@opensip-cli/tool-trivy 0.1.15

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+OpenSIP CLI
+Copyright 2026 opensip-ai
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this software except in compliance with the License. A copy of the License is
+included in the LICENSE file and is also available at:
+
+    http://www.apache.org/licenses/LICENSE-2.0

package/README.md

@@ -0,0 +1,33 @@
+<!-- Generated by scripts/build-package-readmes.mjs — do not edit by hand.
+     Change the package's "description" (or the generator template) and run
+     `pnpm docs:readmes`. CI enforces sync via `pnpm docs:readmes:check`. -->
+
+# @opensip-cli/tool-trivy
+
+> External Tool Adapter for Trivy — wraps the trivy vulnerability + misconfiguration scanner as an opensip-cli tool (opensip trivy)
+
+This package is the **engine** behind a first-party `opensip-cli` tool. The CLI bundles it — you do not normally install it directly.
+
+Part of [**opensip-cli**](https://github.com/opensip-ai/opensip-cli) — an open-source codebase intelligence CLI: fitness checks (`fit`), static call-graph analysis (`graph`), simulation (`sim`), and advisory reduction audits (`yagni`).
+
+**Distribution model:** the published `opensip-cli` npm package is a full-stack bundle of first-party tools, check packs, and language adapters. Third-party tools install separately via the `opensipTools` manifest and host allowlist; a slim install without bundled tools is not a current goal.
+
+## Install
+
+Most users install the CLI, which bundles the first-party tools:
+
+```bash
+curl -fsSL https://opensip.ai/cli/install.sh | bash
+```
+
+This package is published for the CLI and advanced plugin authors; most users should not install `@opensip-cli/tool-trivy` directly.
+
+## Documentation
+
+- 📚 Project docs: https://opensip.ai/docs/opensip-cli/
+- 🧭 Package catalog (what every package does): https://github.com/opensip-ai/opensip-cli/blob/v0.1.15/docs/public/70-reference/02-package-catalog.md
+- 📦 Source: https://github.com/opensip-ai/opensip-cli/tree/v0.1.15/packages/tool-trivy
+
+## License
+
+Apache-2.0 © opensip-ai

package/dist/__tests__/tool.test.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Tier-1 (in-process) tests for the trivy adapter `Tool` (ADR-0090 D6 Tier 1).
+ *
+ * Trivy is the SARIF adapter — the FIRST real consumer of the substrate's shared
+ * `ingestSarif`. So beyond the declarative surface (commandSpecs / identity /
+ * metadata), the binary helpers, the FROZEN exit model (Phase-0 decision 4: NO
+ * findings code; any nonzero is a fault), and the manifest↔runtime host-shape
+ * guards, this suite proves the SARIF READ PATH end-to-end — especially the CVSS
+ * `security-severity` SEVERITY RECOVERY:
+ *
+ *   - a result with `level:"error"` + `security-severity:"9.8"` normalizes to
+ *     `critical` (NOT `high` — the writer collapses critical+high → `error`, so a
+ *     level-only inverse is ambiguous and the CVSS number is what disambiguates);
+ *   - a result with `level:"error"` + `security-severity:"7.5"` → `high`;
+ *   - a result with NO `security-severity` falls back to the `level` band
+ *     (`warning` → `medium`).
+ */
+export {};
+//# sourceMappingURL=tool.test.d.ts.map

package/dist/__tests__/tool.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tool.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/__tests__/tool.test.js

@@ -0,0 +1,234 @@
+/**
+ * Tier-1 (in-process) tests for the trivy adapter `Tool` (ADR-0090 D6 Tier 1).
+ *
+ * Trivy is the SARIF adapter — the FIRST real consumer of the substrate's shared
+ * `ingestSarif`. So beyond the declarative surface (commandSpecs / identity /
+ * metadata), the binary helpers, the FROZEN exit model (Phase-0 decision 4: NO
+ * findings code; any nonzero is a fault), and the manifest↔runtime host-shape
+ * guards, this suite proves the SARIF READ PATH end-to-end — especially the CVSS
+ * `security-severity` SEVERITY RECOVERY:
+ *
+ *   - a result with `level:"error"` + `security-severity:"9.8"` normalizes to
+ *     `critical` (NOT `high` — the writer collapses critical+high → `error`, so a
+ *     level-only inverse is ambiguous and the CVSS number is what disambiguates);
+ *   - a result with `level:"error"` + `security-severity:"7.5"` → `high`;
+ *   - a result with NO `security-severity` falls back to the `level` band
+ *     (`warning` → `medium`).
