@xenos1996/usa 2.27.0 → 2.28.1

package/dist/scanner/identity.js

@@ -0,0 +1,50 @@
+/**
+ * Content-addressed ids for evidence and findings.
+ *
+ * Ids are a hash over the fields that make a claim *the same claim*: the tool
+ * that made it, its native category and identifier, the location, and the claim
+ * text. Timestamps and execution ids are deliberately excluded, so the same
+ * observation made in two runs, or by two adapters, shares one id. That is what
+ * makes deduplication and two-run trending work without similarity heuristics.
+ */
+import { createHash } from 'node:crypto';
+/** Short, stable, non-reversible id. Collisions are theoretical at 20 hex chars. */
+function hash(parts) {
+    const h = createHash('sha256');
+    for (const p of parts)
+        h.update(`${p ?? ''}\u0000`);
+    return h.digest('hex').slice(0, 20);
+}
+export function evidenceId(source, location, claim) {
+    return hash([
+        'evidence-v1',
+        source.tool,
+        source.kind,
+        source.identifier,
+        location?.file,
+        location?.line,
+        claim,
+    ]);
+}
+export function buildEvidence(args) {
+    const source = {
+        tool: args.source.tool,
+        version: args.source.version ?? 'unknown',
+        kind: args.source.kind,
+        identifier: args.source.identifier,
+    };
+    return {
+        id: evidenceId(source, args.location, args.claim),
+        source,
+        provenance: args.provenance,
+        claim: args.claim,
+        severity: args.severity,
+        severitySource: args.severitySource ?? 'tool-native',
+        confidence: args.confidence,
+        status: args.status,
+        location: args.location,
+        rawReference: args.rawReference ?? {},
+        ...(args.cwes && args.cwes.length > 0 ? { cwes: args.cwes } : {}),
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/scanner/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/scanner/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,oFAAoF;AACpF,SAAS,IAAI,CAAC,KAA6C;IACzD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAsB,EACtB,QAAiC,EACjC,KAAa;IAEb,OAAO,IAAI,CAAC;QACV,aAAa;QACb,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,UAAU;QACjB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;QACd,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAW7B;IACC,MAAM,MAAM,GAAmB;QAC7B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS;QACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;KACnC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;QACjD,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,aAAa;QACpD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/dist/scanner/normalize.d.ts

@@ -0,0 +1,40 @@
+import type { Evidence, ScannerSeverity } from './types.js';
+/** The tool's severity word, quoted. Unknown words degrade to LOW. */
+export declare function severity(word: unknown): ScannerSeverity;
+/** Confidence for deterministic facts; a param, not a guess, everywhere else. */
+export declare const DETERMINISTIC_CONFIDENCE = 1;
+export interface UnknownOptions {
+    adapterId: string;
+    adapterVersion: string;
+    reason: string;
+    /** Where the failure was detected. */
+    location?: Evidence['location'];
+}
+/** An evidence row that says "this tool could not tell us". */
+export declare function unknownEvidence(o: UnknownOptions): Evidence;
+/** Parse a payload once; a malformed one is UNKNOWN, never an exception. */
+export declare function tryParseJson(raw: string): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Read a nested key defensively: an absent path yields `undefined`, never
+ * throws. Array indices are accepted as numbers so callers can write
+ * `dig(x, ['locations', 0])` without stringifying.
+ */
+export declare function dig(obj: unknown, path: (string | number)[]): unknown;
+/**
+ * Make a tool-reported path relative to the scanned root.
+ *
+ * Tools report absolute paths when handed an absolute target, and the scanner
+ * runner always runs in a scratch copy — so an unnormalised location points at
+ * a temp directory that will not exist when the evidence is read. A path that
+ * is already relative, or outside the root, is left alone.
+ */
+export declare function relativePath(root: string, file: string): string;
+/** A line number, only when the source actually gave one. */
+export declare function lineNumber(value: unknown): number | undefined;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/scanner/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/scanner/normalize.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI5D,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,CAGvD;AAED,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,IAAM,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,QAAQ,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACjC;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,CAAC,EAAE,cAAc,GAAG,QAAQ,CAsB3D;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,GACV;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAM7D;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAQpE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG7D"}

