@salesforce/uibundle-sourcemap-validator-engine 11.35.0

package/LICENSE.txt

@@ -0,0 +1,82 @@
+Terms of Use
+
+Copyright 2026 Salesforce, Inc. All rights reserved.
+
+These Terms of Use govern the download, installation, and/or use of this
+software provided by Salesforce, Inc. ("Salesforce") (the "Software"), were
+last updated on April 15, 2025, and constitute a legally binding
+agreement between you and Salesforce. If you do not agree to these Terms of
+Use, do not install or use the Software.
+
+Salesforce grants you a worldwide, non-exclusive, no-charge, royalty-free
+copyright license to reproduce, prepare derivative works of, publicly
+display, publicly perform, sublicense, and distribute the Software and
+derivative works subject to these Terms. These Terms shall be included in
+all copies or substantial portions of the Software.
+
+Subject to the limited rights expressly granted hereunder, Salesforce
+reserves all rights, title, and interest in and to all intellectual
+property subsisting in the Software. No rights are granted to you hereunder
+other than as expressly set forth herein. Users residing in countries on
+the United States Office of Foreign Assets Control sanction list, or which
+are otherwise subject to a US export embargo, may not use the Software.
+
+Implementation of the Software may require development work, for which you
+are responsible. The Software may contain bugs, errors and
+incompatibilities and is made available on an AS IS basis without support,
+updates, or service level commitments.
+
+Salesforce reserves the right at any time to modify, suspend, or
+discontinue, the Software (or any part thereof) with or without notice. You
+agree that Salesforce shall not be liable to you or to any third party for
+any modification, suspension, or discontinuance.
+
+You agree to defend Salesforce against any claim, demand, suit or
+proceeding made or brought against Salesforce by a third party arising out
+of or accruing from (a) your use of the Software, and (b) any application
+you develop with the Software that infringes any copyright, trademark,
+trade secret, trade dress, patent, or other intellectual property right of
+any person or defames any person or violates their rights of publicity or
+privacy (each a "Claim Against Salesforce"), and will indemnify Salesforce
+from any damages, attorney fees, and costs finally awarded against
+Salesforce as a result of, or for any amounts paid by Salesforce under a
+settlement approved by you in writing of, a Claim Against Salesforce,
+provided Salesforce (x) promptly gives you written notice of the Claim
+Against Salesforce, (y) gives you sole control of the defense and
+settlement of the Claim Against Salesforce (except that you may not settle
+any Claim Against Salesforce unless it unconditionally releases Salesforce
+of all liability), and (z) gives you all reasonable assistance, at your
+expense.
+
+WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, THE SOFTWARE IS NOT
+SUPPORTED AND IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL SALESFORCE HAVE ANY LIABILITY FOR ANY DAMAGES,
+INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL, INCIDENTAL,
+PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR DAMAGES BASED ON LOST PROFITS, DATA,
+OR USE, IN CONNECTION WITH THE SOFTWARE, HOWEVER CAUSED AND WHETHER IN
+CONTRACT, TORT, OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT YOU
+HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+These Terms of Use shall be governed exclusively by the internal laws of
+the State of California, without regard to its conflicts of laws
+rules. Each party hereby consents to the exclusive jurisdiction of the
+state and federal courts located in San Francisco County, California to
+adjudicate any dispute arising out of or relating to these Terms of Use and
+the download, installation, and/or use of the Software. Except as expressly
+stated herein, these Terms of Use constitute the entire agreement between
+the parties, and supersede all prior and contemporaneous agreements,
+proposals, or representations, written or oral, concerning their subject
+matter. No modification, amendment, or waiver of any provision of these
+Terms of Use shall be effective unless it is by an update to these Terms of
+Use that Salesforce makes available, or is in writing and signed by the
+party against whom the modification, amendment, or waiver is to be
+asserted.
+
+Data Privacy: Salesforce may collect, process, and store device,
+system, and other information related to your use of the Software. This
+information includes, but is not limited to, IP address, user metrics, and
+other data ("Usage Data"). Salesforce may use Usage Data for analytics,
+product development, and marketing purposes. You acknowledge that files
+generated in conjunction with the Software may contain sensitive or
+confidential data, and you are solely responsible for anonymizing and
+protecting such data.

package/README.md

@@ -0,0 +1,243 @@
+# uibundle-sourcemap-validator-engine
+
+A Salesforce Code Analyzer (SFCA v5+) custom engine that verifies UI Bundle build-output integrity by cross-checking each shipped `dist/` artifact against its declared sourcemap and the submitted `src/` tree.
