@smartergpt/lexrunner 1.0.0

package/dist/chunk-LLMY2BZF.js

@@ -0,0 +1,1084 @@
+import {
+  sha256FileRaw
+} from "./chunk-55VWJYZY.js";
+
+// src/audit/emitter.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as readline from "readline";
+import { ulid } from "ulid";
+
+// src/audit/profiles.ts
+var DEFAULT_REDACT_REGEX = "token|secret|pass|key|auth";
+var STRICT_REDACT_REGEX = "token|secret|pass|key|auth|api[_-]?key|bearer|credential|pwd|ssn|ein|dob";
+var AUDIT_PROFILES = {
+  "off": null,
+  "basic": {
+    includeContext: [],
+    includeEnv: [],
+    redactRegex: DEFAULT_REDACT_REGEX,
+    hashPaths: false,
+    retainDays: 365,
+    // 12 months
+    requireSignature: false,
+    includeArtifactRefs: false,
+    includeJobIds: false,
+    strictRedaction: false
+  },
+  "soc2": {
+    includeContext: ["git", "ci", "os"],
+    includeEnv: [],
+    // Must be explicitly allowed
+    redactRegex: DEFAULT_REDACT_REGEX,
+    hashPaths: false,
+    retainDays: 730,
+    // 24 months
+    requireSignature: true,
+    // Stub for Phase 2
+    includeArtifactRefs: true,
+    includeJobIds: true,
+    strictRedaction: false
+  },
+  "hipaa-strict": {
+    includeContext: ["git", "ci", "os"],
+    includeEnv: [],
+    // Must be explicitly allowed
+    redactRegex: STRICT_REDACT_REGEX,
+    hashPaths: true,
+    retainDays: 2190,
+    // 6 years per HIPAA 45 CFR 164.316(b)(2)(i)
+    requireSignature: true,
+    // Stub for Phase 2
+    includeArtifactRefs: true,
+    includeJobIds: true,
+    strictRedaction: true
+  }
+};
+function getProfileConfig(profile) {
+  return AUDIT_PROFILES[profile];
+}
+function mergeProfileConfig(profile, overrides = {}) {
+  const baseConfig = getProfileConfig(profile);
+  if (!baseConfig) return null;
+  return {
+    ...baseConfig,
+    ...overrides
+  };
+}
+
+// src/audit/redaction.ts
+import { createHash } from "crypto";
+function redactSecrets(text, pattern) {
+  try {
+    new RegExp(pattern, "gi");
+    const regex = new RegExp(`(${pattern})\\s*(?:=|:|is|:=)?\\s*([^\\s"']+|"[^"]*"|'[^']*')`, "gi");
+    return text.replace(regex, "$1 ***REDACTED***");
+  } catch (error) {
+    console.warn(`Invalid redaction pattern: ${pattern}`, error);
+    return text;
+  }
+}
+function redactObject(obj, pattern) {
+  if (obj === null || obj === void 0) {
+    return obj;
+  }
+  if (typeof obj === "string") {
+    return redactSecrets(obj, pattern);
+  }
+  if (Array.isArray(obj)) {
+    return obj.map((item) => redactObject(item, pattern));
+  }
+  if (typeof obj === "object") {
+    const redacted = {};
+    for (const [key, value] of Object.entries(obj)) {
+      const shouldRedactKey = new RegExp(pattern, "gi").test(key);
+      if (shouldRedactKey) {
+        redacted[key] = "***REDACTED***";
+      } else {
+        redacted[key] = redactObject(value, pattern);
+      }
+    }
+    return redacted;
+  }
+  return obj;
+}
+function hashPath(filePath) {
+  return createHash("sha256").update(filePath).digest("hex").substring(0, 16);
+}
+function sanitizeEnv(env, allowlist) {
+  const sanitized = {};
+  for (const key of allowlist) {
+    if (env[key]) {
+      sanitized[key] = env[key];
+    }
+  }
+  return sanitized;
+}
+function redactArgv(argv, pattern) {
+  return argv.map((arg) => {
+    if (arg.includes("=")) {
+      const [key, value] = arg.split("=", 2);
+      if (new RegExp(pattern, "gi").test(key)) {
+        return `${key}=***REDACTED***`;
+      }
+      if (value && new RegExp(pattern, "gi").test(value)) {
+        return `${key}=***REDACTED***`;
+      }
+    }
+    if (new RegExp(pattern, "gi").test(arg)) {
+      return "***REDACTED***";
+    }
+    return arg;
+  });
+}
+function sanitizeFileContent(content, maxLength = 1e3) {
+  if (content.length <= maxLength) {
+    return content;
+  }
+  return content.substring(0, maxLength) + "... [truncated]";
+}
+function buildContext(includeContextTypes, gitInfo, includeEnv = []) {
+  const context = {};
+  if (includeContextTypes.includes("git") && gitInfo) {
+    context.git = {
+      branch: gitInfo.branch,
+      commit: gitInfo.commit,
