@owasp-aghast/aghast 0.8.0-beta.0

package/dist/check-library.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Check Library / Config Manager.
+ * Two-layer config: Layer 1 (registry) maps checks to repos,
+ * Layer 2 (<id>.json) defines each check in its own folder.
+ * Implements spec Appendix B.1.
+ */
+import type { SecurityCheck, CheckDetails, CheckRegistryEntry, CheckDefinition } from './types.js';
+export interface CheckRegistry {
+    checks: CheckRegistryEntry[];
+}
+/**
+ * Load and parse the Layer 1 registry from <configDir>/checks-config.json.
+ * Throws on missing file, malformed JSON, or invalid structure.
+ */
+export declare function loadCheckRegistry(configDir: string): Promise<CheckRegistry>;
+/**
+ * Load and parse a Layer 2 check definition from <checkFolderPath>/<id>.json.
+ * Throws on missing file, malformed JSON, or missing required fields.
+ */
+export declare function loadCheckDefinition(checkFolderPath: string): Promise<CheckDefinition>;
+/**
+ * Scan check directories for subfolders containing <id>.json.
+ * Returns a map of check id → folder path.
+ */
+export declare function discoverCheckFolders(checksDirs: string[]): Promise<Map<string, string>>;
+/**
+ * Merge Layer 1 registry entries with Layer 2 check definitions.
+ * Resolves instructionsFile and checkTarget.rules paths relative to check folder.
+ * Throws if a registry entry has no matching check folder.
+ */
+export declare function resolveChecks(registry: CheckRegistry, checkFolders: Map<string, string>): Promise<SecurityCheck[]>;
+export interface CheckLibraryConfig {
+    checks: SecurityCheck[];
+}
+/**
+ * Load and parse a flat JSON config file (old format).
+ * Kept for backward compatibility with existing test fixtures.
+ */
+export declare function loadConfig(configPath: string): Promise<CheckLibraryConfig>;
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Validate a single SecurityCheck definition.
+ * Checks that id is present and non-empty, and instructionsFile exists on disk.
+ * basePath is used to resolve instructionsFile if it's a relative path.
+ * If instructionsFile is already absolute, basePath is ignored.
+ */
+export declare function validateCheck(check: SecurityCheck, basePath: string): Promise<ValidationResult>;
+export { normalizeRepoPath } from './repository-analyzer.js';
+/**
+ * Check if a single check matches the given repository URL/path.
+ * Empty repositories array matches all repos.
+ * Entries in excludeRepositories override matches (exclusion wins).
+ * Uses bidirectional substring matching on normalized paths.
+ */
+export declare function checkMatchesRepository(check: SecurityCheck, repositoryUrl: string): boolean;
+/**
+ * Filter checks to those matching the given repository URL/path.
+ * Also filters out disabled checks (enabled === false).
+ */
+export declare function filterChecksForRepository(checks: SecurityCheck[], repositoryUrl: string): SecurityCheck[];
+/**
+ * Parse a markdown check file into CheckDetails.
+ * Extracts name from first ### heading, overview from #### Overview section.
+ */
+export declare function parseCheckMarkdown(id: string, markdown: string): CheckDetails;
+/**
+ * Load check instructions from the markdown file referenced by a SecurityCheck.
+ * Resolves instructionsFile relative to basePath (or uses absolute path if already resolved).
+ */
+export declare function loadCheckDetails(check: SecurityCheck, basePath: string): Promise<CheckDetails>;
+/**
+ * Filter files to those matching applicablePaths globs.
+ * If applicablePaths is undefined or empty, returns all files.
+ */
+export declare function filterApplicablePaths(files: string[], applicablePaths?: string[]): string[];
+/**
+ * Filter out files matching excludedPaths globs.
+ * If excludedPaths is undefined or empty, returns all files.
+ */
+export declare function filterExcludedPaths(files: string[], excludedPaths?: string[]): string[];
+/**
+ * Apply both applicablePaths and excludedPaths filtering.
