@owasp-aghast/aghast 0.8.4 → 0.9.0-rc.1

package/dist/ci-metadata.d.ts

@@ -0,0 +1,42 @@
+/**
+ * CI/CD pipeline metadata detection (spec E.4).
+ *
+ * Detects whether aghast is running inside a known CI/CD platform and
+ * collects pipeline context (job URL, branch, trigger, start time) from
+ * platform-specific environment variables.
+ *
+ * Supported platforms: GitHub Actions, GitLab CI, CircleCI. Extending to
+ * new platforms means adding another collector function below.
+ *
+ * The functions only read from a supplied env object (defaulting to
+ * `process.env`); they never mutate it and never throw.
+ */
+import type { CIMetadata } from './types.js';
+/** Read-only env shape (process.env compatible). */
+export type EnvLike = Readonly<Record<string, string | undefined>>;
+/**
+ * Every CI/CD environment variable this module consults. Exported so test
+ * helpers can scrub these vars in one place and stay in sync with this
+ * module — adding a new var here automatically updates the hermetic test
+ * scrub list.
+ */
+export declare const CI_ENV_VAR_NAMES: readonly string[];
+/**
+ * Returns true when aghast appears to be running inside a CI/CD environment.
+ *
+ * Most CI providers set `CI=true`; we also accept platform-specific signals
+ * (`GITHUB_ACTIONS`, `GITLAB_CI`, `CIRCLECI`) to cover edge cases where the
+ * generic `CI` flag is unset but the platform-specific flag is present. All
+ * flags accept the literal strings `'true'` or `'1'` for parity.
+ */
+export declare function detectCI(env?: EnvLike): boolean;
+/**
+ * Collect CI/CD metadata from the environment. Returns `undefined` when no
+ * CI signals are present, or when no platform-specific fields could be
+ * resolved (i.e. nothing useful to report).
+ *
+ * Platform precedence: GitHub Actions → GitLab CI → CircleCI. If multiple
+ * sets of variables somehow coexist, the first matched platform wins.
+ */
+export declare function collectCIMetadata(env?: EnvLike): CIMetadata | undefined;
+//# sourceMappingURL=ci-metadata.d.ts.map

package/dist/ci-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-metadata.d.ts","sourceRoot":"","sources":["../src/ci-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,oDAAoD;AACpD,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAqB7C,CAAC;AAOF;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,GAAE,OAAqB,GAAG,OAAO,CAO5D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,OAAqB,GAAG,UAAU,GAAG,SAAS,CAapF"}

