@xenos1996/usa 2.27.0 → 2.28.0

package/dist/scanner/adapters/scorecard.js

@@ -0,0 +1,209 @@
+/**
+ * OpenSSF Scorecard — Tier 2.
+ *
+ * Two modes, because the tool has two natures and they are not interchangeable:
+ *
+ * - `--local <folder>` reads a checkout and runs the **file-based** checks
+ *   offline. Verified here (v5.6.0): SAST, License, Pinned-Dependencies,
+ *   Dependency-Update-Tool, Binary-Artifacts, Fuzzing, Packaging.
+ * - `--repo <url>` reaches the platform API and runs the **platform** checks
+ *   (Branch-Protection, Token-Permissions, Signed-Releases, Code-Review, …).
+ *   It needs network and a token.
+ *
+ * Measured in local mode, the platform checks do not degrade to `?` — they make
+ * the whole run fail (`Unsupported RequestType [0] by check: Branch-Protection`).
+ * So the check list is explicit in local mode; leaving it off is a crash, not a
+ * partial result.
+ *
+ * The aggregate score is deliberately NOT emitted as evidence. Scorecard's own
+ * README says the aggregate "tells you nothing about what individual behaviors a
+ * repository is or is not doing"; a per-check reason is evidence, a 7.5/10 is a
+ * headline.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { buildEvidence } from '../identity.js';
+import { DETERMINISTIC_CONFIDENCE, dig, tryParseJson } from '../normalize.js';
+/** The file-based checks that survive `--local` (verified against v5.6.0). */
+export const LOCAL_CHECKS = [
+    'SAST',
+    'License',
+    'Pinned-Dependencies',
+    'Dependency-Update-Tool',
+    'Binary-Artifacts',
+    'Fuzzing',
+    'Packaging',
+];
+export const scorecardAdapter = {
+    id: 'scorecard',
+    name: 'OpenSSF Scorecard repository posture probes',
+    /** Only the repo mode reaches the network; local mode is fully offline. */
+    needsNetwork: false,
+    defaultConfig() {
+        return { mode: 'local', checks: LOCAL_CHECKS };
+    },
+    probe() {
+        const executable = which('scorecard');
+        if (!executable) {
+            return {
+                available: false,
+                version: '',
+                reason: 'scorecard executable not found on PATH (release binary from ossf/scorecard)',
+            };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(target, config) {
+        const mode = String(config.mode ?? 'local');
+        const checks = Array.isArray(config.checks) ? config.checks : LOCAL_CHECKS;
+        if (mode === 'repo') {
+            const repo = String(config.repo ?? '') || deriveRepoSlug(target.path);
+            return {
+                argv: ['scorecard', '--repo', repo, '--format', 'json', '--show-details'],
+                timeoutMs: 300_000,
+                network: true,
+            };
+        }
+        return {
+            argv: [
+                'scorecard',
+                '--local',
+                target.workdir,
+                '--format',
+                'json',
+                '--checks',
+                checks.join(','),
+            ],
+            timeoutMs: 300_000,
+        };
+    },
+    parse(raw, context) {
+        const parsed = tryParseJson(raw);
+        if (!parsed.ok) {
+            return [unknown(context, `scorecard output was not valid JSON: ${parsed.error}`)];
+        }
+        const checks = dig(parsed.value, ['checks']);
+        if (!Array.isArray(checks)) {
+            return [unknown(context, 'scorecard JSON carried no checks array')];
+        }
+        const toolVersion = String(dig(parsed.value, ['scorecard', 'version']) ?? context.adapterVersion);
+        return checks.flatMap((check, index) => checkToEvidence(check, index, toolVersion));
