@tyroneross/navgator 0.2.2 → 0.10.0

package/dist/audit/oracles/common.js

@@ -0,0 +1,129 @@
+/**
+ * Shared oracle helpers (Run 4). Kept separate from index.ts so each oracle
+ * module can import them without a circular import through the registry.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { proportionInterval } from '../sampler.js';
+const SAMPLE_CAP = 10;
+/**
+ * Build an OracleResult from two name sets. Precision = tp / map_count,
+ * recall = tp / truth_count, both with 95% intervals (Wilson; Clopper-Pearson
+ * at 0 or n — protocol step 9).
+ */
+export function setDiffOracle(oracle, stratum, strength, truth, map, notes = [], extraFp = []) {
+    let tp = 0;
+    const fpList = [];
+    const fnList = [];
+    for (const m of map) {
+        if (truth.has(m))
+            tp++;
+        else
+            fpList.push(m);
+    }
+    for (const t of truth)
+        if (!map.has(t))
+            fnList.push(t);
+    fpList.push(...extraFp);
+    const fp = fpList.length;
+    const fn = fnList.length;
+    const mapCount = tp + fp;
+    const truthCount = truth.size;
+    return {
+        oracle,
+        stratum,
+        oracle_strength: strength,
+        truth_count: truthCount,
+        map_count: mapCount,
+        tp,
+        fp,
+        fn,
+        precision: mapCount > 0 ? tp / mapCount : null,
+        recall: truthCount > 0 ? tp / truthCount : null,
+        precision_ci: mapCount > 0 ? proportionInterval(tp, mapCount) : null,
+        recall_ci: truthCount > 0 ? proportionInterval(tp, truthCount) : null,
+        fp_samples: fpList.slice(0, SAMPLE_CAP),
+        fn_samples: fnList.slice(0, SAMPLE_CAP),
+        notes,
+    };
+}
+/** Result for an oracle whose truth source is absent or unreadable. */
+export function noOracle(oracle, stratum, note) {
+    return {
+        oracle,
+        stratum,
+        oracle_strength: 'none',
+        truth_count: 0,
+        map_count: 0,
+        tp: 0,
+        fp: 0,
+        fn: 0,
+        precision: null,
+        recall: null,
+        precision_ci: null,
+        recall_ci: null,
+        fp_samples: [],
+        fn_samples: [],
+        notes: [note],
+    };
+}
+export function readJsonSafe(absPath) {
+    try {
+        return JSON.parse(fs.readFileSync(absPath, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+const WALK_IGNORE = new Set([
+    'node_modules',
+    '.git',
+    '.next',
+    'dist',
+    'build',
+    'out',
+    'coverage',
+    '.navgator',
+    'vendor',
+    '.turbo',
+    '.cache',
+    'target',
+]);
+const SOURCE_EXT = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+/** Independent source walk (does not reuse the scanner's file list). Bounded at `max` files. */
+export function walkSourceFiles(root, max = 20000) {
+    const out = [];
+    const stack = [root];
+    while (stack.length > 0 && out.length < max) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (e.name.startsWith('.') && e.name !== '.') {
+                if (WALK_IGNORE.has(e.name))
+                    continue;
+            }
+            const abs = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (!WALK_IGNORE.has(e.name))
+                    stack.push(abs);
+            }
+            else if (e.isFile() && SOURCE_EXT.has(path.extname(e.name))) {
+                out.push(abs);
+                if (out.length >= max)
+                    break;
+            }
+        }
+    }
+    return out;
+}
+/** True when the component was derived from the ROOT package manifest. */
+export function isRootPackageDerived(c) {
+    return (c.source?.config_files ?? []).some((f) => f === 'package.json' || f === './package.json');
+}
+//# sourceMappingURL=common.js.map

