@owasp-aghast/aghast 0.8.0-beta.0

package/dist/response-parser.js

@@ -0,0 +1,111 @@
+/**
+ * Response parser.
+ * Parses the raw text body of an agent provider's response into
+ * CheckResponse format (spec Appendix A.3b). Handles malformed JSON,
+ * missing fields, and edge cases.
+ */
+import { logDebug } from './logging.js';
+const TAG = 'parser';
+/**
+ * Attempt to parse the raw text body of an agent provider's response
+ * into a CheckResponse. Returns undefined if the response is not valid
+ * JSON or lacks the expected structure.
+ */
+export function parseAgentResponse(raw) {
+    logDebug(TAG, `Parsing response: ${raw.length} chars`);
+    const tryParse = (text) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    // 1) Direct parse
+    let parsed = tryParse(raw);
+    // 2) If that fails, look for a fenced code block (```json ... ```)
+    if (parsed === undefined) {
+        const fence = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
+        if (fence?.[1]) {
+            logDebug(TAG, 'Trying fenced code block extraction');
+            parsed = tryParse(fence[1]);
+        }
+    }
+    // 3) If still failing, grab the first balanced-looking JSON object
+    if (parsed === undefined) {
+        const firstBrace = raw.indexOf('{');
+        const lastBrace = raw.lastIndexOf('}');
+        if (firstBrace !== -1 && lastBrace !== -1 && lastBrace > firstBrace) {
+            logDebug(TAG, 'Trying brace extraction');
+            const slice = raw.slice(firstBrace, lastBrace + 1);
+            parsed = tryParse(slice);
+        }
+    }
+    if (parsed === undefined) {
+        logDebug(TAG, 'All parse strategies failed');
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return undefined;
+    }
+    const obj = parsed;
+    if (!Array.isArray(obj.issues)) {
+        logDebug(TAG, `Missing issues array, keys: ${Object.keys(obj).join(', ')}`);
+        return undefined;
+    }
+    const issues = [];
+    for (const item of obj.issues) {
+        if (typeof item !== 'object' || item === null) {
+            continue;
+        }
+        const issue = item;
+        // Required fields: file, description, startLine, endLine (per spec A.3)
+        if (typeof issue.file !== 'string' || typeof issue.description !== 'string') {
+            continue;
+        }
+        // Line numbers are required - skip issues without valid line numbers
+        if (typeof issue.startLine !== 'number' || typeof issue.endLine !== 'number') {
+            logDebug(TAG, `Skipping issue missing required line numbers: ${issue.file}`);
+            continue;
+        }
+        const aiIssue = {
+            file: issue.file,
+            startLine: issue.startLine,
+            endLine: issue.endLine,
+            description: issue.description,
+        };
+        // Parse optional dataFlow array
+        if (Array.isArray(issue.dataFlow)) {
+            const validSteps = [];
+            for (const step of issue.dataFlow) {
+                if (typeof step === 'object' && step !== null &&
+                    typeof step.file === 'string' &&
+                    typeof step.lineNumber === 'number' &&
+                    typeof step.label === 'string') {
+                    validSteps.push({
+                        file: step.file,
+                        lineNumber: step.lineNumber,
+                        label: step.label,
+                    });
+                }
+            }
+            if (validSteps.length > 0) {
+                aiIssue.dataFlow = validSteps;
+            }
+        }
+        issues.push(aiIssue);
+    }
+    logDebug(TAG, `Parsed ${issues.length} issues`);
+    const response = { issues };
+    if (obj.flagged === true) {
+        response.flagged = true;
+    }
+    if (typeof obj.summary === 'string') {
+        response.summary = obj.summary;
+    }
+    if (typeof obj.analysisNotes === 'string') {
+        response.analysisNotes = obj.analysisNotes;
+    }
+    return response;
+}
+//# sourceMappingURL=response-parser.js.map