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { assertManifestMatchesTool } from '@opensip-cli/core';
+import { DEFAULT_EXIT_MODEL, deriveAdapterConfigManifest, deriveAdapterManifestCommands, deriveAdapterManifestRequires, ingestSarif, interpretExit, normalizedSignalShape, runAcceptanceCase, sarifLevelToSeverity, } from '@opensip-cli/external-tool-adapter';
+import { describe, expect, it } from 'vitest';
+import { buildScanArgs, buildTrivyExclude, parseTrivyVersion, tool, TRIVY_STABLE_ID, } from '../tool.js';
+const PKG = JSON.parse(readFileSync(fileURLToPath(new URL('../../package.json', import.meta.url)), 'utf8'));
+const GOLDEN_RAW = readFileSync(fileURLToPath(new URL('../../__fixtures__/trivy-golden.sarif', import.meta.url)), 'utf8');
+const EXPECTED = JSON.parse(readFileSync(fileURLToPath(new URL('../../__fixtures__/expected-signals.json', import.meta.url)), 'utf8'));
+/** Reconstruct the admitted `ToolPluginManifest` the host builds from package.json. */
+function manifestFromPackage() {
+    return {
+        ...PKG.opensipTools,
+        name: PKG.name,
+        version: PKG.version,
+        apiVersion: PKG.opensipTools.apiVersion,
+    };
+}
+describe('trivy tool — identity + metadata', () => {
+    it('declares the trivy identity with NO aliases', () => {
+        expect(tool.identity).toEqual({ name: 'trivy' });
+    });
+    it('carries the stable UUID and a description', () => {
+        expect(tool.metadata.id).toBe(TRIVY_STABLE_ID);
+        expect(tool.metadata.name).toBe('trivy');
+        expect(tool.metadata.description).toBe('Vulnerability + misconfig scanning via Trivy');
+    });
+    it('defaults to the line-shift-tolerant message-hash fingerprint strategy', () => {
+        expect(tool.extensionPoints?.fingerprintStrategy?.id).toBe('external-tool-adapter.sha256-file-rule-message');
+    });
+});
+const byName = (name) => tool.commandSpecs?.find((c) => c.name === name);
+describe('trivy tool — commandSpecs', () => {
+    it('mounts the primary scan, plus nested doctor + version', () => {
+        const names = (tool.commandSpecs ?? []).map((c) => c.name);
+        expect(names).toEqual(['trivy', 'doctor', 'version']);
+    });
+    it('the primary command is `trivy` (no aliases), project-scoped, raw-stream dispatch', () => {
+        const primary = byName('trivy');
+        expect(primary?.parent).toBeUndefined();
+        expect(primary?.aliases).toEqual([]);
+        expect(primary?.scope).toBe('project');
+        expect(primary?.output).toBe('raw-stream');
+        expect(primary?.rawStreamReason).toBe('runtime-render-dispatch');
+    });
+    it('doctor + version are nested under trivy, scope:none, diagnostic-gate', () => {
+        for (const name of ['doctor', 'version']) {
+            const spec = byName(name);
+            expect(spec?.parent).toBe('trivy');
+            expect(spec?.scope).toBe('none');
+            expect(spec?.output).toBe('raw-stream');
+            expect(spec?.rawStreamReason).toBe('diagnostic-gate');
+        }
+    });
+});
+describe('trivy tool — binary helpers', () => {
+    it('parses the trivy version stdout (banner, bare semver, or leading v)', () => {
+        expect(parseTrivyVersion('Version: 0.50.1\nVulnerability DB:\n  Version: 2')).toBe('0.50.1');
+        expect(parseTrivyVersion('0.49.0\n')).toBe('0.49.0');
+        expect(parseTrivyVersion('v0.51.2')).toBe('0.51.2');
+    });
+    it('falls back to the trimmed stdout when no semver is present', () => {
+        expect(parseTrivyVersion('  unknown  ')).toBe('unknown');
+    });
+    it('builds the filesystem-scan argv with the local-only flags, writing SARIF to the run artifact path', () => {
+        const ctx = {
+            projectRoot: '/proj',
+            artifactPath: (name) => `/proj/.runtime/artifacts/trivy/run1/${name}`,
+        };
+        expect(buildScanArgs(ctx)).toEqual([
+            'fs',
+            '--scanners',
+            'vuln,secret,misconfig',
+            '--format',
+            'sarif',
+            '--output',
+            '/proj/.runtime/artifacts/trivy/run1/trivy.sarif',
+            '--skip-db-update',
+            '--skip-java-db-update',
+            '--offline-scan',
+            '--skip-check-update',
+            '/proj',
+        ]);
+    });
+    it('A8: requests the misconfig scanner (offline) so the advertised Dockerfile findings are actually produced', () => {
+        // `trivy fs` defaults to `vuln,secret` only — without `--scanners …,misconfig`
+        // a real run emits ZERO misconfig results while metadata/docs/the DS002 golden
+        // all advertise misconfig. The companion `--skip-check-update` keeps the
+        // misconfig checks-bundle fetch offline.