package/dist/ci-metadata.js

@@ -0,0 +1,131 @@
+/**
+ * CI/CD pipeline metadata detection (spec E.4).
+ *
+ * Detects whether aghast is running inside a known CI/CD platform and
+ * collects pipeline context (job URL, branch, trigger, start time) from
+ * platform-specific environment variables.
+ *
+ * Supported platforms: GitHub Actions, GitLab CI, CircleCI. Extending to
+ * new platforms means adding another collector function below.
+ *
+ * The functions only read from a supplied env object (defaulting to
+ * `process.env`); they never mutate it and never throw.
+ */
+/**
+ * Every CI/CD environment variable this module consults. Exported so test
+ * helpers can scrub these vars in one place and stay in sync with this
+ * module — adding a new var here automatically updates the hermetic test
+ * scrub list.
+ */
+export const CI_ENV_VAR_NAMES = [
+    // Generic
+    'CI',
+    // GitHub Actions
+    'GITHUB_ACTIONS',
+    'GITHUB_SERVER_URL',
+    'GITHUB_REPOSITORY',
+    'GITHUB_RUN_ID',
+    'GITHUB_REF_NAME',
+    'GITHUB_EVENT_NAME',
+    'GITHUB_RUN_STARTED_AT',
+    // GitLab CI
+    'GITLAB_CI',
+    'CI_JOB_URL',
+    'CI_COMMIT_REF_NAME',
+    'CI_PIPELINE_SOURCE',
+    'CI_JOB_STARTED_AT',
+    // CircleCI
+    'CIRCLECI',
+    'CIRCLE_BUILD_URL',
+    'CIRCLE_BRANCH',
+];
+/** Returns true when the env var holds a recognised truthy CI flag value. */
+function isTrueFlag(value) {
+    return value === 'true' || value === '1';
+}
+/**
+ * Returns true when aghast appears to be running inside a CI/CD environment.
+ *
+ * Most CI providers set `CI=true`; we also accept platform-specific signals
+ * (`GITHUB_ACTIONS`, `GITLAB_CI`, `CIRCLECI`) to cover edge cases where the
+ * generic `CI` flag is unset but the platform-specific flag is present. All
+ * flags accept the literal strings `'true'` or `'1'` for parity.
+ */
+export function detectCI(env = process.env) {
+    return (isTrueFlag(env.CI) ||
+        isTrueFlag(env.GITHUB_ACTIONS) ||
+        isTrueFlag(env.GITLAB_CI) ||
+        isTrueFlag(env.CIRCLECI));
+}
+/**
+ * Collect CI/CD metadata from the environment. Returns `undefined` when no
+ * CI signals are present, or when no platform-specific fields could be
+ * resolved (i.e. nothing useful to report).
+ *
+ * Platform precedence: GitHub Actions → GitLab CI → CircleCI. If multiple
+ * sets of variables somehow coexist, the first matched platform wins.
+ */
+export function collectCIMetadata(env = process.env) {
+    if (!detectCI(env))
+        return undefined;
+    const collectors = [
+        collectGitHubActions,
+        collectGitLabCI,
+        collectCircleCI,
+    ];
+    for (const collect of collectors) {
+        const meta = collect(env);
+        if (meta && hasAnyField(meta))
+            return meta;
+    }
+    return undefined;
+}
+function hasAnyField(meta) {
+    return Boolean(meta.jobUrl ?? meta.branch ?? meta.pipelineSource ?? meta.jobStartedAt);
+}
+/** GitHub Actions: builds job URL from server/repo/run-id; reads ref + event + start time. */
+function collectGitHubActions(env) {
+    if (!isTrueFlag(env.GITHUB_ACTIONS))
+        return undefined;
+    const meta = {};
+    const server = env.GITHUB_SERVER_URL;
+    const repo = env.GITHUB_REPOSITORY;
+    const runId = env.GITHUB_RUN_ID;
+    if (server && repo && runId) {
+        meta.jobUrl = `${server}/${repo}/actions/runs/${runId}`;
+    }
+    if (env.GITHUB_REF_NAME)
+        meta.branch = env.GITHUB_REF_NAME;
+    if (env.GITHUB_EVENT_NAME)
+        meta.pipelineSource = env.GITHUB_EVENT_NAME;
+    if (env.GITHUB_RUN_STARTED_AT)
+        meta.jobStartedAt = env.GITHUB_RUN_STARTED_AT;
+    return meta;
+}
+/** GitLab CI: native fields cover all four metadata slots directly. */
+function collectGitLabCI(env) {
+    if (!isTrueFlag(env.GITLAB_CI))
+        return undefined;
+    const meta = {};
+    if (env.CI_JOB_URL)
+        meta.jobUrl = env.CI_JOB_URL;
+    if (env.CI_COMMIT_REF_NAME)
+        meta.branch = env.CI_COMMIT_REF_NAME;
+    if (env.CI_PIPELINE_SOURCE)
+        meta.pipelineSource = env.CI_PIPELINE_SOURCE;
+    if (env.CI_JOB_STARTED_AT)
+        meta.jobStartedAt = env.CI_JOB_STARTED_AT;
+    return meta;
+}
+/** CircleCI: only job URL + branch are exposed; trigger/start time are not standard. */
+function collectCircleCI(env) {
+    if (!isTrueFlag(env.CIRCLECI))
+        return undefined;
+    const meta = {};
+    if (env.CIRCLE_BUILD_URL)
+        meta.jobUrl = env.CIRCLE_BUILD_URL;
+    if (env.CIRCLE_BRANCH)
+        meta.branch = env.CIRCLE_BRANCH;
+    return meta;
+}
+//# sourceMappingURL=ci-metadata.js.map

package/dist/ci-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-metadata.js","sourceRoot":"","sources":["../src/ci-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,UAAU;IACV,IAAI;IACJ,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,uBAAuB;IACvB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,WAAW;IACX,UAAU;IACV,kBAAkB;IAClB,eAAe;CAChB,CAAC;AAEF,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAe,OAAO,CAAC,GAAG;IACjD,OAAO,CACL,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe,OAAO,CAAC,GAAG;IAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,UAAU,GAAoD;QAClE,oBAAoB;QACpB,eAAe;QACf,eAAe;KAChB,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACnC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;AACzF,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,iBAAiB,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,eAAe;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;IAC3D,IAAI,GAAG,CAAC,iBAAiB;QAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACvE,IAAI,GAAG,CAAC,qBAAqB;QAAE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,UAAU;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;IACjD,IAAI,GAAG,CAAC,kBAAkB;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACjE,IAAI,GAAG,CAAC,kBAAkB;QAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACzE,IAAI,GAAG,CAAC,iBAAiB;QAAE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAC7D,IAAI,GAAG,CAAC,aAAa;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.js

