@opensip-cli/external-tool-adapter 0.1.15

package/dist/ingest-sarif.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview The single, substrate-LOCAL SARIF ingest (ADR-0091).
+ *
+ * This is the ONLY SARIF read/parse path in the workspace (enforced by the
+ * `single-sarif-ingest` dependency-cruiser rule). The OpenSIP SARIF *writer*'s
+ * shape types are file-private to `@opensip-cli/output` (a layer-3 peer the
+ * substrate may not import) and deliberately minimal — so a foreign-scanner
+ * ingest defines its OWN defensive INPUT types here: it must read
+ * `result.fingerprints`/`partialFingerprints`/`guid`, `properties`, multiple
+ * `runs`/`locations`, `ruleIndex`→`rules` joins, and
+ * `properties["security-severity"]`.
+ *
+ * Severity recovery is the core job: the writer collapses BOTH `critical` and
+ * `high` → SARIF `error`, so a level-only inverse is ambiguous. `ingestSarif`
+ * reads the CVSS `security-severity` number (off the rule descriptor, falling
+ * back to the result) and applies the FIRST/NVD v3 bands BEFORE falling back to
+ * `level`. The native level/severity are preserved on `Signal.metadata`.
+ *
+ * Message stability is the second job: real scanners (Trivy) put a VERBOSE,
+ * version-volatile block in `result.message.text` (e.g. a `Package:/Installed
+ * Version:/Severity:/Fixed Version:/Link:` listing). Surfacing that as
+ * `Signal.message` would also feed it into the `message-hash` fingerprint, so the
+ * baseline would churn on every dependency bump — defeating the whole point of a
+ * line-shift-tolerant hash. So `ingestSarif` prefers the STABLE rule title
+ * (`driver.rules[ruleIndex].shortDescription.text`) for `Signal.message` when
+ * present and stashes the verbose `result.message.text` on `metadata.detail`. It
+ * falls back to `result.message.text` only when no rule/shortDescription exists.
+ */
+import { createSignal } from '@opensip-cli/core';
+import { cvssToSeverity, parseCvss, sarifLevelToSeverity } from './severity-map.js';
+const SECURITY_SEVERITY_KEY = 'security-severity';
+/** Find the rule descriptor for a result by `ruleIndex` first, then by id. */
+function resolveRule(result, rules) {
+    if (typeof result.ruleIndex === 'number' &&
+        result.ruleIndex >= 0 &&
+        result.ruleIndex < rules.length) {
+        return rules[result.ruleIndex];
+    }
+    if (typeof result.ruleId === 'string') {
+        return rules.find((rule) => rule.id === result.ruleId);
+    }
+    return undefined;
+}
+/** Read `properties["security-severity"]` off the rule, then the result. */
+function readSecuritySeverity(result, rule) {
+    for (const props of [rule?.properties, result.properties]) {
+        const raw = props?.[SECURITY_SEVERITY_KEY];
+        const cvss = parseCvss(raw);
+        if (cvss !== undefined)
+            return { raw, cvss };
+    }
+    return undefined;
+}
+/**
+ * Recover the four-bucket OpenSIP severity for one SARIF result: prefer the CVSS
+ * `security-severity` number (bands), else fall back to `level` (then the rule's
+ * `defaultConfiguration.level`). The native `securitySeverity`/`level` are
+ * returned so the caller can preserve them on metadata.
+ */
+function recoverSeverity(result, rule) {
+    const security = readSecuritySeverity(result, rule);
+    if (security !== undefined) {
+        return {
+            severity: cvssToSeverity(security.cvss),
+            securitySeverity: security.raw,
+            nativeLevel: result.level,
+        };
+    }
+    const level = result.level ?? rule?.defaultConfiguration?.level;
+    return { severity: sarifLevelToSeverity(level), nativeLevel: level };
+}
+/** Collapse a result's locations to the primary site + a count of extras. */
+function primaryLocation(result) {
+    const locations = result.locations ?? [];
+    const first = locations[0]?.physicalLocation;
+    return {
+        file: first?.artifactLocation?.uri,
+        line: first?.region?.startLine,
+        column: first?.region?.startColumn,
+        extra: locations.length > 1 ? locations.length - 1 : 0,
+    };
+}
+/**
+ * Resolve `Signal.message` (the fingerprint basis) for one result, preferring the
+ * STABLE rule title over the version-volatile `result.message.text`. When a title
+ * is used and a distinct verbose result message exists, the verbose block is
+ * returned as `detail` to stash on metadata (so nothing is lost).
+ */
+function resolveMessage(result, rule, ruleId) {
+    const title = rule?.shortDescription?.text;
+    const verbose = result.message?.text;
+    if (title !== undefined && title.length > 0) {
+        return {
+            message: title,
+            ...(verbose !== undefined && verbose !== title ? { detail: verbose } : {}),
+        };
+    }
+    return { message: verbose ?? rule?.fullDescription?.text ?? ruleId };
+}
+/** Build the opaque metadata bag for one result (native severity/level/fingerprint/help/detail). */
+function buildMetadata(result, rule, severity, extras) {
+    const nativeFingerprint = result.guid ?? result.fingerprints ?? result.partialFingerprints;
+    const helpUri = rule?.helpUri ?? result.helpUri;
+    return {
+        nativeLevel: severity.nativeLevel ?? null,
+        nativeSeverity: severity.securitySeverity ?? severity.nativeLevel ?? null,
+        ...(severity.securitySeverity === undefined
+            ? {}
+            : { securitySeverity: severity.securitySeverity }),
+        ...(nativeFingerprint === undefined ? {} : { nativeFingerprint }),
+        ...(extras.extraLocations > 0 ? { additionalLocations: extras.extraLocations } : {}),
+        ...(extras.detail === undefined ? {} : { detail: extras.detail }),
+        ...(helpUri === undefined ? {} : { helpUri }),
+    };
+}
+/** Normalize one SARIF result to a Signal, joined against its run's rules. */
+function resultToSignal(result, rules, source, category) {
+    const rule = resolveRule(result, rules);
+    const ruleId = result.ruleId ?? rule?.id ?? 'unknown';
+    const severity = recoverSeverity(result, rule);
+    const { message, detail } = resolveMessage(result, rule, ruleId);
+    const location = primaryLocation(result);
+    return createSignal({
+        source,
+        severity: severity.severity,
+        category,
+        ruleId,
+        message,
+        code: {
+            ...(location.file === undefined ? {} : { file: location.file }),
+            ...(location.line === undefined ? {} : { line: location.line }),
+            ...(location.column === undefined ? {} : { column: location.column }),
+        },
+        metadata: buildMetadata(result, rule, severity, { extraLocations: location.extra, detail }),
+    });
+}
+/**
+ * Ingest a SARIF 2.1.0 log into normalized {@link Signal}s. Defensive over
+ * foreign output: tolerates multiple runs, missing rules/locations, and
+ * `ruleIndex` joins. Severity is recovered from CVSS `security-severity` before
+ * `level` (ADR-0091); native fingerprints/level/severity are preserved on
+ * `metadata`. `Signal.fingerprint` is left unstamped — the host ratchet's
+ * `message-hash` strategy stamps it worker-side at envelope construction.
+ */
+export function ingestSarif(sarif, options) {
+    const category = options?.category ?? 'security';
+    const signals = [];
+    for (const run of sarif.runs ?? []) {
+        const driver = run.tool?.driver;
+        const rules = driver?.rules ?? [];
+        const source = options?.source ?? driver?.name?.toLowerCase() ?? 'sarif';
+        for (const result of run.results ?? []) {
+            signals.push(resultToSignal(result, rules, source, category));
+        }
+    }
+    return signals;
+}
+//# sourceMappingURL=ingest-sarif.js.map

