@xenos1996/usa 2.27.0 → 2.28.1

package/dist/intent/match.js

@@ -0,0 +1,108 @@
+/**
+ * Intended vs observed.
+ *
+ * The join key is the CWE id: a threat declares `cwes: ["CWE-79"]`, and scanner
+ * evidence that names the same CWE is the observation. That is deterministic and
+ * auditable — no similarity scoring, no LLM.
+ *
+ * What it deliberately does NOT do: treat "no evidence" as "mitigated". A threat
+ * with no matching observation is `UNKNOWN` and says so, because the scanners
+ * that ran may simply not cover it.
+ */
+import { normaliseCwe } from './otm.js';
+/** Every CWE token in a piece of evidence, with where it was found. */
+export function cwesOf(evidence) {
+    // A tool that stated its CWE is authoritative; only fall back to scanning the
+    // text when it did not, and never invent a relationship from a substring.
+    if (Array.isArray(evidence.cwes) && evidence.cwes.length > 0) {
+        return evidence.cwes.map((cwe) => ({ cwe: normaliseCwe(cwe), field: 'cwes' }));
+    }
+    const found = [];
+    const scan = (text, field) => {
+        if (!text)
+            return;
+        for (const match of text.matchAll(/\bCWE[-_ ]?(\d{1,5})\b/gi)) {
+            found.push({ cwe: `CWE-${Number(match[1])}`, field });
+        }
+    };
+    scan(evidence.source?.identifier, 'source.identifier');
+    scan(evidence.claim, 'claim');
+    return found;
+}
+export function matchThreats(model, evidence) {
+    const byCwe = indexEvidence(evidence);
+    const matches = model.threats.map((threat) => {
+        const hits = new Set();
+        const seenCwes = [];
+        for (const cwe of threat.cwes) {
+            const ids = byCwe.get(cwe);
+            if (!ids)
+                continue;
+            seenCwes.push(cwe);
+            for (const id of ids)
+                hits.add(id);
+        }
+        if (threat.cwes.length === 0) {
+            return {
+                threat,
+                verdict: 'UNKNOWN',
+                evidenceIds: [],
+                reason: 'the threat declares no CWE, so no scanner observation can be joined to it',
+            };
+        }
+        if (hits.size === 0) {
+            return {
+                threat,
+                verdict: 'NOT_OBSERVED',
+                evidenceIds: [],
+                reason: `no evidence mentions ${threat.cwes.join(', ')} — this does not prove the threat is mitigated`,
+            };
+        }
+        return {
+            threat,
+            verdict: 'OBSERVED',
+            evidenceIds: [...hits].sort(),
+            reason: `evidence cites ${seenCwes.join(', ')}`,
+        };
+    });
+    const declared = new Set(model.threats.flatMap((t) => t.cwes));
+    const unmodeled = [...byCwe.entries()]
+        .filter(([cwe]) => !declared.has(cwe))
+        .map(([cwe, ids]) => ({ cwe, evidenceIds: [...ids].sort() }))
+        .sort((a, b) => a.cwe.localeCompare(b.cwe));
+    const usedZones = new Set(model.components.map((c) => c.trustZone).filter(Boolean));
+    return {
+        model,
+        matches,
+        unmodeled,
+        emptyTrustZones: model.trustZones.filter((z) => !usedZones.has(z.id)),
+    };
+}
+function indexEvidence(evidence) {
+    const index = new Map();
+    for (const item of evidence) {
+        for (const { cwe } of cwesOf(item)) {
+            const set = index.get(cwe) ?? new Set();
+            set.add(item.id);
+            index.set(cwe, set);
+        }
+    }
+    return index;
+}
+/** Convenience for a caller holding an untyped `usa scan --json` payload. */
+export function evidenceFromScanJson(payload) {
+    const list = payload?.evidence;
+    if (!Array.isArray(list))
+        return [];
+    return list.map((raw) => {
+        const o = (raw ?? {});
+        return {
+            id: typeof o.id === 'string' ? o.id : '',
+            claim: typeof o.claim === 'string' ? o.claim : '',
+            source: (o.source ?? {}),
+            cwes: Array.isArray(o.cwes) ? o.cwes : undefined,
+        };
+    });
+}
+export { normaliseCwe };
+//# sourceMappingURL=match.js.map