+        const ctx = {
+            projectRoot: '/proj',
+            artifactPath: (name) => `/proj/.runtime/artifacts/trivy/run1/${name}`,
+        };
+        const args = buildScanArgs(ctx);
+        const i = args.indexOf('--scanners');
+        expect(i).toBeGreaterThanOrEqual(0);
+        expect(args[i + 1]?.split(',')).toContain('misconfig');
+        expect(args).toContain('--skip-check-update');
+    });
+});
+describe('trivy tool — A3 .runtime exclusion (buildTrivyExclude)', () => {
+    it('skips the opensip artifact store via --skip-dirs', () => {
+        expect(buildTrivyExclude({ excludePath: '/proj/opensip-cli/.runtime' }).args).toEqual([
+            '--skip-dirs',
+            '/proj/opensip-cli/.runtime',
+        ]);
+    });
+});
+describe('trivy tool — exit model (Phase-0 decision 4)', () => {
+    // Frozen Trivy model: Trivy exits 0 even WITH findings (no `--exit-code`), so
+    // there is NO findings code — findings are derived from the parsed SARIF and ANY
+    // nonzero exit is a genuine fault.
+    const model = { ok: [0], findings: [], errorFrom: 1 };
+    it('exit 0 ⇒ clean (findings, if any, come from the SARIF — not the exit code)', () => {
+        expect(interpretExit(0, model)).toBe('ok');
+    });
+    it('exit 1 ⇒ fault, EVEN with a valid artifact (no findings code to absorb it)', () => {
+        expect(interpretExit(1, model, { artifactValid: true })).toBe('fault');
+    });
+    it('exit 2 ⇒ fault', () => {
+        expect(interpretExit(2, model)).toBe('fault');
+    });
+    it('diverges from the substrate default by dropping the findings code', () => {
+        expect(model).not.toEqual(DEFAULT_EXIT_MODEL);
+        expect(model.findings).toEqual([]);
+        expect(model.ok).toEqual([0]);
+    });
+});
+describe('trivy tool — manifest ↔ runtime host-shape guards', () => {
+    it('the package.json manifest matches the runtime tool (no drift)', () => {
+        expect(() => {
+            assertManifestMatchesTool(manifestFromPackage(), tool);
+        }).not.toThrow();
+    });
+    it('the generated manifest commands equal the derived runtime command shells', () => {
+        // The package.json `commands` are written by the shared manifest generator
+        // (which OMITS an empty `aliases`); the substrate's `deriveAdapterManifestCommands`
+        // always emits `aliases: []`. Canonicalize that one representational difference
+        // (`aliases ?? []`) before comparing the substantive shells.
+        const canon = (c) => ({
+            ...c,
+            aliases: c.aliases ?? [],
+        });
+        const generated = PKG.opensipTools.commands.map(canon);
+        const derived = deriveAdapterManifestCommands(tool).map((c) => canon(c));
+        expect(generated).toEqual(derived);
+    });
+    it('the generated manifest requires equal the posture-derived requires (no drift)', () => {
+        // A13: `requires` is DERIVED from the network posture, not hand-typed.