+      remote: gitInfo.remote
+    };
+  }
+  if (includeContextTypes.includes("ci")) {
+    context.ci = {
+      name: process.env.CI_NAME || process.env.GITHUB_ACTIONS ? "github-actions" : void 0,
+      job_id: process.env.GITHUB_RUN_ID,
+      job_number: process.env.GITHUB_RUN_NUMBER,
+      workflow: process.env.GITHUB_WORKFLOW,
+      actor: process.env.GITHUB_ACTOR
+    };
+    Object.keys(context.ci).forEach((key) => {
+      if (context.ci[key] === void 0) delete context.ci[key];
+    });
+  }
+  if (includeContextTypes.includes("os")) {
+    context.os = {
+      platform: process.platform,
+      arch: process.arch,
+      node_version: process.version,
+      env: sanitizeEnv(process.env, includeEnv)
+    };
+  }
+  return context;
+}
+var PHI_PATTERNS = [
+  /\b\d{3}-\d{2}-\d{4}\b/g,
+  // SSN
+  /\b\d{2}-\d{7}\b/g,
+  // EIN
+  /\b(19|20)\d{2}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])\b/g
+  // DOB (ISO)
+];
+function redactPHI(text, enable = false) {
+  if (!enable) return { text, flagged: false };
+  let flagged = false;
+  let result = text;
+  for (const re of PHI_PATTERNS) {
+    if (re.test(result)) {
+      flagged = true;
+      result = result.replace(re, "***REDACTED***");
+    }
+  }
+  return { text: result, flagged };
+}
+function redactPHIFromObject(obj) {
+  let flagged = false;
+  function redactValue(value) {
+    if (typeof value === "string") {
+      const { text, flagged: wasRedacted } = redactPHI(value, true);
+      if (wasRedacted) {
+        flagged = true;
+      }
+      return text;
+    } else if (Array.isArray(value)) {
+      return value.map(redactValue);
+    } else if (value !== null && typeof value === "object") {
+      const redacted = {};
+      for (const key in value) {
+        redacted[key] = redactValue(value[key]);
+      }
+      return redacted;
+    }
+    return value;
+  }
+  return { obj: redactValue(obj), flagged };
+}
+
+// src/audit/manifest.ts
+import * as fs from "fs";
+import * as path from "path";
+async function generateManifest(auditDir, ciContext) {
+  const files = [];
+  let totalBytes = 0;
+  const entries = fs.readdirSync(auditDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name !== "audit-manifest.json") {
+      const filePath = path.join(auditDir, entry.name);
+      const stats = fs.statSync(filePath);
+      const hash = sha256FileRaw(filePath);
+      files.push({
+        file: entry.name,
+        sha256: hash,
+        bytes: stats.size
+      });
+      totalBytes += stats.size;
+    }
+  }
+  files.sort((a, b) => a.file.localeCompare(b.file));
+  const manifest = {
+    schemaVersion: "1.0.0",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    files,
+    totalBytes
+  };
+  if (ciContext) {
+    manifest.ciContext = ciContext;
+  }
+  return manifest;
+}
+async function writeManifest(auditDir, manifest) {
+  const manifestPath = path.join(auditDir, "audit-manifest.json");
+  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+  return manifestPath;
+}
+
+// src/audit/sidecar.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+function discoverSidecarFiles(dropDir) {
+  if (!fs2.existsSync(dropDir)) {
+    return [];
+  }
+  const entries = fs2.readdirSync(dropDir, { withFileTypes: true });
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".ndjson") && !e.name.endsWith(".done")).map((e) => path2.join(dropDir, e.name));
+}
+function readSidecarFile(filePath) {
+  const content = fs2.readFileSync(filePath, "utf-8");
+  const lines = content.split("\n").filter((line) => line.trim());
+  const events = [];
+  for (const line of lines) {
+    try {
+      const event = JSON.parse(line);
+      events.push(event);
+    } catch (error) {
+      console.warn(`Failed to parse sidecar event: ${line}`, error);
+    }
+  }
+  return events;
+}
+function markSidecarProcessed(filePath) {
+  const donePath = filePath + ".done";
+  fs2.renameSync(filePath, donePath);
+}
+function enrichSidecarEvent(sidecarEvent, envelope) {
+  return {
+    schema_version: envelope.schema_version || "0.1.0",
+    event: sidecarEvent.event,
