnvelope } from '@opensip-cli/contracts';
+import type { Signal } from '@opensip-cli/core';
+/** A golden case to drive through the normalization pipeline. */
+export interface AcceptanceFixture {
+    readonly tool: string;
+    readonly kind: ScannerOutputKind;
+    /** The scanner's native output bytes (a frozen golden). */
+    readonly raw: string;
+    /** Required for JSON/stdout fixtures; SARIF fixtures use the shared `ingestSarif`. */
+    readonly parse?: (raw: ParsedScannerOutput, ctx: AdapterRunContext) => readonly Signal[];
+    readonly fingerprintStrategy?: FingerprintStrategyChoice;
+    /** Optional partial context for a JSON/stdout `parse` (defaults are filled in). */
+    readonly ctx?: Partial<AdapterRunContext>;
+}
+/** The normalized output of an acceptance case. */
+export interface AcceptanceResult {
+    readonly signals: readonly Signal[];
+    readonly envelope: SignalEnvelope;
+}
+/** The stable, comparable shape of a signal for golden assertions. */
+export interface SignalShape {
+    readonly ruleId: string;
+    readonly severity: string;
+    readonly message: string;
+    readonly file: string;
+    readonly line?: number;
+    readonly column?: number;
+}
+/** Project a signal to its stable comparison shape (drops ids/timestamps/metadata). */
+export declare function normalizedSignalShape(signal: Signal): SignalShape;
+/**
+ * Run a golden fixture through the substrate pipeline. Returns the normalized
+ * signals and a deterministic envelope (host fallback policy, message-hash
+ * fingerprints by default).
+ */
+export declare function runAcceptanceCase(fixture: AcceptanceFixture): AcceptanceResult;
+//# sourceMappingURL=acceptance-harness.d.ts.map

package/dist/acceptance-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acceptance-harness.d.ts","sourceRoot":"","sources":["../src/acceptance-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,KAAK,SAAS,MAAM,EAAE,CAAC;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD,mFAAmF;IACnF,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3C;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CASjE;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA8B9E"}

package/dist/acceptance-harness.js

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview A reusable, framework-agnostic acceptance harness (ADR-0090
+ * §4.12). Given a frozen golden (the scanner's native output) it runs the
+ * substrate's parse → normalize → envelope path and returns the produced signals
+ * + the built `SignalEnvelope`, so an adapter's test asserts on *data* instead of
+ * re-scaffolding the pipeline. The real worker E2E lives in each adapter's tests
+ * (D6 Tier 2); this covers the in-process normalization tier (D6 Tier 1).