@@ -15,6 +15,7 @@ import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ERROR_CODES, formatError, formatFatalError } from './error-codes.js';
+import { docsFooter } from './docs-url.js';
 // Signal to subcommand modules that they're being imported, not run directly
 process.env._AGHAST_CLI = '1';
 const USAGE = `Usage: aghast <command> [options]
@@ -29,7 +30,9 @@ Options:
   --help      Show this help message
   --version   Show version number
 
-Run 'aghast <command> --help' for more information on a command.`;
+Run 'aghast <command> --help' for more information on a command.
+
+${docsFooter()}`;
 function getVersion() {
     const require = createRequire(import.meta.url);
     const pkg = require('../package.json');

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,KAAK,GAAG;;;;;;;;;;;;iEAYmD,CAAC;AAElE,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;IAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,4EAA4E;IAC5E,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC7D,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,KAAK,GAAG;;;;;;;;;;;;;;EAcZ,UAAU,EAAE,EAAE,CAAC;AAEjB,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;IAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,qCAAqC;IACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,4EAA4E;IAC5E,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC7D,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/concurrency.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared concurrency utilities for the scan runner and judge stage.
+ */
+/** Handle for signaling abort to mapWithConcurrency workers. */
+export interface AbortHandle {
+    aborted: boolean;
+    reason?: Error;
+}
+/**
+ * Run an async function over items with bounded concurrency.
+ * Spawns min(concurrency, items.length) workers that pull from a shared index.
+ * Results are written to a pre-allocated array to preserve input order.
+ *
+ * If abortHandle is provided, workers stop picking up new items once
+ * abortHandle.aborted is set to true. In-flight items complete naturally.
+ */
+export declare function mapWithConcurrency<T, R>(items: T[], concurrency: number, fn: (item: T, index: number) => Promise<R>, abortHandle?: AbortHandle): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../src/concurrency.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,CAAC,EAAE,EACV,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,EAAE,CAAC,CA6Bd"}