+    ts: sidecarEvent.ts || (/* @__PURE__ */ new Date()).toISOString(),
+    level: sidecarEvent.level || "info",
+    session_id: envelope.session_id || "",
+    run_id: envelope.run_id || "",
+    tool: envelope.tool || { name: "unknown", version: "unknown" },
+    actor: envelope.actor || { type: "cli" },
+    repo: envelope.repo || {},
+    context: envelope.context,
+    payload: {
+      ...sidecarEvent.payload,
+      gate: sidecarEvent.gate,
+      item: sidecarEvent.item
+    }
+  };
+}
+async function ingestSidecarFiles(dropDir, envelope, onEvent) {
+  const files = discoverSidecarFiles(dropDir);
+  let count = 0;
+  for (const file of files) {
+    const events = readSidecarFile(file);
+    for (const sidecarEvent of events) {
+      const enrichedEvent = enrichSidecarEvent(sidecarEvent, envelope);
+      await onEvent(enrichedEvent);
+      count++;
+    }
+    markSidecarProcessed(file);
+  }
+  return count;
+}
+
+// src/audit/context.ts
+import { execa } from "execa";
+import * as os from "os";
+async function collectContext(contextTypes) {
+  const context = {};
+  for (const type of contextTypes) {
+    switch (type) {
+      case "git":
+        context.git = await collectGitContext();
+        break;
+      case "ci":
+        context.ci = await collectCIContext();
+        break;
+      case "os":
+        context.os = collectOSContext();
+        break;
+    }
+  }
+  return context;
+}
+async function collectGitContext() {
+  try {
+    const { stdout: commit } = await execa("git", ["rev-parse", "HEAD"]);
+    const { stdout: branch } = await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"]);
+    let remote;
+    try {
+      const { stdout } = await execa("git", ["remote", "get-url", "origin"]);
+      remote = stdout;
+    } catch {
+    }
+    let author;
+    try {
+      const { stdout } = await execa("git", ["log", "-1", "--format=%ae"]);
+      author = stdout;
+    } catch {
+    }
+    let committer;
+    try {
+      const { stdout } = await execa("git", ["log", "-1", "--format=%ce"]);
+      committer = stdout;
+    } catch {
+    }
+    let message;
+    try {
+      const { stdout } = await execa("git", ["log", "-1", "--format=%s"]);
+      message = stdout;
+    } catch {
+    }
+    const { stdout: statusOutput } = await execa("git", ["status", "--porcelain"]);
+    const dirty = statusOutput.trim().length > 0;
+    let tags;
+    try {
+      const { stdout } = await execa("git", ["tag", "--points-at", "HEAD"]);
+      const tagList = stdout.trim().split("\n").filter((t) => t.length > 0);
+      if (tagList.length > 0) {
+        tags = tagList;
+      }
+    } catch {
+    }
+    return {
+      commit,
+      branch,
+      remote,
+      author,
+      committer,
+      message,
+      dirty,
+      tags
+    };
+  } catch (error) {
+    return {
+      commit: "unknown",
+      branch: "unknown",
+      dirty: false
+    };
+  }
+}
+async function collectCIContext() {
+  if (process.env.GITHUB_ACTIONS === "true") {
+    return {
+      provider: "github-actions",
+      run_id: process.env.GITHUB_RUN_ID,
+      run_number: process.env.GITHUB_RUN_NUMBER,
+      workflow: process.env.GITHUB_WORKFLOW,
+      job: process.env.GITHUB_JOB,
+      actor: process.env.GITHUB_ACTOR,
+      event_name: process.env.GITHUB_EVENT_NAME,
+      ref: process.env.GITHUB_REF,
+      sha: process.env.GITHUB_SHA
+    };
+  }
+  if (process.env.GITLAB_CI === "true") {
+    return {
+      provider: "gitlab-ci",
+      run_id: process.env.CI_PIPELINE_ID,
+      run_number: process.env.CI_PIPELINE_IID,
+      workflow: process.env.CI_PIPELINE_SOURCE,
+      job: process.env.CI_JOB_NAME,
+      actor: process.env.GITLAB_USER_LOGIN,
+      event_name: process.env.CI_PIPELINE_SOURCE,
+      ref: process.env.CI_COMMIT_REF_NAME,
+      sha: process.env.CI_COMMIT_SHA
+    };
+  }
+  if (process.env.CIRCLECI === "true") {
+    return {
+      provider: "circleci",
+      run_id: process.env.CIRCLE_WORKFLOW_ID,
+      run_number: process.env.CIRCLE_BUILD_NUM,
+      workflow: process.env.CIRCLE_JOB,
+      job: process.env.CIRCLE_JOB,
+      actor: process.env.CIRCLE_USERNAME,