package/dist/intent/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/intent/match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAgBxC,uEAAuE;AACvE,MAAM,UAAU,MAAM,CAAC,QAAsB;IAC3C,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,IAAwB,EAAE,KAAa,EAAQ,EAAE;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAkB,EAAE,QAAwB;IACvE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAkB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,EAAE;gBACf,MAAM,EAAE,2EAA2E;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM;gBACN,OAAO,EAAE,cAAc;gBACvB,WAAW,EAAE,EAAE;gBACf,MAAM,EAAE,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD;aACvG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM;YACN,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;YAC7B,MAAM,EAAE,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SAC5D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAI,OAA2C,EAAE,QAAQ,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACxC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACjD,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA2B;YAClD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,IAAiB,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/intent/otm.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OTM (Open Threat Model) parser.
+ *
+ * Total, like the scanner normalisers: a field the format does not require
+ * becomes an empty value, an entity type we do not model is listed in
+ * `unrecognised`, and a document that is not OTM at all throws a single named
+ * error rather than half-parsing.
+ */
+import type { IntentModel } from './types.js';
+export declare class IntentFormatError extends Error {
+    constructor(message: string);
+}
+export declare function parseOtm(raw: string): IntentModel;
+/** `CWE-79`, `cwe-79`, `CWE 79` and `79` all become `CWE-79`. */
+export declare function normaliseCwe(value: unknown): string;
+//# sourceMappingURL=otm.d.ts.map

package/dist/intent/otm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otm.d.ts","sourceRoot":"","sources":["../../src/intent/otm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAKV,WAAW,EAGZ,MAAM,YAAY,CAAC;AAEpB,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAeD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAuCjD;AA2ED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnD"}

package/dist/intent/otm.js

@@ -0,0 +1,144 @@
+export class IntentFormatError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IntentFormatError';
+    }
+}
+/** Keys this parser models. Anything else in the document is reported, not dropped. */
+const MODELLED = new Set([
+    'otmVersion',
+    'project',
+    'assets',
+    'components',
+    'dataflows',
+    'trustZones',
+    'threats',
+    'mitigations',
+    'representations',
+]);
+export function parseOtm(raw) {
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new IntentFormatError(`not valid JSON: ${err.message}`);
+    }
+    if (typeof doc !== 'object' || doc === null) {
+        throw new IntentFormatError('not an object');
+    }
+    const root = doc;
+    if (typeof root.otmVersion !== 'string') {
+        // Threat Dragon also exports its internal diagram format; saying which one
+        // this is beats "parse failed".
+        throw new IntentFormatError("not an OTM document (no otmVersion). Threat Dragon's internal diagram export is not supported — use its OTM export.");
+    }
+    const project = asRecord(root.project);
+    return {
+        format: 'otm',
+        version: root.otmVersion,
+        project: {
+            id: str(project.id),
+            name: str(project.name),
+            description: str(project.description),
+            owner: str(project.owner),
+        },
+        assets: list(root.assets).map(parseAsset),
+        components: list(root.components).map(parseComponent),
+        dataFlows: list(root.dataflows).map(parseFlow),
+        trustZones: list(root.trustZones).map(parseZone),
+        threats: list(root.threats).map(parseThreat),
+        mitigations: list(root.mitigations).map(parseMitigation),
+        // `$`-prefixed keys are annotations (a fixture note, a schema hint), not
+        // model content, so they are not reported as unmodelled entities.
+        unrecognised: Object.keys(root).filter((k) => !MODELLED.has(k) && !k.startsWith('$')),
+    };
+}
+function parseAsset(raw) {
+    const o = asRecord(raw);
+    const risk = asRecord(o.risk);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        description: str(o.description),
+        risk: {
+            confidentiality: num(risk.confidentiality),
+            integrity: num(risk.integrity),
+            availability: num(risk.availability),
+        },
+    };
+}
+function parseComponent(raw) {
+    const o = asRecord(raw);
+    const parent = asRecord(o.parent);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        type: str(o.type),
+        trustZone: parent.trustZone ? str(parent.trustZone) : undefined,
+    };
+}
+function parseFlow(raw) {
+    const o = asRecord(raw);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        source: str(o.source),
+        destination: str(o.destination),
+        bidirectional: o.bidirectional === true,
+        assets: list(o.assets).map(str).filter(Boolean),
+    };
+}
+function parseZone(raw) {
+    const o = asRecord(raw);
+    const risk = asRecord(o.risk);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        type: str(o.type),
+        trustRating: num(risk.trustRating),
+    };
+}
+function parseThreat(raw) {
+    const o = asRecord(raw);
+    const risk = asRecord(o.risk);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        description: str(o.description),
+        categories: list(o.categories).map(str).filter(Boolean),
+        cwes: list(o.cwes).map(normaliseCwe).filter(Boolean),
+        likelihood: num(risk.likelihood),
+        impact: num(risk.impact),
+    };
+}
+function parseMitigation(raw) {
+    const o = asRecord(raw);
+    return {
+        id: str(o.id),
+        name: str(o.name),
+        description: str(o.description),
+        riskReduction: num(o.riskReduction),
+    };
+}
+/** `CWE-79`, `cwe-79`, `CWE 79` and `79` all become `CWE-79`. */
+export function normaliseCwe(value) {
+    const text = str(value)
+        .toUpperCase()
+        .replace(/[^0-9]/g, '');
+    return text ? `CWE-${Number(text)}` : '';
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+function list(value) {
+    return Array.isArray(value) ? value : [];
+}
+function str(value) {
+    return typeof value === 'string' ? value : '';
+}
+function num(value) {
+    const n = Number(value);
+    return Number.isFinite(n) ? n : undefined;
+}
+//# sourceMappingURL=otm.js.map

