api-tests-coverage 1.0.0

package/dist/src/config/loadConfig.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Central config — entry-point loader.
+ *
+ * This is the single public entry point for loading configuration.
+ * All scanning modules, CLI commands, and test helpers must call
+ * `loadConfig()` rather than reading YAML or JSON config directly.
+ *
+ * Resolution order:
+ *   1. If configPath argument is provided, load that file (error if missing).
+ *   2. Otherwise, look for config.yaml at the current working directory root.
+ *   3. If neither is found, emit a warning and return the default config.
+ */
+import type { AnalyzerConfig } from './types';
+/** Single canonical default config file name. */
+export declare const DEFAULT_CONFIG_FILENAME = "config.yaml";
+/** Path searched when no --config flag is provided. Computed dynamically at call time. */
+export declare const DEFAULT_CONFIG_PATH: string;
+/** Legacy config file name — triggers a deprecation warning when found. */
+export declare const LEGACY_CONFIG_FILENAME = "coverage.config.json";
+export declare const MISSING_CONFIG_WARNING = "[WARNING] No config.yaml found at project root.\nRunning full default analysis profile.\nTo customize scanning, thresholds, MCP integration, and reporting,\ncreate a config.yaml file. See docs/guides/configuration.md for reference.";
+export declare const LEGACY_CONFIG_WARNING = "[DEPRECATED] coverage.config.json is no longer supported.\nPlease migrate your configuration to config.yaml.\nSee docs/guides/migration-to-config-yaml.md for instructions.";
+/**
+ * Load, validate, merge, and return the normalized `AnalyzerConfig`.
+ *
+ * @param configPath  Explicit path to a config file (from --config flag).
+ *                    When omitted, the loader searches for config.yaml at CWD.
+ */
+export declare function loadConfig(configPath?: string): AnalyzerConfig;
+//# sourceMappingURL=loadConfig.d.ts.map

package/dist/src/config/loadConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadConfig.d.ts","sourceRoot":"","sources":["../../../src/config/loadConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAO9C,iDAAiD;AACjD,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAoD,CAAC;AAErF,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAI7D,eAAO,MAAM,sBAAsB,4OAGwC,CAAC;AAE5E,eAAO,MAAM,qBAAqB,gLAE4B,CAAC;AAI/D;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,cAAc,CAuC9D"}