package/dist/scanner/normalize.js

@@ -0,0 +1,85 @@
+/**
+ * Tool output → Evidence.
+ *
+ * Only adapters import this. The functions are total: unknown severity words
+ * become `LOW` (never dropped), missing locations become `null` (never
+ * invented), and an unparseable payload yields `UNKNOWN` evidence rather than a
+ * thrown error — a scanner that breaks must blind the audit, not fail it.
+ */
+import path from 'node:path';
+const KNOWN = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO', 'UNKNOWN'];
+/** The tool's severity word, quoted. Unknown words degrade to LOW. */
+export function severity(word) {
+    const w = String(word ?? '').toUpperCase();
+    return KNOWN.includes(w) ? w : 'LOW';
+}
+/** Confidence for deterministic facts; a param, not a guess, everywhere else. */
+export const DETERMINISTIC_CONFIDENCE = 1.0;
+/** An evidence row that says "this tool could not tell us". */
+export function unknownEvidence(o) {
+    return {
+        id: `UNKNOWN-${o.adapterId}-${o.reason}`.replace(/\s+/g, '-').slice(0, 40),
+        source: { tool: o.adapterId, version: o.adapterVersion, kind: 'check', identifier: 'UNKNOWN' },
+        provenance: {
+            executionId: 'unknown',
+            command: [],
+            config: {},
+            repositoryRevision: 'unknown',
+            timestamp: '',
+            executable: '',
+            timeoutMs: 0,
+            elapsedMs: 0,
+        },
+        claim: o.reason,
+        severity: 'INFO',
+        severitySource: 'adapter-default',
+        confidence: DETERMINISTIC_CONFIDENCE,
+        status: 'UNKNOWN',
+        location: o.location ?? null,
+        rawReference: {},
+    };
+}
+/** Parse a payload once; a malformed one is UNKNOWN, never an exception. */
+export function tryParseJson(raw) {
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch (err) {
+        return { ok: false, error: err.message };
+    }
+}
+/**
+ * Read a nested key defensively: an absent path yields `undefined`, never
+ * throws. Array indices are accepted as numbers so callers can write
+ * `dig(x, ['locations', 0])` without stringifying.
+ */
+export function dig(obj, path) {
+    let node = obj;
+    for (const key of path) {
+        const k = String(key);
+        if (typeof node !== 'object' || node === null || !(k in node))
+            return undefined;
+        node = node[k];
+    }
+    return node;
+}
+/**
+ * Make a tool-reported path relative to the scanned root.
+ *
+ * Tools report absolute paths when handed an absolute target, and the scanner
+ * runner always runs in a scratch copy — so an unnormalised location points at
+ * a temp directory that will not exist when the evidence is read. A path that
+ * is already relative, or outside the root, is left alone.
+ */
+export function relativePath(root, file) {
+    if (!path.isAbsolute(file))
+        return file;
+    const rel = path.relative(root, file);
+    return rel.startsWith('..') || path.isAbsolute(rel) ? file : rel;
+}
+/** A line number, only when the source actually gave one. */
+export function lineNumber(value) {
+    const n = Number(value);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
+}
+//# sourceMappingURL=normalize.js.map

package/dist/scanner/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/scanner/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,KAAK,GAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE1F,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAU5C,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,CAAiB;IAC/C,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;QAC9F,UAAU,EAAE;YACV,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,kBAAkB,EAAE,SAAS;YAC7B,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,CAAC;SACb;QACD,KAAK,EAAE,CAAC,CAAC,MAAM;QACf,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,GAAW;IAEX,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,IAAyB;IACzD,IAAI,IAAI,GAAY,GAAG,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAK,IAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5F,IAAI,GAAI,IAAgC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACnE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC"}

package/dist/scanner/registry.d.ts

@@ -0,0 +1,19 @@
+import type { ScannerAdapter } from './types.js';
+/**
+ * Every registered adapter. Tier 1 first (cheap, local), then Tier 2.
+ * Adding an adapter means appending here — nothing else in the system changes.
+ */
+export declare const scanners: ScannerAdapter[];
+/**
+ * Default-disabled adapters, and why:
+ *  - codeql  needs a database build and hundreds of MB of disk.
+ *  - ort     needs a JVM and a full dependency resolution per package manager.
+ *  - scorecard is enabled in its default `local` mode (offline, file-based);
+ *    `mode: repo` opts into network and a token.
+ */
+export declare const DEFAULT_DISABLED: ReadonlySet<string>;
+export declare function enabledAdapters(config: Record<string, {
+    enabled?: boolean;
+}> | undefined): ScannerAdapter[];
+export declare function byId(id: string): ScannerAdapter | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/scanner/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/scanner/registry.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,cAAc,EAOpC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAA8B,CAAC;AAEhF,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,GACxD,cAAc,EAAE,CAKlB;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3D"}