+ */
+export declare function filterCheckPaths(files: string[], check: SecurityCheck): string[];
+//# sourceMappingURL=check-library.d.ts.map

package/dist/check-library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-library.d.ts","sourceRoot":"","sources":["../src/check-library.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwEjF;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA0I3F;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2B9B;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,aAAa,EACvB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,aAAa,EAAE,CAAC,CAqD1B;AAID,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiChF;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAqC3B;AAKD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,aAAa,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAoBT;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,aAAa,EAAE,CAIjB;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAoB7E;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAOD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,MAAM,EAAE,CAOV;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,MAAM,EAAE,CAOV;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,aAAa,GACnB,MAAM,EAAE,CAGV"}

package/dist/check-library.js

@@ -0,0 +1,461 @@
+/**
+ * Check Library / Config Manager.
+ * Two-layer config: Layer 1 (registry) maps checks to repos,
+ * Layer 2 (<id>.json) defines each check in its own folder.
+ * Implements spec Appendix B.1.
+ */
+import { readFile, readdir, access, constants } from 'node:fs/promises';
+import { resolve, join, basename } from 'node:path';
+import picomatch from 'picomatch';
+import { normalizeRepoPath } from './repository-analyzer.js';
+import { getCheckType, getValidCheckTypes } from './check-types.js';
+import { getRegisteredDiscoveries } from './discovery.js';
+/**
+ * Load and parse the Layer 1 registry from <configDir>/checks-config.json.
+ * Throws on missing file, malformed JSON, or invalid structure.
+ */
+export async function loadCheckRegistry(configDir) {
+    const configPath = resolve(configDir, 'checks-config.json');
+    let raw;
+    try {
+        raw = await readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read config file "${configPath}": ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Config file "${configPath}" contains invalid JSON: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        !('checks' in parsed) ||
+        !Array.isArray(parsed.checks)) {
+        throw new Error(`Config file "${configPath}" has invalid structure: must contain a "checks" array`);
+    }
+    // Validate each registry entry has required fields with correct types
+    const checks = parsed.checks;
+    for (let i = 0; i < checks.length; i++) {
+        const entry = checks[i];
+        if (typeof entry !== 'object' || entry === null) {
+            throw new Error(`Config file "${configPath}": checks[${i}] must be an object`);
+        }
+        const obj = entry;
+        if (typeof obj.id !== 'string' || obj.id.trim() === '') {
+            throw new Error(`Config file "${configPath}": checks[${i}].id must be a non-empty string`);
+        }
+        if (!Array.isArray(obj.repositories)) {
+            throw new Error(`Config file "${configPath}": checks[${i}].repositories must be an array`);
+        }
+        for (let j = 0; j < obj.repositories.length; j++) {
+            if (typeof obj.repositories[j] !== 'string') {
+                throw new Error(`Config file "${configPath}": checks[${i}].repositories[${j}] must be a string`);
+            }
+        }
+        if (obj.excludeRepositories !== undefined) {
+            if (!Array.isArray(obj.excludeRepositories)) {
+                throw new Error(`Config file "${configPath}": checks[${i}].excludeRepositories must be an array`);
+            }
+            for (let j = 0; j < obj.excludeRepositories.length; j++) {
+                if (typeof obj.excludeRepositories[j] !== 'string') {
+                    throw new Error(`Config file "${configPath}": checks[${i}].excludeRepositories[${j}] must be a string`);
+                }
+            }
+        }
+        if (obj.enabled !== undefined && typeof obj.enabled !== 'boolean') {
+            throw new Error(`Config file "${configPath}": checks[${i}].enabled must be a boolean`);
+        }
+    }
+    return parsed;
+}
+// --- Layer 2: Check Definitions ---
+/**
+ * Load and parse a Layer 2 check definition from <checkFolderPath>/<id>.json.
+ * Throws on missing file, malformed JSON, or missing required fields.