package/dist/audit/oracles/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/audit/oracles/common.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAuBnD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,OAAe,EACf,QAAyC,EACzC,KAA0B,EAC1B,GAAwB,EACxB,QAAkB,EAAE,EACpB,UAAoB,EAAE;IAEtB,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,EAAE,EAAE,CAAC;;YAClB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,OAAO;QACL,MAAM;QACN,OAAO;QACP,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,EAAE;QACF,EAAE;QACF,EAAE;QACF,SAAS,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC9C,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI;QAC/C,YAAY,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACpE,SAAS,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QACvC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QACvC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;IACpE,OAAO;QACL,MAAM;QACN,OAAO;QACP,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,CAAC;QACd,SAAS,EAAE,CAAC;QACZ,EAAE,EAAE,CAAC;QACL,EAAE,EAAE,CAAC;QACL,EAAE,EAAE,CAAC;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,CAAC,IAAI,CAAC;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAI,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAM,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc;IACd,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3E,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAG,GAAG,KAAK;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC7C,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;YACxC,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,CAAwB;IAC3D,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,gBAAgB,CAAC,CAAC;AACpG,CAAC"}

package/dist/audit/oracles/cron.d.ts

@@ -0,0 +1,10 @@
+/**
+ * cron oracle — truth frame: `vercel.json` → `crons[].path`.
+ *
+ * Map side: `cron` components tagged `vercel` or sourced from vercel.json.
+ * The cron scanner names the component by the cron path, so the join key is
+ * the path string. Recall is exact (the manifest enumerates truth).
+ */
+import { type OracleInput, type OracleResult } from './common.js';
+export declare function cronOracle(input: OracleInput): OracleResult;
+//# sourceMappingURL=cron.d.ts.map

package/dist/audit/oracles/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../../src/audit/oracles/cron.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAyC,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMzG,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAqB3D"}

package/dist/audit/oracles/cron.js

@@ -0,0 +1,35 @@
+/**
+ * cron oracle — truth frame: `vercel.json` → `crons[].path`.
+ *
+ * Map side: `cron` components tagged `vercel` or sourced from vercel.json.
+ * The cron scanner names the component by the cron path, so the join key is
+ * the path string. Recall is exact (the manifest enumerates truth).
+ */
+import * as path from 'path';
+import { noOracle, readJsonSafe, setDiffOracle } from './common.js';
+export function cronOracle(input) {
+    const vercel = readJsonSafe(path.join(input.projectRoot, 'vercel.json'));
+    if (!vercel)
+        return noOracle('cron', 'infra', 'no readable vercel.json at project root');
+    const crons = Array.isArray(vercel.crons) ? vercel.crons : [];
+    const truth = new Set();
+    for (const c of crons)
+        if (typeof c?.path === 'string' && c.path.length > 0)
+            truth.add(c.path);
+    // Run 4 fix2 #3: vercel.json present and parseable with no crons is a valid
+    // empty frame — every vercel-sourced cron component is a false positive.
+    const map = new Set();
+    for (const c of input.components) {
+        if (c.type !== 'cron')
+            continue;
+        const fromVercel = (c.tags ?? []).includes('vercel') ||
+            (c.source?.config_files ?? []).some((f) => path.basename(f) === 'vercel.json');
+        if (fromVercel)
+            map.add(c.name);
+    }
+    return setDiffOracle('cron', 'infra', 'independent', truth, map, [
+        'truth = vercel.json crons[].path; map = cron components sourced from vercel.json',
+        ...(truth.size === 0 ? ['vercel.json declares no crons: empty frame, every vercel-sourced cron component is a false positive'] : []),
+    ]);
+}
+//# sourceMappingURL=cron.js.map

package/dist/audit/oracles/cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.js","sourceRoot":"","sources":["../../../src/audit/oracles/cron.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAuC,MAAM,aAAa,CAAC;AAMzG,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAa,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,yCAAyC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,4EAA4E;IAC5E,yEAAyE;IAEzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,MAAM,UAAU,GACd,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;QACjF,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE;QAC/D,kFAAkF;QAClF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrI,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/oracles/imports-scip.d.ts

