@opensip-cli/external-tool-adapter 0.1.15

package/dist/run-loop.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @fileoverview The scan run loop (ADR-0090 §4 / ADR-0091).
+ *
+ * resolve binary → build run context → probe version → compute artifact path →
+ * `execFile` (no shell, timeout + output cap) → interpret exit → read native
+ * output → persist via `cli.writeArtifact` (the host seam — NEVER raw fs) →
+ * parse (SARIF via shared `ingestSarif`; JSON via the descriptor `parse`) →
+ * stamp provenance → `buildSignalEnvelope` + worker-side fingerprint stamping →
+ * emit via `cli.emitEnvelope` (`--json`) / `cli.render` (human) → `cli.deliverSignals`
+ * (host derives the findings exit from the verdict) → return a `ToolRunCompletion`.
+ *
+ * For an INSTALLED adapter this body runs WORKER-SIDE; every `cli.*` call here is
+ * captured by the worker's recording context and replayed through the host seams
+ * (`writeArtifact` via host RPC; `emitEnvelope`/`render`/`deliverSignals`/
+ * `setExitCode` via the forwarded-result record). So the substrate never imports
+ * `cli` and the host stays the only privileged-effect process.
+ *
+ * This IO orchestration is excluded from unit coverage; pure helpers are covered
+ * directly and adapter worker E2Es exercise the whole loop.
+ */
+import type { BinaryResolveDeps } from './binary-resolver.js';
+import type { ProbeVersionInput, ProcessResult, RunProcessInput } from './process-exec.js';
+import type { ScanCompletion } from './scan-emit.js';
+import type { BinarySpec, ExternalCommandSpec } from './types.js';
+import type { FingerprintStrategy, ToolCliContext } from '@opensip-cli/core';
+/** Injectable IO seam (real impls default; tests pass stubs). */
+export interface ScanLoopDeps {
+    readonly binaryDeps: BinaryResolveDeps;
+    readonly runProcess: (input: RunProcessInput) => Promise<ProcessResult>;
+    readonly probeVersion: (input: ProbeVersionInput) => string | undefined;
+    readonly readFile: (path: string) => string;
+    /** The artifact file's byte size — used to cap the read (OOM guard) before {@link readFile}. */
+    readonly fileSize: (path: string) => number;
+    /**
+     * The environment the operator binary-pin (`OPENSIP_<TOOL>_BIN`) is read from
+     * — injected (mirrors the doctor/version probe's `DoctorProbeDeps.env`) so the
+     * read flows through a seam, not a raw `process.env` reach, and stays
+     * unit-testable. The pin name is per-tool/dynamic, so it cannot be a static
+     * EnvRegistry `EnvVarSpec`.
+     */
+    readonly env: NodeJS.ProcessEnv;
+    readonly timeoutMs: number;
+    readonly maxBuffer: number;
+}
+export interface ScanLoopInput {
+    readonly cli: ToolCliContext;
+    readonly tool: string;
+    readonly adapterPackage?: string;
+    readonly command: ExternalCommandSpec;
+    readonly binary: BinarySpec;
+    readonly fingerprintStrategy: FingerprintStrategy;
+    /** The parsed command flags (`json` / `cwd` / `reportTo` / `apiKey`). */
+    readonly opts: Record<string, unknown>;
+}
+/**
+ * Run one scanner command end-to-end.
+ *
+ * Returns the {@link ScanCompletion} the host persists/dispatches, or `undefined`
+ * when the invocation is a config error (`--gate-save` + `--gate-compare` together)
+ * — the loop has already recorded the failure + exit via `cli.reportFailure`, so
+ * there is no envelope/session to return.
+ */
+export declare function runScanLoop(input: ScanLoopInput, overrides?: Partial<ScanLoopDeps>): Promise<ScanCompletion | undefined>;
+//# sourceMappingURL=run-loop.d.ts.map

package/dist/run-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop.d.ts","sourceRoot":"","sources":["../src/run-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwBH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAGV,UAAU,EACV,mBAAmB,EAEpB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,mBAAmB,EAAU,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAUrF,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAaD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AA2HD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,aAAa,EACpB,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAChC,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAoMrC"}

package/dist/run-loop.js

@@ -0,0 +1,320 @@
+/**
+ * @fileoverview The scan run loop (ADR-0090 §4 / ADR-0091).