+ */
+export async function loadCheckDefinition(checkFolderPath) {
+    const defPath = resolve(checkFolderPath, basename(checkFolderPath) + '.json');
+    let raw;
+    try {
+        raw = await readFile(defPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read check definition "${defPath}": ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Check definition "${defPath}" contains invalid JSON: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    // Validate field types before casting
+    const obj = parsed;
+    if (typeof obj.id !== 'string' || obj.id.trim() === '') {
+        throw new Error(`Check definition "${defPath}": "id" must be a non-empty string`);
+    }
+    if (typeof obj.name !== 'string' || obj.name.trim() === '') {
+        throw new Error(`Check definition "${defPath}": "name" must be a non-empty string`);
+    }
+    if (obj.instructionsFile !== undefined && typeof obj.instructionsFile !== 'string') {
+        throw new Error(`Check definition "${defPath}": "instructionsFile" must be a string`);
+    }
+    if (obj.severity !== undefined && typeof obj.severity !== 'string') {
+        throw new Error(`Check definition "${defPath}": "severity" must be a string`);
+    }
+    if (obj.confidence !== undefined && typeof obj.confidence !== 'string') {
+        throw new Error(`Check definition "${defPath}": "confidence" must be a string`);
+    }
+    if (obj.model !== undefined && typeof obj.model !== 'string') {
+        throw new Error(`Check definition "${defPath}": "model" must be a string`);
+    }
+    if (obj.applicablePaths !== undefined && !Array.isArray(obj.applicablePaths)) {
+        throw new Error(`Check definition "${defPath}": "applicablePaths" must be an array`);
+    }
+    if (obj.excludedPaths !== undefined && !Array.isArray(obj.excludedPaths)) {
+        throw new Error(`Check definition "${defPath}": "excludedPaths" must be an array`);
+    }
+    if (obj.checkTarget !== undefined) {
+        if (typeof obj.checkTarget !== 'object' || obj.checkTarget === null) {
+            throw new Error(`Check definition "${defPath}": "checkTarget" must be an object`);
+        }
+        const ct = obj.checkTarget;
+        const validTypes = getValidCheckTypes();
+        if (typeof ct.type !== 'string' || !validTypes.includes(ct.type)) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.type" must be one of: ${validTypes.join(', ')}`);
+        }
+        if (ct.rules !== undefined && typeof ct.rules !== 'string' && !Array.isArray(ct.rules)) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.rules" must be a string or array`);
+        }
+        if (ct.config !== undefined && typeof ct.config !== 'string') {
+            throw new Error(`Check definition "${defPath}": "checkTarget.config" must be a string`);
+        }
+        if (ct.maxTargets !== undefined && (typeof ct.maxTargets !== 'number' || ct.maxTargets <= 0 || !Number.isInteger(ct.maxTargets))) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.maxTargets" must be a positive integer`);
+        }
+        if (ct.concurrency !== undefined && (typeof ct.concurrency !== 'number' || ct.concurrency <= 0 || !Number.isInteger(ct.concurrency))) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.concurrency" must be a positive integer`);
+        }
+        if (ct.maxIssuesPerTarget !== undefined && (typeof ct.maxIssuesPerTarget !== 'number' || ct.maxIssuesPerTarget < 1 || !Number.isInteger(ct.maxIssuesPerTarget))) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.maxIssuesPerTarget" must be a positive integer`);
+        }
+        // Validate discovery field is present for targeted/static types (actual type
+        // validation happens in validateCheck, after repo filtering, so unknown
+        // discovery types don't crash the entire scan for unrelated checks)
+        if (ct.type === 'targeted' || ct.type === 'static') {
+            if (typeof ct.discovery !== 'string' || ct.discovery.trim() === '') {
+                throw new Error(`Check definition "${defPath}": "checkTarget.discovery" is required for type "${ct.type}"`);
+            }
+        }
+        if (ct.sarifFile !== undefined && typeof ct.sarifFile !== 'string') {
+            throw new Error(`Check definition "${defPath}": "checkTarget.sarifFile" must be a string`);
+        }
+        if (ct.discovery === 'sarif' && !ct.sarifFile) {
+            throw new Error(`Check definition "${defPath}": "checkTarget.sarifFile" is required when discovery is "sarif"`);
+        }
+        // Validate diff filter fields
+        if (ct.diffFilter !== undefined && typeof ct.diffFilter !== 'boolean') {
+            throw new Error(`Check definition "${defPath}": "checkTarget.diffFilter" must be a boolean`);
+        }
+        if (ct.diffRef !== undefined && typeof ct.diffRef !== 'string') {
+            throw new Error(`Check definition "${defPath}": "checkTarget.diffRef" must be a string`);
+        }
+        // Validate openant filter config
+        if (ct.openant !== undefined) {
+            if (typeof ct.openant !== 'object' || ct.openant === null) {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant" must be an object`);
+            }
+            const oa = ct.openant;
+            if (oa.unitTypes !== undefined && !Array.isArray(oa.unitTypes)) {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.unitTypes" must be an array`);
+            }
+            if (oa.excludeUnitTypes !== undefined && !Array.isArray(oa.excludeUnitTypes)) {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.excludeUnitTypes" must be an array`);
+            }
+            if (oa.securityClassifications !== undefined && !Array.isArray(oa.securityClassifications)) {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.securityClassifications" must be an array`);
+            }
+            if (oa.reachableOnly !== undefined && typeof oa.reachableOnly !== 'boolean') {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.reachableOnly" must be a boolean`);
+            }
+            if (oa.entryPointsOnly !== undefined && typeof oa.entryPointsOnly !== 'boolean') {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.entryPointsOnly" must be a boolean`);
+            }
+            if (oa.minConfidence !== undefined && (typeof oa.minConfidence !== 'number' || oa.minConfidence < 0 || oa.minConfidence > 1)) {
+                throw new Error(`Check definition "${defPath}": "checkTarget.openant.minConfidence" must be a number between 0 and 1`);
+            }
+        }
+    }
+    const def = parsed;
+    // instructionsFile is required for check types where needsInstructions is true,
+    // UNLESS analysisMode is a built-in mode (false-positive-validation, general-vuln-discovery)
+    // which provides its own prompt template.