@@ -0,0 +1,25 @@
+/**
+ * imports-scip oracle — truth frame: compiler-resolved cross-file references
+ * from scip-typescript (what tsserver sees, not what a regex guesses).
+ *
+ * This is a SAMPLED truth frame: scip-typescript indexes the documents the
+ * tsconfig reaches, so recall is a bound that tightens with `frame_coverage`
+ * (documents indexed / TS files in the stored file list). Report both
+ * (protocol step 10; ISSTA 2024 Theorem 3.3, packet source [8]).
+ *
+ * Join key: unordered file pair? No — directed `from → to` file pair. A map
+ * `imports` edge from file A to component X counts as a true positive when
+ * SCIP records a reference from A to X's defining file. Map edges whose source
+ * file is outside the indexed set are out-of-frame and excluded from the
+ * precision denominator (counted in notes).
+ *
+ * Off by default: spawning the indexer costs 1–120 s. Enabled by
+ * `navgator scan --scip` or `navgator audit-report --scip`; timeout via
+ * `--scip-timeout <ms>` or NAVGATOR_SCIP_TIMEOUT_MS (default 120000).
+ */
+import { type OracleInput, type OracleResult } from './common.js';
+export declare function importsScipOracle(input: OracleInput, opts: {
+    enabled: boolean;
+    timeoutMs?: number;
+}): Promise<OracleResult>;
+//# sourceMappingURL=imports-scip.d.ts.map

package/dist/audit/oracles/imports-scip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports-scip.d.ts","sourceRoot":"","sources":["../../../src/audit/oracles/imports-scip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAA2B,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3F,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAkEjI"}

package/dist/audit/oracles/imports-scip.js

@@ -0,0 +1,98 @@
+/**
+ * imports-scip oracle — truth frame: compiler-resolved cross-file references
+ * from scip-typescript (what tsserver sees, not what a regex guesses).
+ *
+ * This is a SAMPLED truth frame: scip-typescript indexes the documents the
+ * tsconfig reaches, so recall is a bound that tightens with `frame_coverage`
+ * (documents indexed / TS files in the stored file list). Report both
+ * (protocol step 10; ISSTA 2024 Theorem 3.3, packet source [8]).
+ *
+ * Join key: unordered file pair? No — directed `from → to` file pair. A map
+ * `imports` edge from file A to component X counts as a true positive when
+ * SCIP records a reference from A to X's defining file. Map edges whose source
+ * file is outside the indexed set are out-of-frame and excluded from the
+ * precision denominator (counted in notes).
+ *
+ * Off by default: spawning the indexer costs 1–120 s. Enabled by
+ * `navgator scan --scip` or `navgator audit-report --scip`; timeout via
+ * `--scip-timeout <ms>` or NAVGATOR_SCIP_TIMEOUT_MS (default 120000).
+ */
+import * as path from 'path';
+import { noOracle, setDiffOracle } from './common.js';
+function norm(p) {
+    if (!p)
+        return null;
+    let s = p.replace(/\\/g, '/');
+    if (s.startsWith('./'))
+        s = s.slice(2);
+    if (path.isAbsolute(s))
+        return null;
+    return s;
+}
+export async function importsScipOracle(input, opts) {
