@xenos1996/usa 2.27.0 → 2.28.0

package/dist/scanner/run.js

@@ -0,0 +1,419 @@
+/**
+ * The one place a scanner process is started.
+ *
+ * Every execution policy — timeout, output bound, scratch working directory,
+ * environment deny-list, network policy, refusal to run build commands — lives
+ * here and nowhere else. Adapters describe *what* to run; the runner decides
+ * whether and how it may run.
+ */
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+export const DEFAULT_TIMEOUT_MS = 300_000;
+export const OUTPUT_CAP_BYTES = 20 * 1024 * 1024;
+/** Env vars stripped from every scanner child process (no credential leakage). */
+const ENV_ALLOW = ['HOME', 'PATH', 'LANG', 'LC_ALL', 'TMPDIR', 'https_proxy', 'http_proxy'];
+const ENV_DENY = [
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'NODE_AUTH_TOKEN',
+    'NPM_TOKEN',
+    'NPM_CONFIG_REGISTRY',
+    'NPM_CONFIG_USERCONFIG',
+    'SEMGREP_APP_TOKEN',
+    'SNYK_TOKEN',
+    'GPR_TOKEN',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+];
+/**
+ * The environment a scanner child inherits: an allow-list, then a deny-list
+ * applied over it. A scanner gets PATH and TMPDIR and nothing that carries a
+ * credential — that is the whole point of the deny list existing.
+ */
+export function childEnv(allow) {
+    const env = {};
+    for (const key of allow) {
+        const v = process.env[key];
+        if (v !== undefined && !ENV_DENY.includes(key))
+            env[key] = v;
+    }
+    return env;
+}
+export class ScannerRunner {
+    adapters;
+    constructor(adapters) {
+        this.adapters = adapters;
+    }
+    /**
+     * Run the selected adapters and return the manifest plus what they found.
+     * `options.adapters` filters the registry; an unknown id is a loud error
+     * rather than an empty run, because "0 evidence" must never be mistaken for
+     * "nothing wrong".
+     */
+    run(options) {
+        const selected = this.select(options.adapters);
+        const started = new Date();
+        const executionId = randomUUID();
+        const resolved = path.resolve(options.target);
+        // A missing target is a loud error, not an empty scan: the CLI also guards
+        // this, but a library caller deserves the same honesty.
+        if (!fs.existsSync(resolved))
+            throw new Error(`scan target not found: ${resolved}`);
+        const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'usa-scan-'));
+        const target = {
+            path: resolved,
+            workdir,
+            revision: detectRevision(path.resolve(options.target)),
+            executionId,
+        };
+        const manifests = [];
+        const evidence = [];
+        const findings = [];
+        try {
+            copyTreeForScan(target.path, workdir);
+            for (const adapter of selected) {
+                const outcome = this.runAdapter(adapter, target, options);
+                manifests.push(outcome.manifest);
+                evidence.push(...outcome.evidence);
+                findings.push(...outcome.findings);
+            }
+        }
+        finally {
+            fs.rmSync(workdir, { recursive: true, force: true });
+        }
+        const elapsed = (options.now ? options.now() : new Date()).getTime() - started.getTime();
+        void elapsed; // manifest timestamps carry per-adapter timing
+        return {
+            manifest: {
+                executionId,
+                target: target.path,
+                repositoryRevision: target.revision,
+                timestamp: started.toISOString(),
+                adapters: manifests,
+                environment: {
+                    sandbox: 'subprocess-scratch-copy',
+                    network: options.network ? 'allowed' : 'denied',
+                    outputCapBytes: OUTPUT_CAP_BYTES,
+                },
+            },
+            evidence,
+            findings,
+        };
+    }
+    select(only) {
+        if (!only || only.length === 0)
+            return this.adapters;
+        const known = new Set(this.adapters.map((a) => a.id));
+        for (const id of only) {
+            if (!known.has(id))
+                throw new Error(`unknown scanner: ${id} (known: ${[...known].join(', ')})`);
+        }
+        return this.adapters.filter((a) => only.includes(a.id));
+    }
+    runAdapter(adapter, target, options) {
+        const probe = adapter.probe();
+        const config = mergeConfig(adapter, options);
+        const gates = runGates(adapter, probe, target, config, options);
+        if (gates)
+            return { manifest: gates, evidence: [], findings: [] };
+        const command = adapter.buildCommand(target, config);
+        const timeoutMs = commandTimeout(command, options);
+        // Upstream stages first: a pipeline tool's evidence command reads what the
+        // earlier stages wrote. A failed stage is a blind spot, not a verdict.
