@ophan/core 0.0.2 → 0.0.4

package/dist/parsers/python.js

@@ -65,6 +65,28 @@ for node in ast.walk(tree):
     for child in ast.iter_child_nodes(node):
         child._parent = node
 
+# Extract file-level imports
+file_imports = []
+for node in ast.iter_child_nodes(tree):
+    if isinstance(node, ast.Import):
+        for alias in node.names:
+            file_imports.append({"module": alias.name, "names": [alias.asname or alias.name]})
+    elif isinstance(node, ast.ImportFrom):
+        module = node.module or ""
+        names = [alias.name for alias in node.names]
+        file_imports.append({"module": module, "names": names})
+
+# Extract call names from a function body
+# Only direct function calls (ast.Name), not method calls (ast.Attribute)
+# Method calls like obj.method() produce false matches against library APIs
+def get_calls(func_node):
+    calls = set()
+    for node in ast.walk(func_node):
+        if isinstance(node, ast.Call):
+            if isinstance(node.func, ast.Name):
+                calls.add(node.func.id)
+    return sorted(calls)
+
 functions = []
 lines = source.split('\\n')
 
@@ -76,15 +98,20 @@ for node in ast.walk(tree):
         parent = getattr(node, '_parent', None)
         entity_type = "method" if isinstance(parent, ast.ClassDef) else "function"
 
+        # Module-level functions (not nested in class or other function) are "exported"
+        exported = isinstance(parent, ast.Module)
+
         functions.append({
             "name": node.name,
             "startLine": node.lineno,
             "endLine": end_line,
             "sourceCode": source_code,
-            "entityType": entity_type
+            "entityType": entity_type,
+            "calls": get_calls(node),
+            "exported": exported
         })
 
-json.dump(functions, sys.stdout)
+json.dump({"functions": functions, "imports": file_imports}, sys.stdout)
 `;
 let pythonAvailable = null;
 function isPythonAvailable() {
@@ -116,8 +143,12 @@ class PythonParser {
                 encoding: "utf-8",
                 timeout: 10000, // 10s timeout per file
             });
-            const raw = JSON.parse(output);
-            return raw.map((fn) => ({
+            const result = JSON.parse(output);
+            const fileImports = result.imports.map((imp) => ({
+                module: imp.module,
+                names: imp.names,
+            }));
+            return result.functions.map((fn) => ({
                 name: fn.name,
                 filePath,
                 startLine: fn.startLine,
@@ -126,6 +157,9 @@ class PythonParser {
                 contentHash: (0, shared_1.computeHash)(fn.sourceCode),
                 language: "python",
                 entityType: fn.entityType,
+                calls: fn.calls,
+                imports: fileImports,
+                exported: fn.exported,
             }));
         }
         catch (err) {

package/dist/parsers/typescript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typescript.d.ts","sourceRoot":"","sources":["../../src/parsers/typescript.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAa9C,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,UAAU,WAAkC;IAErD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;CAyDnD"}
+{"version":3,"file":"typescript.d.ts","sourceRoot":"","sources":["../../src/parsers/typescript.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,WAAW,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAa9C,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,UAAU,WAAkC;IAErD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;CAiEnD"}

