@xenos1996/usa 2.26.2 → 2.28.0

package/dist/scanner/adapters/codeql.js

@@ -0,0 +1,134 @@
+/**
+ * CodeQL — Tier 1, opt-in and heavyweight.
+ *
+ * Two-step by nature: `database create` then `database analyze`. Both are
+ * constructed here and parsed through the shared SARIF normaliser.
+ *
+ * `analyze` writes SARIF to a **file** (`--output=`) and logs to stdout, so the
+ * adapter declares the file as its artifact. Before the runner could read
+ * artifacts, this adapter parsed stdout and therefore parsed log lines: the
+ * SARIF never reached `parse`. That is a structural bug the fixture-based tests
+ * could not see, because they called `parse` directly.
+ *
+ * Verified end-to-end against CodeQL 2.27.3 on `fixtures/insecure-app`: two
+ * stages, one artifact, two findings. Three bugs only a run could find —
+ *
+ * 1. the query specifier is positional, so the default empty `packs` was passed
+ *    as one empty specifier and the run died with `Invalid package
+ *    specification:` and no SARIF;
+ * 2. `codeql --version` prints a sentence, so `[\d.]+` recorded `2.27.3.`;
+ * 3. (in the shared SARIF normaliser) CodeQL omits `result.level`, which made
+ *    every finding INFO until the rule's `defaultConfiguration.level` was used.
+ *
+ * Security boundary, enforced and not aspirational: **the engine never runs a
+ * build command**. CodeQL's `--command` is arbitrary project code; the adapter
+ * will only emit it when the project config sets
+ * `allowBuildCommands: true`, which the runner refuses unless the audit opts in.
+ * Enforced twice, on purpose: once here, once in the tests.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { evidenceFromSarif } from '../sarif.js';
+/** Where `database analyze` writes its SARIF, relative to the scan workdir. */
+export const CODEQL_SARIF = 'codeql-results.sarif';
+export const codeqlAdapter = {
+    id: 'codeql',
+    name: 'CodeQL data-flow analysis (opt-in)',
+    needsNetwork: true,
+    defaultConfig() {
+        return { language: 'javascript-typescript', packs: '', allowBuildCommands: false };
+    },
+    probe() {
+        const executable = which('codeql');
+        if (!executable) {
+            return {
+                available: false,
+                version: '',
+                reason: 'codeql executable not found on PATH (download from github/codeql-action)',
+            };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(target, config) {
+        const language = String(config.language ?? 'javascript-typescript');
+        if (config.allowBuildCommands) {
+            throw new Error('allowBuildCommands must be granted by the audit, not by an adapter: the runner refuses build steps by default');
+        }
+        const db = path.join(target.workdir, 'codeql-db');
+        return {
+            prepare: [
+                {
+                    argv: [
+                        'codeql',
+                        'database',
+                        'create',
+                        db,
+                        '--language',
+                        language,
+                        '--source-root',
+                        target.path,
+                        '--no-run-unnecessary-builds',
+                    ],
+                    timeoutMs: 900_000,
+                },
+            ],
+            argv: codeqlAnalyzeCommand(db, String(config.packs ?? ''), path.join(target.workdir, CODEQL_SARIF)),
+            artifacts: [CODEQL_SARIF],
+            timeoutMs: 900_000,
+            network: true,
+        };
+    },
+    parse(raw, context) {
+        return evidenceFromSarif(raw, {
+            tool: 'codeql',
+            kind: 'dataflow-finding',
+            adapterVersion: context.adapterVersion,
+            confidence: 1.0,
+        });
+    },
+};
+/**
+ * The analyze leg, exposed so tests and callers can build it without running create.
+ *
+ * `packs` is a *positional* argument, so an empty string is not "no packs" — it
+ * is one empty specifier, and CodeQL rejects the whole run with
+ * `Invalid package specification:` and writes no SARIF. Measured on 2.27.3: with
+ * no specifier at all, CodeQL runs the language's default (code-scanning) suite.
+ */
+export function codeqlAnalyzeCommand(db, packs, out) {
+    const specifier = packs.trim();
+    return [
+        'codeql',
+        'database',
+        'analyze',
+        db,
+        ...(specifier ? [specifier] : []),
+        '--format=sarif-latest',
+        `--output=${out}`,
+    ];
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], { encoding: 'utf8', timeout: 30_000 });
+    // `codeql --version` prints "CodeQL command-line toolchain release 2.27.3."
+    // A `[\d.]+` class captures the sentence's full stop, and the version is
+    // recorded as "2.27.3." in every manifest.
+    const match = /(\d+\.\d+\.\d+)/.exec(String(proc.stdout ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=codeql.js.map