package/dist/src/config/loadConfig.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Central config — entry-point loader.
+ *
+ * This is the single public entry point for loading configuration.
+ * All scanning modules, CLI commands, and test helpers must call
+ * `loadConfig()` rather than reading YAML or JSON config directly.
+ *
+ * Resolution order:
+ *   1. If configPath argument is provided, load that file (error if missing).
+ *   2. Otherwise, look for config.yaml at the current working directory root.
+ *   3. If neither is found, emit a warning and return the default config.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_CONFIG_WARNING = exports.MISSING_CONFIG_WARNING = exports.LEGACY_CONFIG_FILENAME = exports.DEFAULT_CONFIG_PATH = exports.DEFAULT_CONFIG_FILENAME = void 0;
+exports.loadConfig = loadConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml = __importStar(require("js-yaml"));
+const defaultConfig_1 = require("./defaultConfig");
+const validateConfig_1 = require("./validateConfig");
+const mergeConfig_1 = require("./mergeConfig");
+// ─── Constants ────────────────────────────────────────────────────────────────
+/** Single canonical default config file name. */
+exports.DEFAULT_CONFIG_FILENAME = 'config.yaml';
+/** Path searched when no --config flag is provided. Computed dynamically at call time. */
+exports.DEFAULT_CONFIG_PATH = path.join(process.cwd(), exports.DEFAULT_CONFIG_FILENAME);
+/** Legacy config file name — triggers a deprecation warning when found. */
+exports.LEGACY_CONFIG_FILENAME = 'coverage.config.json';
+// ─── Warning / deprecation message constants ──────────────────────────────────
+exports.MISSING_CONFIG_WARNING = `[WARNING] No config.yaml found at project root.
+Running full default analysis profile.
+To customize scanning, thresholds, MCP integration, and reporting,
+create a config.yaml file. See docs/guides/configuration.md for reference.`;
+exports.LEGACY_CONFIG_WARNING = `[DEPRECATED] coverage.config.json is no longer supported.
+Please migrate your configuration to config.yaml.
+See docs/guides/migration-to-config-yaml.md for instructions.`;
+// ─── Loader ───────────────────────────────────────────────────────────────────
+/**
+ * Load, validate, merge, and return the normalized `AnalyzerConfig`.
+ *
+ * @param configPath  Explicit path to a config file (from --config flag).
+ *                    When omitted, the loader searches for config.yaml at CWD.
+ */
+function loadConfig(configPath) {
+    const resolvedPath = resolveConfigPath(configPath);
+    // ── Explicit path provided but file does not exist ────────────────────────
+    if (configPath) {
+        const absPath = path.resolve(configPath);
+        if (!fs.existsSync(absPath)) {
+            throw new Error(`Config error: configuration file not found: ${absPath}\n` +
+                `  Check the path passed to --config and try again.`);
+        }
+        return loadAndMerge(absPath);
+    }
+    // ── Auto-discovery ────────────────────────────────────────────────────────
+    if (resolvedPath && fs.existsSync(resolvedPath)) {
+        return loadAndMerge(resolvedPath);
+    }
+    // ── Legacy config detection ───────────────────────────────────────────────
+    const legacyPath = path.join(process.cwd(), exports.LEGACY_CONFIG_FILENAME);
+    if (fs.existsSync(legacyPath)) {
+        process.stderr.write(exports.LEGACY_CONFIG_WARNING + '\n');
+    }
+    // ── No config found — warn and use defaults ───────────────────────────────
+    // Check failOnConfigMissing from the defaults (always false unless overridden
+    // by an already-loaded config — handled upstream).
+    if (defaultConfig_1.DEFAULT_CONFIG.analysis.failOnConfigMissing) {
+        process.stderr.write(exports.MISSING_CONFIG_WARNING + '\n');
+        process.exit(1);
+    }
+    if (defaultConfig_1.DEFAULT_CONFIG.analysis.warnOnConfigMissing !== false) {
+        process.stderr.write(exports.MISSING_CONFIG_WARNING + '\n');
+    }
+    return { ...defaultConfig_1.DEFAULT_CONFIG };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function resolveConfigPath(configPath) {
+    if (configPath)
+        return path.resolve(configPath);
+    // Compute dynamically so tests can change process.cwd() via chdir.
+    return path.join(process.cwd(), exports.DEFAULT_CONFIG_FILENAME);
+}
+function loadAndMerge(absPath) {
+    const raw = fs.readFileSync(absPath, 'utf-8');
+    let parsed;
+    try {
+        parsed = yaml.load(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Config error: failed to parse ${absPath} as YAML.\n  ${msg}`);
+    }
+    // Determine if strict mode is requested (before full validation).
+    const isStrict = typeof parsed === 'object' &&
+        parsed !== null &&
+        !Array.isArray(parsed) &&
+        parsed['qualityGate'] !== undefined &&
+        parsed['qualityGate']['mode'] === 'strict';
+    const partial = (0, validateConfig_1.validateConfig)(parsed, isStrict);
+    return (0, mergeConfig_1.mergeConfig)(defaultConfig_1.DEFAULT_CONFIG, partial);
+}

package/dist/src/config/mergeConfig.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Central config — deep-merge utility.
+ *
+ * Merges a user-supplied partial config over the built-in defaults.
+ * - Plain objects are recursively merged (user values win on conflict).
+ * - Array fields are replaced, not concatenated (user array replaces default).
+ * - Undefined user values are ignored (defaults are preserved).
+ */
+import type { AnalyzerConfig } from './types';
+/**
+ * Deep-merge `user` over `defaults`.
+ * Returns a new object; neither input is mutated.
+ */
+export declare function mergeConfig(defaults: AnalyzerConfig, user: Partial<AnalyzerConfig>): AnalyzerConfig;
+//# sourceMappingURL=mergeConfig.d.ts.map

package/dist/src/config/mergeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeConfig.d.ts","sourceRoot":"","sources":["../../../src/config/mergeConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,GAC5B,cAAc,CAEhB"}