package/dist/intent/otm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otm.js","sourceRoot":"","sources":["../../src/intent/otm.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,SAAS;IACT,aAAa;IACb,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,GAAG,GAA8B,CAAC;IAC5C,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxC,2EAA2E;QAC3E,gCAAgC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI,CAAC,UAAU;QACxB,OAAO,EAAE;YACP,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;YACrC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;SAC1B;QACD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACrD,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9C,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAChD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;QACxD,yEAAyE;QACzE,kEAAkE;QAClE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/B,IAAI,EAAE;YACJ,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI;QACvC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACpD,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/B,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC"}

package/dist/intent/types.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The intent model — what the project says it is, as distinct from what the
+ * scanners observe.
+ *
+ * Shapes come from the **Open Threat Model** format (OTM 0.2.0) that Threat
+ * Dragon exports, verified against the project's own example model rather than
+ * from memory:
+ *
+ *   { otmVersion, project, assets[], components[], dataflows[],
+ *     trustZones[], threats[], mitigations[] }
+ *
+ * We import the *concepts*, not the application: no Threat Dragon process runs,
+ * no diagram is rendered, and the model is a plain file under version control.
+ */
+export interface IntentModel {
+    format: 'otm';
+    version: string;
+    project: IntentProject;
+    assets: IntentAsset[];
+    components: IntentComponent[];
+    dataFlows: IntentDataFlow[];
+    trustZones: IntentTrustZone[];
+    threats: IntentThreat[];
+    mitigations: IntentMitigation[];
+    /** Anything the parser recognised but does not model. Never dropped silently. */
+    unrecognised: string[];
+}
+export interface IntentProject {
+    id: string;
+    name: string;
+    description: string;
+    owner: string;
+}
+export interface IntentAsset {
+    id: string;
+    name: string;
+    description: string;
+    /** Confidentiality / integrity / availability, 0–100, when declared. */
+    risk?: {
+        confidentiality?: number;
+        integrity?: number;
+        availability?: number;
+    };
+}
+export interface IntentComponent {
+    id: string;
+    name: string;
+    type: string;
+    /** The trust zone this component sits in, when declared. */
+    trustZone?: string;
+}
+export interface IntentDataFlow {
+    id: string;
+    name: string;
+    source: string;
+    destination: string;
+    bidirectional: boolean;
+    /** Asset ids carried across this flow. */
+    assets: string[];
+}
+export interface IntentTrustZone {
+    id: string;
+    name: string;
+    type: string;
+    /** 0–100; lower means less trusted. */
+    trustRating?: number;
+}
+export interface IntentThreat {
+    id: string;
+    name: string;
+    description: string;
+    /** STRIDE categories, e.g. ["Spoofing", "Tampering"]. */
+    categories: string[];
+    /** CWE ids this threat is about — the join key to scanner evidence. */
+    cwes: string[];
+    likelihood?: number;
+    impact?: number;
+}
+export interface IntentMitigation {
+    id: string;
+    name: string;
+    description: string;
+    riskReduction?: number;
+}
+/**
+ * What the model claims vs what the evidence shows, per threat.
+ *
+ * `UNKNOWN` is the default and the honest answer when nothing was observed: a
+ * threat with no matching evidence is not "mitigated", it is *unexamined*.
+ */
+export type ThreatVerdict = 'OBSERVED' | 'NOT_OBSERVED' | 'UNKNOWN';
+export interface ThreatMatch {
+    threat: IntentThreat;
+    verdict: ThreatVerdict;
+    /** Evidence ids that cite one of the threat's CWEs. */
+    evidenceIds: string[];
+    /** Why the verdict is what it is — mandatory, never blank. */
+    reason: string;
+}
+export interface IntentReport {
+    model: IntentModel;
+    matches: ThreatMatch[];
+    /** CWE ids seen in evidence that no declared threat mentions. */
+    unmodeled: {
+        cwe: string;
+        evidenceIds: string[];
+    }[];
+    /** Declared trust zones with no component inside them. */
+    emptyTrustZones: IntentTrustZone[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/intent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/intent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,iFAAiF;IACjF,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,uDAAuD;IACvD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,iEAAiE;IACjE,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACpD,0DAA0D;IAC1D,eAAe,EAAE,eAAe,EAAE,CAAC;CACpC"}