+ *
+ * Pure: no test framework, no IO, deterministic `runId`/`createdAt`.
+ */
+import { buildSignalEnvelope } from '@opensip-cli/contracts';
+import { resolveFingerprintStrategy } from './fingerprint.js';
+import { safeParseJson } from './ingest-json.js';
+import { ingestSarif } from './ingest-sarif.js';
+/** Project a signal to its stable comparison shape (drops ids/timestamps/metadata). */
+export function normalizedSignalShape(signal) {
+    return {
+        ruleId: signal.ruleId,
+        severity: signal.severity,
+        message: signal.message,
+        file: signal.filePath,
+        ...(signal.line === undefined ? {} : { line: signal.line }),
+        ...(signal.column === undefined ? {} : { column: signal.column }),
+    };
+}
+/** A single shared no-op used for every level of the harness's stub logger. */
+const noop = () => undefined;
+function defaultCtx(fixture) {
+    return {
+        tool: fixture.tool,
+        projectRoot: '/acceptance',
+        runId: 'acceptance-run',
+        logger: {
+            info: noop,
+            warn: noop,
+            error: noop,
+            debug: noop,
+        },
+        config: {},
+        binary: { path: `/usr/bin/${fixture.tool}`, layer: 'path' },
+        artifactPath: (name) => `/acceptance/acceptance-run/${name}`,
+        ...fixture.ctx,
+    };
+}
+/**
+ * Run a golden fixture through the substrate pipeline. Returns the normalized
+ * signals and a deterministic envelope (host fallback policy, message-hash
+ * fingerprints by default).
+ */
+export function runAcceptanceCase(fixture) {
+    const ctx = defaultCtx(fixture);
+    let signals;
+    if (fixture.kind === 'sarif') {
+        const parsed = safeParseJson(fixture.raw);
+        signals = parsed.ok ? ingestSarif(parsed.value, { source: fixture.tool }) : [];
+    }
+    else if (fixture.parse === undefined) {
+        signals = [];
+    }
+    else {
+        const json = fixture.kind === 'json' ? safeParseJson(fixture.raw) : undefined;
+        signals = fixture.parse({ kind: fixture.kind, raw: fixture.raw, ...(json?.ok === true ? { json: json.value } : {}) }, ctx);
+    }
+    const envelope = buildSignalEnvelope({
+        tool: fixture.tool,
+        runId: ctx.runId,
+        createdAt: '2026-01-01T00:00:00.000Z',
+        units: [
+            { slug: 'scan', passed: signals.length === 0, violationCount: signals.length, durationMs: 0 },
+        ],
+        signals,
+        policy: { failOnErrors: 1, failOnWarnings: 0 },
+        runFaulted: false,
+        fingerprintStrategy: resolveFingerprintStrategy(fixture.fingerprintStrategy),
+    });
+    return { signals, envelope };
+}
+//# sourceMappingURL=acceptance-harness.js.map