+      ref: process.env.CIRCLE_BRANCH,
+      sha: process.env.CIRCLE_SHA1
+    };
+  }
+  if (process.env.JENKINS_URL) {
+    return {
+      provider: "jenkins",
+      run_id: process.env.BUILD_ID,
+      run_number: process.env.BUILD_NUMBER,
+      workflow: process.env.JOB_NAME,
+      job: process.env.JOB_NAME,
+      ref: process.env.GIT_BRANCH,
+      sha: process.env.GIT_COMMIT
+    };
+  }
+  if (process.env.CI === "true") {
+    return {
+      provider: "generic-ci",
+      run_number: process.env.BUILD_NUMBER
+    };
+  }
+  return {
+    provider: "local"
+  };
+}
+function collectOSContext() {
+  const context = {
+    platform: os.platform(),
+    release: os.release(),
+    arch: os.arch()
+  };
+  try {
+    context.hostname = os.hostname();
+  } catch {
+  }
+  try {
+    context.user = os.userInfo().username;
+  } catch {
+  }
+  try {
+    context.uptime = os.uptime();
+  } catch {
+  }
+  try {
+    context.loadavg = os.loadavg();
+  } catch {
+  }
+  return context;
+}
+
+// src/audit/emitter.ts
+import * as crypto from "crypto";
+var AuditEmitter = class {
+  // Optional lock hash for merge-weave runs
+  constructor(options) {
+    this.ndjsonStream = null;
+    this.eventCount = 0;
+    this.eventsByType = {};
+    this.sidecarIngestInterval = null;
+    this.options = options;
+    this.config = getProfileConfig(options.profile);
+    this.auditDir = options.dir;
+    this.ndjsonPath = path3.join(this.auditDir, "audit.ndjson");
+    this.sessionId = options.sessionId || ulid();
+    this.runId = options.runId || ulid();
+    this.startTime = Date.now();
+    this.tool = options.tool || {
+      name: "lex-pr-runner",
+      version: process.env.npm_package_version || "0.1.0"
+    };
+    this.actor = {
+      type: process.env.MCP_SERVER ? "mcp" : process.env.CI ? "ci" : "cli"
+    };
+    this.repo = {};
+    this.context = {};
+    this.dropDir = `/tmp/lex-audit-session-${this.sessionId}`;
+  }
+  /**
+   * Initialize emitter - create directory and files
+   */
+  async init() {
+    if (!this.config || this.options.profile === "off") {
+      return;
+    }
+    if (this.config) {
+      const contextTypes = this.options.contextTypes || this.options.context || this.config.includeContext;
+      if (contextTypes && contextTypes.length > 0) {
+        try {
+          const auditContext = await collectContext(contextTypes);
+          this.context = auditContext;
+        } catch (err) {
+          console.warn("[lex-pr] audit: context collection failed", err);
+          this.context = {};
+        }
+      } else {
+        this.context = {};
+      }
+    }
+    if (!fs3.existsSync(this.auditDir)) {
+      fs3.mkdirSync(this.auditDir, { recursive: true });
+    }
+    if (!fs3.existsSync(this.dropDir)) {
+      fs3.mkdirSync(this.dropDir, { recursive: true });
+    }
+    process.env.LEX_AUDIT_DROP_DIR = this.dropDir;
+    process.env.LEX_AUDIT_SESSION_ID = this.sessionId;
+    if (!fs3.existsSync(this.ndjsonPath)) {
+      fs3.writeFileSync(this.ndjsonPath, "");
+    }
+    this.ndjsonStream = fs3.createWriteStream(this.ndjsonPath, { flags: "a", autoClose: true });
+    this.ndjsonStream.on("error", (err) => {
+      console.warn("[lex-pr] audit: ndjson stream error (ignored)", String(err));
+    });
+    const schemaPath = path3.join(this.auditDir, "audit.schema.json");
+    const schema = {
+      $schema: "http://json-schema.org/draft-07/schema#",
+      version: "0.1.0",
+      description: "Audit event envelope schema",
+      type: "object",
+      required: ["schema_version", "event", "ts", "level", "session_id", "run_id", "tool", "actor", "repo", "payload"],
+      properties: {
+        schema_version: { type: "string" },
+        event: { type: "string" },
+        ts: { type: "string", format: "date-time" },
+        level: { type: "string", enum: ["info", "warn", "error"] },
+        session_id: { type: "string" },
+        run_id: { type: "string" },
+        tool: { type: "object" },
+        actor: { type: "object" },
+        repo: { type: "object" },
+        context: { type: "object" },