package/dist/scanner/adapters/codeql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeql.js","sourceRoot":"","sources":["../../../src/scanner/adapters/codeql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,oCAAoC;IAC1C,YAAY,EAAE,IAAI;IAElB,aAAa;QACX,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,0EAA0E;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAqB;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE;wBACJ,QAAQ;wBACR,UAAU;wBACV,QAAQ;wBACR,EAAE;wBACF,YAAY;wBACZ,QAAQ;wBACR,eAAe;wBACf,MAAM,CAAC,IAAI;wBACX,6BAA6B;qBAC9B;oBACD,SAAS,EAAE,OAAO;iBACnB;aACF;YACD,IAAI,EAAE,oBAAoB,CACxB,EAAE,EACF,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CACxC;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,OAAO,iBAAiB,CAAC,GAAG,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,kBAAkB;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO;QACL,QAAQ;QACR,UAAU;QACV,SAAS;QACT,EAAE;QACF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,uBAAuB;QACvB,YAAY,GAAG,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,4EAA4E;IAC5E,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/adapters/dependency-cruiser.d.ts

@@ -0,0 +1,3 @@
+import type { ScannerAdapter } from '../types.js';
+export declare const dependencyCruiserAdapter: ScannerAdapter;
+//# sourceMappingURL=dependency-cruiser.d.ts.map

package/dist/scanner/adapters/dependency-cruiser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-cruiser.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/dependency-cruiser.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAA0B,cAAc,EAAiB,MAAM,aAAa,CAAC;AAIzF,eAAO,MAAM,wBAAwB,EAAE,cA2EtC,CAAC"}