+    },
+};
+/** One probe → one evidence row carrying the tool's own reason. */
+function checkToEvidence(check, index, toolVersion) {
+    const name = String(dig(check, ['name']) ?? 'unknown-check');
+    const score = Number(dig(check, ['score']));
+    const reason = String(dig(check, ['reason']) ?? 'no reason given');
+    const docUrl = String(dig(check, ['documentation', 'url']) ?? '');
+    const source = {
+        tool: 'scorecard',
+        kind: 'posture-probe',
+        version: toolVersion,
+        identifier: name,
+    };
+    // A negative score is scorecard's "could not evaluate" — UNKNOWN, never a fail
+    // and never a pass. The reason string says why, and that is the evidence.
+    if (!Number.isFinite(score) || score < 0) {
+        return [
+            buildEvidence({
+                source,
+                provenance: placeholder(),
+                claim: `${name}: could not be evaluated — ${reason}`,
+                severity: 'INFO',
+                confidence: DETERMINISTIC_CONFIDENCE,
+                status: 'UNKNOWN',
+                location: null,
+                rawReference: { jsonPath: `checks[${index}]`, excerpt: reason.slice(0, 160) },
+            }),
+        ];
+    }
+    // Scorecard's 0–10 is a scale, not a verdict, and the same number means
+    // different things per probe: License 9 is "detected, not identified" while
+    // Binary-Artifacts 6 is "binaries present". Collapsing either to FAIL loses
+    // the distinction and collapsing to PASS launders the caveat, so the adapter
+    // emits PARTIAL and carries the number in the claim. A rule decides what
+    // threshold means a failure — that is a policy question, not a parsing one.
+    const status = score >= 10 ? 'PASS' : 'PARTIAL';
+    return [
+        buildEvidence({
+            source,
+            provenance: placeholder(),
+            claim: `${name} (${score}/10): ${reason}`,
+            severity: status === 'PASS' ? 'INFO' : 'MEDIUM',
+            confidence: DETERMINISTIC_CONFIDENCE,
+            status,
+            location: null,
+            rawReference: { jsonPath: `checks[${index}]`, excerpt: docUrl.slice(0, 160) },
+        }),
+    ];
+}
+function unknown(context, reason) {
+    return {
+        id: `UNKNOWN-scorecard-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: {
+            tool: 'scorecard',
+            version: context.adapterVersion,
+            kind: 'check',
+            identifier: 'UNKNOWN',
+        },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+/** `git@github.com:org/repo.git` or `https://github.com/org/repo.git` → `org/repo`. */
+export function deriveRepoSlug(targetPath) {
+    const proc = spawnSync('git', ['remote', 'get-url', 'origin'], {
+        cwd: targetPath,
+        encoding: 'utf8',
+        timeout: 15_000,
+    });
+    const url = String(proc.stdout ?? '').trim();
+    const match = /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/.exec(url);
+    return match?.[1] ?? '';
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+/**
+ * `scorecard version` prints an ASCII-art banner before the number, so the
+ * pattern demands a full semver — a loose `[\d.]+` matches the art instead.
+ * The JSON report also carries the version, and the parser prefers that one.
+ */
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['version'], { encoding: 'utf8', timeout: 20_000 });
+    const match = /\bv?(\d+\.\d+\.\d+)\b/.exec(String(proc.stdout ?? proc.stderr ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=scorecard.js.map