+
+**At a glance**
+
+|                                                                        |                                                   |
+| ---------------------------------------------------------------------- | ------------------------------------------------- |
+| npm package                                                            | `@salesforce/uibundle-sourcemap-validator-engine` |
+| Engine identifier (in `--rule-selector`, `engines:`, violation output) | `uibundle-sourcemap-validator`                    |
+| Aggregate tag (selects every rule this engine ships)                   | `UIBundleIntegrity`                               |
+| Common tags every rule carries                                         | `Recommended`, `Security`, `Javascript`           |
+
+## What it does
+
+Eight rules total. Each rule is tagged `Recommended` + `Security` + `Javascript` + `UIBundleIntegrity`. Five are gating (Layer 1: findings mean the bundle should fail review); three are informational (Layers 2–4: signal-generating diagnostics for suspicious mappings that do not on their own warrant a hard fail).
+
+**Layer 1 — Gating (Critical / High / Moderate):**
+
+| Rule                          | Severity | What it checks                                                                                                                                                                                                                                                                       |
+| ----------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `missing-sourcemap`           | High     | Every `.js` in `dist/` has a co-located `.js.map` or an inline `//# sourceMappingURL`. Also flags orphan `.js` files that contain dangerous API substrings (e.g. `document.cookie`, `XMLHttpRequest`, dynamic-code sinks).                                                           |
+| `path-leakage`                | Moderate | `sources[]` entries are relative — no `/Users/...`, `C:\...`, `file://...`                                                                                                                                                                                                           |
+| `invalid-source-references`   | High     | Every `sources[]` entry (without inline `sourcesContent`) resolves to a real file on disk                                                                                                                                                                                            |
+| `vlq-integrity`               | High     | `mappings` field is valid JSON, valid VLQ, and source/name indices are in range                                                                                                                                                                                                      |
+| `source-content-verification` | Critical | Byte-equal `sourcesContent` vs submitted source, virtual-source ratio cap (>20% flagged), AST coverage vs threshold (95% for files ≥500 nodes, 70% otherwise), AST type-mismatch (0.20 threshold with a compatibility matrix), dangerous-API pattern check on unmapped AST snippets. |
+
+**Layers 2–4 — Informational (Info):**
+
+| Rule                   | Severity | What it checks                                                                                                                                                                                                                     |
+| ---------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `coverage-analysis`    | Info     | Character-level coverage: per-line unmapped regions ≥ 50 chars, cumulative unmapped percentage > 2% (line-1 preamble discounted up to 150 chars).                                                                                  |
+| `structural-coherence` | Info     | Bounds check (mapped positions inside source file), whitespace/comment-only sampling every 10th mapping (>80% suspicious), cross-file jump ratio (>50% on consecutive same-line tokens).                                           |
+| `token-consistency`    | Info     | Every 20th token: source-vs-generated token category match (StringLiteral / NumericLiteral / Identifier / Punctuation / Other), name existence check within ±3 col of claimed position, verdict bands 0.85 warn / 0.70 suspicious. |
+
+All eight rules are pure TypeScript — no native binaries, one npm install.
+
+## Lifecycle
+
+This engine runs on **build output**, not source. Every UI Bundle must be built (`npm run build`) before `sf code-analyzer run` — otherwise the engine finds no `dist/` directory and logs an info message with zero violations (not a failure). This is a deliberate mismatch with SFCA's usual source-static model; documented at length in the design discussion in `docs/`.
+
+## Install
+
+```bash
+npm install --save-dev @salesforce/uibundle-sourcemap-validator-engine
+```
+
+Enable in `code-analyzer.yml` at the SFDX project root. Note the split: the plugin is registered by its **npm package name** (`@salesforce/uibundle-sourcemap-validator-engine`), but the **engine identifier** used everywhere else in the config — and in `--rule-selector` on the CLI — is `uibundle-sourcemap-validator` (no `-engine` suffix, matching the SFCA convention where `@salesforce/code-analyzer-retirejs-engine` exposes an engine named `retire-js`, `code-analyzer-eslint-engine` exposes `eslint`, etc.).