package/dist/scanner/adapters/dependency-cruiser.js

@@ -0,0 +1,174 @@
+/**
+ * dependency-cruiser — Tier 1.
+ *
+ * The critical fact driving this adapter: `-T json` **exits 0 regardless of
+ * violations** (the CLI docs are explicit; only the err-family reporters exit
+ * with the count of error-severity violations). Reading the exit code here
+ * would make every architecture violation invisible. The verdict is parsed
+ * from the JSON, never from the process status.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { buildEvidence } from '../identity.js';
+import { DETERMINISTIC_CONFIDENCE, dig, tryParseJson } from '../normalize.js';
+export const dependencyCruiserAdapter = {
+    id: 'dependency-cruiser',
+    name: 'Dependency graph and architecture rules (JS/TS)',
+    defaultConfig() {
+        return { args: ['src'], rules: '' };
+    },
+    /**
+     * `--config` is passed only when the project supplies a rules file. The
+     * alternative — always `--no-config` — would make this adapter a graph
+     * printer: a cruise with no rules produces zero violations, and "0
+     * violations" is exactly the unfalsifiable result this subsystem refuses to
+     * emit. Verified against depcruise 18.7.0: the JSON has no `rules` key, so
+     * whether rules ran is a *configuration* fact, not something to detect from
+     * the output.
+     */
+    probe() {
+        for (const binary of ['depcruise', 'dependency-cruiser']) {
+            const executable = which(binary);
+            if (executable) {
+                return { available: true, version: versionOf(executable), executable };
+            }
+        }
+        return {
+            available: false,
+            version: '',
+            reason: 'depcruise executable not found on PATH (not installed in this environment)',
+        };
+    },
+    buildCommand(target, config) {
+        const args = config.args ?? ['src'];
+        // The rules file has to reach argv, not only the parser. A parser told that
+        // rules exist stops guarding an empty violation list (see `parse`), so a
+        // cruise that never loaded the rules would report `ok` with no rows — a
+        // silent pass on the one thing this adapter exists to detect.
+        const rules = String(config.rules ?? '');
+        return {
+            argv: [
+                'depcruise',
+                '--output-type',
+                'json',
+                ...(rules ? ['--config', rules] : ['--no-config']),
+                ...args,
+            ],
+            timeoutMs: 120_000,
+        };
+    },
+    parse(raw, context) {
+        const parsed = tryParseJson(raw);
+        if (!parsed.ok) {
+            return [unknown(context, `dependency-cruiser output was not valid JSON: ${parsed.error}`)];
+        }
+        const modules = dig(parsed.value, ['modules']);
+        if (!Array.isArray(modules)) {
+            return [
+                unknown(context, 'dependency-cruiser report carried no modules array (nothing scanned?)'),
+            ];
+        }
+        const violations = dig(parsed.value, ['summary', 'violations']);
+        const list = Array.isArray(violations) ? violations : [];
+        // No rules configured means the cruise produced a graph, not a verdict —
+        // and "0 violations" would be indistinguishable from "no problems".
+        if (list.length === 0 && !String(context.config.rules ?? '')) {
+            return [
+                unknown(context, 'dependency-cruiser ran without a rules config — a graph, not a verdict'),
+            ];
+        }
+        return list.map((violation, index) => violationToEvidence(violation, index, context.adapterVersion));
+    },
+};
+/** One edge violation → one evidence row naming both endpoints. */
+/**
+ * depcruise 18.7.0 emits `from`/`to` as plain strings ("a.js"); some versions
+ * and the `--output-type err` family use objects. Accept both rather than
+ * guessing, which is how the first version of this adapter produced `? → ?`.
+ */
+function endpoint(value) {
+    if (typeof value === 'string')
+        return value;
+    return String(dig(value, ['path']) ?? 'unknown');
+}
+function violationToEvidence(violation, index, adapterVersion) {
+    const from = endpoint(dig(violation, ['from']));
+    const to = endpoint(dig(violation, ['to']));
+    const ruleName = String(dig(violation, ['rule', 'name']) ?? dig(violation, ['rule', 'id']) ?? 'unnamed-rule');
+    const severityWord = String(dig(violation, ['rule', 'severity']) ?? 'warn');
+    return buildEvidence({
+        source: {
+            tool: 'dependency-cruiser',
+            kind: 'dependency-edge',
+            version: adapterVersion,
+            identifier: ruleName,
+        },
+        provenance: placeholder(),
+        claim: `${from} → ${to} breaks rule ${ruleName} (${severityWord})`,
+        severity: mapSeverity(severityWord),
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'FAIL',
+        location: { file: from },
+        rawReference: { jsonPath: `summary.violations[${index}]` },
+    });
+}
+function mapSeverity(word) {
+    if (word === 'error')
+        return 'HIGH';
+    if (word === 'info')
+        return 'INFO';
+    return 'MEDIUM';
+}
+function unknown(context, reason) {
+    return {
+        id: `UNKNOWN-dependency-cruiser-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: {
+            tool: 'dependency-cruiser',
+            version: context.adapterVersion,
+            kind: 'check',
+            identifier: 'UNKNOWN',
+        },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], { encoding: 'utf8', timeout: 15_000 });
+    const match = /([\w.]+)/.exec(String(proc.stdout ?? proc.stderr ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=dependency-cruiser.js.map

package/dist/scanner/adapters/dependency-cruiser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-cruiser.js","sourceRoot":"","sources":["../../../src/scanner/adapters/dependency-cruiser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,iDAAiD;IAEvD,aAAa;QACX,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IAEH,KAAK;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAqB;QACxC,MAAM,IAAI,GAAI,MAAM,CAAC,IAA6B,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,IAAI,EAAE;gBACJ,WAAW;gBACX,eAAe;gBACf,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAClD,GAAG,IAAI;aACR;YACD,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,iDAAiD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,CAAC,OAAO,EAAE,uEAAuE,CAAC;aAC1F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,CAAC,OAAO,EAAE,wEAAwE,CAAC;aAC3F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACnC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAC9D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,mEAAmE;AACnE;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAkB,EAAE,KAAa,EAAE,cAAsB;IACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CACrB,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,cAAc,CACrF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;IAC5E,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,QAAQ;SACrB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,GAAG,IAAI,MAAM,EAAE,gBAAgB,QAAQ,KAAK,YAAY,GAAG;QAClE,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACxB,YAAY,EAAE,EAAE,QAAQ,EAAE,sBAAsB,KAAK,GAAG,EAAE;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,OAAsD,EAAE,MAAc;IACrF,OAAO;QACL,EAAE,EAAE,8BAA8B,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACtF,MAAM,EAAE;YACN,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,SAAS;SACtB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/adapters/ort.d.ts