+ *
+ * resolve binary → build run context → probe version → compute artifact path →
+ * `execFile` (no shell, timeout + output cap) → interpret exit → read native
+ * output → persist via `cli.writeArtifact` (the host seam — NEVER raw fs) →
+ * parse (SARIF via shared `ingestSarif`; JSON via the descriptor `parse`) →
+ * stamp provenance → `buildSignalEnvelope` + worker-side fingerprint stamping →
+ * emit via `cli.emitEnvelope` (`--json`) / `cli.render` (human) → `cli.deliverSignals`
+ * (host derives the findings exit from the verdict) → return a `ToolRunCompletion`.
+ *
+ * For an INSTALLED adapter this body runs WORKER-SIDE; every `cli.*` call here is
+ * captured by the worker's recording context and replayed through the host seams
+ * (`writeArtifact` via host RPC; `emitEnvelope`/`render`/`deliverSignals`/
+ * `setExitCode` via the forwarded-result record). So the substrate never imports
+ * `cli` and the host stays the only privileged-effect process.
+ *
+ * This IO orchestration is excluded from unit coverage; pure helpers are covered
+ * directly and adapter worker E2Es exercise the whole loop.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { performance } from 'node:perf_hooks';
+import { buildSignalEnvelope, EXIT_CODES } from '@opensip-cli/contracts';
+import { ConfigurationError, isErrorSignal, resolveProjectPaths, resolveVerdictPolicy, TimeoutError, ToolError, } from '@opensip-cli/core';
+import { resolveBinary, defaultBinaryEnvVar } from './binary-resolver.js';
+import { DEFAULT_EXIT_MODEL, interpretExit } from './exit-model.js';
+import { asObject, getString, safeParseJson } from './ingest-json.js';
+import { ingestSarif } from './ingest-sarif.js';
+import { defaultBinaryDeps, probeBinaryVersion, runScannerProcess } from './process-exec.js';
+import { stampProvenanceAll } from './provenance.js';
+import { buildAdapterRunContext } from './run-context.js';
+import { buildScanCompletion, deliverOptions, emitScanCompletion } from './scan-emit.js';
+/** Logger `module` field for every event this loop emits. */
+const MODULE = 'external-tool-adapter';
+/** Default scanner process budget. */
+const DEFAULT_TIMEOUT_MS = 300_000;
+const DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
+const STDERR_TAIL = 2000;
+const DEFAULT_DEPS = {
+    binaryDeps: defaultBinaryDeps,
+    runProcess: runScannerProcess,
+    probeVersion: probeBinaryVersion,
+    readFile: (path) => readFileSync(path, 'utf8'),
+    fileSize: (path) => statSync(path).size,
+    env: process.env,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    maxBuffer: DEFAULT_MAX_BUFFER,
+};
+const ARTIFACT_EXT = {
+    sarif: 'sarif',
+    json: 'json',
+    stdout: 'out',
+};
+function defaultArtifactName(tool, kind) {
+    return `${tool}.${ARTIFACT_EXT[kind]}`;
+}
+/** Read the namespaced operator pin `binaries.<tool>.path` from the resolved config. */
+function configuredBinaryPath(config, tool) {
+    return getString(asObject(config.binaries)?.[tool], 'path');
+}
+/** Parse native output into signals (SARIF via shared ingest; JSON/stdout via the descriptor). */
+function parseSignals(command, raw, ctx) {
+    if (command.output.kind === 'sarif') {
+        const parsed = safeParseJson(raw);
+        if (!parsed.ok)
+            return [];
+        return ingestSarif(parsed.value, { source: ctx.tool });
+    }
+    if (command.parse === undefined)
+        return [];
+    const json = command.output.kind === 'json' ? safeParseJson(raw) : undefined;
+    const payload = {
+        kind: command.output.kind,
+        raw,
+        ...(json?.ok === true ? { json: json.value } : {}),
+    };
+    return command.parse(payload, ctx);
+}
+/**
+ * Read a FILE-backed scanner report and classify its validity (A11). Size-guarded:
+ * an over-cap report (OOM guard) is never read into memory. Returns the reason a
+ * report is unusable so the caller can fault with a size-distinguished message and
+ * never overwrite the on-disk report with an empty/truncated buffer.