package/dist/response-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-parser.js","sourceRoot":"","sources":["../src/response-parser.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,MAAM,GAAG,GAAG,QAAQ,CAAC;AAErB;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,QAAQ,CAAC,GAAG,EAAE,qBAAqB,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE;QACzC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,kBAAkB;IAClB,IAAI,MAAM,GAAY,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEpC,mEAAmE;IACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACrD,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,wEAAwE;QACxE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7E,QAAQ,CAAC,GAAG,EAAE,iDAAiD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAY;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QAEF,gCAAgC;QAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,GAAmB,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClC,IACE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBACzC,OAAQ,IAAgC,CAAC,IAAI,KAAK,QAAQ;oBAC1D,OAAQ,IAAgC,CAAC,UAAU,KAAK,QAAQ;oBAChE,OAAQ,IAAgC,CAAC,KAAK,KAAK,QAAQ,EAC3D,CAAC;oBACD,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAG,IAAgC,CAAC,IAAc;wBACtD,UAAU,EAAG,IAAgC,CAAC,UAAoB;wBAClE,KAAK,EAAG,IAAgC,CAAC,KAAe;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAkB,EAAE,MAAM,EAAE,CAAC;IAE3C,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC1C,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/runtime-config.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Runtime configuration loader.
+ * Loads runtime-config.json from the config directory to override agent provider and reporting settings.
+ * Spec Section 8.1 & Appendix C.10.
+ */
+import type { RuntimeConfig } from './types.js';
+/**
+ * Load runtime configuration from file.
+ * @param configDir - Directory containing runtime-config.json. Optional when explicitPath is given.
+ * @param explicitPath - Explicit path to the runtime config file (from --runtime-config CLI flag).
+ * @returns Parsed RuntimeConfig object, or empty object if file absent
+ * @throws Error if file exists but contains invalid JSON, or if neither argument resolves a path
+ */
+export declare function loadRuntimeConfig(configDir?: string, explicitPath?: string): Promise<RuntimeConfig>;
+//# sourceMappingURL=runtime-config.d.ts.map

package/dist/runtime-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-config.d.ts","sourceRoot":"","sources":["../src/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+KzG"}