+        const prep = runPrepare(adapter, target, command, probe.version, timeoutMs);
+        if ('manifest' in prep)
+            return { manifest: prep.manifest, evidence: [], findings: [] };
+        const prepared = prep.prepared;
+        const spawn = spawnScanner(adapter, target, command.argv, timeoutMs);
+        if ('failure' in spawn) {
+            return {
+                manifest: { ...spawn.failure, prepare: prepared, evidenceCount: 0 },
+                evidence: [],
+                findings: [],
+            };
+        }
+        const base = {
+            id: adapter.id,
+            available: true,
+            version: probe.version,
+            command: command.argv,
+            ...(prepared.length > 0 ? { prepare: prepared } : {}),
+            status: 'ok',
+            exitCode: spawn.exitCode,
+            evidenceCount: 0,
+            elapsedMs: spawn.elapsedMs,
+            needsNetwork: Boolean(command.network),
+        };
+        const output = resolveOutput(spawn, command, target.workdir);
+        if (!output.ok) {
+            return {
+                manifest: { ...base, status: 'error', reason: output.reason },
+                evidence: [],
+                findings: [],
+            };
+        }
+        const parsed = parseSafely(adapter, output.raw, {
+            adapterId: adapter.id,
+            adapterVersion: probe.version,
+            target,
+            config,
+        });
+        if (!parsed.ok) {
+            return {
+                manifest: { ...base, status: 'error', reason: `parse failed: ${parsed.reason}` },
+                evidence: [],
+                findings: [],
+            };
+        }
+        const evidence = parsed.evidence;
+        stampProvenance(evidence, {
+            executionId: target.executionId,
+            command: command.argv,
+            ...(prepared.length > 0 ? { preparedBy: prepared } : {}),
+            config,
+            repositoryRevision: target.revision,
+            timestamp: new Date(spawn.startedAt).toISOString(),
+            executable: probe.executable ?? command.argv[0],
+            timeoutMs,
+            elapsedMs: spawn.elapsedMs,
+        });
+        return {
+            manifest: {
+                ...base,
+                ...(output.artifact ? { artifact: output.artifact } : {}),
+                evidenceCount: evidence.length,
+            },
+            evidence,
+            findings: findingsOf(adapter, evidence),
+        };
+    }
+}
+/** Adapters opt into path (2); the default is no findings. */
+function findingsOf(adapter, evidence) {
+    return adapter.findings ? adapter.findings(evidence) : [];
+}
+/** Default config under the project's, so a config file overrides one key. */
+function mergeConfig(adapter, options) {
+    return { ...adapter.defaultConfig(), ...(options.config?.[adapter.id] ?? {}) };
+}
+/** Adapter, then run, then global default. */
+function commandTimeout(command, options) {
+    return command.timeoutMs ?? options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+}
+/** A parse failure is never a verdict: everything it would have found is UNKNOWN. */
+function parseSafely(adapter, raw, context) {
+    try {
+        return { ok: true, evidence: adapter.parse(raw, context) };
+    }
+    catch (err) {
+        return { ok: false, reason: err.message };
+    }
+}
+/**
+ * Run the stages a pipeline tool needs before its evidence command.
+ *
+ * A prepare stage produces no payload to judge, so its exit status is the only
+ * signal it has. Using it to *stop* is not a verdict about the project — the
+ * adapter is reported as a blind spot, never as a finding.
+ */
+export function runPrepare(adapter, target, command, version, timeoutMs) {
+    const prepared = [];
+    for (const stage of command.prepare ?? []) {
+        const step = spawnScanner(adapter, target, stage.argv, stage.timeoutMs ?? timeoutMs);
+        const failure = 'failure' in step
+            ? step.failure
+            : step.exitCode === 0
+                ? null
+                : {
+                    id: adapter.id,
+                    available: true,
+                    version,
+                    command: stage.argv,
+                    status: 'error',
+                    reason: `prepare stage exited with status ${step.exitCode}`,
+                    exitCode: step.exitCode,
+                    evidenceCount: 0,
+                    elapsedMs: step.elapsedMs,
+                    needsNetwork: Boolean(command.network),
+                };
+        if (failure) {
+            return {
+                manifest: { ...failure, prepare: prepared, reason: `prepare stage: ${failure.reason}` },
+            };
+        }
+        prepared.push(stage.argv);
+    }
+    return { prepared };
+}
+/** The bytes to parse: the declared artifact if the tool writes one, else stdout. */
+export function resolveOutput(spawn, command, workdir) {
+    if (!command.artifacts || command.artifacts.length === 0) {
+        return { ok: true, raw: spawn.stdout };
+    }
+    const read = readArtifact(workdir, command.artifacts);
+    if (!read.ok)
+        return { ok: false, reason: read.reason };
+    return { ok: true, raw: read.content, artifact: read.path };
+}
+/**
+ * Read the first declared artifact that exists.