package/dist/ingest-sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-sarif.js","sourceRoot":"","sources":["../src/ingest-sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAqFpF,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,8EAA8E;AAC9E,SAAS,WAAW,CAClB,MAAmB,EACnB,KAA0C;IAE1C,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,SAAS,IAAI,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,IAA0C;IAE1C,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,MAAmB,EACnB,IAA0C;IAM1C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,WAAW,EAAE,MAAM,CAAC,KAAK;SAC1B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,MAAmB;IAM1C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG;QAClC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS;QAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW;QAClC,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAmB,EACnB,IAA0C,EAC1C,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,MAAM,EAAE,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CACpB,MAAmB,EACnB,IAA0C,EAC1C,QAAgF,EAChF,MAAqE;IAErE,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;IAChD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACzC,cAAc,EAAE,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI;QACzE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CACrB,MAAmB,EACnB,KAA0C,EAC1C,MAAc,EACd,QAAgB;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC;IACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,YAAY,CAAC;QAClB,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,MAAM;QACN,OAAO;QACP,IAAI,EAAE;YACJ,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;SACtE;QACD,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;KAC5F,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAe,EAAE,OAA4B;IACvE,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC;QACzE,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/manifest-commands.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview Manifest command-shell derivation (ADR-0090, Phase-0 decision 7).
+ *
+ * An installed adapter mounts from its STATIC `package.json#opensipTools.commands`,
+ * not its runtime — and `assertCommandNamesMatch` THROWS if the static shells
+ * drift from the runtime `commandSpecs` (at install + worker import). So the
+ * shells must be GENERATED from the runtime, never hand-authored.
+ *
+ * `deriveAdapterManifestCommands(tool)` produces exactly that serializable data
+ * (the scan + doctor + version shells). A Phase-3 generator extension
+ * (`build-tool-command-manifests.mjs`) writes it into each adapter package.json
+ * and `--check`s parity; this helper is the single source the generator consumes.
+ */
+import type { ManifestCommandShell } from './types.js';
+import type { Tool } from '@opensip-cli/core';
+/**
+ * Derive the serializable `opensipTools.commands` shells from a built adapter
+ * {@link Tool}'s `commandSpecs` — name, description, aliases, common flags,
+ * options (e.g. the gate flags, minus `parse`), scope, output mode, the nesting
+ * `parent`, and (for `raw-stream`) the `rawStreamReason`. Pure.
+ */
+export declare function deriveAdapterManifestCommands(tool: Tool): readonly ManifestCommandShell[];
+//# sourceMappingURL=manifest-commands.d.ts.map