+ */
+function readReportArtifact(path, deps) {
+    let size = -1;
+    try {
+        size = deps.fileSize(path);
+    }
+    catch {
+        return { raw: '', artifactValid: false, invalidReason: 'missing' };
+    }
+    if (size > deps.maxBuffer)
+        return { raw: '', artifactValid: false, invalidReason: 'oversize' };
+    let raw;
+    try {
+        raw = deps.readFile(path);
+    }
+    catch {
+        return { raw: '', artifactValid: false, invalidReason: 'missing' };
+    }
+    if (raw.length === 0)
+        return { raw, artifactValid: false, invalidReason: 'empty' };
+    if (!safeParseJson(raw).ok)
+        return { raw, artifactValid: false, invalidReason: 'unparseable' };
+    return { raw, artifactValid: true };
+}
+/**
+ * A3: append the descriptor's exclusion of opensip's `.runtime` artifact store to
+ * the scanner argv. The substrate supplies the path (run-context-driven) while the
+ * descriptor supplies the per-scanner flag shape; a config-file form (gitleaks's
+ * allowlist) is written through the host `writeArtifact` seam into the per-run dir,
+ * never a raw substrate fs write. No user-facing flag — the command manifest is
+ * unchanged.
+ */
+async function applyScanExclusion(cli, command, ctx, args) {
+    if (command.excludeScan === undefined)
+        return;
+    const exclusion = command.excludeScan({
+        excludePath: resolveProjectPaths(ctx.projectRoot).runtimeDir,
+        configPath: (name) => ctx.artifactPath(name),
+    });
+    if (exclusion.configFile !== undefined) {
+        await cli.writeArtifact(exclusion.configFile.path, exclusion.configFile.contents);
+    }
+    if (exclusion.args !== undefined)
+        args.push(...exclusion.args);
+}
+/**
+ * A11: raise the typed `ADAPTER.ARTIFACT.INVALID` fault for an unusable file-backed
+ * report, distinguishing the oversize-cap case from missing/empty/unparseable.
+ */
+function faultInvalidArtifact(tool, command, read, maxBuffer, stderr) {
+    const maxMiB = Math.floor(maxBuffer / (1024 * 1024));
+    const detail = read.invalidReason === 'oversize'
+        ? `report exceeded the ${String(maxMiB)} MiB cap`
+        : `report ${read.invalidReason ?? 'invalid'}`;
+    throw new ToolError(`${tool} produced no usable ${command.output.kind} report (${detail}).`, 'ADAPTER.ARTIFACT.INVALID', { stderrTail: stderr.slice(-STDERR_TAIL) });
+}
+/**
+ * Run one scanner command end-to-end.
+ *
+ * Returns the {@link ScanCompletion} the host persists/dispatches, or `undefined`
+ * when the invocation is a config error (`--gate-save` + `--gate-compare` together)
+ * — the loop has already recorded the failure + exit via `cli.reportFailure`, so
+ * there is no envelope/session to return.
+ */
+export async function runScanLoop(input, overrides) {
+    const deps = { ...DEFAULT_DEPS, ...overrides };
+    const { cli, tool, command, binary } = input;
+    // ADR-0036 gate-ratchet: --gate-save and --gate-compare are mutually exclusive
+    // (mirrors fit's runGateMode). Validate BEFORE any IO so a misconfiguration
+    // fails fast — no wasted scanner subprocess — and return early (the host replays
+    // the recorded reportFailure → exit 2).