package/dist/scanner/adapters/scorecard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorecard.js","sourceRoot":"","sources":["../../../src/scanner/adapters/scorecard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM;IACN,SAAS;IACT,qBAAqB;IACrB,wBAAwB;IACxB,kBAAkB;IAClB,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,6CAA6C;IACnD,2EAA2E;IAC3E,YAAY,EAAE,KAAK;IAEnB,aAAa;QACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,6EAA6E;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAqB;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,MAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;QACzF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO;gBACL,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC;gBACzE,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,WAAW;gBACX,SAAS;gBACT,MAAM,CAAC,OAAO;gBACd,UAAU;gBACV,MAAM;gBACN,UAAU;gBACV,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACjB;YACD,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,wCAAwC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,cAAc,CACtE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACtF,CAAC;CACF,CAAC;AAEF,mEAAmE;AACnE,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAE,WAAmB;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,IAAI;KACjB,CAAC;IAEF,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,aAAa,CAAC;gBACZ,MAAM;gBACN,UAAU,EAAE,WAAW,EAAE;gBACzB,KAAK,EAAE,GAAG,IAAI,8BAA8B,MAAM,EAAE;gBACpD,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,wBAAwB;gBACpC,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC9E,CAAC;SACH,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,OAAO;QACL,aAAa,CAAC;YACZ,MAAM;YACN,UAAU,EAAE,WAAW,EAAE;YACzB,KAAK,EAAE,GAAG,IAAI,KAAK,KAAK,SAAS,MAAM,EAAE;YACzC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAC/C,UAAU,EAAE,wBAAwB;YACpC,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC9E,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,OAAsD,EAAE,MAAc;IACrF,OAAO;QACL,EAAE,EAAE,qBAAqB,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7E,MAAM,EAAE;YACN,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,SAAS;SACtB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;QAC7D,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/adapters/semgrep.d.ts