package/dist/intent/types.js

@@ -0,0 +1,16 @@
+/**
+ * The intent model — what the project says it is, as distinct from what the
+ * scanners observe.
+ *
+ * Shapes come from the **Open Threat Model** format (OTM 0.2.0) that Threat
+ * Dragon exports, verified against the project's own example model rather than
+ * from memory:
+ *
+ *   { otmVersion, project, assets[], components[], dataflows[],
+ *     trustZones[], threats[], mitigations[] }
+ *
+ * We import the *concepts*, not the application: no Threat Dragon process runs,
+ * no diagram is rendered, and the model is a plain file under version control.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/intent/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/intent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/scanner/adapters/codeql.d.ts

@@ -0,0 +1,14 @@
+import type { ScannerAdapter } from '../types.js';
+/** Where `database analyze` writes its SARIF, relative to the scan workdir. */
+export declare const CODEQL_SARIF = "codeql-results.sarif";
+export declare const codeqlAdapter: ScannerAdapter;
+/**
+ * The analyze leg, exposed so tests and callers can build it without running create.
+ *
+ * `packs` is a *positional* argument, so an empty string is not "no packs" — it
+ * is one empty specifier, and CodeQL rejects the whole run with
+ * `Invalid package specification:` and writes no SARIF. Measured on 2.27.3: with
+ * no specifier at all, CodeQL runs the language's default (code-scanning) suite.
+ */
+export declare function codeqlAnalyzeCommand(db: string, packs: string, out: string): string[];
+//# sourceMappingURL=codeql.d.ts.map

package/dist/scanner/adapters/codeql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeql.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/codeql.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAA0B,cAAc,EAAiB,MAAM,aAAa,CAAC;AAGzF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD,eAAO,MAAM,aAAa,EAAE,cAiE3B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAWrF"}