package/dist/parsers/typescript.js

@@ -67,6 +67,8 @@ class TypeScriptParser {
         const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true);
         const language = detectLanguage(filePath);
         const functions = [];
+        // Collect file-level imports (shared across all functions in this file)
+        const fileImports = extractImports(sourceFile);
         function visit(node) {
             if (ts.isFunctionDeclaration(node) ||
                 ts.isMethodDeclaration(node) ||
@@ -78,6 +80,7 @@ class TypeScriptParser {
                 const start = sourceFile.getLineAndCharacterOfPosition(node.getStart());
                 const end = sourceFile.getLineAndCharacterOfPosition(node.getEnd());
                 const sourceCode = node.getText(sourceFile);
+                const { calls, jsxRefs } = extractCallExpressions(node, sourceFile);
                 functions.push({
                     name,
                     filePath,
@@ -87,6 +90,10 @@ class TypeScriptParser {
                     contentHash: (0, shared_1.computeHash)(sourceCode),
                     language,
                     entityType: detectEntityType(node),
+                    calls,
+                    jsxRefs: jsxRefs.length > 0 ? jsxRefs : undefined,
+                    imports: fileImports,
+                    exported: isExported(node),
                 });
             }
             ts.forEachChild(node, visit);
@@ -108,3 +115,129 @@ class TypeScriptParser {
     }
 }
 exports.TypeScriptParser = TypeScriptParser;
+// ============ RELATIONSHIP EXTRACTION ============
+/**
+ * Extract call expression names and JSX component references from inside a function body.
+ * Returns separate arrays: `calls` for direct function calls (strong signal) and
+ * `jsxRefs` for JSX component references (weaker signal — UI composition, not domain logic).
+ */
+function extractCallExpressions(node, sourceFile) {
+    const calls = new Set();
+    const jsxRefs = new Set();
+    function walkCalls(n) {
+        if (ts.isCallExpression(n)) {
+            const name = getCallName(n.expression, sourceFile);
+            if (name)
+                calls.add(name);
+        }
+        // JSX elements: <Foo /> treated as a component reference (separate from calls)
+        if (ts.isJsxOpeningElement(n) || ts.isJsxSelfClosingElement(n)) {
+            const tagName = n.tagName;
+            if (ts.isIdentifier(tagName)) {
+                const name = tagName.getText(sourceFile);
+                // Only PascalCase (React components), not HTML elements (div, span)
+                if (name[0] === name[0].toUpperCase() && name[0] !== name[0].toLowerCase()) {
+                    jsxRefs.add(name);
+                }
+            }
+        }
+        ts.forEachChild(n, walkCalls);
+    }
+    // Walk the function body (not the signature)
+    const body = getFunctionBody(node);
+    if (body)
+        walkCalls(body);
+    return { calls: [...calls], jsxRefs: [...jsxRefs] };
+}
+function getCallName(expr, sourceFile) {
+    // Direct call: foo()
+    if (ts.isIdentifier(expr)) {
+        return expr.getText(sourceFile);
+    }
+    // Method calls (obj.method()) are excluded — they typically reference
+    // library APIs (db.prepare, res.json, arr.map) and produce false matches.
+    // Intra-project method calls are captured by co-location and import edges instead.
+    return null;
+}
+function getFunctionBody(node) {
+    if (ts.isFunctionDeclaration(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isFunctionExpression(node)) {
+        return node.body || null;
+    }
+    if (ts.isArrowFunction(node)) {
+        return node.body;
+    }
+    return null;
+}
+/**
+ * Extract import declarations from the top level of a source file.
+ */
+function extractImports(sourceFile) {
+    const imports = [];
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt))
+            continue;
+        const moduleSpec = stmt.moduleSpecifier;
+        if (!ts.isStringLiteral(moduleSpec))
+            continue;
+        const module = moduleSpec.text;
+        const names = [];
+        const clause = stmt.importClause;
+        if (clause) {
+            // Skip entire type-only imports: import type { X } from "..."
+            if (clause.isTypeOnly)
+                continue;
+            // Default import: import Foo from "..."
+            if (clause.name) {
+                names.push(clause.name.getText(sourceFile));
+            }
+            // Named imports: import { a, b } from "..."
+            if (clause.namedBindings) {
+                if (ts.isNamedImports(clause.namedBindings)) {
+                    for (const el of clause.namedBindings.elements) {
+                        // Skip individual type-only specifiers: import { type X, Y } from "..."
+                        if (el.isTypeOnly)
+                            continue;
+                        names.push(el.name.getText(sourceFile));
+                    }
+                }
+                // Namespace import: import * as ns from "..."
+                if (ts.isNamespaceImport(clause.namedBindings)) {
+                    names.push(clause.namedBindings.name.getText(sourceFile));
+                }
+            }
+        }
+        imports.push({ module, names });
+    }
+    return imports;
+}
+/**
+ * Check if a function/variable declaration has the `export` modifier.
+ */
+function isExported(node) {
+    // Function declarations: check modifiers directly
+    if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) {
+        return hasExportModifier(node);
+    }
+    // Arrow functions / function expressions: check parent variable statement
+    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+        const parent = node.parent; // VariableDeclaration
+        if (parent && ts.isVariableDeclaration(parent)) {
+            const declList = parent.parent; // VariableDeclarationList
+            if (declList && ts.isVariableDeclarationList(declList)) {
+                const varStmt = declList.parent; // VariableStatement
+                if (varStmt && ts.isVariableStatement(varStmt)) {
+                    return hasExportModifier(varStmt);
+                }
+            }
+        }
+    }
+    return false;
+}
+function hasExportModifier(node) {
+    const modifiers = ts.canHaveModifiers(node) ? ts.getModifiers(node) : undefined;
+    if (!modifiers)
+        return false;
+    return modifiers.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+}