package/dist/concurrency.js

@@ -0,0 +1,39 @@
+/**
+ * Shared concurrency utilities for the scan runner and judge stage.
+ */
+/**
+ * Run an async function over items with bounded concurrency.
+ * Spawns min(concurrency, items.length) workers that pull from a shared index.
+ * Results are written to a pre-allocated array to preserve input order.
+ *
+ * If abortHandle is provided, workers stop picking up new items once
+ * abortHandle.aborted is set to true. In-flight items complete naturally.
+ */
+export async function mapWithConcurrency(items, concurrency, fn, abortHandle) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function worker() {
+        while (nextIndex < items.length) {
+            if (abortHandle?.aborted)
+                break;
+            // Safe without atomics: Node.js is single-threaded, so nextIndex++ is
+            // not interleaved — each worker awaits before looping, yielding to the
+            // event loop where the next worker reads and increments the same variable.
+            const i = nextIndex++;
+            results[i] = await fn(items[i], i);
+        }
+    }
+    const workerCount = Math.min(concurrency, items.length);
+    const workers = [];
+    for (let w = 0; w < workerCount; w++) {
+        workers.push(worker());
+    }
+    // Use allSettled so in-flight items complete before we propagate errors
+    const settled = await Promise.allSettled(workers);
+    const firstRejection = settled.find((r) => r.status === 'rejected');
+    if (firstRejection && firstRejection.status === 'rejected') {
+        throw firstRejection.reason;
+    }
+    return results;
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../src/concurrency.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAU,EACV,WAAmB,EACnB,EAA0C,EAC1C,WAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,UAAU,MAAM;QACnB,OAAO,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,WAAW,EAAE,OAAO;gBAAE,MAAM;YAChC,sEAAsE;YACtE,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3D,MAAM,cAAc,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cost-tracker.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared cost-tracking utilities for the scan runner and judge stage.
+ */
+import { type PricingConfig, type CostBreakdown } from './cost-calculator.js';
+import { type BudgetLimits } from './budget.js';
+import type { TokenUsage } from './types.js';
+import type { ScanRecord } from './scan-history.js';
+/**
+ * Tracks accumulated tokens/cost across a scan so the budget can be evaluated
+ * before each AI call. Mutated in place by AI invocations.
+ */
+export interface ScanCostTracker {
+    pricing?: PricingConfig;
+    budgetLimits?: BudgetLimits;
+    scanHistory?: ScanRecord[];
+    totalTokens: number;
+    totalCostUsd: number;
+    /** Cost source from the last recorded AI call. Used for banner labelling. */
+    lastCostSource?: CostBreakdown['source'];
+    lastCostReportedBy?: CostBreakdown['reportedBy'];
+    lastCostCoveredBySubscription?: boolean;
+    /** Set true after the first warn so we don't log it repeatedly. */
+    warned: boolean;
+    /** Most recent budget action returned to the runner. */
+    lastAction: 'continue' | 'warn' | 'abort';
+    /** Reason from the most recent non-continue check. */
+    lastReason?: string;
+}
+export declare function createCostTracker(options: {
+    pricing?: PricingConfig;
+    budgetLimits?: BudgetLimits;
+    scanHistory?: ScanRecord[];
+}): ScanCostTracker;
+/**
+ * Record an AI call's token usage against the tracker. Called after each
+ * successful executeCheck().
+ */
+export declare function recordUsage(tracker: ScanCostTracker, usage: TokenUsage | undefined, model: string): void;
+/**
+ * Check the budget before an AI call. Logs a warning the first time the warn
+ * threshold is crossed; throws BudgetExceededError when the abort threshold is
+ * crossed.
+ */
+export declare function preflightBudget(tracker: ScanCostTracker): void;
+//# sourceMappingURL=cost-tracker.d.ts.map

package/dist/cost-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-tracker.d.ts","sourceRoot":"","sources":["../src/cost-tracker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,kBAAkB,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACjD,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IAC1C,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B,GAAG,eAAe,CAUlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,UAAU,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GACZ,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAmB9D"}

package/dist/cost-tracker.js

@@ -0,0 +1,56 @@
+/**
+ * Shared cost-tracking utilities for the scan runner and judge stage.
+ */
+import { calculateCost } from './cost-calculator.js';
+import { checkBudget, BudgetExceededError } from './budget.js';
+import { logProgress } from './logging.js';
+const TAG = 'scan';
+export function createCostTracker(options) {
+    return {
+        pricing: options.pricing,
+        budgetLimits: options.budgetLimits,
+        scanHistory: options.scanHistory,
+        totalTokens: 0,
+        totalCostUsd: 0,
+        warned: false,
+        lastAction: 'continue',
+    };
+}
+/**
+ * Record an AI call's token usage against the tracker. Called after each
+ * successful executeCheck().
+ */
+export function recordUsage(tracker, usage, model) {
+    if (!usage || !tracker.pricing)
+        return;
+    const cost = calculateCost(usage, model, tracker.pricing);
+    tracker.totalTokens += usage.totalTokens;
+    tracker.totalCostUsd += cost.totalCost;
+    tracker.lastCostSource = cost.source;
+    tracker.lastCostReportedBy = cost.reportedBy;
+    tracker.lastCostCoveredBySubscription = cost.coveredBySubscription;
+}
+/**
+ * Check the budget before an AI call. Logs a warning the first time the warn
+ * threshold is crossed; throws BudgetExceededError when the abort threshold is
+ * crossed.
+ */
+export function preflightBudget(tracker) {
+    if (!tracker.budgetLimits)
+        return;
+    const status = checkBudget({
+        currentScanCostUsd: tracker.totalCostUsd,
+        currentScanTokens: tracker.totalTokens,
+        history: tracker.scanHistory,
+    }, tracker.budgetLimits);
+    tracker.lastAction = status.action;
+    tracker.lastReason = status.reason;
+    if (status.action === 'abort') {
+        throw new BudgetExceededError(status.reason ?? 'Budget limit exceeded');
+    }
+    if (status.action === 'warn' && !tracker.warned) {
+        tracker.warned = true;
+        logProgress(TAG, `Budget warning: ${status.reason ?? 'approaching limit'}`);
+    }
+}
+//# sourceMappingURL=cost-tracker.js.map