@@ -0,0 +1,3 @@
+import type { ScannerAdapter } from '../types.js';
+export declare const semgrepAdapter: ScannerAdapter;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/scanner/adapters/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/semgrep.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAA0B,cAAc,EAAiB,MAAM,aAAa,CAAC;AAWzF,eAAO,MAAM,cAAc,EAAE,cAmF5B,CAAC"}

package/dist/scanner/adapters/semgrep.js

@@ -0,0 +1,163 @@
+/**
+ * Semgrep — Tier 1.
+ *
+ * Verified by installing semgrep 1.182.0 and running it against
+ * `fixtures/insecure-app` with a vendored rule; the committed fixture is a real
+ * capture. Two measured details shape this adapter: `path` is absolute when the
+ * target is absolute (so it is relativised to the scan root), and
+ * `extra.fingerprint` is the literal string "requires login" on the OSS engine
+ * without an account (so the evidence id is content-derived, never the
+ * fingerprint).
+ *
+ * Exit-code behaviour is verified from the CLI reference: default `scan`
+ * **exits 0 even with findings**; only `--error` exits 1. The runner never
+ * infers a verdict from the status code, so this does not affect semantics —
+ * but it is why the adapter does not pass `--error`.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { buildEvidence } from '../identity.js';
+import { DETERMINISTIC_CONFIDENCE, dig, lineNumber, relativePath, severity, tryParseJson, } from '../normalize.js';
+export const semgrepAdapter = {
+    id: 'semgrep',
+    name: 'Semgrep SAST scanner',
+    networkConfigKey: 'scanners.semgrep.rules',
+    defaultConfig() {
+        return { rules: '', severity: [] };
+    },
+    probe() {
+        const executable = which('semgrep');
+        if (!executable) {
+            return { available: false, version: '', reason: 'semgrep executable not found on PATH' };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(_target, config) {
+        const rules = String(config.rules ?? '');
+        const argv = [
+            'semgrep',
+            'scan',
+            '--json',
+            // No --error: exit status is not a verdict, and 1-on-findings would look
+            // like a crash to any later naive consumer.
+            ...(rules ? ['--config', rules] : ['--config', 'auto']),
+            // Network is only needed for --config auto; a vendored rules dir is offline.
+            ...(rules ? [] : []),
+        ];
+        return { argv, timeoutMs: 300_000, network: !rules };
+    },
+    parse(raw, context) {
+        const parsed = tryParseJson(raw);
+        if (!parsed.ok) {
+            return [unknown(context, `semgrep output was not valid JSON: ${parsed.error}`)];
+        }
+        const results = dig(parsed.value, ['results']);
+        if (!Array.isArray(results)) {
+            return [unknown(context, 'semgrep JSON had no results array (no rules ran?)')];
+        }
+        // `results: []` means "found nothing" only if semgrep actually read
+        // something. `paths.scanned` is the tool's own count, and an empty list
+        // there is a blind spot — the same distinction trivy's `Results` guard and
+        // dependency-cruiser's rules guard exist to keep. An absent key is not
+        // evidence of an empty scan (older builds omit it), so only a present,
+        // empty array fires.
+        const scanned = dig(parsed.value, ['paths', 'scanned']);
+        if (Array.isArray(scanned) && scanned.length === 0) {
+            return [
+                unknown(context, 'semgrep scanned no files — nothing was analysed, not a clean result'),
+            ];
+        }
+        const out = [];
+        for (const [index, result] of results.entries()) {
+            out.push(buildEvidence({
+                source: {
+                    tool: 'semgrep',
+                    kind: 'sast-finding',
+                    version: context.adapterVersion,
+                    identifier: String(dig(result, ['check_id']) ?? 'unknown-rule'),
+                },
+                provenance: placeholder(),
+                claim: String(dig(result, ['extra', 'message']) ?? 'semgrep match').slice(0, 160),
+                severity: severity(dig(result, ['extra', 'severity'])),
+                // Heuristic rule engine, registry-dependent; the number is a policy
+                // statement from the adapter, not a measurement.
+                confidence: 0.9,
+                status: 'FAIL',
+                location: {
+                    // The runner scans a scratch copy, so semgrep reports absolute
+                    // paths there; evidence must name the file in the project.
+                    file: relativePath(context.target.workdir, String(dig(result, ['path']) ?? 'unknown')),
+                    line: lineNumber(dig(result, ['start', 'line'])),
+                },
+                rawReference: { jsonPath: `results[${index}]` },
+                cwes: cwesOf(dig(result, ['extra', 'metadata', 'cwe'])),
+            }));
+        }
+        return out;
+    },
+};
+/** `["CWE-94: Improper Control…"]` → `["CWE-94"]`. */
+function cwesOf(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = new Set();
+    for (const entry of value) {
+        const match = /CWE[-_ ]?(\d{1,5})/i.exec(String(entry));
+        if (match)
+            out.add(`CWE-${Number(match[1])}`);
+    }
+    return [...out];
+}
+function unknown(context, reason) {
+    return {
+        id: `UNKNOWN-semgrep-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: {
+            tool: 'semgrep',
+            version: context.adapterVersion,
+            kind: 'check',
+            identifier: 'UNKNOWN',
+        },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], { encoding: 'utf8', timeout: 30_000 });
+    const match = /([\d.]+)/.exec(String(proc.stdout ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/scanner/adapters/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/scanner/adapters/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,GAAG,EACH,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,YAAY,GACb,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,sBAAsB;IAC5B,gBAAgB,EAAE,wBAAwB;IAE1C,aAAa;QACX,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,OAAO,EAAE,MAAqB;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG;YACX,SAAS;YACT,MAAM;YACN,QAAQ;YACR,yEAAyE;YACzE,4CAA4C;YAC5C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvD,6EAA6E;YAC7E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrB,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,mDAAmD,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,qBAAqB;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,OAAO,CAAC,OAAO,EAAE,qEAAqE,CAAC;aACxF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CACN,aAAa,CAAC;gBACZ,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,OAAO,CAAC,cAAc;oBAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,cAAc,CAAC;iBAChE;gBACD,UAAU,EAAE,WAAW,EAAE;gBACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACjF,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBACtD,oEAAoE;gBACpE,iDAAiD;gBACjD,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE;oBACR,+DAA+D;oBAC/D,2DAA2D;oBAC3D,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;oBACtF,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;iBACjD;gBACD,YAAY,EAAE,EAAE,QAAQ,EAAE,WAAW,KAAK,GAAG,EAAE;gBAC/C,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;aACxD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,sDAAsD;AACtD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,OAAsD,EAAE,MAAc;IACrF,OAAO;QACL,EAAE,EAAE,mBAAmB,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,MAAM,EAAE;YACN,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,SAAS;SACtB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/adapters/trivy.d.ts