+        expect(PKG.opensipTools.requires).toEqual(deriveAdapterManifestRequires(tool));
+    });
+    it('derives subprocess + filesystem only (local-only posture, no network)', () => {
+        expect(PKG.opensipTools.requires.map((r) => r.resource)).toEqual([
+            'subprocess',
+            'filesystem',
+        ]);
+    });
+    it('the generated manifest config descriptor equals the derived namespace claim (A4)', () => {
+        const derived = deriveAdapterConfigManifest(tool);
+        expect(derived?.namespace).toBe('trivy');
+        expect(PKG.opensipTools.config).toEqual(derived);
+    });
+});
+describe('trivy tool — shared ingestSarif (normalize → envelope)', () => {
+    const result = runAcceptanceCase({
+        tool: 'trivy',
+        kind: 'sarif',
+        raw: GOLDEN_RAW,
+        fingerprintStrategy: 'message-hash',
+    });
+    it('produces the golden normalized signals via the shared SARIF read path', () => {
+        expect(result.signals.map(normalizedSignalShape)).toEqual(EXPECTED);
+    });
+    it('builds an envelope whose verdict FAILS (critical + high are error-rung)', () => {
+        expect(result.envelope.tool).toBe('trivy');
+        expect(result.envelope.verdict.passed).toBe(false);
+    });
+    it('stamps a message-hash fingerprint on every envelope signal worker-side', () => {
+        expect(result.envelope.signals).toHaveLength(3);
+        for (const s of result.envelope.signals) {
+            expect(s.fingerprint).toMatch(/^[0-9a-f]{64}$/);
+        }
+    });
+});
+describe('trivy tool — SARIF severity recovery (the ingest core job, ADR-0091 D2)', () => {
+    const signals = ingestSarif(JSON.parse(GOLDEN_RAW), { source: 'trivy' });
+    const byRule = (id) => signals.find((s) => s.ruleId === id);
+    it('recovers `critical` from CVSS 9.8 even though `level:"error"` alone maps to `high`', () => {
+        // The load-bearing proof: the SARIF `level` is lossy (critical AND high → error),
+        // so a level-only inverse can never reach critical.
+        expect(sarifLevelToSeverity('error')).toBe('high');
+        const certifi = byRule('CVE-2023-37920');
+        expect(certifi?.severity).toBe('critical');
+        expect(certifi?.metadata.securitySeverity).toBe('9.8');
+        expect(certifi?.metadata.nativeLevel).toBe('error');
+    });
+    it('recovers `high` from CVSS 7.5 (a second `level:"error"` result, distinct band)', () => {
+        const setuptools = byRule('CVE-2022-40897');
+        expect(setuptools?.severity).toBe('high');
+        expect(setuptools?.metadata.securitySeverity).toBe('7.5');
+        expect(setuptools?.metadata.nativeLevel).toBe('error');
+    });
+    it('falls back to the `level` band when a rule has NO security-severity (warning → medium)', () => {
+        const misconfig = byRule('DS002');
+        expect(misconfig?.severity).toBe('medium');
+        // No CVSS number was present → no securitySeverity recovered; the native level
+        // is preserved for provenance.
+        expect(misconfig?.metadata.securitySeverity).toBeUndefined();
+        expect(misconfig?.metadata.nativeLevel).toBe('warning');
+    });
+    it('anchors each finding at its lockfile/Dockerfile location (startLine 1)', () => {
+        expect(byRule('CVE-2023-37920')?.filePath).toBe('requirements.txt');
+        expect(byRule('CVE-2023-37920')?.line).toBe(1);
+        expect(byRule('DS002')?.filePath).toBe('Dockerfile');
+    });
+});
+//# sourceMappingURL=tool.test.js.map

package/dist/__tests__/tool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.test.js","sourceRoot":"","sources":["../../src/__tests__/tool.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,EAC7B,6BAA6B,EAC7B,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,IAAI,EACJ,eAAe,GAChB,MAAM,YAAY,CAAC;AASpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CACR,CAAC;AAE9E,MAAM,UAAU,GAAG,YAAY,CAC7B,aAAa,CAAC,IAAI,GAAG,CAAC,uCAAuC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAChF,MAAM,CACP,CAAC;AACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CACV,aAAa,CAAC,IAAI,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnF,MAAM,CACP,CACW,CAAC;AAEf,uFAAuF;AACvF,SAAS,mBAAmB;IAC1B,OAAO;QACL,GAAI,GAAG,CAAC,YAAuB;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,UAAoB;KAC5B