package/dist/cost-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-tracker.js","sourceRoot":"","sources":["../src/cost-tracker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAA0C,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAI3C,MAAM,GAAG,GAAG,MAAM,CAAC;AAwBnB,MAAM,UAAU,iBAAiB,CAAC,OAIjC;IACC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,UAAU;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,OAAwB,EACxB,KAA6B,EAC7B,KAAa;IAEb,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC;IACzC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC;IACvC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7C,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,qBAAqB,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,kBAAkB,EAAE,OAAO,CAAC,YAAY;QACxC,iBAAiB,EAAE,OAAO,CAAC,WAAW;QACtC,OAAO,EAAE,OAAO,CAAC,WAAW;KAC7B,EACD,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,CAAC,GAAG,EAAE,mBAAmB,MAAM,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/discoveries/glob-discovery.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Glob-based target discovery.
+ *
+ * Matches files in the repository by glob pattern (e.g. "src/routes/**\/*.ts")
+ * and returns each matched file as a whole-file target. Useful for checks that
+ * apply to entire files (e.g. "review every GraphQL resolver"), without
+ * requiring an external tool such as Semgrep.
+ *
+ * Spec reference: Appendix E.2.1.
+ */
+import type { TargetDiscovery, DiscoveredTarget } from '../discovery.js';
+/**
+ * Discover whole-file targets in `repoPath` matching `pattern`.
+ *
+ * Exposed as a named export (rather than only the registry-facing object) so
+ * unit tests can exercise the matching logic directly without going through
+ * the SecurityCheck plumbing.
+ */
+export declare function discoverGlobTargets(pattern: string, repoPath: string, maxTargets?: number): Promise<DiscoveredTarget[]>;
+export declare const globDiscovery: TargetDiscovery;
+//# sourceMappingURL=glob-discovery.d.ts.map

package/dist/discoveries/glob-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-discovery.d.ts","sourceRoot":"","sources":["../../src/discoveries/glob-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAoB,MAAM,iBAAiB,CAAC;AAmI3F;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoD7B;AAED,eAAO,MAAM,aAAa,EAAE,eAoC3B,CAAC"}