package/dist/acceptance-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acceptance-harness.js","sourceRoot":"","sources":["../src/acceptance-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAyChD,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;AAEnC,SAAS,UAAU,CAAC,OAA0B;IAC5C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,aAAa;QAC1B,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI;SACZ;QACD,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3D,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,IAAI,EAAE;QAC5D,GAAG,OAAO,CAAC,GAAG;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,OAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,OAAO,GAAG,OAAO,CAAC,KAAK,CACrB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5F,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,0BAA0B;QACrC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE;SAC9F;QACD,OAAO;QACP,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;QAC9C,UAAU,EAAE,KAAK;QACjB,mBAAmB,EAAE,0BAA0B,CAAC,OAAO,CAAC,mBAAmB,CAAC;KAC7E,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/adapter-config.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview The DEFAULT namespaced config contribution every adapter claims
+ * (ADR-0090 §4.3 / ADR-0023 / ADR-0054 M4-E).
+ *
+ * Without a claimed namespace `cli.scope.toolConfig?.[<tool>]` is ALWAYS
+ * `undefined`, so (1) the documented `binaries.<tool>.path` operator pin is dead,
+ * (2) the per-tool verdict policy keys (`failOnErrors`/`failOnWarnings`/
+ * `failOnDegraded`) are non-configurable, and (3) an operator adding a `<tool>:`
+ * block to `opensip-cli.config.yml` hits the ADR-0043 unclaimed-namespace
+ * rejection and BRICKS every project command. So an adapter claims its namespace
+ * by default — on BOTH the runtime (the Zod schema the WORKER deep pass runs) and
+ * the static manifest (the JSON-Schema descriptor the HOST coarse pass validates
+ * against pre-fork, since the host never imports the tool's Zod — ADR-0054 M4-E).
+ *
+ * Two halves, kept in lock-step:
+ *   - {@link defaultAdapterConfigSchema} — the runtime Zod. The DEEP pass
+ *     (`runDeepConfigPass`, worker-side) runs THIS raw schema (it is NOT the
+ *     gate-key-decorated one the host composes), so the gate keys MUST be declared
+ *     here or a `<tool>: { failOnWarnings: … }` block would fail the deep pass.
+ *   - {@link defaultAdapterConfigManifest} — the serializable JSON-Schema
+ *     descriptor. Declares ONLY `binaries` (coarse — host validates structure
+ *     pre-fork); the host folds in the reserved gate keys via
+ *     `decorateToolConfigDeclarationsWithGateKeys` exactly as it does for a bundled
+ *     tool, so the gate thresholds are configurable like any bundled tool.
+ *
+ * `binaries` is a `{ <tool>: { path } }` map (the resolver reads
+ * `binaries[<tool>].path`, mirroring `binaries.<tool>.path` in the docs).
+ */
+import { z } from 'zod';
+import type { ToolConfigManifestDescriptor } from '@opensip-cli/core';
+/** The author-facing config slot (namespace is derived from identity by `defineTool`). */
+export interface AdapterConfigContribution {
+    /** The namespace Zod schema — a strict object claiming `binaries` + the gate keys. */
+    readonly schema: z.ZodType;
+}
+/**
+ * The runtime Zod schema the default adapter config claims for its namespace:
+ * the operator binary pin (`binaries.<tool>.path`) PLUS the three reserved
+ * verdict-policy keys. Strict, so a typo inside the block is rejected by the
+ * worker deep pass. The gate keys are declared HERE (unlike a bundled tool, which
+ * leans on the host decorator) because the worker deep pass runs this raw schema —
+ * the decorated one only governs the host pre-fork pass.
+ */
+export declare function defaultAdapterConfigSchema(): z.ZodType;
+/** The default config contribution forwarded to `defineTool` when a spec omits `config`. */
+export declare function defaultAdapterConfig(): AdapterConfigContribution;
+/**
+ * The serializable JSON-Schema descriptor the host coarse pass validates an
+ * installed adapter's `<tool>:` block against BEFORE forking (it never imports
+ * the tool's Zod — ADR-0054 M4-E). Declares ONLY the `binaries` block as a coarse
+ * object; the reserved gate keys are folded in host-side by
+ * `decorateToolConfigDeclarationsWithGateKeys`, so they are NOT (and must not be)
+ * duplicated here — that keeps the gate-key min(0) policy single-sourced in the
+ * decorator, exactly as for a bundled tool. The deep, value-level validation of
+ * `binaries.<tool>.path` runs worker-side via {@link defaultAdapterConfigSchema}.
+ */
+export declare function defaultAdapterConfigManifest(namespace: string): ToolConfigManifestDescriptor;
+//# sourceMappingURL=adapter-config.d.ts.map