package/dist/practices.d.ts

@@ -0,0 +1,28 @@
+import type Database from "better-sqlite3";
+import { MAX_PRACTICES, MAX_RULE_LENGTH } from "./schemas";
+export interface Practice {
+    id: string;
+    rule: string;
+    severity: "error" | "warning" | "info";
+}
+export { MAX_PRACTICES, MAX_RULE_LENGTH };
+/**
+ * Load practices from the local SQLite practices table.
+ * Returns [] if table is empty or doesn't exist.
+ */
+export declare function loadPracticesFromDb(db: Database.Database): Practice[];
+/**
+ * Import practices from Supabase into the local SQLite practices table.
+ * Replaces all existing practices (full sync).
+ */
+export declare function importPractices(db: Database.Database, practices: Practice[]): void;
+/**
+ * Validate practices array. Enforces limits and format.
+ * Returns the validated (possibly truncated) array.
+ */
+export declare function validatePractices(practices: Practice[]): Practice[];
+/**
+ * Build the prompt section for practices. Returns empty string if no practices.
+ */
+export declare function buildPracticesPrompt(practices: Practice[]): string;
+//# sourceMappingURL=practices.d.ts.map

package/dist/practices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"practices.d.ts","sourceRoot":"","sources":["../src/practices.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACxC;AAED,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAI1C;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAcrE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAWN;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CA2BnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAoBlE"}

package/dist/practices.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RULE_LENGTH = exports.MAX_PRACTICES = void 0;
+exports.loadPracticesFromDb = loadPracticesFromDb;
+exports.importPractices = importPractices;
+exports.validatePractices = validatePractices;
+exports.buildPracticesPrompt = buildPracticesPrompt;
+const schemas_1 = require("./schemas");
+Object.defineProperty(exports, "MAX_PRACTICES", { enumerable: true, get: function () { return schemas_1.MAX_PRACTICES; } });
+Object.defineProperty(exports, "MAX_RULE_LENGTH", { enumerable: true, get: function () { return schemas_1.MAX_RULE_LENGTH; } });
+const ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+/**
+ * Load practices from the local SQLite practices table.
+ * Returns [] if table is empty or doesn't exist.
+ */
+function loadPracticesFromDb(db) {
+    try {
+        const rows = db
+            .prepare("SELECT practice_id, rule, severity FROM practices")
+            .all();
+        return rows.map((r) => ({
+            id: r.practice_id,
+            rule: r.rule,
+            severity: r.severity,
+        }));
+    }
+    catch {
+        // Table doesn't exist yet (old DB without initDb migration)
+        return [];
+    }
+}
+/**
+ * Import practices from Supabase into the local SQLite practices table.
+ * Replaces all existing practices (full sync).
+ */
+function importPractices(db, practices) {
+    const validated = validatePractices(practices);
+    db.transaction(() => {
+        db.prepare("DELETE FROM practices").run();
+        const insert = db.prepare("INSERT INTO practices (practice_id, rule, severity) VALUES (?, ?, ?)");
+        for (const p of validated) {
+            insert.run(p.id, p.rule, p.severity);
+        }
+    })();
+}
+/**
+ * Validate practices array. Enforces limits and format.
+ * Returns the validated (possibly truncated) array.
+ */
+function validatePractices(practices) {
+    if (!Array.isArray(practices))
+        return [];
+    const capped = practices.slice(0, schemas_1.MAX_PRACTICES);
+    return capped.map((p, i) => {
+        if (!p.id || typeof p.id !== "string") {
+            throw new Error(`Practice at index ${i} has invalid id: ${JSON.stringify(p.id)}`);
+        }
+        if (!ID_PATTERN.test(p.id)) {
+            throw new Error(`Practice id "${p.id}" must be kebab-case (lowercase letters, numbers, hyphens)`);
+        }
+        if (!p.rule || typeof p.rule !== "string") {
+            throw new Error(`Practice "${p.id}" has invalid rule`);
+        }
+        const severity = p.severity ?? "warning";
+        if (!["error", "warning", "info"].includes(severity)) {
+            throw new Error(`Practice "${p.id}" has invalid severity: ${severity}`);
+        }
+        return {
+            id: p.id,
+            rule: p.rule.slice(0, schemas_1.MAX_RULE_LENGTH),
+            severity: severity,
+        };
+    });
+}
+/**
+ * Build the prompt section for practices. Returns empty string if no practices.
+ */
+function buildPracticesPrompt(practices) {
+    if (practices.length === 0)
+        return "";
+    const lines = practices.map((p) => `- ${p.id} [${p.severity}]: ${p.rule}`);
+    return `
+Also check for violations of these coding practices:
+${lines.join("\n")}
+
+For each violation found, add an entry to practiceViolations (empty array if none), each with:
+  - flag: the practice id from the list above
+  - title: short one-line title
+  - description: what's wrong (1-2 sentences)
+  - explanation: how to fix (2-4 sentences)
+  - line: the line number (read the label, don't count)
+  - startText: first ~30 characters of the problematic code on that line
+  - endText: last ~20 characters of the problematic code on that line
+  - severity: use the severity shown in brackets above`;
+}