package/dist/manifest-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-commands.d.ts","sourceRoot":"","sources":["../src/manifest-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAwC,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAkBpF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,oBAAoB,EAAE,CAYzF"}

package/dist/manifest-commands.js

@@ -0,0 +1,47 @@
+/**
+ * @fileoverview Manifest command-shell derivation (ADR-0090, Phase-0 decision 7).
+ *
+ * An installed adapter mounts from its STATIC `package.json#opensipTools.commands`,
+ * not its runtime — and `assertCommandNamesMatch` THROWS if the static shells
+ * drift from the runtime `commandSpecs` (at install + worker import). So the
+ * shells must be GENERATED from the runtime, never hand-authored.
+ *
+ * `deriveAdapterManifestCommands(tool)` produces exactly that serializable data
+ * (the scan + doctor + version shells). A Phase-3 generator extension
+ * (`build-tool-command-manifests.mjs`) writes it into each adapter package.json
+ * and `--check`s parity; this helper is the single source the generator consumes.
+ */
+import { isAbsolute } from 'node:path';
+/**
+ * `OptionSpec` → `ManifestOptionDescriptor`: every field except the
+ * non-serializable `parse` closure, and minus a machine-specific absolute-path
+ * string `default` (resolved lazily at runtime, so baking it would make the
+ * manifest non-deterministic). Byte-identical to the shared generator's
+ * `deriveOptionDescriptor` (`scripts/build-tool-command-manifests.mjs`), so the
+ * two derivation paths agree (the `tool.test.ts` parity guard pins this).
+ */
+function toManifestOption(option) {
+    const dropDefault = typeof option.default === 'string' && isAbsolute(option.default);
+    const entries = Object.entries(option).filter(([key]) => key !== 'parse' && !(dropDefault && key === 'default'));
+    return Object.fromEntries(entries);
+}
+/**
+ * Derive the serializable `opensipTools.commands` shells from a built adapter
+ * {@link Tool}'s `commandSpecs` — name, description, aliases, common flags,
+ * options (e.g. the gate flags, minus `parse`), scope, output mode, the nesting
+ * `parent`, and (for `raw-stream`) the `rawStreamReason`. Pure.
+ */
+export function deriveAdapterManifestCommands(tool) {
+    return (tool.commandSpecs ?? []).map((spec) => ({
+        name: spec.name,
+        description: spec.description,
+        aliases: [...(spec.aliases ?? [])],
+        commonFlags: [...spec.commonFlags],
+        ...(spec.options === undefined ? {} : { options: spec.options.map(toManifestOption) }),
+        scope: spec.scope,
+        output: spec.output,
+        ...(spec.parent === undefined ? {} : { parent: spec.parent }),
+        ...(spec.rawStreamReason === undefined ? {} : { rawStreamReason: spec.rawStreamReason }),
+    }));
+}
+//# sourceMappingURL=manifest-commands.js.map