package/dist/adapter-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-config.d.ts","sourceRoot":"","sources":["../src/adapter-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAoB,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAExF,0FAA0F;AAC1F,MAAM,WAAW,yBAAyB;IACxC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,CAAC,CAAC,OAAO,CAWtD;AAED,4FAA4F;AAC5F,wBAAgB,oBAAoB,IAAI,yBAAyB,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,4BAA4B,CAQ5F"}

package/dist/adapter-config.js

@@ -0,0 +1,73 @@
+/**
+ * @fileoverview The DEFAULT namespaced config contribution every adapter claims
+ * (ADR-0090 §4.3 / ADR-0023 / ADR-0054 M4-E).
+ *
+ * Without a claimed namespace `cli.scope.toolConfig?.[<tool>]` is ALWAYS
+ * `undefined`, so (1) the documented `binaries.<tool>.path` operator pin is dead,
+ * (2) the per-tool verdict policy keys (`failOnErrors`/`failOnWarnings`/
+ * `failOnDegraded`) are non-configurable, and (3) an operator adding a `<tool>:`
+ * block to `opensip-cli.config.yml` hits the ADR-0043 unclaimed-namespace
+ * rejection and BRICKS every project command. So an adapter claims its namespace
+ * by default — on BOTH the runtime (the Zod schema the WORKER deep pass runs) and
+ * the static manifest (the JSON-Schema descriptor the HOST coarse pass validates
+ * against pre-fork, since the host never imports the tool's Zod — ADR-0054 M4-E).
+ *
+ * Two halves, kept in lock-step:
+ *   - {@link defaultAdapterConfigSchema} — the runtime Zod. The DEEP pass
+ *     (`runDeepConfigPass`, worker-side) runs THIS raw schema (it is NOT the
+ *     gate-key-decorated one the host composes), so the gate keys MUST be declared
+ *     here or a `<tool>: { failOnWarnings: … }` block would fail the deep pass.
+ *   - {@link defaultAdapterConfigManifest} — the serializable JSON-Schema
+ *     descriptor. Declares ONLY `binaries` (coarse — host validates structure
+ *     pre-fork); the host folds in the reserved gate keys via
+ *     `decorateToolConfigDeclarationsWithGateKeys` exactly as it does for a bundled
+ *     tool, so the gate thresholds are configurable like any bundled tool.
+ *
+ * `binaries` is a `{ <tool>: { path } }` map (the resolver reads
+ * `binaries[<tool>].path`, mirroring `binaries.<tool>.path` in the docs).
+ */
+import { z } from 'zod';
+/**
+ * The runtime Zod schema the default adapter config claims for its namespace:
+ * the operator binary pin (`binaries.<tool>.path`) PLUS the three reserved
+ * verdict-policy keys. Strict, so a typo inside the block is rejected by the
+ * worker deep pass. The gate keys are declared HERE (unlike a bundled tool, which
+ * leans on the host decorator) because the worker deep pass runs this raw schema —
+ * the decorated one only governs the host pre-fork pass.
+ */
+export function defaultAdapterConfigSchema() {
+    return z
+        .object({
+        binaries: z
+            .record(z.string(), z.object({ path: z.string().min(1).optional() }).strict())
+            .optional(),
+        failOnErrors: z.number().int().min(0).optional(),
+        failOnWarnings: z.number().int().min(0).optional(),
+        failOnDegraded: z.boolean().optional(),
+    })
+        .strict();
+}
+/** The default config contribution forwarded to `defineTool` when a spec omits `config`. */
+export function defaultAdapterConfig() {
+    return { schema: defaultAdapterConfigSchema() };
+}
+/**
+ * The serializable JSON-Schema descriptor the host coarse pass validates an
+ * installed adapter's `<tool>:` block against BEFORE forking (it never imports
+ * the tool's Zod — ADR-0054 M4-E). Declares ONLY the `binaries` block as a coarse
+ * object; the reserved gate keys are folded in host-side by
+ * `decorateToolConfigDeclarationsWithGateKeys`, so they are NOT (and must not be)
+ * duplicated here — that keeps the gate-key min(0) policy single-sourced in the
+ * decorator, exactly as for a bundled tool. The deep, value-level validation of
+ * `binaries.<tool>.path` runs worker-side via {@link defaultAdapterConfigSchema}.
+ */
+export function defaultAdapterConfigManifest(namespace) {
+    const schema = {
+        type: 'object',
+        properties: {
+            binaries: { type: 'object' },
+        },
+    };
+    return { namespace, schema };
+}
+//# sourceMappingURL=adapter-config.js.map