+    if (!opts.enabled)
+        return noOracle('imports-scip', 'connection-imports', 'skipped: run `navgator scan --scip` or `navgator audit-report --scip` to enable');
+    const { runScip, crossFileEdges, hasTsConfig } = await import('../../parsers/scip-runner.js');
+    if (!hasTsConfig(input.projectRoot))
+        return noOracle('imports-scip', 'connection-imports', 'no tsconfig.json / jsconfig.json at project root');
+    const timeoutMs = opts.timeoutMs && opts.timeoutMs > 0 ? opts.timeoutMs : 120_000;
+    const scip = await runScip(input.projectRoot, { timeoutMs });
+    if (!scip.ok) {
+        // Finding (c): a timeout is reported as its own reason so the reader can raise it.
+        const timedOut = /ETIMEDOUT|timed? ?out/i.test(scip.error ?? '');
+        return noOracle('imports-scip', 'connection-imports', timedOut
+            ? `scip-typescript timed out after ${timeoutMs} ms (${scip.duration_ms} ms elapsed); raise with --scip-timeout <ms> or NAVGATOR_SCIP_TIMEOUT_MS`
+            : `scip-typescript unavailable: ${scip.error ?? 'unknown error'}`);
+    }
+    const indexedDocs = new Set();
+    const truth = new Set();
+    for (const e of scip.edges) {
+        const from = norm(e.from_file);
+        if (from)
+            indexedDocs.add(from);
+    }
+    for (const e of crossFileEdges(scip.edges)) {
+        const from = norm(e.from_file);
+        const to = norm(e.to_file);
+        if (from && to)
+            truth.add(`${from} -> ${to}`);
+    }
+    const map = new Set();
+    let outOfFrame = 0;
+    let noTarget = 0;
+    for (const conn of input.connections) {
+        if (conn.connection_type !== 'imports')
+            continue;
+        const from = norm(conn.code_reference?.file ?? conn.from?.location?.file);
+        if (!from)
+            continue;
+        const target = input.componentById.get(conn.to?.component_id ?? '');
+        const to = norm(conn.to?.location?.file ?? target?.source?.config_files?.[0]);
+        if (!to) {
+            noTarget++;
+            continue;
+        }
+        if (!indexedDocs.has(from)) {
+            outOfFrame++;
+            continue;
+        }
+        map.add(`${from} -> ${to}`);
+    }
+    let tsFiles = 0;
+    if (input.hashes?.files) {
+        for (const f of Object.keys(input.hashes.files))
+            if (/\.(ts|tsx|mts|cts)$/.test(f))
+                tsFiles++;
+    }
+    const coverage = tsFiles > 0 ? Math.min(1, indexedDocs.size / tsFiles) : undefined;
+    const notes = [
+        `truth = ${truth.size} directed file pairs from scip-typescript (${scip.documents_indexed} documents, ${scip.duration_ms} ms)`,
+        'map = stored `imports` connections as (source file -> target file) pairs',
+        `${outOfFrame} map edges outside the indexed document set excluded; ${noTarget} map edges had no resolvable target file`,
+    ];
+    const res = setDiffOracle('imports-scip', 'connection-imports', 'independent', truth, map, notes);
+    if (coverage !== undefined)
+        res.frame_coverage = coverage;
+    return res;
+}
+//# sourceMappingURL=imports-scip.js.map