package/dist/schemas.d.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 export declare const AnalysisType: z.ZodEnum<{
     documentation: "documentation";
     security: "security";
+    practices: "practices";
 }>;
 export type AnalysisType = z.infer<typeof AnalysisType>;
 export declare const KNOWN_DATA_TAGS: readonly ["user_input", "pii", "credentials", "database", "external_api", "file_system", "config", "internal"];
@@ -34,15 +35,87 @@ export declare const DocumentationAnalysis: z.ZodObject<{
 }, z.core.$strip>;
 export type DocumentationAnalysis = z.infer<typeof DocumentationAnalysis>;
 /**
- * Security analysis: data flow tags and security vulnerability flags.
- * Both fields use z.string() arrays (not enums) — open with known values.
- * Unknown values from Claude are preserved, not rejected.
+ * A rich security or practice issue with location, description, and fix guidance.
+ * Every field uses .catch() so malformed Claude responses degrade gracefully.
+ * The `line` field is 1-indexed within the function (from line-numbered prompt context).
+ * `startText`/`endText` are anchor snippets for character-level precision.
+ */
+export declare const DetailedIssue: z.ZodObject<{
+    flag: z.ZodString;
+    title: z.ZodCatch<z.ZodString>;
+    description: z.ZodCatch<z.ZodString>;
+    explanation: z.ZodCatch<z.ZodString>;
+    line: z.ZodCatch<z.ZodNumber>;
+    startText: z.ZodCatch<z.ZodString>;
+    endText: z.ZodCatch<z.ZodString>;
+    severity: z.ZodCatch<z.ZodEnum<{
+        error: "error";
+        warning: "warning";
+        info: "info";
+    }>>;
+    confidence: z.ZodCatch<z.ZodEnum<{
+        high: "high";
+        medium: "medium";
+        low: "low";
+    }>>;
+    lineText: z.ZodCatch<z.ZodString>;
+}, z.core.$strip>;
+export type DetailedIssue = z.infer<typeof DetailedIssue>;
+/**
+ * Security analysis: data flow tags, vulnerability flags, and detailed issues.
+ * `securityFlags` is kept as a lightweight summary (for CodeLens icons, filtering, badge counts).
+ * `issues` provides rich details (title, description, explanation, line location).
+ * `issues` uses .catch([]) so v1 rows (without issues) parse successfully.
  */
 export declare const SecurityAnalysis: z.ZodObject<{
     dataTags: z.ZodArray<z.ZodString>;
     securityFlags: z.ZodArray<z.ZodString>;
+    issues: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        flag: z.ZodString;
+        title: z.ZodCatch<z.ZodString>;
+        description: z.ZodCatch<z.ZodString>;
+        explanation: z.ZodCatch<z.ZodString>;
+        line: z.ZodCatch<z.ZodNumber>;
+        startText: z.ZodCatch<z.ZodString>;
+        endText: z.ZodCatch<z.ZodString>;
+        severity: z.ZodCatch<z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+        }>>;
+        confidence: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+        lineText: z.ZodCatch<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type SecurityAnalysis = z.infer<typeof SecurityAnalysis>;
+/** Practices analysis: violations of team-defined coding practices. */
+export declare const PracticesAnalysis: z.ZodObject<{
+    violations: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        flag: z.ZodString;
+        title: z.ZodCatch<z.ZodString>;
+        description: z.ZodCatch<z.ZodString>;
+        explanation: z.ZodCatch<z.ZodString>;
+        line: z.ZodCatch<z.ZodNumber>;
+        startText: z.ZodCatch<z.ZodString>;
+        endText: z.ZodCatch<z.ZodString>;
+        severity: z.ZodCatch<z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+        }>>;
+        confidence: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+        lineText: z.ZodCatch<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type PracticesAnalysis = z.infer<typeof PracticesAnalysis>;
 export declare const TypedAnalysis: z.ZodDiscriminatedUnion<[z.ZodObject<{
     analysisType: z.ZodLiteral<"documentation">;
     data: z.ZodObject<{
@@ -62,6 +135,50 @@ export declare const TypedAnalysis: z.ZodDiscriminatedUnion<[z.ZodObject<{
     data: z.ZodObject<{
         dataTags: z.ZodArray<z.ZodString>;
         securityFlags: z.ZodArray<z.ZodString>;
+        issues: z.ZodCatch<z.ZodArray<z.ZodObject<{
+            flag: z.ZodString;
+            title: z.ZodCatch<z.ZodString>;
+            description: z.ZodCatch<z.ZodString>;
+            explanation: z.ZodCatch<z.ZodString>;
+            line: z.ZodCatch<z.ZodNumber>;
+            startText: z.ZodCatch<z.ZodString>;