package/dist/scanner/registry.js

@@ -0,0 +1,43 @@
+/**
+ * Registry — the only place that knows which adapters exist.
+ *
+ * Adding an adapter must not require touching the runner, the CLI, or the rule
+ * packs; appending to this list is the whole integration.
+ */
+import { trivyAdapter } from './adapters/trivy.js';
+import { dependencyCruiserAdapter } from './adapters/dependency-cruiser.js';
+import { semgrepAdapter } from './adapters/semgrep.js';
+import { codeqlAdapter } from './adapters/codeql.js';
+import { scorecardAdapter } from './adapters/scorecard.js';
+import { ortAdapter } from './adapters/ort.js';
+/**
+ * Every registered adapter. Tier 1 first (cheap, local), then Tier 2.
+ * Adding an adapter means appending here — nothing else in the system changes.
+ */
+export const scanners = [
+    trivyAdapter,
+    dependencyCruiserAdapter,
+    semgrepAdapter,
+    codeqlAdapter,
+    scorecardAdapter,
+    ortAdapter,
+];
+/**
+ * Default-disabled adapters, and why:
+ *  - codeql  needs a database build and hundreds of MB of disk.
+ *  - ort     needs a JVM and a full dependency resolution per package manager.
+ *  - scorecard is enabled in its default `local` mode (offline, file-based);
+ *    `mode: repo` opts into network and a token.
+ */
+export const DEFAULT_DISABLED = new Set(['codeql', 'ort']);
+export function enabledAdapters(config) {
+    return scanners.filter((a) => {
+        if (config && typeof config[a.id]?.enabled === 'boolean')
+            return config[a.id].enabled;
+        return !DEFAULT_DISABLED.has(a.id);
+    });
+}
+export function byId(id) {
+    return scanners.find((a) => a.id === id);
+}
+//# sourceMappingURL=registry.js.map

package/dist/scanner/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/scanner/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAqB;IACxC,YAAY;IACZ,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,UAAU;CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,eAAe,CAC7B,MAAyD;IAEzD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,OAAQ,CAAC;QACxF,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,EAAU;IAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/scanner/run.d.ts

@@ -0,0 +1,71 @@
+import type { ScanOptions, ScanResult, ScannerAdapter, ScannerCommand, AdapterRun, ScanTarget } from './types.js';
+export declare const DEFAULT_TIMEOUT_MS = 300000;
+export declare const OUTPUT_CAP_BYTES: number;
+/**
+ * The environment a scanner child inherits: an allow-list, then a deny-list
+ * applied over it. A scanner gets PATH and TMPDIR and nothing that carries a
+ * credential — that is the whole point of the deny list existing.
+ */
+export declare function childEnv(allow: string[], prependToPath?: string[]): NodeJS.ProcessEnv;
+export declare class ScannerRunner {
+    private readonly adapters;
+    constructor(adapters: ScannerAdapter[]);
+    /**
+     * Run the selected adapters and return the manifest plus what they found.
+     * `options.adapters` filters the registry; an unknown id is a loud error
+     * rather than an empty run, because "0 evidence" must never be mistaken for
+     * "nothing wrong".
+     */
+    run(options: ScanOptions): ScanResult;
+    private select;
+    private runAdapter;
+}
+type ArtifactRead = {
+    ok: true;
+    path: string;
+    content: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Run the stages a pipeline tool needs before its evidence command.
+ *
+ * A prepare stage produces no payload to judge, so its exit status is the only
+ * signal it has. Using it to *stop* is not a verdict about the project — the
+ * adapter is reported as a blind spot, never as a finding.
+ */
+export declare function runPrepare(adapter: ScannerAdapter, target: ScanTarget, command: ScannerCommand, version: string, timeoutMs: number): {
+    prepared: string[][];
+} | {
+    manifest: AdapterRun;
+};
+/** The bytes to parse: the declared artifact if the tool writes one, else stdout. */
+export declare function resolveOutput(spawn: SpawnSuccess, command: ScannerCommand, workdir: string): {
+    ok: true;
+    raw: string;
+    artifact?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Read the first declared artifact that exists.
+ *
+ * A declared artifact that is missing is an `error` with a reason, never an
+ * empty result: "the tool produced no file" and "the policy passed" are
+ * different sentences and only one of them is usually true.
+ */
+export declare function readArtifact(workdir: string, declared: string[]): ArtifactRead;
+type SpawnSuccess = {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    elapsedMs: number;
+    startedAt: number;
+};
+export declare function copyTreeForScan(from: string, into: string): void;
+/** The commit the checkout points at, or `unversioned` — never blank. */
+export declare function detectRevision(dir: string): string;
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/scanner/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/scanner/run.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,cAAc,EAEd,cAAc,EAKd,UAAU,EACV,UAAU,EACX,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAmBjD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,aAAa,GAAE,MAAM,EAAO,GAAG,MAAM,CAAC,UAAU,CAWzF;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,cAAc,EAAE;IAEvD;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU;IAmDrC,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,UAAU;CAyFnB;AA+DD,KAAK,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB;IAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAA;CAAE,CA6BrD;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,MAAM,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAO9E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,CAuB9E;AA0CD,KAAK,YAAY,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AA6EF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAehE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAelD"}