@@ -0,0 +1,12 @@
+import type { ScannerAdapter } from '../types.js';
+/** The artifact `analyze` writes and `evaluate` reads. */
+export declare const ORT_ANALYZER_RESULT = "analyzer-result.yml";
+/** The artifact `evaluate -f JSON` writes — the one this adapter parses. */
+export declare const ORT_EVALUATION_RESULT = "evaluation-result.json";
+/**
+ * The ruleset ORT bundles. Reachable only with the leading slash (measured);
+ * `scanners.ort.rulesFile` replaces it with a project's own `.kts` script.
+ */
+export declare const ORT_DEFAULT_RULES = "/rules/osadl.rules.kts";
+export declare const ortAdapter: ScannerAdapter;
+//# sourceMappingURL=ort.d.ts.map

package/dist/scanner/adapters/ort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ort.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/ort.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAA0B,cAAc,EAAE,MAAM,aAAa,CAAC;AAI1E,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,eAAO,MAAM,UAAU,EAAE,cAkFxB,CAAC"}

package/dist/scanner/adapters/ort.js

@@ -0,0 +1,259 @@
+/**
+ * OSS Review Toolkit (ORT) — Tier 2.
+ *
+ * ORT is a staged pipeline: `analyze` → `scan` → `advise` → `evaluate` → `report`.
+ * The stage whose output is *evidence* is `evaluate`: policy rules applied to a
+ * resolved dependency graph, producing rule violations with a package, a
+ * version and a rule name.
+ *
+ * CLI and payload verified against ORT 97.0.0 (run from the project's container
+ * image, `ghcr.io/oss-review-toolkit/ort`):
+ *
+ *     ort analyze --input-dir <dir> --output-dir <dir>        # → analyzer-result.yml
+ *     ort evaluate -i <analyzer-result.yml> -o <dir> -f JSON  # → evaluation-result.json
+ *
+ * Four things measured here that the documentation does not say:
+ *
+ * 1. `evaluate` does not take `--input-dir`; the input is `-i/--ort-file` and
+ *    it takes the result *file*.
+ * 2. `evaluate` refuses to run without a rules *script* ("No rules specified.").
+ *    The ruleset ORT ships is a classpath resource, and `--rules-resource` needs
+ *    a **leading slash** (`/rules/osadl.rules.kts`): the un-prefixed form
+ *    resolves against the command's own jar and dies with a NullPointerException.
+ * 3. The violations are written to a **file**, not stdout — stdout carries
+ *    progress logs. An adapter that parses stdout parses the wrong stream.
+ * 4. `evaluate` **exits 2** when it finds violations. That is a successful run
+ *    that objects, so exit status is recorded and never interpreted.
+ *
+ * The payload is `{ evaluator: { violations: [ { rule, pkg, license,
+ * license_sources, severity, message, how_to_fix } ] } }` where `pkg` is a
+ * coordinate string (`NPM::lodash:4.17.21`) or `null` for a violation that is
+ * not attached to a package.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { buildEvidence } from '../identity.js';
+import { DETERMINISTIC_CONFIDENCE, dig, tryParseJson } from '../normalize.js';
+/** The artifact `analyze` writes and `evaluate` reads. */
+export const ORT_ANALYZER_RESULT = 'analyzer-result.yml';
+/** The artifact `evaluate -f JSON` writes — the one this adapter parses. */
+export const ORT_EVALUATION_RESULT = 'evaluation-result.json';
+/**
+ * The ruleset ORT bundles. Reachable only with the leading slash (measured);
+ * `scanners.ort.rulesFile` replaces it with a project's own `.kts` script.
+ */
+export const ORT_DEFAULT_RULES = '/rules/osadl.rules.kts';
+export const ortAdapter = {
+    id: 'ort',
+    name: 'OSS Review Toolkit dependency policy evaluator',
+    // Only `analyze` reaches the network: it resolves the dependency graph from
+    // the package registry. `evaluate` reads a file.
+    needsNetwork: true,
+    networkConfigKey: 'scanners.ort.ortFile',
+    defaultConfig() {
+        return {
+            outputDir: '.ort-results',
+            ortFile: '',
+            rulesFile: '',
+            rulesResource: ORT_DEFAULT_RULES,
+        };
+    },
+    probe() {
+        const executable = which('ort');
+        if (!executable) {
+            return {
+                available: false,
+                version: '',
+                reason: 'ort executable not found on PATH (JVM package from oss-review-toolkit/ort; ' +
+                    'the container image ghcr.io/oss-review-toolkit/ort is the verified runner)',
+            };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(target, config) {
+        const outputDir = String(config.outputDir ?? '.ort-results');
+        // A pre-computed result file turns this into a single offline stage.
+        const ortFile = String(config.ortFile ?? '');
+        const rulesFile = String(config.rulesFile ?? '');
+        const rulesResource = String(config.rulesResource ?? ORT_DEFAULT_RULES);
+        const input = ortFile || path.posix.join(outputDir, ORT_ANALYZER_RESULT);
+        const rules = rulesFile ? ['-r', rulesFile] : [`--rules-resource=${rulesResource}`];
+        return {
+            argv: ['ort', 'evaluate', '-i', input, '-o', outputDir, '-f', 'JSON', ...rules],
+            prepare: ortFile
+                ? []
+                : [
+                    {
+                        argv: ['ort', 'analyze', '--input-dir', target.workdir, '--output-dir', outputDir],
+                        timeoutMs: 900_000,
+                    },
+                ],
+            artifacts: [path.posix.join(outputDir, ORT_EVALUATION_RESULT)],