+    if (input.opts.gateSave === true && input.opts.gateCompare === true) {
+        cli.logger.warn({
+            evt: 'adapter.gate.config_error',
+            module: MODULE,
+            tool,
+            reason: 'mutually-exclusive flags',
+        });
+        await cli.reportFailure({
+            message: 'Error: --gate-save and --gate-compare are mutually exclusive.',
+            exitCode: EXIT_CODES.CONFIGURATION_ERROR,
+            jsonRequested: input.opts.json === true,
+        });
+        return undefined;
+    }
+    const config = (cli.scope.toolConfig?.[tool] ?? {});
+    const envVar = binary.envVar ?? defaultBinaryEnvVar(tool);
+    const resolution = resolveBinary({
+        command: binary.command,
+        configuredPath: configuredBinaryPath(config, tool),
+        envPath: deps.env[envVar],
+    }, deps.binaryDeps);
+    if (!resolution.found) {
+        throw new ConfigurationError(`${tool}: ${resolution.reason}. Run 'opensip ${tool} doctor' for setup help.`, { code: 'ADAPTER.BINARY.NOT_FOUND' });
+    }
+    const version = deps.probeVersion({
+        path: resolution.path,
+        versionArgs: binary.versionArgs,
+        parse: binary.versionParse,
+        timeoutMs: deps.timeoutMs,
+    });
+    const ctx = buildAdapterRunContext({
+        cli,
+        tool,
+        adapterPackage: input.adapterPackage,
+        binary: { path: resolution.path, layer: resolution.layer, version },
+        config,
+    });
+    const artifactName = command.output.path ?? defaultArtifactName(tool, command.output.kind);
+    const artifactFullPath = ctx.artifactPath(artifactName);
+    // A1/A7: create the per-run artifact dir through the host seam before the
+    // scanner opens its report path. The substrate never mkdirs `.runtime` itself;
+    // host RPC owns the privileged FS effect.
+    await cli.ensureArtifactDir(artifactFullPath);
+    // A3: keep the scanner off opensip's own persisted reports under `.runtime/`
+    // (see applyScanExclusion) — inherited by every adapter, no user flag.
+    const args = [...command.args(ctx)];
+    await applyScanExclusion(cli, command, ctx, args);
+    cli.logger.info({
+        evt: 'adapter.binary.resolved',
+        module: MODULE,
+        tool,
+        layer: resolution.layer,
+        path: resolution.path,
+        version: version ?? null,
+    });
+    const startedAt = new Date().toISOString();
+    const begin = performance.now();
+    const proc = await deps.runProcess({
+        command: resolution.path,
+        args,
+        cwd: ctx.projectRoot,
+        timeoutMs: deps.timeoutMs,
+        maxBuffer: deps.maxBuffer,
+    });
+    const durationMs = Math.max(0, Math.round(performance.now() - begin));
+    if (proc.timedOut) {
+        cli.logger.warn({
+            evt: 'adapter.scan.faulted',
+            module: MODULE,
+            tool,
+            reason: 'timeout',
+        });
+        throw new TimeoutError(`${tool} scan timed out after ${String(deps.timeoutMs)}ms`, {
+            code: 'ADAPTER.SCAN.TIMEOUT',
+            stderrTail: proc.stderr.slice(-STDERR_TAIL),
+        });
+    }
+    // Read the native output: stdout commands use the captured stdout (always valid);
+    // file-backed commands read + classify the report (A11) via readReportArtifact.
+    const read = command.output.kind === 'stdout'
+        ? { raw: proc.stdout, artifactValid: true }
+        : readReportArtifact(artifactFullPath, deps);
+    const verdict = interpretExit(proc.code, command.exitCodes ?? DEFAULT_EXIT_MODEL, {
+        artifactValid: read.artifactValid,
+    });
+    if (verdict === 'fault') {
+        cli.logger.warn({
+            evt: 'adapter.scan.faulted',
+            module: MODULE,
+            tool,
+            code: proc.code,
+        });
+        throw new ToolError(`${tool} scan failed (exit ${String(proc.code)})`, 'ADAPTER.SCAN.FAULT', {
+            stderrTail: proc.stderr.slice(-STDERR_TAIL),
+        });
+    }
+    // A11: a FILE-backed scanner MUST produce a readable, parseable report. An invalid
+    // artifact is a FAULT even under an `ok`/`findings` verdict — otherwise trivy's
+    // `ok:[0]` model would read a broken report as a clean PASS and the `writeArtifact`
+    // below would overwrite the real report with the empty buffer. We throw BEFORE
+    // writeArtifact, so the scanner's report on disk is never destroyed.
+    if (!read.artifactValid) {
+        cli.logger.warn({
+            evt: 'adapter.scan.faulted',
+            module: MODULE,
+            tool,
+            reason: `artifact-${read.invalidReason ?? 'invalid'}`,
+        });
+        faultInvalidArtifact(tool, command, read, deps.maxBuffer, proc.stderr);
+    }
+    const raw = read.raw;
+    // Persist the raw artifact through the HOST seam (0600 + retention, ADR-0080/0091).