package/dist/manifest-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-commands.js","sourceRoot":"","sources":["../src/manifest-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKvC;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,KAAK,SAAS,CAAC,CAClE,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAA6B,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAU;IACtD,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;KACzF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/process-exec.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @fileoverview The substrate's SINGLE subprocess/IO boundary (ADR-0090 §11).
+ *
+ * `execFile` / `execFileSync` ONLY — NEVER `exec` with a shell string. Args are
+ * descriptor-controlled arrays, so a scanner argument can never be interpreted as
+ * a shell metacharacter. This module wraps the three IO primitives the substrate
+ * needs — PATH lookup (`which`/`where`), the scanner process runner (timeout +
+ * output cap), and the version probe — plus the real {@link BinaryResolveDeps}.
+ *
+ * It is the one file excluded from unit coverage: it runs a real external binary
+ * and is exercised end-to-end by each adapter's worker E2E (ADR-0090 D6 Tier 2).
+ * Every decision it feeds (resolution, exit modeling, ingest) is pure and covered
+ * directly.
+ */
+import type { BinaryResolveDeps } from './binary-resolver.js';
+/** The captured outcome of a scanner process run. */
+export interface ProcessResult {
+    /** The exit code (`-1` when the process was killed by the timeout). */
+    readonly code: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly timedOut: boolean;
+}
+export interface RunProcessInput {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly timeoutMs: number;
+    /** Max captured stdout+stderr bytes before the run is aborted. */
+    readonly maxBuffer: number;
+}
+/**
+ * Run a scanner binary with `execFile` (no shell), capturing stdout/stderr and
+ * the exit code EVEN on a nonzero exit (a scanner signalling findings via exit
+ * code is not an error here — {@link interpretExit} classifies it). Rejects only
+ * on a spawn failure (e.g. `ENOENT`); a timeout resolves with `timedOut: true`.
+ */
+export declare function runScannerProcess(input: RunProcessInput): Promise<ProcessResult>;
+export interface ProbeVersionInput {
+    readonly path: string;
+    readonly versionArgs: readonly string[];
+    readonly parse?: (stdout: string) => string;
+    readonly timeoutMs: number;
+}
+/** Probe a binary's version (`execFileSync`, no shell). Returns `undefined` on any failure. */
+export declare function probeBinaryVersion(input: ProbeVersionInput): string | undefined;
+/** PATH lookup via `which` (POSIX) / `where` (Windows), no shell. `undefined` if absent. */
+export declare function whichBinary(command: string, platform: NodeJS.Platform): string | undefined;
+/** The real binary-resolution IO deps (existence check + PATH lookup). */
+export declare const defaultBinaryDeps: BinaryResolveDeps;
+//# sourceMappingURL=process-exec.d.ts.map

package/dist/process-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-exec.d.ts","sourceRoot":"","sources":["../src/process-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CA8ChF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAe/E;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,GAAG,SAAS,CAc1F;AAED,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,EAAE,iBAG/B,CAAC"}