+
+```yaml
+custom_engine_plugin_modules:
+  - "@salesforce/uibundle-sourcemap-validator-engine" # npm package (has -engine suffix)
+
+engines:
+  uibundle-sourcemap-validator: # engine identifier (no suffix)
+    disable_engine: false
+```
+
+### Recommended `code-analyzer.yml`
+
+The following config is what the two demo projects use. It (a) registers the plugin, (b) tells every _other_ engine to ignore `dist/**` so they don't false-positive on minified bundler runtime code (the sourcemap-validator engine locates each UI Bundle via its `ui-bundle.json` marker in `src/` and reads the sibling `dist/` directly from disk, so it is unaffected by this ignore), and (c) disables the JVM-based engines that don't apply to a JS/UI-Bundle codebase:
+
+```yaml
+custom_engine_plugin_modules:
+  - "@salesforce/uibundle-sourcemap-validator-engine"
+
+# dist/** is built output. Excluding it from the workspace file list means the
+# other engines (eslint, retire-js, regex, ...) never see it — no false positives
+# on minified bundler runtime code. The sourcemap validator locates each UI
+# Bundle via its `ui-bundle.json` / `*.uibundle-meta.xml` marker in src/ and
+# reads the sibling dist/ directly from disk, so it is unaffected by this ignore.
+ignores:
+  files:
+    - "**/dist/**"
+
+suppressions:
+  "force-app/main/default/uiBundles":
+    - rule_selector: "eslint:@lwc/lwc"
+    - rule_selector: "eslint:@lwc/lwc-platform"
+
+engines:
+  pmd:
+    disable_engine: true
+  cpd:
+    disable_engine: true
+  sfge:
+    disable_engine: true
+  flow:
+    disable_engine: true
+  uibundle-sourcemap-validator:
+    disable_engine: false
+```
+
+### Recommended invocation
+
+Build every UI Bundle first (otherwise the engine finds no `dist/` and emits zero violations), then run the canonical AppExchange + Recommended-Security scan with the engine explicitly named:
+
+```bash
+# 1. Build every UI Bundle in the SFDX project
+for bundle in force-app/main/default/uiBundles/*/; do
+  (cd "$bundle" && npm run build)
+done
+
+# 2. Run the scan
+sf code-analyzer run \
+  --rule-selector AppExchange \
+  --rule-selector Recommended:Security \
+  --rule-selector UIBundleIntegrity \
+  --output-file CodeAnalyzerReport.html
+```
+
+Every selector is a **tag** — a label attached to rules, matched against the shape SFCA already uses (`AppExchange`, `Recommended:Security`). The three compose as a union:
+
+| Selector               | What it selects                                                                                                                                                                                        |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `AppExchange`          | Every rule tagged for AppExchange package review (from `pmd`, `regex`, `retire-js`, `eslint`, etc.)                                                                                                    |
+| `Recommended:Security` | Every rule tagged both `Recommended` and `Security` — this already picks up the eight `uibundle-sourcemap-validator` rules by their tags.                                                              |
+| `UIBundleIntegrity`    | Belt-and-braces: an engine-specific tag on every rule in `uibundle-sourcemap-validator`, so all eight run even if a future recommendation-tag pruning removed one of them from `Recommended:Security`. |
+
+## What the engine looks for
+
+The engine scans targeted files for two UI Bundle markers:
+
+1. **Bundle roots** — directories containing `ui-bundle.json` or `*.uibundle-meta.xml`
+2. **`dist/` ancestors** — any targeted file living inside a `dist/` folder
+
+For each bundle root found, the engine runs all eight validators against `<bundleRoot>/dist`. `source-content-verification`, `structural-coherence`, and `token-consistency` additionally require `<bundleRoot>/src` as the source path — if it doesn't exist those rules are skipped with a warn-level log message; the other five rules still run.
+
+## Sample output
+
+Both scans below were produced with the recommended invocation against the two demo UI Bundles that ship with this repo (`demo/testb2epkgapp1` clean and `demo/testb2epkgapp1_vuln` after `node scripts/tamper.mjs --src <path>` planted six independent tamper vectors).
+
+**Clean bundle** — 14 violations, 1 Critical + 13 Info. The single Critical is `source-content-verification` flagging two GraphQL `?raw` imports that the bundler inlines as pseudo-sources; every other finding is Info-tier signal (coverage anomalies on line 1 preamble, JSX runtime name narrowing, Radix member-expression name reporting).
+
+![Clean bundle SFCA report — 14 violations, all from uibundle-sourcemap-validator](docs/report-clean.png)
+
+**Tampered bundle** — 48 violations across all planted vectors: absolute-path leakage in `sources[0]`, phantom source reference in `sources[1]`, byte-corrupted `sourcesContent[]`, 5 appended stealth functions after `//# sourceMappingURL`, 35% virtual-source ratio, and a planted `stealth-orphan.js` with dangerous-API substrings. 14 Critical + 3 High + 1 Moderate + 30 Info.