package/dist/audit/oracles/imports-scip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports-scip.js","sourceRoot":"","sources":["../../../src/audit/oracles/imports-scip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAuC,MAAM,aAAa,CAAC;AAE3F,SAAS,IAAI,CAAC,CAAqB;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,IAA8C;IACxG,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,cAAc,EAAE,oBAAoB,EAAE,iFAAiF,CAAC,CAAC;IAE5J,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC9F,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC,cAAc,EAAE,oBAAoB,EAAE,kDAAkD,CAAC,CAAC;IAE/I,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAClF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,mFAAmF;QACnF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,QAAQ,CACb,cAAc,EACd,oBAAoB,EACpB,QAAQ;YACN,CAAC,CAAC,mCAAmC,SAAS,QAAQ,IAAI,CAAC,WAAW,0EAA0E;YAChJ,CAAC,CAAC,gCAAgC,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,IAAI,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,SAAS;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnF,MAAM,KAAK,GAAG;QACZ,WAAW,KAAK,CAAC,IAAI,8CAA8C,IAAI,CAAC,iBAAiB,eAAe,IAAI,CAAC,WAAW,MAAM;QAC9H,0EAA0E;QAC1E,GAAG,UAAU,yDAAyD,QAAQ,0CAA0C;KACzH,CAAC;IACF,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClG,IAAI,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/audit/oracles/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * NavGator audit oracles — Run 4 (2026-09-05).
+ *
+ * An oracle compares the STORED map against a source of truth the scanner
+ * never read (protocol step 10, research packet §2.5(b)). Where the oracle
+ * enumerates truth completely (package.json, prisma models, vercel crons,
+ * queue literals) recall is exact; for TS imports the SCIP index is a sampled
+ * frame and `frame_coverage` is reported next to recall, because recall
+ * against an under-approximating baseline is a bound, not a measurement
+ * (ISSTA 2024 Theorem 3.3, packet source [8]).
+ *
+ * Oracles read ONLY manifest files in the target repo and the stored graph.
+ * They never import scanner internals.
+ */
+import type { ArchitectureComponent, ArchitectureConnection, AuditCensus } from '../../types.js';
+import { type OracleInput, type OracleOptions, type OracleResult } from './common.js';
+export * from './common.js';
+/**
+ * Run every oracle, isolating failures: an oracle that throws becomes a
+ * strength-'none' result with the error in `notes`. Never throws.
+ */
+export declare function runOracles(input: OracleInput, opts?: OracleOptions): Promise<OracleResult[]>;
+/**
+ * Census (Run 4 defect 5): invariants that can be counted exactly over the
+ * whole population in milliseconds are never sampled.
+ *   - unresolved endpoints: either component_id of a connection is absent from the graph
+ *   - dedup collisions: duplicate (type, name, primary config) triples
+ */
+export declare function runCensus(components: ReadonlyArray<ArchitectureComponent>, connections: ReadonlyArray<ArchitectureConnection>, componentById?: Map<string, ArchitectureComponent>): AuditCensus;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/oracles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/oracles/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEjG,OAAO,EAAY,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAOhG,cAAc,aAAa,CAAC;AAE5B;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkBtG;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,UAAU,EAAE,aAAa,CAAC,qBAAqB,CAAC,EAChD,WAAW,EAAE,aAAa,CAAC,sBAAsB,CAAC,EAClD,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GACjD,WAAW,CA6Cb"}

