@owasp-aghast/aghast 0.8.0-beta.0

package/dist/discovery.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Pluggable target discovery system.
+ *
+ * Separates "how targets are found" (discovery) from "what happens with them"
+ * (execution). Each discovery mechanism implements the TargetDiscovery interface
+ * and is registered in a central registry.
+ */
+import type { SecurityCheck } from './types.js';
+/**
+ * A target discovered by a discovery mechanism, ready for AI analysis.
+ * Contains location information plus optional discovery-specific enrichment.
+ */
+export interface DiscoveredTarget {
+    /** File path relative to the repository root. */
+    file: string;
+    /** Start line number (1-based). */
+    startLine: number;
+    /** End line number (1-based). */
+    endLine: number;
+    /** Display label for logging (e.g. "[target 1/10]"). */
+    label: string;
+    /** Extra context appended to prompt per target (e.g. call graph for openant, finding details for sarif). */
+    promptEnrichment?: string;
+    /** Discovery-specific agent provider options (e.g. maxTurns for openant). */
+    agentOptions?: {
+        maxTurns?: number;
+    };
+    /** Message from the discovery tool (e.g. Semgrep finding description). */
+    message?: string;
+    /** Code snippet from the discovery tool (e.g. Semgrep snippet). */
+    snippet?: string;
+}
+/**
+ * Options passed to a discovery implementation.
+ *
+ * Diff-related values (diffRef, diffFile) intentionally don't live here.
+ * Diff filtering is applied by the scan runner after discovery completes,
+ * so the discovery implementations don't need to know about the diff.
+ */
+export interface DiscoveryOptions {
+    /** Path to the target repository. */
+    repositoryPath: string;
+    /**
+     * Path to a pre-generated OpenAnt dataset.
+     * When provided, discoveries that use OpenAnt (currently `openant`) skip their
+     * internal runOpenAnt call and read from this file instead. The scan runner sets
+     * this to share one OpenAnt invocation across discovery and the diff filter.
+     */
+    openantDatasetPath?: string;
+}
+/**
+ * Interface for pluggable target discovery mechanisms.
+ * Each implementation knows how to find targets and enrich them with context.
+ */
+export interface TargetDiscovery {
+    /** Discovery mechanism name (e.g. 'semgrep', 'openant', 'sarif'). */
+    readonly name: string;
+    /** Default generic prompt filename used for this discovery type. */
+    readonly defaultGenericPrompt: string;
+    /** Whether checks using this discovery require an instructions file. */
+    readonly needsInstructions: boolean;
+    /**
+     * Whether this discovery opts into automatic diff filtering when a diff
+     * source is available at scan time. True for all built-in discoveries today
+     * (semgrep, sarif, openant), since each returns targets with file/line info
+     * that can meaningfully be narrowed by the diff. Set false on a discovery
+     * whose output lacks file/line granularity or whose semantics make diff
+     * scoping nonsensical.
+     */
+    readonly supportsDiffFilter: boolean;
+    /**
+     * Discover targets in the repository for the given check.
+     * Returns an array of targets with optional prompt enrichment.
+     */
+    discover(check: SecurityCheck, repoPath: string, options?: DiscoveryOptions): Promise<DiscoveredTarget[]>;
+}
+/**
+ * Register a discovery implementation.
+ */
+export declare function registerDiscovery(discovery: TargetDiscovery): void;
+/**
+ * Get a discovery implementation by name.
+ * Throws if the discovery type is not registered.
+ */
+export declare function getDiscovery(name: string): TargetDiscovery;
+/**
+ * Get all registered discovery type names.
+ */
+export declare function getRegisteredDiscoveries(): string[];
+/**
+ * Clear all registered discoveries. For testing only.
+ */
+export declare function clearDiscoveryRegistry(): void;
+/**
+ * Remove a single discovery by name. Returns true if the entry existed.
+ * Intended for tests that want to register a one-off discovery and clean
+ * it up without disturbing the standard registrations.
+ */
+export declare function unregisterDiscovery(name: string): boolean;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,4GAA4G;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,QAAQ,CACN,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAElE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAS1D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/discovery.js