+
+![Tampered bundle SFCA report — 48 violations across missing-sourcemap, path-leakage, invalid-source-references, source-content-verification, coverage-analysis, structural-coherence, and token-consistency](docs/report-vuln.png)
+
+Both HTML reports are checked into `docs/report-clean.html` and `docs/report-vuln.html` — open either in a browser to explore the full findings interactively.
+
+## Output
+
+Violations are emitted in the standard SFCA format — SARIF, JSON, HTML, and CSV are all produced by SFCA's built-in formatters. CI integrations (GitHub code scanning, Sonar, etc.) that already ingest SFCA output work without changes.
+
+## Development
+
+```bash
+npm install
+npm run build     # tsc → dist/
+npm test          # vitest
+```
+
+### Demo scripts
+
+Three helper scripts under `scripts/` make it easy to see the engine catch real tampering without spinning up SFCA. All three require `--src <uiBundleRoot>` — the directory that contains the bundle's `src/` and `dist/`:
+
+```bash
+# 1. Baseline scan of a clean bundle
+node scripts/scan.mjs --src path/to/uiBundles/myBundle
+
+# 2. Plant six tampering vectors in the bundle's dist/
+node scripts/tamper.mjs --src path/to/uiBundles/myBundle
+
+# 3. Re-scan and watch every vector get caught
+node scripts/scan.mjs --src path/to/uiBundles/myBundle
+
+# 4. Restore the bundle from .orig backups
+node scripts/revert.mjs --src path/to/uiBundles/myBundle
+```
+
+The tamper script plants six independent vectors, one per Layer-1 rule surface:
+
+1. `path-leakage` — rewrites `sources[0]` to `/Users/attacker/...`.
+2. `invalid-source-references` — rewrites `sources[1]` to a phantom path and nulls its inline `sourcesContent`.
+3. `source-content-verification` (AST/dangerous) — appends 5 exfil/backdoor functions after the `//# sourceMappingURL` comment.
+4. `source-content-verification` (byte-equal) — corrupts a `sourcesContent[i]` entry so it no longer matches the submitted source.
+5. `missing-sourcemap` (orphan-JS scan) — writes `stealth-orphan.js` into `dist/` with dangerous API patterns and no map.
+6. `source-content-verification` (virtual-source ratio) — rewrites ~35% of `sources[]` to bundler pseudo-paths (`webpack/…`, `vite/…`, `<runtime>`) to breach the 20% gate.
+
+Tampering writes `<file>.orig` next to the modified files, so `revert.mjs` is always safe to run (it also deletes `stealth-orphan.js`).
+
+Package layout:
+
+```
+src/
+├── index.ts                              # Public exports
+├── engine.ts                             # SourcemapValidatorEngine (implements SFCA Engine)
+├── plugin.ts                             # SourcemapValidatorEnginePlugin (SFCA plugin entry)
+├── rules.ts                              # RuleDescription[]
+└── validators/
+    ├── types.ts                          # ValidatorFinding, ValidatorResult
+    ├── sourcemap-io.ts                   # Shared: walk + collectSourceMaps
+    ├── classification.ts                 # Path helpers + dangerous-API pattern list
+    ├── missing-sourcemap.ts              # Rule 1 (+ orphan-JS API scan)
+    ├── path-leakage.ts                   # Rule 2
+    ├── invalid-source-references.ts     # Rule 3
+    ├── vlq-integrity.ts                  # Rule 4
+    ├── source-content-verification.ts   # Rule 5 — byte-equal + AST coverage/type/dangerous
+    ├── coverage-analysis.ts              # Rule 6 — Layer 2 char-level coverage (Info)
+    ├── structural-coherence.ts           # Rule 7 — Layer 3 bounds/whitespace/jump (Info)
+    └── token-consistency.ts              # Rule 8 — Layer 4 token type + name (Info)
+tests/
+├── missing-sourcemap.test.ts
+├── path-leakage.test.ts
+├── invalid-source-references.test.ts
+├── vlq-integrity.test.ts
+├── source-content-verification.test.ts
+├── coverage-analysis.test.ts
+├── structural-coherence.test.ts
+└── token-consistency.test.ts
+```
+
+Validators are SFCA-agnostic — each takes a `distPath: string` and returns `ValidatorResult`. The engine layer maps findings to SFCA `Violation` objects. This keeps the validation logic independently testable and reusable outside SFCA.