package/dist/process-exec.js

@@ -0,0 +1,99 @@
+/**
+ * @fileoverview The substrate's SINGLE subprocess/IO boundary (ADR-0090 §11).
+ *
+ * `execFile` / `execFileSync` ONLY — NEVER `exec` with a shell string. Args are
+ * descriptor-controlled arrays, so a scanner argument can never be interpreted as
+ * a shell metacharacter. This module wraps the three IO primitives the substrate
+ * needs — PATH lookup (`which`/`where`), the scanner process runner (timeout +
+ * output cap), and the version probe — plus the real {@link BinaryResolveDeps}.
+ *
+ * It is the one file excluded from unit coverage: it runs a real external binary
+ * and is exercised end-to-end by each adapter's worker E2E (ADR-0090 D6 Tier 2).
+ * Every decision it feeds (resolution, exit modeling, ingest) is pure and covered
+ * directly.
+ */
+import { execFile, execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+/**
+ * Run a scanner binary with `execFile` (no shell), capturing stdout/stderr and
+ * the exit code EVEN on a nonzero exit (a scanner signalling findings via exit
+ * code is not an error here — {@link interpretExit} classifies it). Rejects only
+ * on a spawn failure (e.g. `ENOENT`); a timeout resolves with `timedOut: true`.
+ */
+export function runScannerProcess(input) {
+    return new Promise((resolve, reject) => {
+        execFile(input.command, [...input.args], {
+            cwd: input.cwd,
+            timeout: input.timeoutMs,
+            maxBuffer: input.maxBuffer,
+            encoding: 'utf8',
+            windowsHide: true,
+        }, (error, stdout, stderr) => {
+            const out = typeof stdout === 'string' ? stdout : String(stdout ?? '');
+            const err = typeof stderr === 'string' ? stderr : String(stderr ?? '');
+            if (error === null) {
+                resolve({ code: 0, stdout: out, stderr: err, timedOut: false });
+                return;
+            }
+            const failure = error;
+            if (failure.killed === true || failure.signal === 'SIGTERM') {
+                resolve({ code: -1, stdout: out, stderr: err, timedOut: true });
+                return;
+            }
+            // A string `code` (`ENOENT`/`EACCES`) is a spawn failure, not an exit code.
+            if (typeof failure.code === 'string') {
+                reject(error instanceof Error
+                    ? error
+                    : new Error(`scanner '${input.command}' failed to spawn (${failure.code})`));
+                return;
+            }
+            resolve({
+                code: typeof failure.code === 'number' ? failure.code : 1,
+                stdout: out,
+                stderr: err,
+                timedOut: false,
+            });
+        });
+    });
+}
+/** Probe a binary's version (`execFileSync`, no shell). Returns `undefined` on any failure. */
+export function probeBinaryVersion(input) {
+    try {
+        const stdout = execFileSync(input.path, [...input.versionArgs], {
+            encoding: 'utf8',
+            timeout: input.timeoutMs,
+            windowsHide: true,
+        });
+        const text = typeof stdout === 'string' ? stdout : String(stdout);
+        return (input.parse ?? ((s) => s.trim()))(text);
+    }
+    catch {
+        // intentionally silent: a version probe failure (binary missing, slow, or
+        // a non-version output) is a normal "version unknown" — surfaced as
+        // undefined, which doctor renders. No logger is available in this pure seam.
+        return undefined;
+    }
+}
+/** PATH lookup via `which` (POSIX) / `where` (Windows), no shell. `undefined` if absent. */
+export function whichBinary(command, platform) {
+    const finder = platform === 'win32' ? 'where' : 'which';
+    try {
+        const out = execFileSync(finder, [command], { encoding: 'utf8', windowsHide: true });
+        return String(out)
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .find((line) => line.length > 0);
+    }
+    catch {
+        // intentionally silent: a `which`/`where` miss means "not on PATH" — a normal
+        // resolution outcome surfaced as undefined (the resolver then reports a
+        // not-found with an install hint). No logger in this pure IO seam.
+        return undefined;
+    }
+}
+/** The real binary-resolution IO deps (existence check + PATH lookup). */
+export const defaultBinaryDeps = {
+    existsSync: (path) => existsSync(path),
+    which: (command, platform) => whichBinary(command, platform),
+};
+//# sourceMappingURL=process-exec.js.map

package/dist/process-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-exec.js","sourceRoot":"","sources":["../src/process-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAsBrC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,QAAQ,CACN,KAAK,CAAC,OAAO,EACb,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EACf;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,SAAS;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,KAIf,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,CACJ,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,OAAO,sBAAsB,OAAO,CAAC,IAAI,GAAG,CAAC,CAC9E,CAAC;gBACF,OAAO;YACT,CAAC;YACD,OAAO,CAAC;gBACN,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,GAAG;gBACX,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AASD,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE;YAC9D,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,oEAAoE;QACpE,6EAA6E;QAC7E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAAyB;IACpE,MAAM,MAAM,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,GAAG,CAAC;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IACtC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC7D,CAAC"}

package/dist/provenance.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview Provenance stamping (ADR-0090 §8, ADR-0092 review bar item 4).
+ *
+ * Every normalized signal carries, on `metadata.provenance`, the facts a
+ * reviewer/operator needs to trust the finding: the tool, the adapter package,
+ * the resolved binary version + path, the exact args, and the config file path.
+ * Pure — returns a new `Signal`; the matched secret is NEVER part of provenance.
+ */
+import type { AdapterProvenance } from './types.js';
+import type { Signal } from '@opensip-cli/core';
+/**
+ * Return a copy of `signal` with {@link AdapterProvenance} merged under
+ * `metadata.provenance`. Undefined provenance fields are dropped so the bag stays
+ * compact and deterministic.
+ */
+export declare function stampProvenance(signal: Signal, provenance: AdapterProvenance): Signal;
+/** Stamp provenance across a batch of signals. */
+export declare function stampProvenanceAll(signals: readonly Signal[], provenance: AdapterProvenance): readonly Signal[];
+//# sourceMappingURL=provenance.d.ts.map