+    await cli.writeArtifact(artifactFullPath, raw);
+    cli.logger.info({
+        evt: 'adapter.artifact.stored',
+        module: MODULE,
+        tool,
+        path: artifactFullPath,
+        bytes: raw.length,
+    });
+    const parsed = parseSignals(command, raw, ctx);
+    const provenance = {
+        tool,
+        adapterPackage: input.adapterPackage,
+        binaryPath: resolution.path,
+        binaryVersion: version,
+        args,
+        configPath: ctx.configPath,
+    };
+    const signals = stampProvenanceAll(parsed, provenance);
+    const unitPassed = !signals.some(isErrorSignal);
+    const envelope = buildSignalEnvelope({
+        tool,
+        runId: ctx.runId,
+        createdAt: startedAt,
+        units: [{ slug: command.name, passed: unitPassed, violationCount: signals.length, durationMs }],
+        signals,
+        policy: resolveVerdictPolicy(tool),
+        runFaulted: false,
+        fingerprintStrategy: input.fingerprintStrategy,
+    });
+    const deliver = deliverOptions(input.opts, ctx.projectRoot);
+    // The session contribution (incl. the dashboard-shaped grouped payload) is shaped
+    // in a sibling helper so this orchestration body stays flat (file-length budget).
+    const completion = buildScanCompletion({
+        tool,
+        cwd: deliver.cwd,
+        envelope,
+        signals,
+        binary: { path: resolution.path, layer: resolution.layer, version: version ?? null },
+        artifact: artifactFullPath,
+        durationMs,
+    });
+    // Emit + deliver + return. The gate-ratchet branch (ADR-0036) and the normal
+    // emit live in a sibling helper so this orchestration body stays flat.
+    return emitScanCompletion({
+        cli,
+        tool,
+        opts: input.opts,
+        envelope,
+        signalCount: signals.length,
+        deliver,
+        completion,
+    });
+}
+//# sourceMappingURL=run-loop.js.map

package/dist/run-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-loop.js","sourceRoot":"","sources":["../src/run-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAezF,6DAA6D;AAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,sCAAsC;AACtC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,WAAW,GAAG,IAAI,CAAC;AAsBzB,MAAM,YAAY,GAAiB;IACjC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,YAAY,EAAE,kBAAkB;IAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI;IACvC,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,kBAAkB;CAC9B,CAAC;AAaF,MAAM,YAAY,GAA0D;IAC1E,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAAY,EAAE,IAA2C;IACpF,OAAO,GAAG,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,SAAS,oBAAoB,CAC3B,MAAyC,EACzC,IAAY;IAEZ,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CACnB,OAA4B,EAC5B,GAAW,EACX,GAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,WAAW,CAAC,MAAM,CAAC,KAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,OAAO,GAAwB;QACnC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;QACzB,GAAG;QACH,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IACF,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAWD;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAkB;IAC1D,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;IAC/F,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACnF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/F,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAmB,EACnB,OAA4B,EAC5B,GAAsB,EACtB,IAAc;IAEd,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;QACpC,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,UAAU;QAC5D,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,IAAY,EACZ,OAA4B,EAC5B,IAAgB,EAChB,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GACV,IAAI,CAAC,aAAa,KAAK,UAAU;QAC/B,CAAC,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,UAAU;QACjD,CAAC,CAAC,UAAU,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAClD,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,uBAAuB,OAAO,CAAC,MAAM,CAAC,IAAI,YAAY,MAAM,IAAI,EACvE,0BAA0B,EAC1B,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAoB,EACpB,SAAiC;IAEjC,MAAM,IAAI,GAAiB,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE7C,+EAA+E;IAC/E,4EAA4E;IAC5E,iFAAiF;IACjF,wCAAwC;IACxC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,2BAA2B;YAChC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,0BAA0B;SACnC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC;YACtB,OAAO,EAAE,+DAA+D;YACxE,QAAQ,EAAE,UAAU,CAAC,mBAAmB;YACxC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI;SACxC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAsC,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,aAAa,CAC9B;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC;QAClD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;KAC1B,EACD,IAAI,CAAC,UAAU,CAChB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAC1B,GAAG,IAAI