+            endText: z.ZodCatch<z.ZodString>;
+            severity: z.ZodCatch<z.ZodEnum<{
+                error: "error";
+                warning: "warning";
+                info: "info";
+            }>>;
+            confidence: z.ZodCatch<z.ZodEnum<{
+                high: "high";
+                medium: "medium";
+                low: "low";
+            }>>;
+            lineText: z.ZodCatch<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    analysisType: z.ZodLiteral<"practices">;
+    data: z.ZodObject<{
+        violations: z.ZodCatch<z.ZodArray<z.ZodObject<{
+            flag: z.ZodString;
+            title: z.ZodCatch<z.ZodString>;
+            description: z.ZodCatch<z.ZodString>;
+            explanation: z.ZodCatch<z.ZodString>;
+            line: z.ZodCatch<z.ZodNumber>;
+            startText: z.ZodCatch<z.ZodString>;
+            endText: z.ZodCatch<z.ZodString>;
+            severity: z.ZodCatch<z.ZodEnum<{
+                error: "error";
+                warning: "warning";
+                info: "info";
+            }>>;
+            confidence: z.ZodCatch<z.ZodEnum<{
+                high: "high";
+                medium: "medium";
+                low: "low";
+            }>>;
+            lineText: z.ZodCatch<z.ZodString>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>;
 }, z.core.$strip>], "analysisType">;
 export type TypedAnalysis = z.infer<typeof TypedAnalysis>;
@@ -87,14 +204,145 @@ export declare const ClaudeAnalysisResponse: z.ZodObject<{
     }, z.core.$strip>>;
     dataTags: z.ZodCatch<z.ZodArray<z.ZodString>>;
     securityFlags: z.ZodCatch<z.ZodArray<z.ZodString>>;
+    issues: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        flag: z.ZodString;
+        title: z.ZodCatch<z.ZodString>;
+        description: z.ZodCatch<z.ZodString>;
+        explanation: z.ZodCatch<z.ZodString>;
+        line: z.ZodCatch<z.ZodNumber>;
+        startText: z.ZodCatch<z.ZodString>;
+        endText: z.ZodCatch<z.ZodString>;
+        severity: z.ZodCatch<z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+        }>>;
+        confidence: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+        lineText: z.ZodCatch<z.ZodString>;
+    }, z.core.$strip>>>;
+    practiceViolations: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        flag: z.ZodString;
+        title: z.ZodCatch<z.ZodString>;
+        description: z.ZodCatch<z.ZodString>;
+        explanation: z.ZodCatch<z.ZodString>;
+        line: z.ZodCatch<z.ZodNumber>;
+        startText: z.ZodCatch<z.ZodString>;
+        endText: z.ZodCatch<z.ZodString>;
+        severity: z.ZodCatch<z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+        }>>;
+        confidence: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+        lineText: z.ZodCatch<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type ClaudeAnalysisResponse = z.infer<typeof ClaudeAnalysisResponse>;
+export declare const SummaryMeta: z.ZodObject<{
+    securityPosture: z.ZodCatch<z.ZodString>;
+    dataClassification: z.ZodCatch<z.ZodArray<z.ZodString>>;
+    boundaries: z.ZodCatch<z.ZodArray<z.ZodString>>;
+    keyFunctions: z.ZodCatch<z.ZodArray<z.ZodString>>;
+    complexity: z.ZodCatch<z.ZodEnum<{
+        high: "high";
+        medium: "medium";
+        low: "low";
+    }>>;
+}, z.core.$strip>;
+export type SummaryMeta = z.infer<typeof SummaryMeta>;
+/** L1 subsystem summary: docs for a group of closely-related functions */
+export declare const L1Summary: z.ZodObject<{
+    title: z.ZodCatch<z.ZodString>;
+    documentation: z.ZodCatch<z.ZodString>;
+    meta: z.ZodCatch<z.ZodObject<{
+        securityPosture: z.ZodCatch<z.ZodString>;
+        dataClassification: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        boundaries: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        keyFunctions: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        complexity: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type L1Summary = z.infer<typeof L1Summary>;
+/** L2 system summary: docs for a group of L1 subsystems */
+export declare const L2Summary: z.ZodObject<{
+    title: z.ZodCatch<z.ZodString>;
+    documentation: z.ZodCatch<z.ZodString>;
+    meta: z.ZodCatch<z.ZodObject<{
+        securityPosture: z.ZodCatch<z.ZodString>;