package/dist/src/config/mergeConfig.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * Central config — deep-merge utility.
+ *
+ * Merges a user-supplied partial config over the built-in defaults.
+ * - Plain objects are recursively merged (user values win on conflict).
+ * - Array fields are replaced, not concatenated (user array replaces default).
+ * - Undefined user values are ignored (defaults are preserved).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeConfig = mergeConfig;
+/**
+ * Deep-merge `user` over `defaults`.
+ * Returns a new object; neither input is mutated.
+ */
+function mergeConfig(defaults, user) {
+    return deepMerge(defaults, user);
+}
+function deepMerge(target, source) {
+    // For non-objects or arrays, the source value wins outright.
+    if (source === undefined ||
+        source === null ||
+        typeof source !== 'object' ||
+        Array.isArray(source)) {
+        return (source !== undefined ? source : target);
+    }
+    if (target === undefined ||
+        target === null ||
+        typeof target !== 'object' ||
+        Array.isArray(target)) {
+        return source;
+    }
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        const srcVal = source[key];
+        const tgtVal = target[key];
+        if (srcVal === undefined) {
+            // Preserve the default.
+            continue;
+        }
+        if (Array.isArray(srcVal)) {
+            // Arrays are replaced, not merged.
+            result[key] = srcVal;
+        }
+        else if (typeof srcVal === 'object' &&
+            srcVal !== null &&
+            typeof tgtVal === 'object' &&
+            tgtVal !== null &&
+            !Array.isArray(tgtVal)) {
+            result[key] = deepMerge(tgtVal, srcVal);
+        }
+        else {
+            result[key] = srcVal;
+        }
+    }
+    return result;
+}

package/dist/src/config/schema.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Central config — valid enum value constants.
+ *
+ * Used by the validator to verify config field values and by the default
+ * config to populate the full-profile defaults.
+ */
+import type { CoverageType, SecurityScannerType, IntelligenceType, ReportFormat, QualityGateMode } from './types';
+export declare const VALID_COVERAGE_TYPES: CoverageType[];
+export declare const VALID_SECURITY_SCANNERS: SecurityScannerType[];
+export declare const VALID_INTELLIGENCE_TYPES: IntelligenceType[];
+export declare const VALID_REPORT_FORMATS: ReportFormat[];
+export declare const VALID_QUALITY_GATE_MODES: QualityGateMode[];
+export declare const VALID_ANALYSIS_MODES: readonly ["full", "custom"];
+export declare const SUPPORTED_VERSIONS: readonly [1];
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EAChB,MAAM,SAAS,CAAC;AAEjB,eAAO,MAAM,oBAAoB,EAAE,YAAY,EAS9C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,mBAAmB,EAAgC,CAAC;AAE1F,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,EAKtD,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,YAAY,EAAiD,CAAC;AAEjG,eAAO,MAAM,wBAAwB,EAAE,eAAe,EAAuB,CAAC;AAE9E,eAAO,MAAM,oBAAoB,6BAA8B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,cAAe,CAAC"}

package/dist/src/config/schema.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Central config — valid enum value constants.
+ *
+ * Used by the validator to verify config field values and by the default
+ * config to populate the full-profile defaults.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPPORTED_VERSIONS = exports.VALID_ANALYSIS_MODES = exports.VALID_QUALITY_GATE_MODES = exports.VALID_REPORT_FORMATS = exports.VALID_INTELLIGENCE_TYPES = exports.VALID_SECURITY_SCANNERS = exports.VALID_COVERAGE_TYPES = void 0;
+exports.VALID_COVERAGE_TYPES = [
+    'endpoint',
+    'parameter',
+    'business',
+    'integration',
+    'error',
+    'security',
+    'performance',
+    'compatibility',
+];
+exports.VALID_SECURITY_SCANNERS = ['semgrep', 'trivy', 'zap'];
+exports.VALID_INTELLIGENCE_TYPES = [
+    'ai-summary',
+    'risk-prioritization',
+    'recommendations',
+    'scanner-interpretation',
+];
+exports.VALID_REPORT_FORMATS = ['json', 'html', 'csv', 'junit', 'markdown'];
+exports.VALID_QUALITY_GATE_MODES = ['strict', 'warn'];
+exports.VALID_ANALYSIS_MODES = ['full', 'custom'];
+exports.SUPPORTED_VERSIONS = [1];