,KAAK,UAAU,CAAC,MAAM,kBAAkB,IAAI,0BAA0B,EAC7E,EAAE,IAAI,EAAE,0BAA0B,EAAE,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAChC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG;QACH,IAAI;QACJ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAExD,0EAA0E;IAC1E,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,GAAG,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAE9C,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAElD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,yBAAyB;QAC9B,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,OAAO,EAAE,OAAO,IAAI,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;QACjC,OAAO,EAAE,UAAU,CAAC,IAAI;QACxB,IAAI;QACJ,GAAG,EAAE,GAAG,CAAC,WAAW;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAEtE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,yBAAyB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YACjF,IAAI,EAAE,sBAAsB;YAC5B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE;QAC3C,CAAC,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE;QAChF,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE;YAC3F,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,oFAAoF;IACpF,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,YAAY,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE;SACtD,CAAC,CAAC;QACH,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,oFAAoF;IACpF,MAAM,GAAG,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,yBAAyB;QAC9B,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,GAAG,CAAC,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAsB;QACpC,IAAI;QACJ,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU,CAAC,IAAI;QAC3B,aAAa,EAAE,OAAO;QACtB,IAAI;QACJ,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;IACF,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACnC,IAAI;QACJ,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;QAC/F,OAAO;QACP,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,KAAK;QACjB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5D,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ;QACR,OAAO;QACP,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE;QACpF,QAAQ,EAAE,gBAAgB;QAC1B,UAAU;KACX,CAAC,CAAC;IAEH,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,OAAO;QACP,UAAU;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/scan-emit.d.ts

@@ -0,0 +1,81 @@
+/**
+ * @fileoverview Scan-result emission + the gate-ratchet decision (ADR-0036).
+ *
+ * Split from {@link ./run-loop} (the IO orchestration: resolve → exec → parse →
+ * envelope) so the "what to emit + which gate branch" decision is a small,
+ * directly-testable unit and the loop body stays a flat pipeline. Every effect
+ * here is a documented `ToolCliContext` seam — for an INSTALLED adapter these run
+ * worker-side and replay through the host (FRR for `render`/`emitEnvelope`; host
+ * RPC for `saveBaseline`/`compareBaseline`/`deliverSignals`).
+ */
+import type { BinaryResolutionLayer } from './types.js';
+import type { SignalEnvelope } from '@opensip-cli/contracts';
+import type { Signal, ToolCliContext } from '@opensip-cli/core';
+/** What the host persists + dispatches after a scan (the run loop's return shape). */
+export interface ScanCompletion {
+    readonly envelope: SignalEnvelope;
+    readonly session: {
+        readonly tool: string;
+        readonly cwd: string;
+        readonly score: number;
+        readonly passed: boolean;
+        readonly payload: Record<string, unknown>;
+    };
+}
+/** The `deliverSignals` options bag (cwd + optional egress targets). */
+export interface DeliverOpts {
+    readonly cwd: string;
+    readonly reportTo?: string;
+    readonly apiKey?: string;
+}
+/** Build the `deliverSignals` options bag from the parsed flags (cwd + optional egress). */
+export declare function deliverOptions(opts: Record<string, unknown>, fallbackCwd: string): DeliverOpts;
+/** Inputs the run loop hands {@link buildScanCompletion} to shape the session row. */
+export interface ScanCompletionInput {
+    readonly tool: string;
+    readonly cwd: string;
+    readonly envelope: SignalEnvelope;
+    readonly signals: readonly Signal[];
+    readonly binary: {
+        readonly path: string;
+        readonly layer: BinaryResolutionLayer;
+        readonly version: string | null;
+    };
+    readonly artifact: string;
+    readonly durationMs: number;
+}
+/**
+ * Shape the {@link ScanCompletion} the host persists/dispatches. The session
+ * payload carries the dashboard-shaped grouped detail (`__version`/`summary`/
+ * `checks[]` from {@link buildAdapterSessionPayload}) so the HTML report renders
+ * the scan's findings instead of falsely "clean" — plus the operational
+ * provenance the row also keeps (binary/artifact/findings/durationMs). Built from
+ * the already-redacted signals, so no raw secret reaches the persisted row.