package/dist/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,CAYrF;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,UAAU,EAAE,iBAAiB,GAC5B,SAAS,MAAM,EAAE,CAEnB"}

package/dist/provenance.js

@@ -0,0 +1,31 @@
+/**
+ * @fileoverview Provenance stamping (ADR-0090 §8, ADR-0092 review bar item 4).
+ *
+ * Every normalized signal carries, on `metadata.provenance`, the facts a
+ * reviewer/operator needs to trust the finding: the tool, the adapter package,
+ * the resolved binary version + path, the exact args, and the config file path.
+ * Pure — returns a new `Signal`; the matched secret is NEVER part of provenance.
+ */
+/**
+ * Return a copy of `signal` with {@link AdapterProvenance} merged under
+ * `metadata.provenance`. Undefined provenance fields are dropped so the bag stays
+ * compact and deterministic.
+ */
+export function stampProvenance(signal, provenance) {
+    const bag = {
+        tool: provenance.tool,
+        binaryPath: provenance.binaryPath,
+        args: [...provenance.args],
+        ...(provenance.adapterPackage === undefined
+            ? {}
+            : { adapterPackage: provenance.adapterPackage }),
+        ...(provenance.binaryVersion === undefined ? {} : { binaryVersion: provenance.binaryVersion }),
+        ...(provenance.configPath === undefined ? {} : { configPath: provenance.configPath }),
+    };
+    return { ...signal, metadata: { ...signal.metadata, provenance: bag } };
+}
+/** Stamp provenance across a batch of signals. */
+export function stampProvenanceAll(signals, provenance) {
+    return signals.map((signal) => stampProvenance(signal, provenance));
+}
+//# sourceMappingURL=provenance.js.map

package/dist/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAA6B;IAC3E,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QAC1B,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;QAClD,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;QAC9F,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;KACtF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAChC,OAA0B,EAC1B,UAA6B;IAE7B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Secret redaction for secret-scanner parsers (ADR-0091 / ADR-0092).
+ *
+ * A secret scanner (gitleaks) captures the live credential (`Secret`) and the
+ * surrounding match region (`Match`). Neither may EVER reach `Signal.message`,
+ * `Signal.metadata` in raw form, or any egress payload. A parser stores only a
+ * {@link redactSecret} PREVIEW (or {@link secretHash}) so a finding stays
+ * identifiable without leaking the value.
+ *
+ * Pure functions; `redactSecret` provably never returns the raw string.
+ */
+/**
+ * Mask a secret to a short, non-reversible PREVIEW: the first 4 characters plus
+ * an ellipsis (`'AKIA…'`). A value of length `<= 4` collapses to just `'…'`, so
+ * the full raw secret is NEVER returned. Empty/undefined → `''`.
+ */
+export declare function redactSecret(raw: string | undefined | null): string;
+/**
+ * A stable, non-reversible identity for a secret: the first 12 hex chars of its
+ * SHA-256. Useful when two findings must be told apart without storing any part
+ * of the value. Empty/undefined → `''`.
+ */
+export declare function secretHash(raw: string | undefined | null): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAGjE"}