+            network: !ortFile,
+            timeoutMs: 600_000,
+        };
+    },
+    parse(raw, context) {
+        // ORT writes YAML by default; `-f JSON` (what the adapter asks for) writes
+        // JSON. Accept both so a hand-converted artifact still parses.
+        let doc;
+        if (raw.trimStart().startsWith('{')) {
+            const parsed = tryParseJson(raw);
+            if (!parsed.ok)
+                return [unknown(context, `ORT output was not valid JSON: ${parsed.error}`)];
+            doc = parsed.value;
+        }
+        else {
+            try {
+                doc = parseYaml(raw);
+            }
+            catch (err) {
+                return [unknown(context, `ORT output was not valid YAML: ${err.message}`)];
+            }
+        }
+        // ORT 97 nests the result under `evaluator`; older layouts put it at the
+        // top. Accept both, and say so when neither is present rather than
+        // reporting a clean scan.
+        const violations = dig(doc, ['evaluator', 'violations']) ?? dig(doc, ['violations']);
+        if (!Array.isArray(violations)) {
+            return [unknown(context, 'ORT evaluation carried no violations array (nothing evaluated?)')];
+        }
+        if (violations.length === 0)
+            return [cleanRun(doc, context)];
+        return violations.map((violation, index) => violationToEvidence(violation, index, context.adapterVersion));
+    },
+};
+/**
+ * A clean evaluation is a fact, and its absence is not.
+ *
+ * With no row, "the policy was applied and nothing violated it" and "the policy
+ * never ran" look identical to a rule consuming this evidence.
+ */
+function cleanRun(doc, context) {
+    const packages = dig(doc, ['analyzer', 'result', 'packages']);
+    const count = Array.isArray(packages) ? packages.length : null;
+    const ruleset = String(context.config.rulesFile || context.config.rulesResource || ORT_DEFAULT_RULES);
+    return buildEvidence({
+        source: {
+            tool: 'ort',
+            kind: 'policy-evaluation',
+            version: context.adapterVersion,
+            identifier: 'evaluation',
+        },
+        provenance: placeholder(),
+        claim: `ORT evaluated ${count === null ? 'an unrecorded number of' : count} package(s) ` +
+            `under ${ruleset}: no rule violations`,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'PASS',
+        location: null,
+        rawReference: { jsonPath: 'evaluator.violations' },
+    });
+}
+/** ORT's own severity words, mapped once here rather than inside the normaliser. */
+function ortSeverity(word) {
+    switch (word.toUpperCase()) {
+        case 'ERROR':
+            return 'HIGH';
+        case 'WARNING':
+            return 'MEDIUM';
+        case 'HINT':
+            return 'INFO';
+        default:
+            return 'LOW';
+    }
+}
+/** A string field, trimmed; anything else is empty rather than "[object Object]". */
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function violationToEvidence(violation, index, adapterVersion) {
+    const rule = text(dig(violation, ['rule'])) || 'unknown rule';
+    // `pkg` is a coordinate string or null. Null is not "unknown package": it is
+    // a violation the ruleset attached to the result rather than to a package.
+    const pkg = text(dig(violation, ['pkg'])) || null;
+    const message = text(dig(violation, ['message']));
+    const howToFix = text(dig(violation, ['how_to_fix']));
+    const license = text(dig(violation, ['license']));
+    const severityWord = text(dig(violation, ['severity'])) || 'ERROR';
+    // A licence-policy violation is only actionable if the licence is in the
+    // claim: the rule name alone does not say which licence tripped it.
+    const about = license ? ` (license ${license})` : '';
+    const detail = message ? `: ${message}` : '';
+    return buildEvidence({
+        source: {
+            tool: 'ort',
+            kind: 'policy-violation',
+            version: adapterVersion,
+            identifier: rule,
+        },
+        provenance: placeholder(),
+        claim: `${pkg ?? 'the repository'} violates policy rule ${rule}${about}${detail}`,
+        severity: ortSeverity(severityWord),
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'FAIL',
+        location: null,
+        rawReference: {
+            jsonPath: `evaluator.violations[${index}]`,
+            ...(howToFix ? { excerpt: howToFix } : {}),
+        },
+    });
+}
+function unknown(context, reason) {
+    return {
+        id: `UNKNOWN-ort-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: { tool: 'ort', version: context.adapterVersion, kind: 'check', identifier: 'UNKNOWN' },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], { encoding: 'utf8', timeout: 60_000 });
+    // Measured: `ort --version` prints JVM warnings first, and one of them names a
+    // jar (`jna-5.19.1.jar`) — a loose regex on the whole output reports 5.19.1 as
+    // the ORT version. Only a line that *is* a version counts, and the real one is
+    // last.
+    const lines = String(proc.stdout ?? proc.stderr ?? '')
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => /^\d+\.\d+\.\d+/.test(line));
+    const last = lines.at(-1);
+    return last ? /^(\d+\.\d+\.\d+)/.exec(last)[1] : 'unknown';
+}
+//# sourceMappingURL=ort.js.map