+
+## Known limitations
+
+- `source-content-verification` uses the bundle's `src/` sibling as the source root. Bundles that use a different layout will produce spurious "source not found" findings — configurable source path is on the roadmap.
+- `invalid-source-references` skips inline `sourcesContent`. That's technically correct per the sourcemap spec (self-contained sources need not exist), but it also means an attacker can hide a fabricated source by embedding it inline. The `source-content-verification` rule is the mitigation — it walks compiled AST nodes and confirms each maps into a source file that actually exists.
+- `@babel/parser` is used with `sourceType: 'unambiguous'` and JSX + TypeScript plugins enabled with `errorRecovery: true`, which handles the vast majority of UI Bundle build output. Extremely exotic dialects (e.g. Flow syntax, custom Babel plugin output) may fail to parse and surface a "compiled JS failed to parse" finding rather than a coverage measurement.
+
+## Inputs
+
+The engine takes no CLI arguments — both the source and dist paths are derived automatically from the files SFCA passes in. For each targeted file, the engine walks up to find a `dist/` ancestor (or a `ui-bundle.json` / `*.uibundle-meta.xml` marker) and treats its parent as the bundle root. It then uses:
+
+- `<bundleRoot>/dist` for all eight rules
+- `<bundleRoot>/src` for `source-content-verification`, `structural-coherence`, and `token-consistency` (skipped with a `Warn` log if missing; the other five rules still run)
+
+Example — scanning a UI bundle via the helper script:
+
+```bash
+node scripts/scan.mjs --src path/to/uiBundles/myBundle
+```
+
+## Why pure TypeScript
+
+Earlier iterations of this engine wrapped a Rust binary (`uibundle-sourcemap-validator`) for the AST-based Layer 1 check. That was dropped in favor of a pure-TS implementation using `@babel/parser` and `@jridgewell/trace-mapping`:
+
+- **One npm install, no native binary** — the engine ships as a single package and works out of the box in every environment SFCA runs in (Node ≥ 18).
+- **No output-format brittleness** — the earlier design shelled out and regex-parsed unstructured text from the Rust tool; direct API calls remove that failure mode.
+- **Slower but fast enough** — `@babel/parser` is measurably slower than `oxc` on very large files, but SFCA's per-bundle scan is not a hot path.
+- **Behavior parity** — all four Rust validation layers (source content, AST, coverage, coherence, token consistency) are ported line-for-line with the same thresholds (95/70% coverage, 0.20 type-mismatch, 20% virtual-source ratio, 2% cumulative unmapped, 50%/80% coherence, 0.70/0.85 token bands, ±3 col name tolerance) and the same significant-node set.

package/dist/engine.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { Engine, type DescribeOptions, type EngineRunResults, type RuleDescription, type RunOptions } from "@salesforce/code-analyzer-engine-api";
+export declare const ENGINE_NAME = "uibundle-sourcemap-validator";
+export declare class SourcemapValidatorEngine extends Engine {
+    getName(): string;
+    getEngineVersion(): Promise<string>;
+    describeRules(_options: DescribeOptions): Promise<RuleDescription[]>;
+    runRules(ruleNames: string[], runOptions: RunOptions): Promise<EngineRunResults>;
+    private runOnTarget;
+    private consumeResult;
+    private findBundleTargets;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EACN,MAAM,EAEN,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,MAAM,sCAAsC,CAAC;AA8B9C,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAO1D,qBAAa,wBAAyB,SAAQ,MAAM;IACnD,OAAO,IAAI,MAAM;IAIX,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAIpE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAoBxE,WAAW;IA8CzB,OAAO,CAAC,aAAa;YAkBP,iBAAiB;CA6B/B"}

package/dist/engine.js

@@ -0,0 +1,142 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { Engine, LogLevel, } from "@salesforce/code-analyzer-engine-api";
+import { RULES, RULE_NAMES } from "./rules.js";
+import { COVERAGE_ANALYSIS_RULE, validateCoverageAnalysis, } from "./validators/coverage-analysis.js";
+import { INVALID_SOURCE_REFERENCES_RULE, validateInvalidSourceReferences, } from "./validators/invalid-source-references.js";