package/dist/discoveries/glob-discovery.js

@@ -0,0 +1,215 @@
+/**
+ * Glob-based target discovery.
+ *
+ * Matches files in the repository by glob pattern (e.g. "src/routes/**\/*.ts")
+ * and returns each matched file as a whole-file target. Useful for checks that
+ * apply to entire files (e.g. "review every GraphQL resolver"), without
+ * requiring an external tool such as Semgrep.
+ *
+ * Spec reference: Appendix E.2.1.
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { createReadStream } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import picomatch from 'picomatch';
+import { logDebug } from '../logging.js';
+import { ERROR_CODES, formatError } from '../error-codes.js';
+import { DEFAULT_GENERIC_PROMPT } from '../defaults.js';
+const TAG = 'glob-discovery';
+/**
+ * Skip files larger than this (in bytes) to avoid OOM when a wide glob
+ * (e.g. "**\/*") accidentally matches a large generated/binary file.
+ * Files above this threshold are excluded from the target set with a debug log.
+ */
+const MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024; // 10 MiB
+/** Directories that are always skipped when walking the repository tree. */
+const ALWAYS_SKIP_DIRS = new Set([
+    '.git',
+    'node_modules',
+    '.venv',
+    'venv',
+    '__pycache__',
+    '.tox',
+    '.mypy_cache',
+    '.pytest_cache',
+    'dist',
+    'build',
+    '.next',
+    '.nuxt',
+    '.cache',
+    '.idea',
+    '.vscode',
+]);
+function buildTargetPromptEnrichment(file, endLine) {
+    return `\n\nTARGET FILE:
+
+You are analyzing a specific file:
+- File: ${file}
+- Lines: 1-${endLine} (whole file)
+
+You MUST:
+- Analyze ONLY this specific file — do not search for or report issues in other files
+- You may read other files to understand context (e.g., imports, type definitions, data flow), but only report issues in this file
+- Do NOT scan the broader repository for other instances of this vulnerability pattern
+`;
+}
+/**
+ * Walk a directory tree recursively and yield every file path (POSIX-normalized,
+ * relative to `root`). Skips well-known noise directories so glob patterns do
+ * not have to opt out of `node_modules`/`.git` etc. on every check.
+ *
+ * Symlinks are NOT followed: `Dirent.isDirectory()` returns true only for real
+ * directories, so symlinked directories (and any cycles they could form) are
+ * skipped. Symlinked files are also skipped (`isFile()` returns false). This
+ * is the safe default — there's no general way to detect a hostile cycle, and
+ * source repos rarely rely on symlink-to-directory for layout.
+ */
+async function* walkFiles(root) {
+    async function* walk(dir) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (ALWAYS_SKIP_DIRS.has(entry.name))
+                    continue;
+                yield* walk(full);
+            }
+            else if (entry.isFile()) {
+                const rel = relative(root, full).split(sep).join('/');
+                yield rel;
+            }
+            // Symlinks (entry.isSymbolicLink()) are intentionally skipped — see
+            // the function-level comment above.
+        }
+    }
+    yield* walk(root);
+}
+/**
+ * Count the number of lines in a file by streaming and counting `\n` bytes.
+ * Constant memory; safe for very large files.
+ *
+ * Returns 1 for empty files so that `endLine >= startLine` always holds.
+ * Returns `undefined` if the file cannot be read or exceeds `MAX_FILE_SIZE_BYTES`
+ * — callers should treat that as "skip this target" and log accordingly.
+ */
+async function countLines(filePath) {
+    let size;
+    try {
+        const st = await stat(filePath);
+        size = st.size;
+    }
+    catch (err) {
+        logDebug(TAG, `failed to stat ${filePath} for line count: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    if (size > MAX_FILE_SIZE_BYTES) {
+        logDebug(TAG, `skipping ${filePath}: size ${size} bytes exceeds limit ${MAX_FILE_SIZE_BYTES}`);
+        return undefined;
+    }
+    if (size === 0)
+        return 1;
+    return new Promise((resolvePromise) => {
+        let newlineCount = 0;
+        let endsWithNewline = false;
+        const stream = createReadStream(filePath);
+        stream.on('data', (chunk) => {
+            // Treat the stream as bytes — counting `\n` bytes is safe for UTF-8 because
+            // 0x0A never appears as a continuation byte of a multi-byte sequence.
+            const buf = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+            for (let i = 0; i < buf.length; i++) {
+                if (buf[i] === 0x0a)
+                    newlineCount++;
+            }
+            if (buf.length > 0)
+                endsWithNewline = buf[buf.length - 1] === 0x0a;
+        });
+        stream.on('error', (err) => {
+            logDebug(TAG, `failed to read ${filePath} for line count: ${err.message}`);
+            resolvePromise(undefined);
+        });
+        stream.on('end', () => {
+            // If the file ends with a newline, the count of \n equals the number of lines.
+            // If it does not, the trailing partial line adds one to the count.
+            const lines = endsWithNewline ? newlineCount : newlineCount + 1;
+            resolvePromise(lines || 1);
+        });
+    });
+}
+/**
+ * Discover whole-file targets in `repoPath` matching `pattern`.
+ *
+ * Exposed as a named export (rather than only the registry-facing object) so
+ * unit tests can exercise the matching logic directly without going through
+ * the SecurityCheck plumbing.
+ */
+export async function discoverGlobTargets(pattern, repoPath, maxTargets) {
+    if (!pattern || pattern.trim() === '') {
+        throw new Error(formatError(ERROR_CODES.E2004, 'Glob discovery requires a non-empty "glob" pattern'));
+    }
+    const matcher = picomatch(pattern, { dot: false });
+    const matches = [];
+    for await (const rel of walkFiles(repoPath)) {
+        if (matcher(rel)) {
+            matches.push(rel);
+        }
+    }
+    // Sort BEFORE applying maxTargets so that the truncated subset is deterministic
+    // across platforms (readdir order varies by filesystem). Without this, a glob
+    // with maxTargets=N could analyze a different N files on Linux vs Windows vs
+    // macOS, making findings non-reproducible.
+    matches.sort();
+    const limited = typeof maxTargets === 'number' ? matches.slice(0, maxTargets) : matches;
+    // Compute line counts in parallel; drop unreadable / oversized files.
+    const lineCounts = await Promise.all(limited.map((rel) => countLines(join(repoPath, rel))));
+    const usable = [];
+    for (let i = 0; i < limited.length; i++) {
+        const endLine = lineCounts[i];
+        if (endLine === undefined)
+            continue; // unreadable / oversized — already logged
+        usable.push({ rel: limited[i], endLine });
+    }
+    // Surface a single summary log when files were dropped, so users debugging
+    // "why is my big bundle missing from the target set?" don't have to enable
+    // trace-level logging to find the per-file skip messages from countLines.
+    const skippedCount = limited.length - usable.length;
+    if (skippedCount > 0) {
+        logDebug(TAG, `${skippedCount} matched file${skippedCount === 1 ? '' : 's'} skipped (unreadable or > ${MAX_FILE_SIZE_BYTES} bytes)`);
+    }
+    return usable.map(({ rel, endLine }, idx) => ({
+        file: rel,
+        startLine: 1,
+        endLine,
+        label: `[file ${idx + 1}/${usable.length}]`,
+        promptEnrichment: buildTargetPromptEnrichment(rel, endLine),
+    }));
+}
+export const globDiscovery = {
+    name: 'glob',
+    defaultGenericPrompt: DEFAULT_GENERIC_PROMPT,
+    needsInstructions: true,
+    // Opted out deliberately. `supportsDiffFilter` became a required field on
+    // TargetDiscovery after this discovery was written (#227), and the diff
+    // filter is built around findings with meaningful line ranges. Glob targets
+    // are whole files, so filtering them has never been designed or tested for
+    // this shape. Opting out preserves the behaviour this discovery was built
+    // and tested with: a glob check scans every matching file. Enabling it later
+    // is a small change plus tests for the whole-file case.
+    supportsDiffFilter: false,
+    async discover(check, repoPath, _options) {
+        const checkTarget = check.checkTarget;
+        if (!checkTarget.glob) {
+            throw new Error(formatError(ERROR_CODES.E2004, `Check "${check.id}" uses glob discovery but has no "glob" pattern in its check definition`));
+        }
+        logDebug(TAG, `Running glob discovery for check "${check.id}": ${checkTarget.glob}`);
+        const targets = await discoverGlobTargets(checkTarget.glob, repoPath, checkTarget.maxTargets);
+        logDebug(TAG, `Discovered ${targets.length} files matching pattern`);
+        return targets;
+    },
+};
+//# sourceMappingURL=glob-discovery.js.map