+ *
+ * A declared artifact that is missing is an `error` with a reason, never an
+ * empty result: "the tool produced no file" and "the policy passed" are
+ * different sentences and only one of them is usually true.
+ */
+export function readArtifact(workdir, declared) {
+    const root = path.resolve(workdir);
+    for (const rel of declared) {
+        const abs = path.resolve(root, rel);
+        if (abs !== root && !abs.startsWith(root + path.sep)) {
+            return { ok: false, reason: `artifact ${rel} resolves outside the scan workdir` };
+        }
+        let stat;
+        try {
+            stat = fs.statSync(abs);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > OUTPUT_CAP_BYTES) {
+            return {
+                ok: false,
+                reason: `artifact ${rel} is ${stat.size} bytes, over the output cap of ${OUTPUT_CAP_BYTES}`,
+            };
+        }
+        return { ok: true, path: path.relative(root, abs), content: fs.readFileSync(abs, 'utf8') };
+    }
+    return { ok: false, reason: `declared artifact not produced: ${declared.join(', ')}` };
+}
+/** The two checks that can refuse a run before a process exists. */
+function runGates(adapter, probe, target, config, options) {
+    if (!probe.available) {
+        return {
+            id: adapter.id,
+            available: false,
+            version: '',
+            command: [],
+            status: 'unavailable',
+            reason: probe.reason ?? 'executable not found',
+            evidenceCount: 0,
+            elapsedMs: 0,
+            needsNetwork: Boolean(adapter.needsNetwork),
+        };
+    }
+    const command = adapter.buildCommand(target, config);
+    if (command.network && !options.network) {
+        return {
+            id: adapter.id,
+            available: true,
+            version: probe.version,
+            command: command.argv,
+            status: 'unavailable',
+            reason: adapter.networkConfigKey
+                ? `needs network unless configured offline — set ${adapter.networkConfigKey}`
+                : 'adapter needs network but this run denied it',
+            evidenceCount: 0,
+            elapsedMs: 0,
+            needsNetwork: true,
+        };
+    }
+    return null;
+}
+function spawnScanner(adapter, target, argv, timeoutMs) {
+    const startedAt = Date.now();
+    const proc = spawnSync(argv[0], argv.slice(1), {
+        cwd: target.workdir,
+        env: childEnv(ENV_ALLOW),
+        encoding: 'buffer',
+        timeout: timeoutMs,
+        killSignal: 'SIGTERM',
+        maxBuffer: OUTPUT_CAP_BYTES,
+    });
+    const elapsedMs = Date.now() - startedAt;
+    if (proc.error || proc.signal === 'SIGTERM' || proc.status === null) {
+        return { failure: spawnFailure(adapter, argv, proc, timeoutMs, elapsedMs) };
+    }
+    return {
+        stdout: proc.stdout ? proc.stdout.toString('utf8') : '',
+        exitCode: proc.status,
+        elapsedMs,
+        startedAt,
+    };
+}
+/** A process that died (including by timeout) is a blind spot, not a verdict. */
+function spawnFailure(adapter, argv, proc, timeoutMs, elapsedMs) {
+    const timedOut = proc.error?.code === 'ETIMEDOUT' ||
+        proc.signal === 'SIGTERM';
+    return {
+        id: adapter.id,
+        available: true,
+        version: '',
+        command: argv,
+        status: timedOut ? 'timeout' : 'error',
+        reason: timedOut
+            ? `timed out after ${timeoutMs}ms`
+            : `failed to start: ${proc.error?.message ?? 'unknown error'}`,
+        evidenceCount: 0,
+        elapsedMs,
+        needsNetwork: false,
+    };
+}
+/** The runner owns provenance, so no adapter can invent one. */
+function stampProvenance(evidence, provenance) {
+    for (const item of evidence)
+        item.provenance = provenance;
+}
+/**
+ * Copy the target into the scratch directory so no scanner ever runs against,
+ * or writes into, the checkout.