+ */
+export declare function buildScanCompletion(input: ScanCompletionInput): ScanCompletion;
+export interface EmitScanCompletionInput {
+    readonly cli: ToolCliContext;
+    readonly tool: string;
+    readonly opts: Record<string, unknown>;
+    readonly envelope: SignalEnvelope;
+    readonly signalCount: number;
+    readonly deliver: DeliverOpts;
+    readonly completion: ScanCompletion;
+}
+/**
+ * Emit the scan result, deliver its signals, and return the completion. Branches:
+ *
+ *   - `--gate-save` (ADR-0020/0035): record the baseline via the host seam, render
+ *     `gate-done`, and deliver WITHOUT a runFailed override so the host derives the
+ *     findings exit from the verdict.
+ *   - `--gate-compare` (ADR-0035/0036): diff against the saved baseline, render the
+ *     diff, and pass `degraded && failOnDegraded` as the host runFailed override
+ *     (the findings verdict does NOT gate here — only NET-NEW findings fail).
+ *   - normal: emit the envelope (`--json`) or a human summary, deliver without an
+ *     override.
+ *
+ * Both gate paths still RETURN the session contribution, so a gate run persists a
+ * session alongside a normal scan.
+ */
+export declare function emitScanCompletion(input: EmitScanCompletionInput): Promise<ScanCompletion>;
+//# sourceMappingURL=scan-emit.d.ts.map

package/dist/scan-emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-emit.d.ts","sourceRoot":"","sources":["../src/scan-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKhE,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC3C,CAAC;CACH;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,WAAW,CAM9F;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAiB9E;AAiCD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;CACrC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuChG"}

package/dist/scan-emit.js

@@ -0,0 +1,125 @@
+/**
+ * @fileoverview Scan-result emission + the gate-ratchet decision (ADR-0036).
+ *
+ * Split from {@link ./run-loop} (the IO orchestration: resolve → exec → parse →
+ * envelope) so the "what to emit + which gate branch" decision is a small,
+ * directly-testable unit and the loop body stays a flat pipeline. Every effect
+ * here is a documented `ToolCliContext` seam — for an INSTALLED adapter these run
+ * worker-side and replay through the host (FRR for `render`/`emitEnvelope`; host
+ * RPC for `saveBaseline`/`compareBaseline`/`deliverSignals`).
+ */
+import { resolveFailOnDegraded } from '@opensip-cli/core';
+import { renderGateCompareLines, renderGateSaveLines } from './gate-render.js';
+import { buildAdapterSessionPayload } from './session-payload.js';
+/** Logger `module` field for every event this module emits. */
+const MODULE = 'external-tool-adapter';
+/** Build the `deliverSignals` options bag from the parsed flags (cwd + optional egress). */
+export function deliverOptions(opts, fallbackCwd) {
+    return {
+        cwd: typeof opts.cwd === 'string' ? opts.cwd : fallbackCwd,
+        ...(typeof opts.reportTo === 'string' ? { reportTo: opts.reportTo } : {}),
+        ...(typeof opts.apiKey === 'string' ? { apiKey: opts.apiKey } : {}),
+    };
+}
+/**
+ * Shape the {@link ScanCompletion} the host persists/dispatches. The session
+ * payload carries the dashboard-shaped grouped detail (`__version`/`summary`/
+ * `checks[]` from {@link buildAdapterSessionPayload}) so the HTML report renders
+ * the scan's findings instead of falsely "clean" — plus the operational
+ * provenance the row also keeps (binary/artifact/findings/durationMs). Built from
+ * the already-redacted signals, so no raw secret reaches the persisted row.