,CAAC;AAC1B,CAAC;AAED,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,IAAI,CACxD,gDAAgD,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAEjF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,iBAAiB,CAAC,kDAAkD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7F,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,GAAG,EAAE;QAC3G,MAAM,GAAG,GAAG;YACV,WAAW,EAAE,OAAO;YACpB,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,uCAAuC,IAAI,EAAE;SAC9C,CAAC;QAClC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,IAAI;YACJ,YAAY;YACZ,uBAAuB;YACvB,UAAU;YACV,OAAO;YACP,UAAU;YACV,iDAAiD;YACjD,kBAAkB;YAClB,uBAAuB;YACvB,gBAAgB;YAChB,qBAAqB;YACrB,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0GAA0G,EAAE,GAAG,EAAE;QAClH,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,yCAAyC;QACzC,MAAM,GAAG,GAAG;YACV,WAAW,EAAE,OAAO;YACpB,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,uCAAuC,IAAI,EAAE;SAC9C,CAAC;QAClC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YACpF,aAAa;YACb,4BAA4B;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,8EAA8E;IAC9E,iFAAiF;IACjF,mCAAmC;IACnC,MAAM,KAAK,GAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAExE,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,EAAE;YACV,yBAAyB,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,2EAA2E;QAC3E,oFAAoF;QACpF,gFAAgF;QAChF,6DAA6D;QAC7D,MAAM,KAAK,GAAG,CAAC,CAA0B,EAA2B,EAAE,CAAC,CAAC;YACtE,GAAG,CAAC;YACJ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,SAAS,GAAI,GAAG,CAAC,YAAY,CAAC,QAAsC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,KAAK,CAAC,CAAuC,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,uEAAuE;QACvE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAE,GAAG,CAAC,YAAY,CAAC,QAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3F,YAAY;YACZ,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,UAAU;QACf,mBAAmB,EAAE,cAAc;KACpC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAEpE,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,kFAAkF;QAClF,oDAAoD;QACpD,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,+EAA+E;QAC/E,+BAA+B;QAC/B,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/worker-e2e.test.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Tier-2 worker E2E (ADR-0090 D6 Tier 2) — install / discover / dispatch the trivy
+ * adapter over a REAL forked worker, end-to-end against the BUILT CLI.
+ *
+ * Trivy is the SARIF adapter, so this also proves the shared `ingestSarif` read
+ * path through the FULL installed-tool dispatch:
+ *   - the trivy package is presented as a genuinely INSTALLED npm tool in a
+ *     throwaway project (symlinked into its `node_modules` so the worker resolves
+ *     the adapter's workspace deps from the monorepo via realpath);
+ *   - `OPENSIP_CLI_ALLOW_INSTALLED_TOOLS` trusts it (installed tools are
+ *     deny-by-default);
+ *   - a FAKE `trivy` binary on PATH makes the run deterministic: it copies the
+ *     committed golden SARIF to `--output` and exits 0 — Trivy exits 0 EVEN WITH
+ *     findings, so the CLI's nonzero exit comes from the findings DERIVED FROM THE
+ *     PARSED SARIF, not from the process exit (the Trivy exit-model proof). The
+ *     worker fork curates its env to an allow-list, so the golden path is forwarded
+ *     via the documented `OPENSIP_CLI_TOOL_ENV_PASSTHROUGH`.
+ *
+ * `opensip trivy` forks a worker that re-discovers + imports the real runtime and
+ * runs the scan loop; this suite asserts the worker→host result + host-side
+ * effects: normalized signals match the golden (with the RECOVERED severities —
+ * `critical` from CVSS 9.8, not `high` from `level:"error"`), the raw SARIF
+ * artifact lands at `.runtime/artifacts/trivy/<runId>/trivy.sarif` with mode 0600,
+ * the `--json` envelope is well-formed, the session row persists with provenance,
+ * and the full gate ratchet (gate-save → clean compare → net-new vuln surfaces)
+ * works.
+ *
+ * Requires `pnpm build` first (the CLI dist + the trivy dist). Missing builds FAIL
+ * loudly (no silent skip).
+ */
+export {};
+//# sourceMappingURL=worker-e2e.test.d.ts.map

package/dist/__tests__/worker-e2e.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-e2e.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/worker-e2e.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}