package/dist/redact.js

@@ -0,0 +1,38 @@
+/**
+ * @fileoverview Secret redaction for secret-scanner parsers (ADR-0091 / ADR-0092).
+ *
+ * A secret scanner (gitleaks) captures the live credential (`Secret`) and the
+ * surrounding match region (`Match`). Neither may EVER reach `Signal.message`,
+ * `Signal.metadata` in raw form, or any egress payload. A parser stores only a
+ * {@link redactSecret} PREVIEW (or {@link secretHash}) so a finding stays
+ * identifiable without leaking the value.
+ *
+ * Pure functions; `redactSecret` provably never returns the raw string.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Mask a secret to a short, non-reversible PREVIEW: the first 4 characters plus
+ * an ellipsis (`'AKIA…'`). A value of length `<= 4` collapses to just `'…'`, so
+ * the full raw secret is NEVER returned. Empty/undefined → `''`.
+ */
+export function redactSecret(raw) {
+    if (raw === undefined || raw === null)
+        return '';
+    const s = String(raw);
+    if (s.length === 0)
+        return '';
+    if (s.length <= 4)
+        return '…';
+    return `${s.slice(0, 4)}…`;
+}
+/**
+ * A stable, non-reversible identity for a secret: the first 12 hex chars of its
+ * SHA-256. Useful when two findings must be told apart without storing any part
+ * of the value. Empty/undefined → `''`.
+ */
+export function secretHash(raw) {
+    if (raw === undefined || raw === null || raw.length === 0)
+        return '';
+    return createHash('sha256').update(String(raw)).digest('hex').slice(0, 12);
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAA8B;IACzD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAA8B;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/run-context.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Build the {@link AdapterRunContext} from a `ToolCliContext`
+ * (ADR-0090, Phase-0 decision 8).
+ *
+ * Layer-legal: paths come from core `resolveProjectPaths`, NOT a `cli` import.
+ * `scan` REQUIRES a project — a config-less/project-agnostic run has no targeting
+ * root to scan, so a missing `projectContext` is a `ConfigurationError` (exit 2),
+ * mirroring MCP's datastore-unavailable handling (Phase-0 decision 2).
+ */
+import type { AdapterRunContext, ResolvedBinary } from './types.js';
+import type { ToolCliContext } from '@opensip-cli/core';
+export interface BuildRunContextInput {
+    readonly cli: ToolCliContext;
+    readonly tool: string;
+    readonly adapterPackage?: string;
+    readonly binary: ResolvedBinary;
+    readonly config: Readonly<Record<string, unknown>>;
+}
+/**
+ * Construct the per-run {@link AdapterRunContext}. Throws `ConfigurationError`
+ * when no project scope is present (scan needs a targeting root).
+ */
+export declare function buildAdapterRunContext(input: BuildRunContextInput): AdapterRunContext;
+//# sourceMappingURL=run-context.d.ts.map

package/dist/run-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-context.d.ts","sourceRoot":"","sources":["../src/run-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,iBAAiB,CA2BrF"}

package/dist/run-context.js

@@ -0,0 +1,36 @@
+/**
+ * @fileoverview Build the {@link AdapterRunContext} from a `ToolCliContext`
+ * (ADR-0090, Phase-0 decision 8).
+ *
+ * Layer-legal: paths come from core `resolveProjectPaths`, NOT a `cli` import.
+ * `scan` REQUIRES a project — a config-less/project-agnostic run has no targeting
+ * root to scan, so a missing `projectContext` is a `ConfigurationError` (exit 2),
+ * mirroring MCP's datastore-unavailable handling (Phase-0 decision 2).
+ */
+import { ConfigurationError, resolveProjectPaths } from '@opensip-cli/core';
+import { resolveScannerArtifactPath } from './artifact-path.js';
+/**
+ * Construct the per-run {@link AdapterRunContext}. Throws `ConfigurationError`
+ * when no project scope is present (scan needs a targeting root).
+ */
+export function buildAdapterRunContext(input) {
+    const project = input.cli.scope.projectContext;
+    if (project === undefined) {
+        throw new ConfigurationError(`Cannot run '${input.tool}': no opensip-cli project found here. ` +
+            `Run 'opensip ${input.tool}' from inside an opensip-cli project (a directory with opensip-cli.config.yml).`, { code: 'ADAPTER.SCAN.NO_PROJECT' });
+    }
+    const projectPaths = resolveProjectPaths(project.projectRoot);
+    const runId = input.cli.scope.runId;
+    return {
+        tool: input.tool,
+        adapterPackage: input.adapterPackage,
+        projectRoot: project.projectRoot,
+        runId,
+        logger: input.cli.logger,
+        config: input.config,
+        binary: input.binary,
+        configPath: project.configPath,
+        artifactPath: (name) => resolveScannerArtifactPath({ artifactDir: projectPaths.artifactDir, runId }, input.tool, name),
+    };
+}
+//# sourceMappingURL=run-context.js.map

package/dist/run-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-context.js","sourceRoot":"","sources":["../src/run-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAahE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,KAAK,CAAC,IAAI,wCAAwC;YAC/D,gBAAgB,KAAK,CAAC,IAAI,iFAAiF,EAC7G,EAAE,IAAI,EAAE,yBAAyB,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;IACpC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CACrB,0BAA0B,CACxB,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,EAChD,KAAK,CAAC,IAAI,EACV,IAAI,CACL;KACJ,CAAC;AACJ,CAAC"}