+        lock_hash: { type: "string", description: "Lock hash for merge-weave idempotency" },
+        payload: { type: "object" }
+      }
+    };
+    fs3.writeFileSync(schemaPath, JSON.stringify(schema, null, 2));
+    this.startSidecarIngestion();
+  }
+  /**
+   * Emit an audit event
+   */
+  async emit(event, payload, level = "info") {
+    if (!this.config || !this.ndjsonStream) {
+      return;
+    }
+    if (this.options.sample !== void 0 && this.options.sample < 100) {
+      if (Math.random() * 100 > this.options.sample) {
+        return;
+      }
+    }
+    let redactedPayload = payload;
+    const redactRegex = this.options.redactRegex || this.config.redactRegex;
+    if (redactRegex) {
+      redactedPayload = redactObject(payload, redactRegex);
+    }
+    if (this.options.phiRedaction) {
+      const { obj, flagged } = redactPHIFromObject(redactedPayload);
+      if (flagged) {
+        redactedPayload = obj;
+        if (typeof redactedPayload === "object" && redactedPayload !== null) {
+          redactedPayload._phi_redacted = true;
+        }
+      }
+    }
+    if (this.options.hashPaths || this.config.hashPaths) {
+      if (redactedPayload.path) {
+        redactedPayload.path = hashPath(redactedPayload.path);
+      }
+      if (redactedPayload.files && Array.isArray(redactedPayload.files)) {
+        redactedPayload.files = redactedPayload.files.map((f) => hashPath(f));
+      }
+    }
+    const envelope = {
+      schema_version: "0.1.0",
+      event,
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      session_id: this.sessionId,
+      run_id: this.runId,
+      tool: this.tool,
+      actor: this.actor,
+      repo: this.repo,
+      context: this.context,
+      lock_hash: this.lockHash,
+      // Include lock hash if set
+      payload: redactedPayload
+    };
+    let line = JSON.stringify(envelope) + "\n";
+    try {
+      if (this.ndjsonStream && !this.ndjsonStream.destroyed) {
+        this.ndjsonStream.write(line);
+      }
+    } catch (e) {
+      console.warn("[lex-pr] audit: ndjson write failed (ignored)", String(e));
+    }
+    this.eventCount++;
+    this.eventsByType[event] = (this.eventsByType[event] || 0) + 1;
+  }
+  /**
+   * Set repository context
+   */
+  setRepo(repo) {
+    this.repo = { ...this.repo, ...repo };
+  }
+  /**
+   * Set lock hash for merge-weave runs
+   */
+  setLockHash(lockHash) {
+    this.lockHash = lockHash;
+  }
+  /**
+   * Start periodic sidecar ingestion
+   */
+  startSidecarIngestion() {
+    this.sidecarIngestInterval = setInterval(async () => {
+      try {
+        await this.ingestSidecar();
+      } catch (e) {
+        console.warn("[lex-pr] audit: sidecar ingestion error (ignored)", String(e));
+      }
+    }, 5e3);
+    try {
+      if (this.sidecarIngestInterval && typeof this.sidecarIngestInterval.unref === "function") {
+        this.sidecarIngestInterval.unref();
+      }
+    } catch (e) {
+    }
+  }
+  /**
+   * Ingest sidecar files
+   */
+  async ingestSidecar() {
+    if (!this.config) return;
+    const envelope = {
+      schema_version: "0.1.0",
+      session_id: this.sessionId,
+      run_id: this.runId,
+      tool: this.tool,
+      actor: this.actor,
+      repo: this.repo,
+      context: this.context
+    };
+    try {
+      await ingestSidecarFiles(this.dropDir, envelope, async (event) => {
+        try {
+          const redactRegex = this.options.redactRegex || this.config.redactRegex;
+          if (redactRegex) {
+            event.payload = redactObject(event.payload, redactRegex);
+          }
+          if (this.ndjsonStream) {
+            this.ndjsonStream.write(JSON.stringify(event) + "\n");
+            this.eventCount++;
+            this.eventsByType[event.event] = (this.eventsByType[event.event] || 0) + 1;
+          }
+        } catch (innerErr) {
+          console.warn("[lex-pr] audit: error ingesting sidecar event (ignored)", String(innerErr));
+        }
+      });
+    } catch (err) {
+      console.warn("[lex-pr] audit: ingestSidecarFiles failed (ignored)", String(err));
+    }
+  }
+  /**