+    const builtInMode = def.checkTarget?.analysisMode === 'false-positive-validation'
+        || def.checkTarget?.analysisMode === 'general-vuln-discovery';
+    if (getCheckType(def.checkTarget?.type).needsInstructions && !builtInMode && !def.instructionsFile) {
+        throw new Error(`Check definition "${defPath}" is missing required field "instructionsFile"`);
+    }
+    return def;
+}
+/**
+ * Scan check directories for subfolders containing <id>.json.
+ * Returns a map of check id → folder path.
+ */
+export async function discoverCheckFolders(checksDirs) {
+    const result = new Map();
+    for (const dir of checksDirs) {
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            // Directory doesn't exist — skip
+            continue;
+        }
+        for (const entry of entries) {
+            const folderPath = join(dir, entry);
+            const checkJsonPath = join(folderPath, entry + '.json');
+            try {
+                await access(checkJsonPath, constants.R_OK);
+                // Load just to get the id
+                const def = await loadCheckDefinition(folderPath);
+                result.set(def.id, folderPath);
+            }
+            catch {
+                // Not a check folder or can't read — skip
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Merge Layer 1 registry entries with Layer 2 check definitions.
+ * Resolves instructionsFile and checkTarget.rules paths relative to check folder.
+ * Throws if a registry entry has no matching check folder.
+ */
+export async function resolveChecks(registry, checkFolders) {
+    const checks = [];
+    for (const entry of registry.checks) {
+        const folderPath = checkFolders.get(entry.id);
+        if (!folderPath) {
+            throw new Error(`Check "${entry.id}" is registered but no matching check folder was found in any checks directory`);
+        }
+        const def = await loadCheckDefinition(folderPath);
+        if (def.id !== entry.id) {
+            throw new Error(`Check ID mismatch: registry has "${entry.id}" but ${entry.id}.json has "${def.id}"`);
+        }
+        // Merge Layer 1 + Layer 2
+        const merged = {
+            id: entry.id,
+            name: def.name,
+            repositories: entry.repositories,
+            excludeRepositories: entry.excludeRepositories,
+            instructionsFile: def.instructionsFile ? resolve(folderPath, def.instructionsFile) : undefined,
+            enabled: entry.enabled,
+            checkDir: folderPath,
+        };
+        if (def.severity)
+            merged.severity = def.severity;
+        if (def.confidence)
+            merged.confidence = def.confidence;
+        if (def.model)
+            merged.model = def.model;
+        if (def.applicablePaths)
+            merged.applicablePaths = def.applicablePaths;
+        if (def.excludedPaths)
+            merged.excludedPaths = def.excludedPaths;
+        if (def.checkTarget) {
+            merged.checkTarget = { ...def.checkTarget };
+            // Resolve rules paths relative to check folder
+            if (merged.checkTarget.rules) {
+                const rules = merged.checkTarget.rules;
+                merged.checkTarget.rules = Array.isArray(rules)
+                    ? rules.map((r) => resolve(folderPath, r))
+                    : resolve(folderPath, rules);
+            }
+            if (merged.checkTarget.config) {
+                merged.checkTarget.config = resolve(folderPath, merged.checkTarget.config);
+            }
+        }
+        checks.push(merged);
+    }
+    return checks;
+}
+/**
+ * Load and parse a flat JSON config file (old format).