+import { MISSING_SOURCEMAP_RULE, validateMissingSourcemaps, } from "./validators/missing-sourcemap.js";
+import { PATH_LEAKAGE_RULE, validatePathLeakage } from "./validators/path-leakage.js";
+import { SOURCE_CONTENT_VERIFICATION_RULE, validateSourceContent, } from "./validators/source-content-verification.js";
+import { STRUCTURAL_COHERENCE_RULE, validateStructuralCoherence, } from "./validators/structural-coherence.js";
+import { TOKEN_CONSISTENCY_RULE, validateTokenConsistency, } from "./validators/token-consistency.js";
+import { VLQ_INTEGRITY_RULE, validateVlqIntegrity } from "./validators/vlq-integrity.js";
+export const ENGINE_NAME = "uibundle-sourcemap-validator";
+export class SourcemapValidatorEngine extends Engine {
+    getName() {
+        return ENGINE_NAME;
+    }
+    async getEngineVersion() {
+        return "0.1.0";
+    }
+    async describeRules(_options) {
+        return RULES;
+    }
+    async runRules(ruleNames, runOptions) {
+        const selected = ruleNames.filter((name) => RULE_NAMES.has(name));
+        if (selected.length === 0)
+            return { violations: [] };
+        const targets = await this.findBundleTargets(runOptions);
+        if (targets.length === 0) {
+            this.emitLogEvent(LogLevel.Info, `[${ENGINE_NAME}] No UI Bundle dist/ directories found. Run 'npm run build' in each UI Bundle before code analysis.`);
+            return { violations: [] };
+        }
+        const violations = [];
+        for (const target of targets) {
+            await this.runOnTarget(target, selected, violations);
+        }
+        return { violations };
+    }
+    async runOnTarget(target, selected, violations) {
+        const distOnlyDispatch = [
+            [MISSING_SOURCEMAP_RULE, () => validateMissingSourcemaps(target.distPath)],
+            [PATH_LEAKAGE_RULE, () => validatePathLeakage(target.distPath)],
+            [INVALID_SOURCE_REFERENCES_RULE, () => validateInvalidSourceReferences(target.distPath)],
+            [VLQ_INTEGRITY_RULE, () => validateVlqIntegrity(target.distPath)],
+            [COVERAGE_ANALYSIS_RULE, () => validateCoverageAnalysis(target.distPath)],
+        ];
+        for (const [ruleName, runValidator] of distOnlyDispatch) {
+            if (!selected.includes(ruleName))
+                continue;
+            const result = await runValidator();
+            this.consumeResult(ruleName, target.distPath, result, violations);
+        }
+        // Rules that also require the submitted source tree
+        const sourceDispatch = [
+            [SOURCE_CONTENT_VERIFICATION_RULE, validateSourceContent],
+            [STRUCTURAL_COHERENCE_RULE, validateStructuralCoherence],
+            [TOKEN_CONSISTENCY_RULE, validateTokenConsistency],
+        ];
+        for (const [ruleName, runValidator] of sourceDispatch) {
+            if (!selected.includes(ruleName))
+                continue;
+            if (!target.sourcePath) {
+                this.emitLogEvent(LogLevel.Warn, `[${ENGINE_NAME}] Skipping ${ruleName} for ${target.distPath}: could not locate a source directory sibling to dist/.`);
+                continue;
+            }
+            const result = await runValidator({
+                sourcePath: target.sourcePath,
+                distPath: target.distPath,
+            });
+            this.consumeResult(ruleName, target.distPath, result, violations);
+        }
+    }
+    consumeResult(ruleName, distPath, result, violations) {
+        if (result.skipped) {
+            this.emitLogEvent(LogLevel.Warn, `[${ENGINE_NAME}] ${ruleName} skipped for ${distPath}: ${result.skipped.reason}`);
+            return;
+        }
+        for (const finding of result.findings) {
+            violations.push(toViolation(finding));
+        }
+    }
+    async findBundleTargets(runOptions) {
+        const targetedFiles = await runOptions.workspace.getTargetedFiles();
+        const bundleRoots = new Set();
+        for (const file of targetedFiles) {
+            const base = path.basename(file);
+            if (base === "ui-bundle.json" || base.endsWith(".uibundle-meta.xml")) {
+                bundleRoots.add(path.dirname(file));
+            }
+        }
+        // Fallback: any file inside a dist/ directory contributes a bundle whose bundle root is that dist's parent.