package/dist/runtime-config.js

@@ -0,0 +1,187 @@
+/**
+ * Runtime configuration loader.
+ * Loads runtime-config.json from the config directory to override agent provider and reporting settings.
+ * Spec Section 8.1 & Appendix C.10.
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+/**
+ * Load runtime configuration from file.
+ * @param configDir - Directory containing runtime-config.json. Optional when explicitPath is given.
+ * @param explicitPath - Explicit path to the runtime config file (from --runtime-config CLI flag).
+ * @returns Parsed RuntimeConfig object, or empty object if file absent
+ * @throws Error if file exists but contains invalid JSON, or if neither argument resolves a path
+ */
+export async function loadRuntimeConfig(configDir, explicitPath) {
+    if (!explicitPath && !configDir) {
+        throw new Error('loadRuntimeConfig: one of configDir or explicitPath is required');
+    }
+    const pathToLoad = explicitPath ?? resolve(configDir, 'runtime-config.json');
+    let content;
+    try {
+        content = await readFile(pathToLoad, 'utf-8');
+    }
+    catch (err) {
+        // File absent: silently return defaults
+        if (err.code === 'ENOENT') {
+            return {};
+        }
+        throw err;
+    }
+    // File exists but may have invalid JSON
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw new Error(`Invalid JSON in runtime config file: ${pathToLoad}`);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`Runtime config file "${pathToLoad}" must contain a JSON object`);
+    }
+    // Validate field types
+    const obj = parsed;
+    if (obj.aiProvider !== undefined) {
+        throw new Error(`Runtime config "${pathToLoad}": "aiProvider" has been renamed to "agentProvider" in 0.5.0. ` +
+            `Update your runtime-config.json to use the new key.`);
+    }
+    if (obj.agentProvider !== undefined) {
+        if (typeof obj.agentProvider !== 'object' || obj.agentProvider === null || Array.isArray(obj.agentProvider)) {
+            throw new Error(`Runtime config "${pathToLoad}": "agentProvider" must be an object`);
+        }
+        const ap = obj.agentProvider;
+        if (ap.name !== undefined && typeof ap.name !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "agentProvider.name" must be a string`);
+        }
+        if (ap.model !== undefined && typeof ap.model !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "agentProvider.model" must be a string`);
+        }
+    }
+    if (obj.reporting !== undefined) {
+        if (typeof obj.reporting !== 'object' || obj.reporting === null || Array.isArray(obj.reporting)) {
+            throw new Error(`Runtime config "${pathToLoad}": "reporting" must be an object`);
+        }
+        const rpt = obj.reporting;
+        if (rpt.outputDirectory !== undefined && typeof rpt.outputDirectory !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "reporting.outputDirectory" must be a string`);
+        }
+        if (rpt.outputFormat !== undefined && typeof rpt.outputFormat !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "reporting.outputFormat" must be a string`);
+        }
+    }
+    if (obj.genericPrompt !== undefined && typeof obj.genericPrompt !== 'string') {
+        throw new Error(`Runtime config "${pathToLoad}": "genericPrompt" must be a string`);
+    }
+    if (obj.failOnCheckFailure !== undefined && typeof obj.failOnCheckFailure !== 'boolean') {
+        throw new Error(`Runtime config "${pathToLoad}": "failOnCheckFailure" must be a boolean`);
+    }
+    if (obj.budget !== undefined) {
+        if (typeof obj.budget !== 'object' || obj.budget === null || Array.isArray(obj.budget)) {
+            throw new Error(`Runtime config "${pathToLoad}": "budget" must be an object`);
+        }
+        const budget = obj.budget;
+        if (budget.perScan !== undefined) {
+            if (typeof budget.perScan !== 'object' || budget.perScan === null || Array.isArray(budget.perScan)) {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.perScan" must be an object`);
+            }
+            const ps = budget.perScan;
+            if (ps.maxTokens !== undefined) {
+                if (typeof ps.maxTokens !== 'number' || !Number.isFinite(ps.maxTokens) || ps.maxTokens < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "budget.perScan.maxTokens" must be a non-negative number`);
+                }
+            }
+            if (ps.maxCostUsd !== undefined) {
+                if (typeof ps.maxCostUsd !== 'number' || !Number.isFinite(ps.maxCostUsd) || ps.maxCostUsd < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "budget.perScan.maxCostUsd" must be a non-negative number`);
+                }
+            }
+        }
+        if (budget.perPeriod !== undefined) {
+            if (typeof budget.perPeriod !== 'object' || budget.perPeriod === null || Array.isArray(budget.perPeriod)) {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.perPeriod" must be an object`);
+            }
+            const pp = budget.perPeriod;
+            if (pp.window !== undefined && pp.window !== 'day' && pp.window !== 'week' && pp.window !== 'month') {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.perPeriod.window" must be "day", "week", or "month"`);
+            }
+            if (pp.maxCostUsd !== undefined) {
+                if (typeof pp.maxCostUsd !== 'number' || !Number.isFinite(pp.maxCostUsd) || pp.maxCostUsd < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "budget.perPeriod.maxCostUsd" must be a non-negative number`);
+                }
+            }
+            // perPeriod requires both window and maxCostUsd to be functional. Reject
+            // partial config so misconfiguration is loud, not silently dropped at
+            // runtime. (The dual-undefined case is naturally caught by either
+            // single-field check below — they fire in source order, the window check
+            // wins. No separate guard needed.)
+            if (pp.window === undefined) {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.perPeriod.window" is required when "budget.perPeriod" is set (must be "day", "week", or "month")`);
+            }
+            if (pp.maxCostUsd === undefined) {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.perPeriod.maxCostUsd" is required when "budget.perPeriod" is set`);
+            }
+        }
+        if (budget.thresholds !== undefined) {
+            if (typeof budget.thresholds !== 'object' || budget.thresholds === null || Array.isArray(budget.thresholds)) {
+                throw new Error(`Runtime config "${pathToLoad}": "budget.thresholds" must be an object`);
+            }
+            const th = budget.thresholds;
+            if (th.warnAt !== undefined) {
+                if (typeof th.warnAt !== 'number' || !Number.isFinite(th.warnAt) || th.warnAt < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "budget.thresholds.warnAt" must be a non-negative number`);
+                }
+            }
+            if (th.abortAt !== undefined) {
+                if (typeof th.abortAt !== 'number' || !Number.isFinite(th.abortAt) || th.abortAt < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "budget.thresholds.abortAt" must be a non-negative number`);
+                }
+            }
+        }
+    }
+    if (obj.pricing !== undefined) {
+        if (typeof obj.pricing !== 'object' || obj.pricing === null || Array.isArray(obj.pricing)) {
+            throw new Error(`Runtime config "${pathToLoad}": "pricing" must be an object`);
+        }
+        const pricing = obj.pricing;
+        if (pricing.currency !== undefined && typeof pricing.currency !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "pricing.currency" must be a string`);
+        }
+        if (pricing.models !== undefined) {
+            if (typeof pricing.models !== 'object' || pricing.models === null || Array.isArray(pricing.models)) {
+                throw new Error(`Runtime config "${pathToLoad}": "pricing.models" must be an object`);
+            }
+            for (const [modelName, def] of Object.entries(pricing.models)) {
+                if (!def || typeof def !== 'object' || Array.isArray(def)) {
+                    throw new Error(`Runtime config "${pathToLoad}": "pricing.models.${modelName}" must be an object`);
+                }
+                const d = def;
+                if (typeof d.inputPerMillion !== 'number' || typeof d.outputPerMillion !== 'number') {
+                    throw new Error(`Runtime config "${pathToLoad}": "pricing.models.${modelName}" must have numeric "inputPerMillion" and "outputPerMillion"`);
+                }
+                if (!Number.isFinite(d.inputPerMillion) || d.inputPerMillion < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "pricing.models.${modelName}.inputPerMillion" must be a non-negative number`);
+                }
+                if (!Number.isFinite(d.outputPerMillion) || d.outputPerMillion < 0) {
+                    throw new Error(`Runtime config "${pathToLoad}": "pricing.models.${modelName}.outputPerMillion" must be a non-negative number`);
+                }
+            }
+        }
+    }
+    if (obj.logging !== undefined) {
+        if (typeof obj.logging !== 'object' || obj.logging === null || Array.isArray(obj.logging)) {
+            throw new Error(`Runtime config "${pathToLoad}": "logging" must be an object`);
+        }
+        const log = obj.logging;
+        if (log.logFile !== undefined && typeof log.logFile !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "logging.logFile" must be a string`);
+        }
+        if (log.logType !== undefined && typeof log.logType !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "logging.logType" must be a string`);
+        }
+        if (log.level !== undefined && typeof log.level !== 'string') {
+            throw new Error(`Runtime config "${pathToLoad}": "logging.level" must be a string`);
+        }
+    }
+    return parsed;
+}
+//# sourceMappingURL=runtime-config.js.map