+   * Finalize audit - write summary and manifest
+   */
+  async finalize(finalStatus = "success") {
+    if (this.sidecarIngestInterval) {
+      clearInterval(this.sidecarIngestInterval);
+      this.sidecarIngestInterval = null;
+    }
+    await this.ingestSidecar();
+    if (this.ndjsonStream) {
+      const stream = this.ndjsonStream;
+      await new Promise((resolve, reject) => {
+        stream.end((err) => {
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+      this.ndjsonStream = null;
+    }
+    if (!this.config) return;
+    if (this.options.profile === "hipaa-strict") {
+      const keyHex = this.options.encryptionKeyHex || process.env.LEX_AUDIT_KEY_HEX;
+      const valid = typeof keyHex === "string" && /^[0-9a-fA-F]{64}$/.test(keyHex);
+      if (!valid) {
+        try {
+          const nd = this.ndjsonPath;
+          if (fs3.existsSync(nd)) {
+            fs3.unlinkSync(nd);
+          }
+          const enc = nd + ".enc";
+          if (fs3.existsSync(enc)) {
+            fs3.unlinkSync(enc);
+          }
+        } catch (e) {
+          console.error("[HIPAA] Failed to scrub sensitive audit files:", e);
+        }
+        const errObj = {
+          profile: "hipaa-strict",
+          status: "aborted",
+          reason: "missing_or_invalid_key"
+        };
+        try {
+          fs3.writeFileSync(path3.join(this.auditDir, "audit.error.json"), JSON.stringify(errObj, null, 2));
+        } catch (e) {
+        }
+        throw new Error("HIPAA: encryption key required and must be 64 hex chars (32 bytes); aborting and scrubbed plaintext.");
+      }
+      this.options.encryptionKeyHex = keyHex;
+    }
+    const duration = Date.now() - this.startTime;
+    const summary = {
+      schemaVersion: "1.0.0",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      sessionId: this.sessionId,
+      runId: this.runId,
+      profile: this.options.profile,
+      totalEvents: this.eventCount,
+      eventsByType: this.eventsByType,
+      duration,
+      finalStatus
+    };
+    const summaryPath = path3.join(this.auditDir, "audit-summary.json");
+    fs3.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
+    if (this.config.includeContext?.length > 0) {
+      await this.generateGateMatrix();
+    }
+    if (this.options.sarif) {
+      await this.generateSARIF();
+    }
+    if (this.config.requireSignature) {
+      const sigPath = path3.join(this.auditDir, "audit.sig");
+      fs3.writeFileSync(sigPath, "# Signature stub - Phase 2 implementation pending\n");
+    }
+    if (this.options.encryptionKeyHex) {
+      try {
+        const key = Buffer.from(this.options.encryptionKeyHex, "hex");
+        if (key.length !== 32) {
+          throw new Error("HIPAA: encryption key invalid length");
+        }
+        const ndjsonPath = this.ndjsonPath;
+        const src = fs3.readFileSync(ndjsonPath);
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+        const enc = Buffer.concat([cipher.update(src), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const outPath = ndjsonPath + ".enc";
+        fs3.writeFileSync(outPath, Buffer.concat([iv, tag, enc]));
+        fs3.unlinkSync(ndjsonPath);
+      } catch (e) {
+        try {
+          const nd = this.ndjsonPath;
+          if (fs3.existsSync(nd)) fs3.unlinkSync(nd);
+          const enc = nd + ".enc";
+          if (fs3.existsSync(enc)) fs3.unlinkSync(enc);
+        } catch (ignored) {
+        }
+        try {
+          fs3.writeFileSync(path3.join(this.auditDir, "audit.error.json"), JSON.stringify({ profile: this.options.profile, status: "aborted", reason: "encryption_failed" }, null, 2));
+        } catch (ignored) {
+        }
+        throw new Error("HIPAA: encryption failed; scrubbed plaintext and aborting.");
+      }
+    }
+    const manifest = await generateManifest(this.auditDir, this.context);
+    const manifestPath = await writeManifest(this.auditDir, manifest);
+    if (this.options.signer) {
+      const { signManifest, parseSignerOption } = await import("./signing-7DK7SABM.js");
+      const signingOptions = parseSignerOption(this.options.signer);