@@ -0,0 +1,3 @@
+import type { ScannerAdapter } from '../types.js';
+export declare const trivyAdapter: ScannerAdapter;
+//# sourceMappingURL=trivy.d.ts.map

package/dist/scanner/adapters/trivy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/trivy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAA0B,cAAc,EAAiB,MAAM,aAAa,CAAC;AAIzF,eAAO,MAAM,YAAY,EAAE,cAyF1B,CAAC"}

package/dist/scanner/adapters/trivy.js

@@ -0,0 +1,163 @@
+/**
+ * Trivy — Tier 1, and the reference adapter.
+ *
+ * Verified by running the real binary (v0.75.0) on a fixture package-lock and
+ * reading the actual JSON shape, including `PkgIdentifier.PURL`, which gives
+ * every finding a stable native identifier.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { buildEvidence } from '../identity.js';
+import { DETERMINISTIC_CONFIDENCE, dig, lineNumber, severity, tryParseJson } from '../normalize.js';
+export const trivyAdapter = {
+    id: 'trivy',
+    name: 'Trivy vulnerability / secret / misconfiguration scanner',
+    defaultConfig() {
+        return { scanners: ['vuln', 'secret', 'misconfig'], severity: ['HIGH', 'CRITICAL'] };
+    },
+    probe() {
+        const executable = which('trivy');
+        if (!executable) {
+            return { available: false, version: '', reason: 'trivy executable not found on PATH' };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(target, config) {
+        return {
+            argv: [
+                'trivy',
+                'fs',
+                '--format',
+                'json',
+                '--quiet',
+                '--scanners',
+                config.scanners?.join(',') ?? 'vuln,secret,misconfig',
+                // Exit 0 regardless of findings: exit status is never the verdict, so a
+                // findings-rich scan must not be smuggled in as a crash.
+                '--exit-code',
+                '0',
+                '--skip-version-check',
+                target.workdir,
+            ],
+            timeoutMs: 300_000,
+        };
+    },
+    parse(raw, context) {
+        const parsed = tryParseJson(raw);
+        if (!parsed.ok) {
+            return [unknown(context, `trivy output was not valid JSON: ${parsed.error}`)];
+        }
+        const results = dig(parsed.value, ['Results']);
+        if (!Array.isArray(results)) {
+            // An absent Results array means "nothing scanned", which is not
+            // "nothing found" — the difference the evidence model exists to keep.
+            return [unknown(context, 'trivy report carried no Results array (nothing scanned?)')];
+        }
+        const out = [];
+        for (const [index, result] of results.entries()) {
+            const target = String(dig(result, ['Target']) ?? 'unknown');
+            out.push(...evidenceOf(result, 'Vulnerabilities', index, 'vulnerability', context.adapterVersion, (item) => [
+                String(dig(item, ['VulnerabilityID']) ?? 'unknown'),
+                `${dig(item, ['PkgName'])} ${dig(item, ['InstalledVersion'])} is vulnerable to ${dig(item, ['VulnerabilityID'])} (fixed in ${dig(item, ['FixedVersion']) ?? 'unfixed'})`,
+                { file: target },
+            ]));
+            out.push(...evidenceOf(result, 'Secrets', index, 'secret', context.adapterVersion, (item) => [
+                String(dig(item, ['RuleID']) ?? 'unknown'),
+                `${dig(item, ['Title']) ?? 'possible credential'} detected`,
+                { file: target, line: lineNumber(dig(item, ['StartLine'])) },
+            ]));
+            out.push(...evidenceOf(result, 'Misconfigurations', index, 'misconfiguration', context.adapterVersion, (item) => [
+                String(dig(item, ['ID']) ?? 'unknown'),
+                `${dig(item, ['Title']) ?? 'misconfiguration'}: ${String(dig(item, ['Message']) ?? '').slice(0, 160)}`,
+                { file: target, line: lineNumber(dig(item, ['CauseMetadata', 'StartLine'])) },
+            ]));
+        }
+        return out;
+    },
+};
+/** One trivy result category → evidence rows. */
+function evidenceOf(result, key, index, kind, adapterVersion, extract) {
+    const items = dig(result, [key]);
+    if (!Array.isArray(items))
+        return [];
+    const out = [];
+    for (const item of items) {
+        const [identifier, claim, location] = extract(item);
+        out.push(buildEvidence({
+            source: {
+                tool: 'trivy',
+                kind,
+                version: adapterVersion,
+                identifier,
+            },
+            provenance: placeholder(),
+            claim,
+            severity: severity(dig(item, ['Severity'])),
+            // Secrets are heuristic engine matches; the others are deterministic
+            // record reads. Saying so is a confidence a reviewer can check.
+            confidence: kind === 'secret' ? 0.9 : DETERMINISTIC_CONFIDENCE,
+            status: 'FAIL',
+            location,
+            rawReference: { jsonPath: `Results[${index}]`, excerpt: claim.slice(0, 160) },
+        }));
+    }
+    return out;
+}
+/** The runner stamps real provenance on every row after parsing. */
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+function unknown(context, reason) {
+    return {
+        id: `UNKNOWN-trivy-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: {
+            tool: 'trivy',
+            version: context.adapterVersion,
+            kind: 'check',
+            identifier: 'UNKNOWN',
+        },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+/* ---------------------------------------------------------------- process */
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking — a missing entry is not an error */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], {
+        encoding: 'utf8',
+        timeout: 15_000,
+    });
+    const match = /Version:?\s*([\w.]+)/.exec(String(proc.stdout ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=trivy.js.map