package/dist/runtime-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-config.js","sourceRoot":"","sources":["../src/runtime-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAkB,EAAE,YAAqB;IAC/E,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,IAAI,OAAO,CAAC,SAAU,EAAE,qBAAqB,CAAC,CAAC;IAC9E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,wCAAwC;QACxC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,wCAAwC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,8BAA8B,CAAC,CAAC;IACpF,CAAC;IAED,uBAAuB;IACvB,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,mBAAmB,UAAU,gEAAgE;YAC3F,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,sCAAsC,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,aAAwC,CAAC;QACxD,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,0CAA0C,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,2CAA2C,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,kCAAkC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAoC,CAAC;QACrD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,iDAAiD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,8CAA8C,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,qCAAqC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,+BAA+B,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,uCAAuC,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAkC,CAAC;YACrD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;oBAC3F,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,6DAA6D,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;oBAC9F,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,8DAA8D,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzG,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,yCAAyC,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAoC,CAAC;YACvD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACpG,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,gEAAgE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;oBAC9F,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,gEAAgE,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,kEAAkE;YAClE,yEAAyE;YACzE,mCAAmC;YACnC,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,6GAA6G,CAAC,CAAC;YAC9J,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,6EAA6E,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5G,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,0CAA0C,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAqC,CAAC;YACxD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,6DAA6D,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;YACD,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;oBACrF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,8DAA8D,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkC,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,uCAAuC,CAAC,CAAC;YACxF,CAAC;YACD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,sBAAsB,SAAS,qBAAqB,CAAC,CAAC;gBACrG,CAAC;gBACD,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,sBAAsB,SAAS,8DAA8D,CAAC,CAAC;gBAC9I,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,sBAAsB,SAAS,iDAAiD,CAAC,CAAC;gBACjI,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,sBAAsB,SAAS,kDAAkD,CAAC,CAAC;gBAClI,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAkC,CAAC;QACnD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,uCAAuC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,uCAAuC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,qCAAqC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,OAAO,MAAuB,CAAC;AACjC,CAAC"}