+ * Kept for backward compatibility with existing test fixtures.
+ */
+export async function loadConfig(configPath) {
+    let raw;
+    try {
+        raw = await readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read config file "${configPath}": ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Config file "${configPath}" contains invalid JSON: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        !('checks' in parsed) ||
+        !Array.isArray(parsed.checks)) {
+        throw new Error(`Config file "${configPath}" has invalid structure: must contain a "checks" array`);
+    }
+    return parsed;
+}
+/**
+ * Validate a single SecurityCheck definition.
+ * Checks that id is present and non-empty, and instructionsFile exists on disk.
+ * basePath is used to resolve instructionsFile if it's a relative path.
+ * If instructionsFile is already absolute, basePath is ignored.
+ */
+export async function validateCheck(check, basePath) {
+    const errors = [];
+    if (!check.id || typeof check.id !== 'string' || check.id.trim() === '') {
+        errors.push('Check is missing a valid "id" field');
+    }
+    // Validate discovery type is registered (checked here, after repo filtering,
+    // so unknown discovery types in unrelated checks don't crash the scan).
+    // Only validates when discoveries have been registered (skips in unit tests
+    // where scan-runner.ts hasn't been imported).
+    const discovery = check.checkTarget?.discovery;
+    const registered = getRegisteredDiscoveries();
+    if (discovery && registered.length > 0 && !registered.includes(discovery)) {
+        errors.push(`Unknown discovery type "${discovery}". Available: ${registered.join(', ')}`);
+    }
+    // Built-in analysis modes provide their own prompt template — no instructionsFile needed
+    const builtInModeV = check.checkTarget?.analysisMode === 'false-positive-validation'
+        || check.checkTarget?.analysisMode === 'general-vuln-discovery';
+    if (!getCheckType(check.checkTarget?.type).needsInstructions || builtInModeV) {
+        // No instructionsFile validation needed for this check type/discovery
+    }
+    else if (!check.instructionsFile) {
+        errors.push('Check is missing required "instructionsFile" field');
+    }
+    else {
+        // instructionsFile may already be an absolute path (from resolveChecks)
+        const instructionsPath = resolve(basePath, check.instructionsFile);
+        try {
+            await access(instructionsPath, constants.R_OK);
+        }
+        catch {
+            errors.push(`Instructions file "${check.instructionsFile}" not found at "${instructionsPath}"`);
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+// --- Repository Matching (spec C.6) ---
+// Re-export normalizeRepoPath from repository-analyzer for convenience
+export { normalizeRepoPath } from './repository-analyzer.js';
+/**
+ * Check if a single check matches the given repository URL/path.
+ * Empty repositories array matches all repos.
+ * Entries in excludeRepositories override matches (exclusion wins).
+ * Uses bidirectional substring matching on normalized paths.
+ */
+export function checkMatchesRepository(check, repositoryUrl) {
+    const normalizedRepo = normalizeRepoPath(repositoryUrl);
+    const matches = (entry) => {
+        const normalizedEntry = normalizeRepoPath(entry);
+        return (normalizedRepo.includes(normalizedEntry) ||
+            normalizedEntry.includes(normalizedRepo));
+    };
+    if (check.excludeRepositories && check.excludeRepositories.some(matches)) {
+        return false;
+    }
+    if (check.repositories.length === 0) {
+        return true;
+    }
+    return check.repositories.some(matches);
+}
+/**
+ * Filter checks to those matching the given repository URL/path.
+ * Also filters out disabled checks (enabled === false).
+ */
+export function filterChecksForRepository(checks, repositoryUrl) {
+    return checks
+        .filter((check) => check.enabled !== false)
+        .filter((check) => checkMatchesRepository(check, repositoryUrl));
+}
+// --- Markdown Parsing (spec A.7) ---
+/**
+ * Parse a markdown check file into CheckDetails.
+ * Extracts name from first ### heading, overview from #### Overview section.