+      await signManifest(manifestPath, signingOptions);
+    }
+  }
+  /**
+   * Generate gate matrix from audit events
+   * Uses streaming to handle large audit logs efficiently
+   */
+  async generateGateMatrix() {
+    const auditPath = path3.join(this.auditDir, "audit.ndjson");
+    if (!fs3.existsSync(auditPath)) {
+      return;
+    }
+    const matrix = {};
+    let totalPassed = 0;
+    let totalFailed = 0;
+    let totalSkipped = 0;
+    let totalBlocked = 0;
+    let totalGates = 0;
+    try {
+      const fileStream = fs3.createReadStream(auditPath);
+      const rl = readline.createInterface({
+        input: fileStream,
+        crlfDelay: Infinity
+      });
+      for await (const line of rl) {
+        if (!line.trim()) continue;
+        try {
+          const event = JSON.parse(line);
+          if (event.event === "gate_finished") {
+            const { item, gate, status, duration_ms, error, reason } = event.payload;
+            if (!matrix[item]) {
+              matrix[item] = {};
+            }
+            matrix[item][gate] = {
+              status,
+              ...duration_ms !== void 0 && { duration_ms },
+              ...error && { error },
+              ...reason && { reason }
+            };
+            totalGates++;
+            if (status === "pass") totalPassed++;
+            else if (status === "fail") totalFailed++;
+            else if (status === "skip") totalSkipped++;
+            else if (status === "blocked") totalBlocked++;
+          }
+        } catch (parseError) {
+          console.warn("[lex-pr] audit: skipping malformed line in audit.ndjson");
+        }
+      }
+    } catch (e) {
+      console.warn("[lex-pr] audit: failed to read audit.ndjson (ignored)", String(e));
+      return;
+    }
+    const gateMatrix = {
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      session_id: this.sessionId,
+      matrix,
+      summary: {
+        total_prs: Object.keys(matrix).length,
+        total_gates: totalGates,
+        passed: totalPassed,
+        failed: totalFailed,
+        skipped: totalSkipped,
+        blocked: totalBlocked
+      }
+    };
+    const matrixPath = path3.join(this.auditDir, "audit-gate-matrix.json");
+    fs3.writeFileSync(matrixPath, JSON.stringify(gateMatrix, null, 2));
+  }
+  /**
+   * Generate SARIF report from vuln_found events
+   * Uses streaming to handle large audit logs efficiently
+   */
+  async generateSARIF() {
+    const auditPath = path3.join(this.auditDir, "audit.ndjson");
+    if (!fs3.existsSync(auditPath)) {
+      return;
+    }
+    const vulnEvents = [];
+    try {
+      const fileStream = fs3.createReadStream(auditPath);
+      const rl = readline.createInterface({
+        input: fileStream,
+        crlfDelay: Infinity
+      });
+      for await (const line of rl) {
+        if (!line.trim()) continue;
+        try {
+          const event = JSON.parse(line);
+          if (event.event === "vuln_found") {
+            vulnEvents.push(event);
+          }
+        } catch (parseError) {
+          console.warn("[lex-pr] audit: skipping malformed line in audit.ndjson");
+        }
+      }
+    } catch (e) {
+      console.warn("[lex-pr] audit: failed to read audit.ndjson for SARIF (ignored)", String(e));
+      return;
+    }
+    if (vulnEvents.length === 0) {
+      return;
+    }
+    const { generateSARIF: generateSARIF2, writeSARIF: writeSARIF2 } = await import("./sarif-OGAGDL6B.js");
+    const sarifReport = await generateSARIF2(vulnEvents, this.tool.version);
+    const sarifPath = path3.join(this.auditDir, "audit-sarif.json");
+    await writeSARIF2(sarifReport, sarifPath);
+  }
+  /**
+   * Get session ID
+   */
+  getSessionId() {
+    return this.sessionId;
+  }
+  /**
+   * Get run ID
+   */
+  getRunId() {
+    return this.runId;
+  }
+  /**
+   * Get drop directory
+   */
+  getDropDir() {
+    return this.dropDir;
+  }
+};
+async function initAuditEmitter(options) {
+  const emitter = new AuditEmitter(options);
+  await emitter.init();
+  return emitter;
+}
+async function emitEvent(emitter, event, payload, level) {