package/dist/sarif-parser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SARIF 2.1.0 parser for Semgrep output.
+ * Extracts CheckTarget[] from SARIF results.
+ */
+import type { CheckTarget } from './types.js';
+/**
+ * Parse SARIF 2.1.0 JSON content into CheckTarget[].
+ * Skips results with missing location fields.
+ * Throws on invalid JSON or missing SARIF structure.
+ */
+export declare function parseSARIF(sarifContent: string): CheckTarget[];
+/**
+ * Deduplicate targets by file:startLine:endLine key.
+ */
+export declare function deduplicateTargets(targets: CheckTarget[]): CheckTarget[];
+/**
+ * Limit the number of targets to a maximum.
+ */
+export declare function limitTargets(targets: CheckTarget[], maxTargets: number): CheckTarget[];
+//# sourceMappingURL=sarif-parser.d.ts.map

package/dist/sarif-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-parser.d.ts","sourceRoot":"","sources":["../src/sarif-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyB9C;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAsD9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAaxE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,EAAE,CAEtF"}

package/dist/sarif-parser.js

@@ -0,0 +1,76 @@
+/**
+ * SARIF 2.1.0 parser for Semgrep output.
+ * Extracts CheckTarget[] from SARIF results.
+ */
+/**
+ * Parse SARIF 2.1.0 JSON content into CheckTarget[].
+ * Skips results with missing location fields.
+ * Throws on invalid JSON or missing SARIF structure.
+ */
+export function parseSARIF(sarifContent) {
+    let doc;
+    try {
+        doc = JSON.parse(sarifContent);
+    }
+    catch {
+        throw new Error('Invalid SARIF: malformed JSON');
+    }
+    if (!doc.runs || !Array.isArray(doc.runs)) {
+        throw new Error('Invalid SARIF: missing "runs" array');
+    }
+    const targets = [];
+    for (const run of doc.runs) {
+        if (!run.results || !Array.isArray(run.results)) {
+            continue;
+        }
+        for (const result of run.results) {
+            if (!result.locations || result.locations.length === 0) {
+                continue;
+            }
+            const loc = result.locations[0];
+            const phys = loc?.physicalLocation;
+            if (!phys)
+                continue;
+            const file = phys.artifactLocation?.uri;
+            const startLine = phys.region?.startLine;
+            // Skip results missing required location fields
+            if (!file || startLine === undefined) {
+                continue;
+            }
+            const endLine = phys.region?.endLine ?? startLine;
+            const target = {
+                file,
+                startLine,
+                endLine,
+                message: result.message?.text ?? '',
+            };
+            if (phys.region?.snippet?.text) {
+                target.snippet = phys.region.snippet.text;
+            }
+            targets.push(target);
+        }
+    }
+    return targets;
+}
+/**
+ * Deduplicate targets by file:startLine:endLine key.
+ */
+export function deduplicateTargets(targets) {
+    const seen = new Set();
+    const result = [];
+    for (const target of targets) {
+        const key = `${target.file}:${target.startLine}:${target.endLine}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(target);
+        }
+    }
+    return result;
+}
+/**
+ * Limit the number of targets to a maximum.
+ */
+export function limitTargets(targets, maxTargets) {
+    return targets.slice(0, maxTargets);
+}
+//# sourceMappingURL=sarif-parser.js.map