package/dist/scanner/adapters/trivy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../../src/scanner/adapters/trivy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpG,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,yDAAyD;IAE/D,aAAa;QACX,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAqB;QACxC,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO;gBACP,IAAI;gBACJ,UAAU;gBACV,MAAM;gBACN,SAAS;gBACT,YAAY;gBACX,MAAM,CAAC,QAAiC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,uBAAuB;gBAC/E,wEAAwE;gBACxE,yDAAyD;gBACzD,aAAa;gBACb,GAAG;gBACH,sBAAsB;gBACtB,MAAM,CAAC,OAAO;aACf;YACD,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,oCAAoC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,0DAA0D,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;YAC5D,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,CACX,MAAM,EACN,iBAAiB,EACjB,KAAK,EACL,eAAe,EACf,OAAO,CAAC,cAAc,EACtB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS,CAAC;gBACnD,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC,qBAAqB,GAAG,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,SAAS,GAAG;gBACxK,EAAE,IAAI,EAAE,MAAM,EAAE;aACjB,CACF,CACF,CAAC;YACF,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;gBAC1C,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,qBAAqB,WAAW;gBAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;aAC7D,CAAC,CACH,CAAC;YACF,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,CACX,MAAM,EACN,mBAAmB,EACnB,KAAK,EACL,kBAAkB,EAClB,OAAO,CAAC,cAAc,EACtB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;gBACtC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,kBAAkB,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACtG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE;aAC9E,CACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,iDAAiD;AACjD,SAAS,UAAU,CACjB,MAAe,EACf,GAAW,EACX,KAAa,EACb,IAAY,EACZ,cAAsB,EACtB,OAA6E;IAE7E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CACN,aAAa,CAAC;YACZ,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,OAAO,EAAE,cAAc;gBACvB,UAAU;aACX;YACD,UAAU,EAAE,WAAW,EAAE;YACzB,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3C,qEAAqE;YACrE,gEAAgE;YAChE,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB;YAC9D,MAAM,EAAE,MAAM;YACd,QAAQ;YACR,YAAY,EAAE,EAAE,QAAQ,EAAE,WAAW,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,OAAsD,EAAE,MAAc;IACrF,OAAO;QACL,EAAE,EAAE,iBAAiB,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACzE,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,SAAS;SACtB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/config.d.ts

@@ -0,0 +1,4 @@
+import type { ScannerConfig } from './types.js';
+/** Per-project scanner config, `.usa/scanners.yaml`. */
+export declare function loadScannerConfig(root: string): Record<string, ScannerConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/scanner/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/scanner/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAU7E"}

package/dist/scanner/config.js

@@ -0,0 +1,15 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse as parseYaml } from 'yaml';
+/** Per-project scanner config, `.usa/scanners.yaml`. */
+export function loadScannerConfig(root) {
+    const file = path.join(root, '.usa', 'scanners.yaml');
+    try {
+        const doc = parseYaml(fs.readFileSync(file, 'utf8'));
+        return doc?.scanners ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/scanner/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/scanner/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAElD,CAAC;QACF,OAAO,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/scanner/identity.d.ts

@@ -0,0 +1,17 @@
+import type { Evidence, EvidenceSource, EvidenceLocation, RawReference } from './types.js';
+export declare function evidenceId(source: EvidenceSource, location: EvidenceLocation | null, claim: string): string;
+export declare function buildEvidence(args: {
+    source: Omit<EvidenceSource, 'version'> & {
+        version?: string;
+    };
+    provenance: Evidence['provenance'];
+    claim: string;
+    severity: Evidence['severity'];
+    severitySource?: Evidence['severitySource'];
+    confidence: number;
+    status: Evidence['status'];
+    location: EvidenceLocation | null;
+    rawReference?: RawReference;
+    cwes?: string[];
+}): Evidence;
+//# sourceMappingURL=identity.d.ts.map

package/dist/scanner/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/scanner/identity.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS3F,wBAAgB,UAAU,CACxB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,KAAK,EAAE,MAAM,GACZ,MAAM,CAUR;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,QAAQ,CAoBX"}