+        for (const file of targetedFiles) {
+            const dist = findAncestorNamed(file, "dist");
+            if (dist)
+                bundleRoots.add(path.dirname(dist));
+        }
+        const targets = [];
+        for (const bundleRoot of bundleRoots) {
+            const distPath = path.join(bundleRoot, "dist");
+            if (!(await isDirectory(distPath)))
+                continue;
+            const srcPath = path.join(bundleRoot, "src");
+            const sourcePath = (await isDirectory(srcPath)) ? srcPath : null;
+            targets.push({ distPath, sourcePath });
+        }
+        return targets;
+    }
+}
+function toViolation(finding) {
+    // SFCA requires 1-based line/column; validators emit 0-based columns (Babel/trace-mapping).
+    const startLine = Math.max(1, finding.startLine ?? 1);
+    const rawCol = finding.startColumn;
+    const startColumn = rawCol == null ? 1 : Math.max(1, rawCol + 1);
+    return {
+        ruleName: finding.ruleName,
+        message: finding.message,
+        primaryLocationIndex: 0,
+        codeLocations: [{ file: finding.file, startLine, startColumn }],
+    };
+}
+async function isDirectory(p) {
+    try {
+        const stat = await fs.stat(p);
+        return stat.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function findAncestorNamed(filePath, name) {
+    const parts = filePath.split(path.sep);
+    const idx = parts.lastIndexOf(name);
+    if (idx <= 0)
+        return null;
+    return parts.slice(0, idx + 1).join(path.sep);
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACN,MAAM,EACN,QAAQ,GAMR,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,GAC/B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACN,sBAAsB,EACtB,yBAAyB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EACN,gCAAgC,EAChC,qBAAqB,GACrB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACN,yBAAyB,EACzB,2BAA2B,GAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAEzF,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAO1D,MAAM,OAAO,wBAAyB,SAAQ,MAAM;IACnD,OAAO;QACN,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,gBAAgB;QACrB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAyB;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAmB,EAAE,UAAsB;QACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAChB,QAAQ,CAAC,IAAI,EACb,IAAI,WAAW,qGAAqG,CACpH,CAAC;YACF,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,WAAW,CACxB,MAAoB,EACpB,QAAkB,EAClB,UAAuB;QAEvB,MAAM,gBAAgB,GAA+C;YACpE,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACzE,CAAC;QAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,oDAAoD;QACpD,MAAM,cAAc,GAGd;YACL,CAAC,gCAAgC,EAAE,qBAAqB,CAAC;YACzD,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YACxD,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SAClD,CAAC;QAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC,YAAY,CAChB,QAAQ,CAAC,IAAI,EACb,IAAI,WAAW,cAAc,QAAQ,QAAQ,MAAM,CAAC,QAAQ,yDAAyD,CACrH,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAEO,aAAa,CACpB,QAAgB,EAChB,QAAgB,EAChB,MAAuB,EACvB,UAAuB;QAEvB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAChB,QAAQ,CAAC,IAAI,EACb,IAAI,WAAW,KAAK,QAAQ,gBAAgB,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAChF,CAAC;YACF,OAAO;QACR,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,UAAsB;QACrD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAEpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACtE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;QAED,4GAA4G;QAC5G,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAEjE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;CACD;AAED,SAAS,WAAW,CAAC,OAAyB;IAC7C,4FAA4F;IAC5F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO;QACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,CAAC;QACvB,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;KAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+export { SourcemapValidatorEngine, ENGINE_NAME } from "./engine.js";
+export { SourcemapValidatorEnginePlugin, createEnginePlugin } from "./plugin.js";
+export { RULES } from "./rules.js";
+export { MISSING_SOURCEMAP_RULE, validateMissingSourcemaps, } from "./validators/missing-sourcemap.js";
+export { PATH_LEAKAGE_RULE, validatePathLeakage } from "./validators/path-leakage.js";
+export { INVALID_SOURCE_REFERENCES_RULE, validateInvalidSourceReferences, } from "./validators/invalid-source-references.js";
+export { VLQ_INTEGRITY_RULE, validateVlqIntegrity } from "./validators/vlq-integrity.js";
+export { SOURCE_CONTENT_VERIFICATION_RULE, validateSourceContent, } from "./validators/source-content-verification.js";
+export { COVERAGE_ANALYSIS_RULE, validateCoverageAnalysis, analyzeCoverage, } from "./validators/coverage-analysis.js";