@@ -0,0 +1,49 @@
+/**
+ * Pluggable target discovery system.
+ *
+ * Separates "how targets are found" (discovery) from "what happens with them"
+ * (execution). Each discovery mechanism implements the TargetDiscovery interface
+ * and is registered in a central registry.
+ */
+import { ERROR_CODES, formatError } from './error-codes.js';
+// --- Discovery Registry ---
+const discoveryRegistry = new Map();
+/**
+ * Register a discovery implementation.
+ */
+export function registerDiscovery(discovery) {
+    discoveryRegistry.set(discovery.name, discovery);
+}
+/**
+ * Get a discovery implementation by name.
+ * Throws if the discovery type is not registered.
+ */
+export function getDiscovery(name) {
+    const discovery = discoveryRegistry.get(name);
+    if (!discovery) {
+        const available = [...discoveryRegistry.keys()].join(', ');
+        throw new Error(formatError(ERROR_CODES.E2004, `Unknown discovery type: "${name}". Available: ${available || '(none registered)'}`));
+    }
+    return discovery;
+}
+/**
+ * Get all registered discovery type names.
+ */
+export function getRegisteredDiscoveries() {
+    return [...discoveryRegistry.keys()];
+}
+/**
+ * Clear all registered discoveries. For testing only.
+ */
+export function clearDiscoveryRegistry() {
+    discoveryRegistry.clear();
+}
+/**
+ * Remove a single discovery by name. Returns true if the entry existed.
+ * Intended for tests that want to register a one-off discovery and clean
+ * it up without disturbing the standard registrations.
+ */
+export function unregisterDiscovery(name) {
+    return discoveryRegistry.delete(name);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAiF5D,6BAA6B;AAE7B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE7D;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,4BAA4B,IAAI,iBAAiB,SAAS,IAAI,mBAAmB,EAAE,CAAC,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/error-codes.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Trackable error codes for CLI error paths.
+ *
+ * Numbering scheme:
+ *   E1xxx — CLI parsing (argument/flag/command errors)
+ *   E2xxx — Configuration (config dir, checks, runtime config)
+ *   E3xxx — Agent provider
+ *   E4xxx — Repository/target validation
+ *   E5xxx — Semgrep
+ *   E6xxx — OpenAnt
+ *   E9xxx — Internal/fatal
+ */
+export interface ErrorCode {
+    code: string;
+    label: string;
+}
+export declare const ERROR_CODES: {
+    readonly E1001: ErrorCode;
+    readonly E1002: ErrorCode;
+    readonly E1003: ErrorCode;
+    readonly E2001: ErrorCode;
+    readonly E2002: ErrorCode;
+    readonly E2003: ErrorCode;
+    readonly E2004: ErrorCode;
+    readonly E2005: ErrorCode;
+    readonly E3001: ErrorCode;
+    readonly E3002: ErrorCode;
+    readonly E3003: ErrorCode;
+    readonly E3004: ErrorCode;
+    readonly E4001: ErrorCode;
+    readonly E5001: ErrorCode;
+    readonly E6001: ErrorCode;
+    readonly E6002: ErrorCode;
+    readonly E7001: ErrorCode;
+    readonly E9001: ErrorCode;
+};
+/**
+ * Format an error message with a trackable error code.
+ * Output: "Error [E1001]: <message>"
+ */
+export declare function formatError(errorCode: ErrorCode, message: string): string;
+/**
+ * Format a fatal error with version and bug report URL.
+ */
+export declare function formatFatalError(message: string, version: string): string;
+//# sourceMappingURL=error-codes.d.ts.map

package/dist/error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;CAsCd,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWzE"}