+  await emitter.emit(event, payload, level);
+}
+async function finalizeAudit(emitter, finalStatus) {
+  await emitter.finalize(finalStatus);
+}
+
+// src/audit/events.ts
+import { z } from "zod";
+var ToolSchema = z.object({
+  name: z.string(),
+  version: z.string()
+});
+var ActorSchema = z.object({
+  type: z.enum(["cli", "mcp", "ci"])
+});
+var RepoSchema = z.object({
+  remote: z.string().optional(),
+  branch: z.string().optional(),
+  commit: z.string().optional()
+});
+var ContextSchema = z.object({
+  git: z.record(z.string(), z.any()).optional(),
+  ci: z.record(z.string(), z.any()).optional(),
+  os: z.record(z.string(), z.any()).optional()
+});
+var EventEnvelopeSchema = z.object({
+  schema_version: z.string(),
+  event: z.string(),
+  ts: z.string(),
+  level: z.enum(["info", "warn", "error"]),
+  session_id: z.string(),
+  run_id: z.string(),
+  tool: ToolSchema,
+  actor: ActorSchema,
+  repo: RepoSchema,
+  context: ContextSchema.optional(),
+  lock_hash: z.string().optional(),
+  // Lock hash for merge-weave idempotency
+  payload: z.any()
+});
+var CommandInvocationPayloadSchema = z.object({
+  argv: z.array(z.string()),
+  cwd: z.string()
+});
+var PlanDiscoveredPayloadSchema = z.object({
+  pr_ids: z.array(z.union([z.string(), z.number()])),
+  base: z.string(),
+  head: z.string(),
+  plan_hash: z.string()
+});
+var PlanValidatedPayloadSchema = z.object({
+  schema_version: z.string(),
+  warnings: z.array(z.string()).optional()
+});
+var MergeOrderComputedPayloadSchema = z.object({
+  levels: z.number(),
+  items_per_level: z.array(z.number())
+});
+var GateStartedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  gate: z.string()
+});
+var GateFinishedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  gate: z.string(),
+  duration_ms: z.number(),
+  status: z.string(),
+  artifact_refs: z.array(z.string()).optional()
+});
+var MergeDryRunStartedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  base: z.string(),
+  head: z.string()
+});
+var MergeDryRunFinishedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  status: z.string(),
+  conflicts: z.array(z.string()).optional()
+});
+var MergeExecuteStartedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  base: z.string(),
+  head: z.string()
+});
+var MergeConflictDetectedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  files: z.array(z.string())
+});
+var MergeFinishedPayloadSchema = z.object({
+  item: z.union([z.string(), z.number()]),
+  status: z.string(),
+  commit: z.string().optional()
+});
+var ArtifactWrittenPayloadSchema = z.object({
+  path: z.string(),
+  sha256: z.string(),
+  bytes: z.number()
+});
+var ErrorPayloadSchema = z.object({
+  code: z.string(),
+  message: z.string(),
+  where: z.string().optional()
+});
+var RunSummaryPayloadSchema = z.object({
+  totals: z.object({
+    items: z.number(),
+    gates: z.number(),
+    passed: z.number(),
+    failed: z.number()
+  }),
+  pass_fail_matrix: z.record(z.string(), z.record(z.string(), z.string())),
+  final_status: z.string()
+});
+var EVENT_TYPES = {
+  COMMAND_INVOCATION: "command_invocation",
+  PLAN_DISCOVERED: "plan_discovered",
+  PLAN_VALIDATED: "plan_validated",
+  MERGE_ORDER_COMPUTED: "merge_order_computed",
+  GATE_STARTED: "gate_started",
+  GATE_FINISHED: "gate_finished",
+  MERGE_DRY_RUN_STARTED: "merge_dry_run_started",
+  MERGE_DRY_RUN_FINISHED: "merge_dry_run_finished",
+  MERGE_EXECUTE_STARTED: "merge_execute_started",
+  MERGE_CONFLICT_DETECTED: "merge_conflict_detected",
+  MERGE_FINISHED: "merge_finished",
+  ARTIFACT_WRITTEN: "artifact_written",
+  ERROR: "error",
+  RUN_SUMMARY: "run_summary"
+};
+
+export {
+  DEFAULT_REDACT_REGEX,
+  STRICT_REDACT_REGEX,
+  AUDIT_PROFILES,
+  getProfileConfig,
+  mergeProfileConfig,
+  redactSecrets,
+  redactObject,
+  hashPath,
+  sanitizeEnv,
+  redactArgv,
+  sanitizeFileContent,
+  buildContext,
+  generateManifest,
+  writeManifest,
+  discoverSidecarFiles,
+  readSidecarFile,
+  markSidecarProcessed,
+  enrichSidecarEvent,
+  ingestSidecarFiles,
+  AuditEmitter,
+  initAuditEmitter,
+  emitEvent,
+  finalizeAudit,
+  EVENT_TYPES
+};