package/dist/adapter-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-config.js","sourceRoot":"","sources":["../src/adapter-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC;SACL,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC7E,QAAQ,EAAE;QACb,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACvC,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB;IAClC,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC7B;KACF,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/adapter-manifest.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Manifest derivation from the built adapter `Tool` (ADR-0090
+ * §4.3 / §4.8 / ADR-0092) — the `config` namespace claim and the `requires`
+ * resource needs.
+ *
+ * An installed adapter's static `package.json#opensipTools` must mirror its
+ * runtime, and the generator (`build-tool-command-manifests.mjs`) plus a per-tool
+ * `--check` parity gate keep them in lock-step. `deriveAdapterManifestCommands`
+ * (a sibling) derives the command shells; the helpers here derive the remaining
+ * adapter-shaped manifest fields from data the substrate STAMPS on the built Tool
+ * ({@link AdapterToolMarkers}) — the substrate's own data, never a core `Tool`
+ * concept:
+ *
+ *   - {@link deriveAdapterManifestRequires} forward-maps the declared `network`
+ *     posture (ADR-0092) onto `opensipTools.requires`: `subprocess` + `filesystem`
+ *     ALWAYS (every adapter `execFile`s a binary and reads/writes the project +
+ *     artifact store), plus `network` WHEN the posture is not `local-only`. This is
+ *     the §4.8 "honest labeling" mapping the `types.ts` contract claims — derived,
+ *     not hand-authored, so flipping an adapter to `networked` produces a `--check`
+ *     drift the gate catches.
+ *   - {@link deriveAdapterConfigManifest} returns the coarse config descriptor the
+ *     adapter claims (its namespace + `binaries` block) so the host pre-fork pass
+ *     recognizes the namespace and an operator's `<tool>:` block no longer bricks.
+ */
+import type { NetworkPosture } from './types.js';
+import type { Tool, ToolConfigManifestDescriptor, ToolResourceRequirement } from '@opensip-cli/core';
+/**
+ * The adapter-substrate markers {@link defineExternalToolAdapter} stamps on the
+ * Tool it returns. Kept off the core `Tool` contract (an adapter concept, not a
+ * kernel one); the substrate reads them back here to derive manifest fields.
+ */
+export interface AdapterToolMarkers {
+    /** The declared network posture (ADR-0092), drives `requires` derivation. */
+    readonly adapterNetwork?: NetworkPosture;
+    /** The coarse config descriptor the adapter claims, or `undefined` for a custom config. */
+    readonly adapterConfigManifest?: ToolConfigManifestDescriptor;
+}
+/** Read the stamped network posture; defaults to `'local-only'` (the safe, no-network posture). */
+export declare function adapterNetworkOf(tool: Tool): NetworkPosture;
+/** Read the stamped config descriptor, or `undefined` when the adapter uses a custom config. */
+export declare function adapterConfigManifestOf(tool: Tool): ToolConfigManifestDescriptor | undefined;
+/**
+ * Derive `opensipTools.requires` from the adapter's network posture (ADR-0092
+ * §4.8). `subprocess` + `filesystem` are unconditional; `network` is added only
+ * when the posture is `networked`/`auth-required`. Pure — the manifest generator
+ * writes the result and the per-tool `--check` parity gate fails on drift.
+ */
+export declare function deriveAdapterManifestRequires(tool: Tool): readonly ToolResourceRequirement[];
+/**
+ * Derive the static `opensipTools.config` descriptor for an adapter — the coarse
+ * namespace claim the host validates a `<tool>:` block against pre-fork. Returns
+ * `undefined` for an adapter whose config cannot be coarsely serialized (a custom
+ * `spec.config`), which defers ALL of its config validation to the worker deep
+ * pass (ADR-0054 M4-E); the generator then omits the `config` key.
+ */
+export declare function deriveAdapterConfigManifest(tool: Tool): ToolConfigManifestDescriptor | undefined;
+//# sourceMappingURL=adapter-manifest.d.ts.map

package/dist/adapter-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-manifest.d.ts","sourceRoot":"","sources":["../src/adapter-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EACV,IAAI,EACJ,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,2FAA2F;IAC3F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;CAC/D;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc,CAE3D;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,IAAI,GAAG,4BAA4B,GAAG,SAAS,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,uBAAuB,EAAE,CAmB5F;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,4BAA4B,GAAG,SAAS,CAEhG"}