package/dist/audit/oracles/index.js

@@ -0,0 +1,100 @@
+/**
+ * NavGator audit oracles — Run 4 (2026-09-05).
+ *
+ * An oracle compares the STORED map against a source of truth the scanner
+ * never read (protocol step 10, research packet §2.5(b)). Where the oracle
+ * enumerates truth completely (package.json, prisma models, vercel crons,
+ * queue literals) recall is exact; for TS imports the SCIP index is a sampled
+ * frame and `frame_coverage` is reported next to recall, because recall
+ * against an under-approximating baseline is a bound, not a measurement
+ * (ISSTA 2024 Theorem 3.3, packet source [8]).
+ *
+ * Oracles read ONLY manifest files in the target repo and the stored graph.
+ * They never import scanner internals.
+ */
+import { proportionInterval } from '../sampler.js';
+import { noOracle } from './common.js';
+import { npmOracle } from './npm.js';
+import { prismaOracle } from './prisma.js';
+import { cronOracle } from './cron.js';
+import { queueOracle } from './queue.js';
+import { importsScipOracle } from './imports-scip.js';
+export * from './common.js';
+/**
+ * Run every oracle, isolating failures: an oracle that throws becomes a
+ * strength-'none' result with the error in `notes`. Never throws.
+ */
+export async function runOracles(input, opts = {}) {
+    const jobs = [
+        ['npm', () => Promise.resolve(npmOracle(input))],
+        ['prisma', () => prismaOracle(input, { trustTargetDeps: !!opts.trustTargetDeps })],
+        ['cron', () => Promise.resolve(cronOracle(input))],
+        ['queue', () => Promise.resolve(queueOracle(input))],
+        ['imports-scip', () => importsScipOracle(input, { enabled: !!opts.scip, timeoutMs: opts.scipTimeoutMs })],
+    ];
+    const results = [];
+    for (const [id, job] of jobs) {
+        if (opts.only && !opts.only.includes(id))
+            continue;
+        try {
+            results.push(await job());
+        }
+        catch (err) {
+            results.push(noOracle(id, id, `oracle error: ${err.message}`));
+        }
+    }
+    return results;
+}
+/**
+ * Census (Run 4 defect 5): invariants that can be counted exactly over the
+ * whole population in milliseconds are never sampled.
+ *   - unresolved endpoints: either component_id of a connection is absent from the graph
+ *   - dedup collisions: duplicate (type, name, primary config) triples
+ */
+export function runCensus(components, connections, componentById) {
+    const byId = componentById ?? new Map(components.map((c) => [c.component_id, c]));
+    const by_type = {};
+    const by_top_dir = {};
+    let bad = 0;
+    for (const conn of connections) {
+        const ok = byId.has(conn.from?.component_id ?? '') && byId.has(conn.to?.component_id ?? '');
+        const t = conn.connection_type ?? 'other';
+        const file = conn.code_reference?.file ?? conn.from?.location?.file ?? '';
+        const top = file ? file.replace(/^\.\//, '').split('/')[0] || '.' : '__no-file';
+        by_type[t] ??= { bad: 0, total: 0 };
+        by_top_dir[top] ??= { bad: 0, total: 0 };
+        by_type[t].total++;
+        by_top_dir[top].total++;
+        if (!ok) {
+            bad++;
+            by_type[t].bad++;
+            by_top_dir[top].bad++;
+        }
+    }
+    // Keep by_top_dir bounded: top 15 dirs by bad count, then by total.
+    const dirEntries = Object.entries(by_top_dir)
+        .sort((a, b) => b[1].bad - a[1].bad || b[1].total - a[1].total)
+        .slice(0, 15);
+    const total = connections.length;
+    const seen = new Set();
+    let dedup = 0;
+    for (const c of components) {
+        const key = `${c.type}|${c.name}|${c.source?.config_files?.[0] ?? '__none'}`;
+        if (seen.has(key))
+            dedup++;
+        else
+            seen.add(key);
+    }
+    return {
+        unresolved_endpoints: {
+            bad,
+            total,
+            rate: total > 0 ? bad / total : 0,
+            ...(total > 0 ? { ci: proportionInterval(bad, total) } : {}),
+            by_type,
+            by_top_dir: Object.fromEntries(dirEntries),
+        },
+        dedup_collisions: dedup,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/audit/oracles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/oracles/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,QAAQ,EAA2D,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,cAAc,aAAa,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,OAAsB,EAAE;IAC3E,MAAM,IAAI,GAAiD;QACzD,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;KAC1G,CAAC;IACF,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,SAAS;QACnD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,UAAgD,EAChD,WAAkD,EAClD,aAAkD;IAElD,MAAM,IAAI,GAAG,aAAa,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAmD,EAAE,CAAC;IACnE,MAAM,UAAU,GAAmD,EAAE,CAAC;IACtE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAChF,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACnB,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,EAAE,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACjB,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;SAC9D,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;IAEjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC7E,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;;YACtB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,oBAAoB,EAAE;YACpB,GAAG;YACH,KAAK;YACL,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACjC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;SAC3C;QACD,gBAAgB,EAAE,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/audit/oracles/npm.d.ts