package/dist/discoveries/glob-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-discovery.js","sourceRoot":"","sources":["../../src/discoveries/glob-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAEvD,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;IACN,aAAa;IACb,MAAM;IACN,aAAa;IACb,eAAe;IACf,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAAC,IAAY,EAAE,OAAe;IAChE,OAAO;;;UAGC,IAAI;aACD,OAAO;;;;;;CAMnB,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY;IACpC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW;QAC9B,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/C,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oEAAoE;YACpE,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,kBAAkB,QAAQ,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,YAAY,QAAQ,UAAU,IAAI,wBAAwB,mBAAmB,EAAE,CAAC,CAAC;QAC/F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEzB,OAAO,IAAI,OAAO,CAAqB,CAAC,cAAc,EAAE,EAAE;QACxD,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAC3C,4EAA4E;YAC5E,sEAAsE;YACtE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,QAAQ,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACpB,+EAA+E;YAC/E,mEAAmE;YACnE,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;YAChE,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,QAAgB,EAChB,UAAmB;IAEnB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,oDAAoD,CAAC,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,2CAA2C;IAC3C,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAExF,sEAAsE;IACtE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CACtD,CAAC;IACF,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,0CAA0C;QAC/E,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,QAAQ,CACN,GAAG,EACH,GAAG,YAAY,gBAAgB,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6BAA6B,mBAAmB,SAAS,CACtH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,GAAG;QACT,SAAS,EAAE,CAAC;QACZ,OAAO;QACP,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG;QAC3C,gBAAgB,EAAE,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;KAC5D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,MAAM;IACZ,oBAAoB,EAAE,sBAAsB;IAC5C,iBAAiB,EAAE,IAAI;IACvB,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,wDAAwD;IACxD,kBAAkB,EAAE,KAAK;IAEzB,KAAK,CAAC,QAAQ,CACZ,KAAoB,EACpB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAY,CAAC;QAEvC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,WAAW,CACT,WAAW,CAAC,KAAK,EACjB,UAAU,KAAK,CAAC,EAAE,yEAAyE,CAC5F,CACF,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,qCAAqC,KAAK,CAAC,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAErF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;QAE9F,QAAQ,CAAC,GAAG,EAAE,cAAc,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}