+ */
+export function buildScanCompletion(input) {
+    return {
+        envelope: input.envelope,
+        session: {
+            tool: input.tool,
+            cwd: input.cwd,
+            score: input.envelope.verdict.score,
+            passed: input.envelope.verdict.passed,
+            payload: {
+                ...buildAdapterSessionPayload(input.signals),
+                binary: input.binary,
+                artifact: input.artifact,
+                findings: input.signals.length,
+                durationMs: input.durationMs,
+            },
+        },
+    };
+}
+/** The human (non-`--json`) one-line scan summary. */
+function summaryLines(tool, signalCount, score, passed) {
+    return [
+        `${tool}: ${String(signalCount)} finding(s)`,
+        `verdict: ${passed ? 'PASS' : 'FAIL'} (score ${score.toFixed(2)})`,
+    ];
+}
+/** One `adapter.scan.completed` log line, with the optional gate-mode annotations. */
+function logCompleted(input) {
+    const { cli, tool, signalCount, passed, gate, degraded } = input;
+    cli.logger.info({
+        evt: 'adapter.scan.completed',
+        module: MODULE,
+        tool,
+        findings: signalCount,
+        passed,
+        ...(gate === undefined ? {} : { gate }),
+        ...(degraded === undefined ? {} : { degraded }),
+    });
+}
+/**
+ * Emit the scan result, deliver its signals, and return the completion. Branches:
+ *
+ *   - `--gate-save` (ADR-0020/0035): record the baseline via the host seam, render
+ *     `gate-done`, and deliver WITHOUT a runFailed override so the host derives the
+ *     findings exit from the verdict.
+ *   - `--gate-compare` (ADR-0035/0036): diff against the saved baseline, render the
+ *     diff, and pass `degraded && failOnDegraded` as the host runFailed override
+ *     (the findings verdict does NOT gate here — only NET-NEW findings fail).
+ *   - normal: emit the envelope (`--json`) or a human summary, deliver without an
+ *     override.
+ *
+ * Both gate paths still RETURN the session contribution, so a gate run persists a
+ * session alongside a normal scan.
+ */
+export async function emitScanCompletion(input) {
+    const { cli, tool, opts, envelope, signalCount, deliver, completion } = input;
+    if (opts.gateSave === true) {
+        await cli.saveBaseline(tool, envelope);
+        await cli.render({ type: 'gate-done', lines: renderGateSaveLines(tool, signalCount) });
+        await cli.deliverSignals(envelope, deliver);
+        logCompleted({ cli, tool, signalCount, passed: envelope.verdict.passed, gate: 'save' });
+        return completion;
+    }
+    if (opts.gateCompare === true) {
+        const result = await cli.compareBaseline(tool, envelope);
+        await cli.render({ type: 'gate-done', lines: renderGateCompareLines(tool, result) });
+        await cli.deliverSignals(envelope, {
+            ...deliver,
+            runFailed: result.degraded && resolveFailOnDegraded(tool),
+        });
+        logCompleted({
+            cli,
+            tool,
+            signalCount,
+            passed: envelope.verdict.passed,
+            gate: 'compare',
+            degraded: result.degraded,
+        });
+        return completion;
+    }
+    if (opts.json === true) {
+        cli.emitEnvelope(envelope);
+    }
+    else {
+        await cli.render({
+            type: 'text-lines',
+            title: `${tool} scan`,
+            lines: summaryLines(tool, signalCount, envelope.verdict.score, envelope.verdict.passed),
+        });
+    }
+    await cli.deliverSignals(envelope, deliver);
+    logCompleted({ cli, tool, signalCount, passed: envelope.verdict.passed });
+    return completion;
+}
+//# sourceMappingURL=scan-emit.js.map

package/dist/scan-emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-emit.js","sourceRoot":"","sources":["../src/scan-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAMlE,+DAA+D;AAC/D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAqBvC,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAA6B,EAAE,WAAmB;IAC/E,OAAO;QACL,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW;QAC1D,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC5D,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;YACnC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;YACrC,OAAO,EAAE;gBACP,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B;SACF;KACF,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,SAAS,YAAY,CAAC,IAAY,EAAE,WAAmB,EAAE,KAAa,EAAE,MAAe;IACrF,OAAO;QACL,GAAG,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,aAAa;QAC5C,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;KACnE,CAAC;AACJ,CAAC;AAWD,sFAAsF;AACtF,SAAS,YAAY,CAAC,KAAwB;IAC5C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACjE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACd,GAAG,EAAE,wBAAwB;QAC7B,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,QAAQ,EAAE,WAAW;QACrB,MAAM;QACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC9E,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE;YACjC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC;SAC1D,CAAC,CAAC;QACH,YAAY,CAAC;YACX,GAAG;YACH,IAAI;YACJ,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/B,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,GAAG,IAAI,OAAO;YACrB,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;SACxF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}