+ *
+ * Skips VCS and installed dependencies: a scanner that reads `node_modules`
+ * produces findings about vendored code, not about the project. The skip list
+ * is deliberately short and explicit — an unexpected large tree costs time, an
+ * unexpected *silent* miss costs an audit.
+ */
+const COPY_SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.usa']);
+export function copyTreeForScan(from, into) {
+    for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+        if (COPY_SKIP.has(entry.name))
+            continue;
+        const src = path.join(from, entry.name);
+        const dest = path.join(into, entry.name);
+        if (entry.isDirectory()) {
+            fs.mkdirSync(dest, { recursive: true });
+            copyTreeForScan(src, dest);
+        }
+        else if (entry.isSymbolicLink()) {
+            continue;
+        }
+        else if (entry.isFile()) {
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            fs.copyFileSync(src, dest);
+        }
+    }
+}
+/** The commit the checkout points at, or `unversioned` — never blank. */
+export function detectRevision(dir) {
+    const head = path.join(dir, '.git', 'HEAD');
+    try {
+        if (fs.existsSync(head)) {
+            const ref = fs.readFileSync(head, 'utf8').trim();
+            if (ref.startsWith('ref:')) {
+                const p = path.join(dir, '.git', ref.slice(5).trim());
+                if (fs.existsSync(p))
+                    return fs.readFileSync(p, 'utf8').trim().slice(0, 40);
+            }
+            return ref.slice(0, 40);
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    return 'unversioned';
+}
+//# sourceMappingURL=run.js.map

package/dist/scanner/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/scanner/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,kFAAkF;AAClF,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAE5F,MAAM,QAAQ,GAAG;IACf,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,WAAW;IACX,qBAAqB;IACrB,uBAAuB;IACvB,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,uBAAuB;IACvB,mBAAmB;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAe;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,QAA0B;QAA1B,aAAQ,GAAR,QAAQ,CAAkB;IAAG,CAAC;IAE3D;;;;;OAKG;IACH,GAAG,CAAC,OAAoB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,wDAAwD;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtD,WAAW;SACZ,CAAC;QACF,MAAM,SAAS,GAAiB,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1D,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACzF,KAAK,OAAO,CAAC,CAAC,+CAA+C;QAC7D,OAAO;YACL,QAAQ,EAAE;gBACR,WAAW;gBACX,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,kBAAkB,EAAE,MAAM,CAAC,QAAQ;gBACnC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;gBAChC,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE;oBACX,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;oBAC/C,cAAc,EAAE,gBAAgB;iBACjC;aACF;YACD,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,IAA0B;QACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,UAAU,CAChB,OAAuB,EACvB,MAAkB,EAClB,OAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAElE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEnD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,OAAO;gBACL,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE;gBACnE,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACvC,CAAC;QAEF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC7D,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,cAAc,EAAE,KAAK,CAAC,OAAO;YAC7B,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,MAAM,EAAE,EAAE;gBAChF,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,eAAe,CAAC,QAAQ,EAAE;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,QAAQ;YACnC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAClD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE;YAChD,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI;gBACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,aAAa,EAAE,QAAQ,CAAC,MAAM;aAC/B;YACD,QAAQ;YACR,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;SACxC,CAAC;IACJ,CAAC;CACF;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,OAAuB,EAAE,QAAoB;IAC/D,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,OAAuB,EAAE,OAAoB;IAChE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,8CAA8C;AAC9C,SAAS,cAAc,CAAC,OAAuB,EAAE,OAAoB;IACnE,OAAO,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAClB,OAAuB,EACvB,GAAW,EACX,OAAqB;IAErB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,OAAuB,EACvB,MAAkB,EAClB,OAAuB,EACvB,OAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QACrF,MAAM,OAAO,GACX,SAAS,IAAI,IAAI;YACf,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBACnB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,IAAI;oBACf,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,MAAM,EAAE,OAAgB;oBACxB,MAAM,EAAE,oCAAoC,IAAI,CAAC,QAAQ,EAAE;oBAC3D,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,aAAa,EAAE,CAAC;oBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;iBACvC,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE;aACxF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAC3B,KAAmB,EACnB,OAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAkB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,oCAAoC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,YAAY,GAAG,OAAO,IAAI,CAAC,IAAI,kCAAkC,gBAAgB,EAAE;aAC5F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACzF,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CACf,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,MAAqB,EACrB,OAAoB;IAEpB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,sBAAsB;YAC9C,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAC9B,CAAC,CAAC,iDAAiD,OAAO,CAAC,gBAAgB,EAAE;gBAC7E,CAAC,CAAC,8CAA8C;YAClD,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAS,YAAY,CACnB,OAAuB,EACvB,MAAkB,EAClB,IAAc,EACd,SAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC9C,GAAG,EAAE,MAAM,CAAC,OAAO;QACnB,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QACvD,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CACnB,OAAuB,EACvB,IAAc,EACd,IAAyD,EACzD,SAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GACX,IAAI,CAAC,KAA2C,EAAE,IAAI,KAAK,WAAW;QACvE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IAC5B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACtC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mBAAmB,SAAS,IAAI;YAClC,CAAC,CAAC,oBAAqB,IAAI,CAAC,KAA2B,EAAE,OAAO,IAAI,eAAe,EAAE;QACvF,aAAa,EAAE,CAAC;QAChB,SAAS;QACT,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,QAAoB,EAAE,UAAkC;IAC/E,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;oBAAE,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/scanner/sarif.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SARIF → Evidence.