+        dataClassification: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        boundaries: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        keyFunctions: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        complexity: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type L2Summary = z.infer<typeof L2Summary>;
+/** L3 architecture overview: top-level docs from L2 summaries */
+export declare const L3Summary: z.ZodObject<{
+    title: z.ZodCatch<z.ZodString>;
+    documentation: z.ZodCatch<z.ZodString>;
+    meta: z.ZodCatch<z.ZodObject<{
+        securityPosture: z.ZodCatch<z.ZodString>;
+        dataClassification: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        boundaries: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        keyFunctions: z.ZodCatch<z.ZodArray<z.ZodString>>;
+        complexity: z.ZodCatch<z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type L3Summary = z.infer<typeof L3Summary>;
+/** Cross-cutting concern summary: docs for a data flow or security pattern spanning communities */
+export declare const CrossCuttingConcernSummary: z.ZodObject<{
+    title: z.ZodCatch<z.ZodString>;
+    concernType: z.ZodCatch<z.ZodString>;
+    tag: z.ZodCatch<z.ZodString>;
+    documentation: z.ZodCatch<z.ZodString>;
+    bridgeFunctions: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        functionName: z.ZodString;
+        contentHash: z.ZodString;
+        communityId: z.ZodString;
+        centrality: z.ZodNumber;
+    }, z.core.$strip>>>;
+    affectedCommunities: z.ZodCatch<z.ZodArray<z.ZodObject<{
+        communityId: z.ZodString;
+        communityTitle: z.ZodString;
+    }, z.core.$strip>>>;
+    severity: z.ZodCatch<z.ZodString>;
+}, z.core.$strip>;
+export type CrossCuttingConcernSummary = z.infer<typeof CrossCuttingConcernSummary>;
 /**
  * Each analysis type has an independent schema version.
  * Bump when the JSON shape changes. Old rows remain readable.
  * Stored alongside each row for forward-compatibility.
  */
 export declare const SCHEMA_VERSIONS: Record<AnalysisType, number>;
+export declare const MAX_PRACTICES = 10;
+export declare const MAX_RULE_LENGTH = 200;
 export declare const SECURITY_FLAG_LABELS: Record<string, string>;
+export interface SecurityFlagMeta {
+    tier: 1 | 2 | 3 | 4;
+    cwe: string;
+    owasp: string;
+}
+export declare const SECURITY_FLAG_META: Record<string, SecurityFlagMeta>;
+export declare const SECURITY_TIER_LABELS: Record<number, string>;
 export declare const DATA_TAG_LABELS: Record<string, string>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,YAAY;;;EAAwC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAaxD,eAAO,MAAM,eAAe,gHASlB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB,wMAWvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAItE,eAAO,MAAM,WAAW;;;;iBAItB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;mCASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAOjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAI5E;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAGxD,CAAC;AAQF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAWvD,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CASlD,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,YAAY;;;;EAAqD,CAAC;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAaxD,eAAO,MAAM,eAAe,gHASlB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,oBAAoB,wMAWvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAItE,eAAO,MAAM,WAAW;;;;iBAItB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;iBAWxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;iBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAaxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBASjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAW5E,eAAO,MAAM,WAAW;;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAUtD,0EAA0E;AAC1E,eAAO,MAAM,SAAS;;;;;;;;;;;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,2DAA2D;AAC3D,eAAO,MAAM,SAAS;;;;;;;;;;;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,iEAAiE;AACjE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AASlD,mGAAmG;AACnG,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;iBAgBrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAIpF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIxD,CAAC;AAIF,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,eAAe,MAAM,CAAC;AAQnC,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAWvD,CAAC;AAaF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAW/D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKvD,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CASlD,CAAC"}