@@ -0,0 +1,11 @@
+/**
+ * npm oracle — truth frame: root package.json `dependencies` ∪ `devDependencies`.
+ *
+ * Map side: every component derived from the ROOT package.json, whatever type
+ * the scanner assigned it (npm / database / queue / service / llm / framework —
+ * the type is a classification on top of the same manifest fact). Recall is
+ * exact because the manifest enumerates truth (protocol step 10).
+ */
+import { type OracleInput, type OracleResult } from './common.js';
+export declare function npmOracle(input: OracleInput): OracleResult;
+//# sourceMappingURL=npm.d.ts.map

package/dist/audit/oracles/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../src/audit/oracles/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAA+D,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAO/H,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAsB1D"}

package/dist/audit/oracles/npm.js

@@ -0,0 +1,37 @@
+/**
+ * npm oracle — truth frame: root package.json `dependencies` ∪ `devDependencies`.
+ *
+ * Map side: every component derived from the ROOT package.json, whatever type
+ * the scanner assigned it (npm / database / queue / service / llm / framework —
+ * the type is a classification on top of the same manifest fact). Recall is
+ * exact because the manifest enumerates truth (protocol step 10).
+ */
+import * as path from 'path';
+import { isRootPackageDerived, noOracle, readJsonSafe, setDiffOracle } from './common.js';
+export function npmOracle(input) {
+    const pkg = readJsonSafe(path.join(input.projectRoot, 'package.json'));
+    if (!pkg)
+        return noOracle('npm', 'package', 'no readable package.json at project root');
+    const truth = new Set([
+        ...Object.keys(pkg.dependencies ?? {}),
+        ...Object.keys(pkg.devDependencies ?? {}),
+    ]);
+    // Run 4 fix2 #3: a manifest that exists and parses is a VALID, possibly
+    // empty, frame. Every package-derived component is then a false positive.
+    const map = new Set();
+    let nested = 0;
+    for (const c of input.components) {
+        const files = c.source?.config_files ?? [];
+        if (isRootPackageDerived(c))
+            map.add(c.name);
+        else if (files.some((f) => path.basename(f) === 'package.json'))
+            nested++;
+    }
+    const notes = ['truth = dependencies ∪ devDependencies of root package.json; map = components sourced from that file'];
+    if (truth.size === 0)
+        notes.push('package.json declares no dependencies: the frame is empty, so every package-derived component is a false positive');
+    if (nested > 0)
+        notes.push(`${nested} components from nested package.json files excluded (outside the truth frame)`);
+    return setDiffOracle('npm', 'package', 'independent', truth, map, notes);
+}
+//# sourceMappingURL=npm.js.map

package/dist/audit/oracles/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/audit/oracles/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAuC,MAAM,aAAa,CAAC;AAO/H,MAAM,UAAU,SAAS,CAAC,KAAkB;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,0CAA0C,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS;QAC5B,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACtC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;KAC1C,CAAC,CAAC;IACH,wEAAwE;IACxE,0EAA0E;IAE1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;QAC3C,IAAI,oBAAoB,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC;YAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,sGAAsG,CAAC,CAAC;IACvH,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACtJ,IAAI,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,+EAA+E,CAAC,CAAC;IACrH,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC"}

package/dist/audit/oracles/prisma.d.ts

@@ -0,0 +1,42 @@
+/**
+ * prisma oracle — truth frame: models declared in the Prisma schema.
+ *
+ * Strength:
+ *   'independent' when `@prisma/internals` getDMMF resolves from the TARGET
+ *   repo's node_modules (the compiler's own parse of the schema) — only with
+ *   an explicit opt-in (`--trust-target-deps` / NAVGATOR_TRUST_TARGET_DEPS=1)
+ *   because that is code execution from the audited repo;
+ *   'weak' when we fall back to an independent regex (`^\s*model\s+(\w+)` plus
+ *   `@@map("…")`), which is a re-derivation, not a second source.
+ *
+ * Map side: every `database` component. Prisma-model components (primary
+ * config file ends in .prisma) are matched by model name or @@map table name.
+ * Known client libraries typed `database` (Run 4 finding: @prisma/client,
+ * ioredis, pg, redis, prisma, Supabase) are counted as false positives with
+ * note `client-library-misclassified`; any other non-schema `database`
+ * component is a false positive with note `not-a-schema-model`.
+ */
+import { type OracleInput, type OracleResult } from './common.js';
+/** Client libraries / hosted DB services the npm and service scanners type as `database`. */
+export declare const DATABASE_CLIENT_LIBRARIES: Set<string>;
+export interface PrismaTruth {
+    models: Array<{
+        name: string;
+        dbName?: string;
+    }>;
+    strength: 'independent' | 'weak';
+    files: string[];
+    note?: string;
+}
+/** Independent regex parse: `model Name {` … `@@map("table")` inside the block. */
+export declare function regexModels(datamodel: string): Array<{
+    name: string;
+    dbName?: string;
+}>;
+export declare function loadPrismaTruth(root: string, opts?: {
+    trustTargetDeps?: boolean;
+}): Promise<PrismaTruth | null>;
+export declare function prismaOracle(input: OracleInput, opts?: {
+    trustTargetDeps?: boolean;
+}): Promise<OracleResult>;
+//# sourceMappingURL=prisma.d.ts.map

package/dist/audit/oracles/prisma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.d.ts","sourceRoot":"","sources":["../../../src/audit/oracles/prisma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAiD,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEjH,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB,aAqBrC,CAAC;AAIF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,EAAE,aAAa,GAAG,MAAM,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAkBD,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAUvF;AAqBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA2BzH;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CA+BtH"}