+ *
+ * SARIF is the interchange format for three of our four Tier-1 tools, so the
+ * parser is shared and lives here rather than inside any one adapter. It is
+ * deliberately conservative: only the fields the spec defines are read, and a
+ * missing region becomes `null` (no location) rather than a zero.
+ */
+import type { Evidence, ScannerSeverity } from './types.js';
+/** SARIF level → our severity scale. A level is not a severity; the mapping is a policy. */
+export declare function sarifLevelToSeverity(level: unknown): ScannerSeverity;
+export interface SarifEvidenceOptions {
+    tool: string;
+    kind: string;
+    adapterVersion: string;
+    /** Confidence for this tool's SARIF results. */
+    confidence?: number;
+}
+/** Parse a SARIF log into evidence rows, one per result (plus one per run failure). */
+export declare function evidenceFromSarif(raw: string, options: SarifEvidenceOptions): Evidence[];
+//# sourceMappingURL=sarif.d.ts.map

package/dist/scanner/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/scanner/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI5D,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAWpE;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CASxF"}

package/dist/scanner/sarif.js

@@ -0,0 +1,156 @@
+import { buildEvidence } from './identity.js';
+import { dig, tryParseJson } from './normalize.js';
+/** SARIF level → our severity scale. A level is not a severity; the mapping is a policy. */
+export function sarifLevelToSeverity(level) {
+    switch (String(level ?? '').toLowerCase()) {
+        case 'error':
+            return 'HIGH';
+        case 'warning':
+            return 'MEDIUM';
+        case 'note':
+            return 'LOW';
+        default:
+            return 'INFO';
+    }
+}
+/** Parse a SARIF log into evidence rows, one per result (plus one per run failure). */
+export function evidenceFromSarif(raw, options) {
+    const parsed = tryParseJson(raw);
+    if (!parsed.ok)
+        return [unknown(options.tool, options.adapterVersion, `not valid JSON: ${parsed.error}`)];
+    const runs = dig(parsed.value, ['runs']);
+    if (!Array.isArray(runs)) {
+        return [unknown(options.tool, options.adapterVersion, 'SARIF log had no runs array')];
+    }
+    return runs.flatMap((run, runIndex) => runEvidence(run, runIndex, options));
+}
+/** One SARIF run → evidence rows. A run with no results contributes nothing. */
+function runEvidence(run, runIndex, options) {
+    const driver = dig(run, ['tool', 'driver']);
+    const toolVersion = String(dig(driver, ['version']) ?? options.adapterVersion);
+    const rules = ruleIndex(dig(driver, ['rules']));
+    const results = dig(run, ['results']);
+    if (!Array.isArray(results))
+        return [];
+    return results.map((result, index) => resultToEvidence(result, { index, runIndex, toolVersion, rules, options }));
+}
+function ruleIndex(rules) {
+    const index = new Map();
+    if (!Array.isArray(rules))
+        return index;
+    for (const rule of rules) {
+        const id = String(dig(rule, ['id']) ?? '');
+        if (id) {
+            const tags = dig(rule, ['properties', 'tags']);
+            const level = dig(rule, ['defaultConfiguration', 'level']);
+            index.set(id, {
+                // `name` is the id in every SARIF producer we consume, so a claim built
+                // from it reads "js/insufficient-key-size: <message>" — the identifier
+                // twice and a human title nowhere. shortDescription is the title.