package/dist/error-codes.js

@@ -0,0 +1,70 @@
+/**
+ * Trackable error codes for CLI error paths.
+ *
+ * Numbering scheme:
+ *   E1xxx — CLI parsing (argument/flag/command errors)
+ *   E2xxx — Configuration (config dir, checks, runtime config)
+ *   E3xxx — Agent provider
+ *   E4xxx — Repository/target validation
+ *   E5xxx — Semgrep
+ *   E6xxx — OpenAnt
+ *   E9xxx — Internal/fatal
+ */
+function ec(code, label) {
+    return { code, label };
+}
+export const ERROR_CODES = {
+    // E1xxx — CLI parsing
+    E1001: ec('E1001', 'Missing required flag argument'),
+    E1002: ec('E1002', 'Unknown command'),
+    E1003: ec('E1003', 'Required input missing'),
+    // E2xxx — Configuration
+    E2001: ec('E2001', 'Config directory not specified'),
+    E2002: ec('E2002', 'Config directory structure invalid'),
+    E2003: ec('E2003', 'No checks found'),
+    E2004: ec('E2004', 'Invalid check definition'),
+    E2005: ec('E2005', 'Configuration error'),
+    // E3xxx — Agent provider
+    E3001: ec('E3001', 'API key missing'),
+    E3002: ec('E3002', 'Unknown agent provider'),
+    // E3003 retains "AI" intentionally: it refers to the file containing the
+    // mocked AI/LLM response body, not the agent harness. Same rationale as
+    // AGHAST_MOCK_AI / AGHAST_AI_MODEL — the model and its output are AI
+    // concerns; only the provider/harness layer was renamed to "agent".
+    E3003: ec('E3003', 'Mock AI response file not found'),
+    E3004: ec('E3004', 'OpenCode not installed'),
+    // E4xxx — Repository/target validation
+    E4001: ec('E4001', 'Repository path not found'),
+    // E5xxx — Semgrep
+    E5001: ec('E5001', 'Semgrep not installed'),
+    // E6xxx — OpenAnt
+    E6001: ec('E6001', 'OpenAnt not installed'),
+    E6002: ec('E6002', 'OpenAnt execution failed'),
+    // E7xxx — Budget / cost controls
+    E7001: ec('E7001', 'Budget limit exceeded'),
+    // E9xxx — Internal
+    E9001: ec('E9001', 'Fatal internal error'),
+};
+/**
+ * Format an error message with a trackable error code.
+ * Output: "Error [E1001]: <message>"
+ */
+export function formatError(errorCode, message) {
+    return `Error [${errorCode.code}]: ${message}`;
+}
+/**
+ * Format a fatal error with version and bug report URL.
+ */
+export function formatFatalError(message, version) {
+    const title = encodeURIComponent(`[Bug] ${message}`);
+    const body = encodeURIComponent(`**Version:** ${version}\n\n**Error:**\n${message}`);
+    const url = `https://github.com/owasp-aghast/aghast/issues/new?title=${title}&body=${body}&labels=bug`;
+    return [
+        `AGHAST Fatal Error [${ERROR_CODES.E9001.code}]: ${message}`,
+        `Version: ${version}`,
+        '',
+        `If this is unexpected, please report it:`,
+        `  ${url}`,
+    ].join('\n');
+}
+//# sourceMappingURL=error-codes.js.map

package/dist/error-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,sBAAsB;IACtB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,wBAAwB;IACxB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACpD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACxD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC9C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,yBAAyB;IACzB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC5C,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACrD,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,uCAAuC;IACvC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAE/C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,kBAAkB;IAClB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC3C,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,iCAAiC;IACjC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,mBAAmB;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAClC,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,OAAe;IAC/D,OAAO,UAAU,SAAS,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,OAAO,mBAAmB,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,2DAA2D,KAAK,SAAS,IAAI,aAAa,CAAC;IACvG,OAAO;QACL,uBAAuB,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,OAAO,EAAE;QAC5D,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,0CAA0C;QAC1C,KAAK,GAAG,EAAE;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/formatters/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Formatter registry — resolves output format IDs to formatter instances.
+ */
+import type { OutputFormatter } from './types.js';
+export type { OutputFormatter } from './types.js';
+/** Returns the formatter for the given ID, or throws listing available formats. */
+export declare function getFormatter(id: string): OutputFormatter;
+/** Returns all registered format IDs. */
+export declare function getAvailableFormats(): string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/formatters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlD,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAOxD;AAED,yCAAyC;AACzC,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}