package/dist/adapter-manifest.js

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Manifest derivation from the built adapter `Tool` (ADR-0090
+ * §4.3 / §4.8 / ADR-0092) — the `config` namespace claim and the `requires`
+ * resource needs.
+ *
+ * An installed adapter's static `package.json#opensipTools` must mirror its
+ * runtime, and the generator (`build-tool-command-manifests.mjs`) plus a per-tool
+ * `--check` parity gate keep them in lock-step. `deriveAdapterManifestCommands`
+ * (a sibling) derives the command shells; the helpers here derive the remaining
+ * adapter-shaped manifest fields from data the substrate STAMPS on the built Tool
+ * ({@link AdapterToolMarkers}) — the substrate's own data, never a core `Tool`
+ * concept:
+ *
+ *   - {@link deriveAdapterManifestRequires} forward-maps the declared `network`
+ *     posture (ADR-0092) onto `opensipTools.requires`: `subprocess` + `filesystem`
+ *     ALWAYS (every adapter `execFile`s a binary and reads/writes the project +
+ *     artifact store), plus `network` WHEN the posture is not `local-only`. This is
+ *     the §4.8 "honest labeling" mapping the `types.ts` contract claims — derived,
+ *     not hand-authored, so flipping an adapter to `networked` produces a `--check`
+ *     drift the gate catches.
+ *   - {@link deriveAdapterConfigManifest} returns the coarse config descriptor the
+ *     adapter claims (its namespace + `binaries` block) so the host pre-fork pass
+ *     recognizes the namespace and an operator's `<tool>:` block no longer bricks.
+ */
+/** Read the stamped network posture; defaults to `'local-only'` (the safe, no-network posture). */
+export function adapterNetworkOf(tool) {
+    return tool.adapterNetwork ?? 'local-only';
+}
+/** Read the stamped config descriptor, or `undefined` when the adapter uses a custom config. */
+export function adapterConfigManifestOf(tool) {
+    return tool.adapterConfigManifest;
+}
+/**
+ * Derive `opensipTools.requires` from the adapter's network posture (ADR-0092
+ * §4.8). `subprocess` + `filesystem` are unconditional; `network` is added only
+ * when the posture is `networked`/`auth-required`. Pure — the manifest generator
+ * writes the result and the per-tool `--check` parity gate fails on drift.
+ */
+export function deriveAdapterManifestRequires(tool) {
+    const requires = [
+        {
+            resource: 'subprocess',
+            reason: `Executes the user-installed ${tool.metadata.name} binary via execFile (no shell)`,
+        },
+        {
+            resource: 'filesystem',
+            reason: 'Reads the project working tree and writes the raw scan artifact under .runtime/artifacts',
+        },
+    ];
+    if (adapterNetworkOf(tool) !== 'local-only') {
+        requires.push({
+            resource: 'network',
+            reason: `Performs network I/O for the ${adapterNetworkOf(tool)} scanner posture`,
+        });
+    }
+    return requires;
+}
+/**
+ * Derive the static `opensipTools.config` descriptor for an adapter — the coarse
+ * namespace claim the host validates a `<tool>:` block against pre-fork. Returns
+ * `undefined` for an adapter whose config cannot be coarsely serialized (a custom
+ * `spec.config`), which defers ALL of its config validation to the worker deep
+ * pass (ADR-0054 M4-E); the generator then omits the `config` key.
+ */
+export function deriveAdapterConfigManifest(tool) {
+    return adapterConfigManifestOf(tool);
+}
+//# sourceMappingURL=adapter-manifest.js.map

package/dist/adapter-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-manifest.js","sourceRoot":"","sources":["../src/adapter-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAqBH,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,IAAU;IACzC,OAAQ,IAAkC,CAAC,cAAc,IAAI,YAAY,CAAC;AAC5E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,uBAAuB,CAAC,IAAU;IAChD,OAAQ,IAAkC,CAAC,qBAAqB,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAU;IACtD,MAAM,QAAQ,GAA8B;QAC1C;YACE,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,+BAA+B,IAAI,CAAC,QAAQ,CAAC,IAAI,iCAAiC;SAC3F;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,MAAM,EACJ,0FAA0F;SAC7F;KACF,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,gCAAgC,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;SACjF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAU;IACpD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}