+export { STRUCTURAL_COHERENCE_RULE, validateStructuralCoherence, analyzeCoherence, pointsToWhitespaceOrComment, } from "./validators/structural-coherence.js";
+export { TOKEN_CONSISTENCY_RULE, validateTokenConsistency, analyzeTokenConsistency, classifyTokenAt, } from "./validators/token-consistency.js";
+export { DANGEROUS_API_PATTERNS, DANGEROUS_AST_EXTRA_PATTERNS, containsDangerousApi, containsDangerousPattern, isAsset, isDependency, isVirtualSource, normalizeSourcePath, } from "./validators/classification.js";
+export type { ValidatorFinding, ValidatorResult } from "./validators/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,sBAAsB,EACtB,yBAAyB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,GAC/B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACN,gCAAgC,EAChC,qBAAqB,GACrB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,GACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,2BAA2B,GAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,GACnB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+export { SourcemapValidatorEngine, ENGINE_NAME } from "./engine.js";
+export { SourcemapValidatorEnginePlugin, createEnginePlugin } from "./plugin.js";
+export { RULES } from "./rules.js";
+export { MISSING_SOURCEMAP_RULE, validateMissingSourcemaps, } from "./validators/missing-sourcemap.js";
+export { PATH_LEAKAGE_RULE, validatePathLeakage } from "./validators/path-leakage.js";
+export { INVALID_SOURCE_REFERENCES_RULE, validateInvalidSourceReferences, } from "./validators/invalid-source-references.js";
+export { VLQ_INTEGRITY_RULE, validateVlqIntegrity } from "./validators/vlq-integrity.js";
+export { SOURCE_CONTENT_VERIFICATION_RULE, validateSourceContent, } from "./validators/source-content-verification.js";
+export { COVERAGE_ANALYSIS_RULE, validateCoverageAnalysis, analyzeCoverage, } from "./validators/coverage-analysis.js";
+export { STRUCTURAL_COHERENCE_RULE, validateStructuralCoherence, analyzeCoherence, pointsToWhitespaceOrComment, } from "./validators/structural-coherence.js";
+export { TOKEN_CONSISTENCY_RULE, validateTokenConsistency, analyzeTokenConsistency, classifyTokenAt, } from "./validators/token-consistency.js";
+export { DANGEROUS_API_PATTERNS, DANGEROUS_AST_EXTRA_PATTERNS, containsDangerousApi, containsDangerousPattern, isAsset, isDependency, isVirtualSource, normalizeSourcePath, } from "./validators/classification.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,sBAAsB,EACtB,yBAAyB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,GAC/B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACN,gCAAgC,EAChC,qBAAqB,GACrB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,GACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,2BAA2B,GAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,GACnB,MAAM,gCAAgC,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { EnginePluginV1, type ConfigObject, type Engine } from "@salesforce/code-analyzer-engine-api";
+export declare class SourcemapValidatorEnginePlugin extends EnginePluginV1 {
+    getAvailableEngineNames(): string[];
+    createEngine(engineName: string, _resolvedConfig: ConfigObject): Promise<Engine>;
+}
+export declare function createEnginePlugin(): SourcemapValidatorEnginePlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,MAAM,sCAAsC,CAAC;AAG9C,qBAAa,8BAA+B,SAAQ,cAAc;IACjE,uBAAuB,IAAI,MAAM,EAAE;IAI7B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;CAMtF;AAED,wBAAgB,kBAAkB,IAAI,8BAA8B,CAEnE"}

package/dist/plugin.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { EnginePluginV1, } from "@salesforce/code-analyzer-engine-api";
+import { ENGINE_NAME, SourcemapValidatorEngine } from "./engine.js";
+export class SourcemapValidatorEnginePlugin extends EnginePluginV1 {
+    getAvailableEngineNames() {
+        return [ENGINE_NAME];
+    }
+    async createEngine(engineName, _resolvedConfig) {
+        if (engineName !== ENGINE_NAME) {
+            throw new Error(`Unknown engine: ${engineName}`);
+        }
+        return new SourcemapValidatorEngine();
+    }
+}
+export function createEnginePlugin() {
+    return new SourcemapValidatorEnginePlugin();
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,cAAc,GAGd,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACjE,uBAAuB;QACtB,OAAO,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,eAA6B;QACnE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;CACD;AAED,MAAM,UAAU,kBAAkB;IACjC,OAAO,IAAI,8BAA8B,EAAE,CAAC;AAC7C,CAAC"}

package/dist/rules.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { type RuleDescription } from "@salesforce/code-analyzer-engine-api";
+export declare const RULES: RuleDescription[];
+export declare const RULE_NAMES: Set<string>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,sCAAsC,CAAC;AAE9C,eAAO,MAAM,KAAK,EAAE,eAAe,EA2GlC,CAAC;AAEF,eAAO,MAAM,UAAU,aAAoC,CAAC"}