+ */
+export function parseCheckMarkdown(id, markdown) {
+    // Extract name from first ### heading
+    const nameMatch = markdown.match(/^###\s+(.+)$/m);
+    const name = nameMatch ? nameMatch[1].trim() : 'Unknown Check';
+    // Extract overview from #### Overview section
+    let overview = '';
+    const overviewMatch = markdown.match(/^####\s+Overview\s*\n([\s\S]*?)(?=^####\s|\s*$)/m);
+    if (overviewMatch) {
+        overview = overviewMatch[1].trim();
+    }
+    return {
+        id,
+        name,
+        overview,
+        content: markdown,
+    };
+}
+/**
+ * Load check instructions from the markdown file referenced by a SecurityCheck.
+ * Resolves instructionsFile relative to basePath (or uses absolute path if already resolved).
+ */
+export async function loadCheckDetails(check, basePath) {
+    if (!check.instructionsFile) {
+        throw new Error(`Check "${check.id}" has no instructionsFile`);
+    }
+    const instructionsPath = resolve(basePath, check.instructionsFile);
+    let markdown;
+    try {
+        markdown = await readFile(instructionsPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to load instructions file "${check.instructionsFile}": ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+    }
+    return parseCheckMarkdown(check.id, markdown);
+}
+// --- Path Filtering ---
+// Note: These path filtering functions are implemented and tested but not yet
+// wired into the scan execution path. They will be integrated in a future
+// iteration when the agent provider interface supports scoped file lists.
+/**
+ * Filter files to those matching applicablePaths globs.
+ * If applicablePaths is undefined or empty, returns all files.
+ */
+export function filterApplicablePaths(files, applicablePaths) {
+    if (!applicablePaths || applicablePaths.length === 0) {
+        return files;
+    }
+    const matcher = picomatch(applicablePaths);
+    return files.filter((file) => matcher(file));
+}
+/**
+ * Filter out files matching excludedPaths globs.
+ * If excludedPaths is undefined or empty, returns all files.
+ */
+export function filterExcludedPaths(files, excludedPaths) {
+    if (!excludedPaths || excludedPaths.length === 0) {
+        return files;
+    }
+    const matcher = picomatch(excludedPaths);
+    return files.filter((file) => !matcher(file));
+}
+/**
+ * Apply both applicablePaths and excludedPaths filtering.
+ */
+export function filterCheckPaths(files, check) {
+    const applicable = filterApplicablePaths(files, check.applicablePaths);
+    return filterExcludedPaths(applicable, check.excludedPaths);
+}
+//# sourceMappingURL=check-library.js.map

package/dist/check-library.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-library.js","sourceRoot":"","sources":["../src/check-library.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAO7D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAQ1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACrB,CAAC,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,MAAM,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,wDAAwD,CACnF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,MAAM,GAAI,MAAkC,CAAC,MAAmB,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,aAAa,CAAC,qBAAqB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,aAAa,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,aAAa,CAAC,wCAAwC,CACjF,CAAC;YACJ,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxD,IAAI,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,aAAa,CAAC,yBAAyB,CAAC,oBAAoB,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,aAAa,CAAC,6BAA6B,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,qCAAqC;AAErC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,eAAuB;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,CAAC;IAC9E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1G,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,oCAAoC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,sCAAsC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,gCAAgC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,6BAA6B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,qCAAqC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,oCAAoC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAsC,CAAC;QACtD,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,yCAAyC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,kDAAkD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,0CAA0C,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,wDAAwD,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrI,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,yDAAyD,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,kBAAkB,KAAK,QAAQ,IAAI,EAAE,CAAC,kBAAkB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAChK,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,gEAAgE,CAAC,CAAC;QAChH,CAAC;QACD,6EAA6E;QAC7E,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,oDAAoD,EAAE,CAAC,IAAI,GAAG,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,6CAA6C,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,kEAAkE,CAC/F,CAAC;QACJ,CAAC;QACD,8BAA8B;QAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,+CAA+C,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,2CAA2C,CAAC,CAAC;QAC3F,CAAC;QACD,iCAAiC;QACjC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4CAA4C,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAkC,CAAC;YACjD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,qDAAqD,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4DAA4D,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,mEAAmE,CAAC,CAAC;YACnH,CAAC;YACD,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,0DAA0D,CAAC,CAAC;YAC1G,CAAC;YACD,IAAI,EAAE,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