package/dist/scanner/adapters/ort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ort.js","sourceRoot":"","sources":["../../../src/scanner/adapters/ort.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE9E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,MAAM,CAAC,MAAM,UAAU,GAAmB;IACxC,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,gDAAgD;IACtD,4EAA4E;IAC5E,iDAAiD;IACjD,YAAY,EAAE,IAAI;IAClB,gBAAgB,EAAE,sBAAsB;IAExC,aAAa;QACX,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,iBAAiB;SACjC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE;gBACX,MAAM,EACJ,6EAA6E;oBAC7E,4EAA4E;aAC/E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAM;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC,CAAC;QAC7D,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,aAAa,EAAE,CAAC,CAAC;QACpF,OAAO;YACL,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;YAC/E,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC;wBAClF,SAAS,EAAE,OAAO;qBACnB;iBACF;YACL,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;YAC9D,OAAO,EAAE,CAAC,OAAO;YACjB,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,2EAA2E;QAC3E,+DAA+D;QAC/D,IAAI,GAAY,CAAC;QACjB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,kCAAkC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5F,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,kCAAmC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,mEAAmE;QACnE,0BAA0B;QAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,iEAAiE,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACzC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAC9D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,QAAQ,CACf,GAAY,EACZ,OAAoE;IAEpE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,CACpB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,iBAAiB,CAC9E,CAAC;IACF,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,UAAU,EAAE,YAAY;SACzB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EACH,iBAAiB,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,cAAc;YACjF,SAAS,OAAO,sBAAsB;QACxC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAY;IAC/B,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAkB,EAAE,KAAa,EAAE,cAAsB;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;IAC9D,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IACnE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,IAAI;SACjB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,GAAG,GAAG,IAAI,gBAAgB,yBAAyB,IAAI,GAAG,KAAK,GAAG,MAAM,EAAE;QACjF,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE;YACZ,QAAQ,EAAE,wBAAwB,KAAK,GAAG;YAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,OAAsD,EAAE,MAAc;IACrF,OAAO;QACL,EAAE,EAAE,eAAe,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACvE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;QAC9F,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,QAAQ;IACR,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SACnD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC"}

package/dist/scanner/adapters/scorecard.d.ts

@@ -0,0 +1,7 @@
+import type { ScannerAdapter } from '../types.js';
+/** The file-based checks that survive `--local` (verified against v5.6.0). */
+export declare const LOCAL_CHECKS: string[];
+export declare const scorecardAdapter: ScannerAdapter;
+/** `git@github.com:org/repo.git` or `https://github.com/org/repo.git` → `org/repo`. */
+export declare function deriveRepoSlug(targetPath: string): string;
+//# sourceMappingURL=scorecard.d.ts.map

package/dist/scanner/adapters/scorecard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorecard.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/scorecard.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA0B,cAAc,EAAiB,MAAM,aAAa,CAAC;AAIzF,8EAA8E;AAC9E,eAAO,MAAM,YAAY,UAQxB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,cA6D9B,CAAC;AAsFF,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CASzD"}