package/dist/formatters/index.js

@@ -0,0 +1,23 @@
+/**
+ * Formatter registry — resolves output format IDs to formatter instances.
+ */
+import { JsonFormatter } from './json-formatter.js';
+import { SarifFormatter } from './sarif-formatter.js';
+const formatters = new Map([
+    ['json', new JsonFormatter()],
+    ['sarif', new SarifFormatter()],
+]);
+/** Returns the formatter for the given ID, or throws listing available formats. */
+export function getFormatter(id) {
+    const formatter = formatters.get(id);
+    if (!formatter) {
+        const available = getAvailableFormats().join(', ');
+        throw new Error(`Unknown output format "${id}". Available formats: ${available}`);
+    }
+    return formatter;
+}
+/** Returns all registered format IDs. */
+export function getAvailableFormats() {
+    return Array.from(formatters.keys());
+}
+//# sourceMappingURL=index.js.map

package/dist/formatters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/formatters/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,MAAM,UAAU,GAAG,IAAI,GAAG,CAA0B;IAClD,CAAC,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/formatters/json-formatter.d.ts

@@ -0,0 +1,11 @@
+/**
+ * JSON output formatter — reproduces current default behavior.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+export declare class JsonFormatter implements OutputFormatter {
+    readonly id = "json";
+    readonly fileExtension = ".json";
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=json-formatter.d.ts.map

package/dist/formatters/json-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/json-formatter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,qBAAa,aAAc,YAAW,eAAe;IACnD,QAAQ,CAAC,EAAE,UAAU;IACrB,QAAQ,CAAC,aAAa,WAAW;IAEjC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;CAGrC"}

package/dist/formatters/json-formatter.js

@@ -0,0 +1,11 @@
+/**
+ * JSON output formatter — reproduces current default behavior.
+ */
+export class JsonFormatter {
+    id = 'json';
+    fileExtension = '.json';
+    format(results) {
+        return JSON.stringify(results, null, 2);
+    }
+}
+//# sourceMappingURL=json-formatter.js.map

package/dist/formatters/json-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-formatter.js","sourceRoot":"","sources":["../../src/formatters/json-formatter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,MAAM,CAAC;IACZ,aAAa,GAAG,OAAO,CAAC;IAEjC,MAAM,CAAC,OAAoB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/formatters/sarif-formatter.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SARIF 2.1.0 output formatter.
+ * Maps ScanResults to the SARIF schema for integration with
+ * code scanning UIs (e.g. GitHub Code Scanning) and SARIF viewers.
+ */
+import type { ScanResults } from '../types.js';
+import type { OutputFormatter } from './types.js';
+/** Maps aghast severity to SARIF result level. */
+export declare function mapSeverityToLevel(severity: string | undefined): 'error' | 'warning' | 'note';
+export declare class SarifFormatter implements OutputFormatter {
+    readonly id = "sarif";
+    readonly fileExtension = ".sarif";
+    format(results: ScanResults): string;
+    private buildRules;
+    private buildResults;
+    private buildCodeFlow;
+}
+//# sourceMappingURL=sarif-formatter.d.ts.map

package/dist/formatters/sarif-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAA+B,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAY7F;AA0DD,qBAAa,cAAe,YAAW,eAAe;IACpD,QAAQ,CAAC,EAAE,WAAW;IACtB,QAAQ,CAAC,aAAa,YAAY;IAElC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;IAwBpC,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,YAAY;IAgCpB,OAAO,CAAC,aAAa;CAiBtB"}