4DAA4D,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,IAAI,EAAE,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7H,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,yEAAyE,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAyB,CAAC;IAEtC,gFAAgF;IAChF,6FAA6F;IAC7F,0CAA0C;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,YAAY,KAAK,2BAA2B;WAC5E,GAAG,CAAC,WAAW,EAAE,YAAY,KAAK,wBAAwB,CAAC;IAChE,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,gDAAgD,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;YACjC,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC5C,0BAA0B;gBAC1B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAuB,EACvB,YAAiC;IAEjC,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,CAAC,EAAE,gFAAgF,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,cAAc,GAAG,CAAC,EAAE,GAAG,CACrF,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAkB;YAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9F,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,UAAU;SACrB,CAAC;QAEF,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACvD,IAAI,GAAG,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxC,IAAI,GAAG,CAAC,eAAe;YAAE,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;QACtE,IAAI,GAAG,CAAC,aAAa;YAAE,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;QAEhE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC5C,+CAA+C;YAC/C,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;gBACvC,MAAM,CAAC,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC7C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC1C,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACrB,CAAC,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,MAAM,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gBAAgB,UAAU,wDAAwD,CACnF,CAAC;IACJ,CAAC;IAED,OAAO,MAA4B,CAAC;AACtC,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;IAC/C,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,IAAI,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,2BAA2B,SAAS,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,yFAAyF;IACzF,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,YAAY,KAAK,2BAA2B;WAC/E,KAAK,CAAC,WAAW,EAAE,YAAY,KAAK,wBAAwB,CAAC;IAClE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,iBAAiB,IAAI,YAAY,EAAE,CAAC;QAC7E,sEAAsE;IACxE,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,sBAAsB,KAAK,CAAC,gBAAgB,mBAAmB,gBAAgB,GAAG,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,yCAAyC;AAEzC,uEAAuE;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAoB,EACpB,aAAqB;IAErB,MAAM,cAAc,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAW,EAAE;QACzC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,CACL,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxC,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAC,CACzC,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB,EACvB,aAAqB;IAErB,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,sCAAsC;AAEtC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,QAAgB;IAC7D,sCAAsC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAE/D,8CAA8C;IAC9C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAClC,kDAAkD,CACnD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,QAAQ;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoB,EACpB,QAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,gBAAgB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnH,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,yBAAyB;AACzB,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAE1E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe,EACf,eAA0B;IAE1B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAe,EACf,aAAwB;IAExB,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAe,EACf,KAAoB;IAEpB,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACvE,OAAO,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}

package/dist/check-types.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Check type descriptor system.
+ *
+ * Each check type declares its characteristics (needs AI, needs instructions, etc.)
+ * in one place. Code throughout the codebase queries these descriptors instead
+ * of comparing raw type strings.
+ *
+ * Check types describe *execution mode* (what happens with targets).
+ * Discovery type (how targets are found) is a separate axis — see src/discovery.ts.
+ */
+/** Characteristics of a check type. */
+export interface CheckTypeDescriptor {
+    /** The string value used in check definitions. */
+    readonly type: string;
+    /** Whether the check requires AI analysis. */
+    readonly needsAI: boolean;
+    /** Whether the check requires an instructions markdown file. */
+    readonly needsInstructions: boolean;
+    /** Whether the check supports maxTargets (multi-target checks). */
+    readonly supportsMaxTargets: boolean;
+}
+/**
+ * Get the descriptor for a check type string.
+ * Returns conservative defaults for unknown/undefined types.
+ */
+export declare function getCheckType(type: string | undefined): CheckTypeDescriptor;
+/** All valid check type strings. */
+export declare function getValidCheckTypes(): string[];
+/** Check type string constants for use in routing (scan-runner switch). */
+export declare const CHECK_TYPE: {
+    readonly REPOSITORY: string;
+    readonly TARGETED: string;
+    readonly STATIC: string;
+};
+//# sourceMappingURL=check-types.d.ts.map

package/dist/check-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-types.d.ts","sourceRoot":"","sources":["../src/check-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AA6CD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAG1E;AAED,oCAAoC;AACpC,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,2EAA2E;AAC3E,eAAO,MAAM,UAAU;;;;CAIb,CAAC"}