+                text: titleOf(rule),
+                cwes: cwesOfTags(tags),
+                ...(typeof level === 'string' ? { level } : {}),
+            });
+        }
+    }
+    return index;
+}
+function titleOf(rule) {
+    const short = dig(rule, ['shortDescription', 'text']);
+    if (typeof short === 'string' && short.length > 0)
+        return short;
+    const name = dig(rule, ['name']);
+    return typeof name === 'string' && name.length > 0 ? name : undefined;
+}
+function resultToEvidence(result, run) {
+    const { index, runIndex, toolVersion, rules, options } = run;
+    const ruleId = String(dig(result, ['ruleId']) ?? 'unknown-rule');
+    const message = firstMessage(result);
+    // SARIF 3.27.10: a result may omit `level` when it equals the rule's
+    // default. CodeQL omits it for every result, so reading only `result.level`
+    // turned every CodeQL finding into INFO — an error-severity certificate
+    // check and a warning-severity key-size check became indistinguishable.
+    const level = dig(result, ['level']) ?? rules.get(ruleId)?.level;
+    return buildEvidence({
+        source: {
+            tool: options.tool,
+            kind: options.kind,
+            version: toolVersion,
+            identifier: ruleId,
+        },
+        provenance: placeholder(),
+        claim: `${rules.get(ruleId)?.text ?? ruleId}: ${message}`,
+        severity: sarifLevelToSeverity(level),
+        confidence: options.confidence ?? 1.0,
+        status: 'FAIL',
+        location: locationOf(dig(result, ['locations', 0])),
+        rawReference: {
+            jsonPath: `runs[${runIndex}].results[${index}]`,
+            excerpt: message.slice(0, 160),
+        },
+        cwes: rules.get(ruleId)?.cwes,
+    });
+}
+/** SARIF rule tags look like `external/cwe/cwe-094`. */
+function cwesOfTags(tags) {
+    if (!Array.isArray(tags))
+        return undefined;
+    const out = new Set();
+    for (const tag of tags) {
+        const match = /cwe[-_]?(\d{1,5})/i.exec(String(tag));
+        if (match)
+            out.add(`CWE-${Number(match[1])}`);
+    }
+    return out.size > 0 ? [...out] : undefined;
+}
+function firstMessage(result) {
+    const direct = dig(result, ['message', 'text']);
+    if (typeof direct === 'string' && direct.length > 0)
+        return direct;
+    const parts = dig(result, ['message', 'arguments']);
+    if (Array.isArray(parts))
+        return parts
+            .map((p) => String(p))
+            .join(' ')
+            .slice(0, 160);
+    return 'no message';
+}
+function locationOf(loc) {
+    const file = dig(loc, ['physicalLocation', 'artifactLocation', 'uri']);
+    if (typeof file !== 'string' || file.length === 0)
+        return null;
+    const line = Number(dig(loc, ['physicalLocation', 'region', 'startLine']));
+    const column = Number(dig(loc, ['physicalLocation', 'region', 'startColumn']));
+    return {
+        file,
+        line: Number.isFinite(line) && line > 0 ? line : undefined,
+        column: Number.isFinite(column) && column > 0 ? column : undefined,
+    };
+}
+function unknown(tool, version, reason) {
+    return {
+        id: `UNKNOWN-${tool}-${reason}`.replace(/[^A-Za-z0-9-]/g, '-').slice(0, 48),
+        source: { tool, version, kind: 'check', identifier: 'UNKNOWN' },
+        provenance: placeholder(),
+        claim: reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: 1.0,
+        status: 'UNKNOWN',
+        location: null,
+        rawReference: {},
+    };
+}
+function placeholder() {
+    return {
+        executionId: '',
+        command: [],
+        config: {},
+        repositoryRevision: '',
+        timestamp: '',
+        executable: '',
+        timeoutMs: 0,
+        elapsedMs: 0,
+    };
+}
+//# sourceMappingURL=sarif.js.map

package/dist/scanner/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/scanner/sarif.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAUD,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAA6B;IAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE;QACZ,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,GAAY,EAAE,QAAgB,EAAE,OAA6B;IAChF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACnC,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAc,IAAI,GAAG,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;gBACZ,wEAAwE;gBACxE,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAe,EACf,GAMC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACjE,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,MAAM;SACnB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,MAAM,KAAK,OAAO,EAAE;QACzD,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG;QACrC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,YAAY,EAAE;YACZ,QAAQ,EAAE,QAAQ,QAAQ,aAAa,KAAK,GAAG;YAC/C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC/B;QACD,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACrB,IAAI,CAAC,GAAG,CAAC;aACT,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC1D,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IAC5D,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;QAC/D,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC"}