package/dist/formatters/sarif-formatter.js

@@ -0,0 +1,103 @@
+/**
+ * SARIF 2.1.0 output formatter.
+ * Maps ScanResults to the SARIF schema for integration with
+ * code scanning UIs (e.g. GitHub Code Scanning) and SARIF viewers.
+ */
+/** Maps aghast severity to SARIF result level. */
+export function mapSeverityToLevel(severity) {
+    switch (severity) {
+        case 'critical':
+        case 'high':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+        case 'informational':
+        default:
+            return 'note';
+    }
+}
+export class SarifFormatter {
+    id = 'sarif';
+    fileExtension = '.sarif';
+    format(results) {
+        const rules = this.buildRules(results);
+        const sarifResults = this.buildResults(results.issues);
+        const sarif = {
+            $schema: 'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json',
+            version: '2.1.0',
+            runs: [
+                {
+                    tool: {
+                        driver: {
+                            name: 'aghast',
+                            semanticVersion: results.version,
+                            rules,
+                        },
+                    },
+                    results: sarifResults,
+                },
+            ],
+        };
+        return JSON.stringify(sarif, null, 2);
+    }
+    buildRules(results) {
+        const seen = new Map();
+        for (const check of results.checks) {
+            if (!seen.has(check.checkId)) {
+                seen.set(check.checkId, {
+                    id: check.checkId,
+                    name: check.checkName,
+                    shortDescription: { text: check.checkName },
+                });
+            }
+        }
+        return Array.from(seen.values());
+    }
+    buildResults(issues) {
+        return issues.map((issue) => {
+            const region = {
+                startLine: issue.startLine,
+                endLine: issue.endLine,
+            };
+            if (issue.codeSnippet) {
+                region.snippet = { text: issue.codeSnippet };
+            }
+            const result = {
+                ruleId: issue.checkId,
+                message: { text: issue.description },
+                level: mapSeverityToLevel(issue.severity),
+                locations: [
+                    {
+                        physicalLocation: {
+                            artifactLocation: { uri: issue.file },
+                            region,
+                        },
+                    },
+                ],
+            };
+            if (issue.dataFlow && issue.dataFlow.length > 0) {
+                result.codeFlows = [this.buildCodeFlow(issue.dataFlow)];
+            }
+            return result;
+        });
+    }
+    buildCodeFlow(steps) {
+        return {
+            threadFlows: [
+                {
+                    locations: steps.map((step) => ({
+                        location: {
+                            physicalLocation: {
+                                artifactLocation: { uri: step.file },
+                                region: { startLine: step.lineNumber },
+                            },
+                            message: { text: step.label },
+                        },
+                    })),
+                },
+            ],
+        };
+    }
+}
+//# sourceMappingURL=sarif-formatter.js.map

package/dist/formatters/sarif-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-formatter.js","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK,CAAC;QACX,KAAK,eAAe,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AA0DD,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,OAAO,CAAC;IACb,aAAa,GAAG,QAAQ,CAAC;IAElC,MAAM,CAAC,OAAoB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAa;YACtB,OAAO,EAAE,4FAA4F;YACrG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,eAAe,EAAE,OAAO,CAAC,OAAO;4BAChC,KAAK;yBACN;qBACF;oBACD,OAAO,EAAE,YAAY;iBACtB;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,OAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;oBACtB,EAAE,EAAE,KAAK,CAAC,OAAO;oBACjB,IAAI,EAAE,KAAK,CAAC,SAAS;oBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,MAAuB;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAgB;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;gBACpC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzC,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE;4BACrC,MAAM;yBACP;qBACF;iBACF;aACF,CAAC;YAEF,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,KAAqB;QACzC,OAAO;YACL,WAAW,EAAE;gBACX;oBACE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC9B,QAAQ,EAAE;4BACR,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gCACpC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;6BACvC;4BACD,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;yBAC9B;qBACF,CAAC,CAAC;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/formatters/types.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Output formatter interface for scan results.
+ * Follows the AgentProvider interface pattern from src/types.ts.
+ */
+import type { ScanResults } from '../types.js';
+export interface OutputFormatter {
+    readonly id: string;
+    readonly fileExtension: string;
+    format(results: ScanResults): string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/formatters/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC;CACtC"}

package/dist/formatters/types.js

@@ -0,0 +1,6 @@
+/**
+ * Output formatter interface for scan results.
+ * Follows the AgentProvider interface pattern from src/types.ts.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/formatters/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/formatters/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI entry point for aghast.
+ * Usage: aghast scan <repository-path> --config-dir <path> [options]
+ */
+import 'dotenv/config';
+export declare function runScan(args: string[]): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AA4YvB,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsa3D"}