package/dist/sarif-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-parser.js","sourceRoot":"","sources":["../src/sarif-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC7C,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAkB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,EAAE,gBAAgB,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;YAEzC,gDAAgD;YAChD,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC;YAElD,MAAM,MAAM,GAAgB;gBAC1B,IAAI;gBACJ,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE;aACpC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC/B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5C,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE,UAAkB;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC"}

package/dist/scan-history.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Scan history: persisted record of completed scans for cost dashboards
+ * and budget controls.
+ *
+ * Storage: `~/.aghast/history.json` by default (one file per user). When the
+ * home directory cannot be resolved, falls back to project-local
+ * `.aghast-history.json`. The path can be overridden in tests via the
+ * `AGHAST_HISTORY_FILE` env var or by passing `historyFile` to the helpers.
+ *
+ * Format: a single JSON document `{ "records": [...] }`. We keep this simple
+ * (no SQLite) so the file is human-readable and can be edited / pruned by
+ * hand. Corrupt files are logged and rebuilt to avoid blocking scans on a
+ * malformed history file.
+ */
+import type { TokenUsage } from './types.js';
+/** A single completed-scan record. */
+export interface ScanRecord {
+    scanId: string;
+    /** ISO timestamp of scan start. */
+    startedAt: string;
+    /** ISO timestamp of scan end. */
+    endedAt: string;
+    /** Wall-clock duration in milliseconds. */
+    durationMs: number;
+    /** Repository path or remote URL. */
+    repository: string;
+    /** Repository remote URL when known. */
+    repositoryUrl?: string;
+    /** Models used during the scan. */
+    models: string[];
+    /** Aggregate token usage across the scan. */
+    tokenUsage?: TokenUsage;
+    /** Estimated total cost (in `currency`). */
+    totalCost: number;
+    /** ISO 4217 currency code. */
+    currency: string;
+    /** How the cost was determined. Absent on records written before this feature. */
+    costSource?: 'reported' | 'estimated' | 'estimated-unpriced' | 'legacy';
+    /** Which provider reported the cost when costSource === 'reported'. */
+    costReportedBy?: 'claude-agent-sdk' | 'opencode';
+    /** true when the scan ran with AGHAST_LOCAL_CLAUDE=true */
+    costCoveredBySubscription?: boolean;
+    /** Number of checks executed. */
+    checks: number;
+    /** Number of issues reported. */
+    issues: number;
+}
+/** Filters for queryScanHistory(). */
+export interface HistoryFilters {
+    repository?: string;
+    /** Substring match against any element of `models`. */
+    model?: string;
+    /** Inclusive ISO timestamp lower bound on `startedAt`. */
+    since?: string;
+    /** Inclusive ISO timestamp upper bound on `startedAt`. */
+    until?: string;
+}
+/**
+ * Resolve the history file path.
+ *
+ * Precedence:
+ *   1. explicit `historyFile` argument
+ *   2. AGHAST_HISTORY_FILE env var
+ *   3. ~/.aghast/history.json when homedir is available
+ *   4. project-local `.aghast-history.json`
+ */
+export declare function resolveHistoryFilePath(historyFile?: string): string;
+/**
+ * Append a record to the scan history, deduplicating by scanId.
+ * If a record with the same scanId already exists, it is replaced.
+ */
+export declare function saveScanRecord(record: ScanRecord, options?: {
+    historyFile?: string;
+}): Promise<void>;
+/**
+ * Load all scan records, applying optional filters.
+ * Records are returned newest-first (descending startedAt).
+ */
+export declare function queryScanHistory(filters?: HistoryFilters, options?: {
+    historyFile?: string;
+}): Promise<ScanRecord[]>;
+//# sourceMappingURL=scan-history.d.ts.map

package/dist/scan-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-history.d.ts","sourceRoot":"","sources":["../src/scan-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAO7C,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,UAAU,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IACxE,uEAAuE;IACvE,cAAc,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAAC;IACjD,2DAA2D;IAC3D,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAOD,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAcnE;AAiCD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9G;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,cAAmB,EAC5B,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACrC,OAAO,CAAC,UAAU,EAAE,CAAC,CA8BvB"}