package/dist/scanner/adapters/codeql.js

@@ -0,0 +1,134 @@
+/**
+ * CodeQL — Tier 1, opt-in and heavyweight.
+ *
+ * Two-step by nature: `database create` then `database analyze`. Both are
+ * constructed here and parsed through the shared SARIF normaliser.
+ *
+ * `analyze` writes SARIF to a **file** (`--output=`) and logs to stdout, so the
+ * adapter declares the file as its artifact. Before the runner could read
+ * artifacts, this adapter parsed stdout and therefore parsed log lines: the
+ * SARIF never reached `parse`. That is a structural bug the fixture-based tests
+ * could not see, because they called `parse` directly.
+ *
+ * Verified end-to-end against CodeQL 2.27.3 on `fixtures/insecure-app`: two
+ * stages, one artifact, two findings. Three bugs only a run could find —
+ *
+ * 1. the query specifier is positional, so the default empty `packs` was passed
+ *    as one empty specifier and the run died with `Invalid package
+ *    specification:` and no SARIF;
+ * 2. `codeql --version` prints a sentence, so `[\d.]+` recorded `2.27.3.`;
+ * 3. (in the shared SARIF normaliser) CodeQL omits `result.level`, which made
+ *    every finding INFO until the rule's `defaultConfiguration.level` was used.
+ *
+ * Security boundary, enforced and not aspirational: **the engine never runs a
+ * build command**. CodeQL's `--command` is arbitrary project code; the adapter
+ * will only emit it when the project config sets
+ * `allowBuildCommands: true`, which the runner refuses unless the audit opts in.
+ * Enforced twice, on purpose: once here, once in the tests.
+ */
+import { spawnSync } from 'node:child_process';
+import { statSync } from 'node:fs';
+import path from 'node:path';
+import { evidenceFromSarif } from '../sarif.js';
+/** Where `database analyze` writes its SARIF, relative to the scan workdir. */
+export const CODEQL_SARIF = 'codeql-results.sarif';
+export const codeqlAdapter = {
+    id: 'codeql',
+    name: 'CodeQL data-flow analysis (opt-in)',
+    needsNetwork: true,
+    defaultConfig() {
+        return { language: 'javascript-typescript', packs: '', allowBuildCommands: false };
+    },
+    probe() {
+        const executable = which('codeql');
+        if (!executable) {
+            return {
+                available: false,
+                version: '',
+                reason: 'codeql executable not found on PATH (download from github/codeql-action)',
+            };
+        }
+        return { available: true, version: versionOf(executable), executable };
+    },
+    buildCommand(target, config) {
+        const language = String(config.language ?? 'javascript-typescript');
+        if (config.allowBuildCommands) {
+            throw new Error('allowBuildCommands must be granted by the audit, not by an adapter: the runner refuses build steps by default');
+        }
+        const db = path.join(target.workdir, 'codeql-db');
+        return {
+            prepare: [
+                {
+                    argv: [
+                        'codeql',
+                        'database',
+                        'create',
+                        db,
+                        '--language',
+                        language,
+                        '--source-root',
+                        target.path,
+                        '--no-run-unnecessary-builds',
+                    ],
+                    timeoutMs: 900_000,
+                },
+            ],
+            argv: codeqlAnalyzeCommand(db, String(config.packs ?? ''), path.join(target.workdir, CODEQL_SARIF)),
+            artifacts: [CODEQL_SARIF],
+            timeoutMs: 900_000,
+            network: true,
+        };
+    },
+    parse(raw, context) {
+        return evidenceFromSarif(raw, {
+            tool: 'codeql',
+            kind: 'dataflow-finding',
+            adapterVersion: context.adapterVersion,
+            confidence: 1.0,
+        });
+    },
+};
+/**
+ * The analyze leg, exposed so tests and callers can build it without running create.
+ *
+ * `packs` is a *positional* argument, so an empty string is not "no packs" — it
+ * is one empty specifier, and CodeQL rejects the whole run with
+ * `Invalid package specification:` and writes no SARIF. Measured on 2.27.3: with
+ * no specifier at all, CodeQL runs the language's default (code-scanning) suite.
+ */
+export function codeqlAnalyzeCommand(db, packs, out) {
+    const specifier = packs.trim();
+    return [
+        'codeql',
+        'database',
+        'analyze',
+        db,
+        ...(specifier ? [specifier] : []),
+        '--format=sarif-latest',
+        `--output=${out}`,
+    ];
+}
+function which(binary) {
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, binary);
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* keep looking */
+        }
+    }
+    return null;
+}
+function versionOf(executable) {
+    const proc = spawnSync(executable, ['--version'], { encoding: 'utf8', timeout: 30_000 });
+    // `codeql --version` prints "CodeQL command-line toolchain release 2.27.3."
+    // A `[\d.]+` class captures the sentence's full stop, and the version is
+    // recorded as "2.27.3." in every manifest.
+    const match = /(\d+\.\d+\.\d+)/.exec(String(proc.stdout ?? ''));
+    return match?.[1] ?? 'unknown';
+}
+//# sourceMappingURL=codeql.js.map

package/dist/scanner/adapters/codeql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeql.js","sourceRoot":"","sources":["../../../src/scanner/adapters/codeql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,oCAAoC;IAC1C,YAAY,EAAE,IAAI;IAElB,aAAa;QACX,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC;IAED,KAAK;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,0EAA0E;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,MAAqB;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE;wBACJ,QAAQ;wBACR,UAAU;wBACV,QAAQ;wBACR,EAAE;wBACF,YAAY;wBACZ,QAAQ;wBACR,eAAe;wBACf,MAAM,CAAC,IAAI;wBACX,6BAA6B;qBAC9B;oBACD,SAAS,EAAE,OAAO;iBACnB;aACF;YACD,IAAI,EAAE,oBAAoB,CACxB,EAAE,EACF,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CACxC;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,OAAO;QACxB,OAAO,iBAAiB,CAAC,GAAG,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,kBAAkB;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO;QACL,QAAQ;QACR,UAAU;QACV,SAAS;QACT,EAAE;QACF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,uBAAuB;QACvB,YAAY,GAAG,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,4EAA4E;IAC5E,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/scanner/adapters/dependency-cruiser.d.ts

@@ -0,0 +1,3 @@
+import type { ScannerAdapter } from '../types.js';
+export declare const dependencyCruiserAdapter: ScannerAdapter;
+//# sourceMappingURL=dependency-cruiser.d.ts.map

package/dist/scanner/adapters/dependency-cruiser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-cruiser.d.ts","sourceRoot":"","sources":["../../../src/scanner/adapters/dependency-cruiser.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAGV,cAAc,EAGf,MAAM,aAAa,CAAC;AAIrB,eAAO,MAAM,wBAAwB,EAAE,cAkFtC,CAAC"}