package/dist/src/config/types.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Central config — TypeScript type definitions.
+ *
+ * `AnalyzerConfig` is the single normalized config object consumed by every
+ * scanning module, CLI command, MCP client, report generator, and quality gate.
+ * All external consumers must import from this module, never from raw YAML.
+ */
+import type { McpConfig } from '../mcp/types';
+export type { McpConfig } from '../mcp/types';
+export interface ProjectConfig {
+    /** Display name used in summaries and reports */
+    name?: string;
+}
+export interface AstLanguageConfig {
+    /** When false, skip AST analysis for this language and use regex fallback */
+    enabled?: boolean;
+}
+export interface AstAnalysisConfig {
+    /** Master switch. When false, skip AST entirely and use regex fallback. Default: true. */
+    enabled?: boolean;
+    /**
+     * When true (default), if AST parsing succeeds but returns 0 HTTP interactions the
+     * engine runs the regex fallback and tags its results with resolutionType:'heuristic'
+     * and confidence:'low'. When false, 0 AST results are returned verbatim.
+     */
+    fallbackHeuristics?: boolean;
+    /** Maximum call-chain depth for wrapper/helper tracing. Default: 4. */
+    maxCallDepth?: number;
+    /** Include assertion type metadata in output. Default: true. */
+    assertionAware?: boolean;
+    /** Per-language enable/disable toggles */
+    languages?: {
+        java?: AstLanguageConfig;
+        kotlin?: AstLanguageConfig;
+        python?: AstLanguageConfig;
+        ruby?: AstLanguageConfig;
+        javascript?: AstLanguageConfig;
+        typescript?: AstLanguageConfig;
+        cucumber?: AstLanguageConfig;
+    };
+}
+export interface AnalysisConfig {
+    /** 'full' runs all scans; 'custom' runs only explicitly-enabled scans */
+    defaultMode?: 'full' | 'custom';
+    /** If true, missing config.yaml halts execution with non-zero exit */
+    failOnConfigMissing?: boolean;
+    /** If true, emits a warning when config.yaml is absent */
+    warnOnConfigMissing?: boolean;
+    /** AST-based analysis configuration */
+    ast?: AstAnalysisConfig;
+    /**
+     * When true, the analyzer will automatically discover API specs, tests,
+     * contracts, performance results, and security reports without explicit config.
+     * Default: true.
+     */
+    agnosticDiscovery?: boolean;
+    /**
+     * When true, if business rule files are absent the analyzer infers rules
+     * from service-code validation / conditional logic. Default: true.
+     */
+    inferBusinessRules?: boolean;
+    /**
+     * When true, if integration flow files are absent the analyzer constructs
+     * flows from test call sequences and Cucumber scenarios. Default: true.
+     */
+    inferIntegrationFlows?: boolean;
+}
+export type CoverageType = 'endpoint' | 'parameter' | 'business' | 'integration' | 'error' | 'security' | 'performance' | 'compatibility';
+export type SecurityScannerType = 'semgrep' | 'trivy' | 'zap';
+export type IntelligenceType = 'ai-summary' | 'risk-prioritization' | 'recommendations' | 'scanner-interpretation';
+export type ReportFormat = 'json' | 'html' | 'csv' | 'junit' | 'markdown';
+/**
+ * Configuration for the deep endpoint analysis feature.
+ * Nested under scans.coverage.deepAnalysis in config.yaml.
+ */
+export interface DeepAnalysisCoverageConfig {
+    /** Master switch. When false the engine falls back to direct regex only. */
+    enabled?: boolean;
+    /** Maximum call-chain depth to follow when tracing wrapper methods. Default: 4. */
+    maxCallDepth?: number;
+    /** Resolve named constant/variable references to their literal values. */
+    resolveConstants?: boolean;
+    /** Resolve enum member references to their literal path values. */
+    resolveEnums?: boolean;
+    /** Resolve template literals and string concatenation. */
+    resolveStringTemplates?: boolean;
+    /** Trace helper/wrapper methods to find HTTP calls. */
+    resolveWrappers?: boolean;
+    /** Detect request-builder / request-object patterns. */
+    resolveRequestBuilders?: boolean;
+    /** Apply explicit or inferred client-to-HTTP-method mapping. */
+    resolveClientMappings?: boolean;
+    /** Associate HTTP calls with downstream response assertions. */
+    assertionAware?: boolean;
+    /**
+     * Explicit client-method → HTTP mappings.
+     * Example: { classOrObject: 'userClient', method: 'getById', httpMethod: 'GET', pathTemplate: '/users/{id}' }
+     */
+    clientMappings?: Array<{
+        classOrObject: string;
+        method: string;
+        httpMethod: string;
+        pathTemplate: string;
+    }>;
+}
+export interface CoverageScansConfig {
+    enabled?: boolean;
+    types?: CoverageType[];
+    /** Deep endpoint analysis configuration. */
+    deepAnalysis?: DeepAnalysisCoverageConfig;
+}
+export interface SecurityScansConfig {
+    enabled?: boolean;
+    scanners?: SecurityScannerType[];
+}
+export interface IntelligenceScansConfig {
+    enabled?: boolean;
+    types?: IntelligenceType[];
+}
+export interface ScansConfig {
+    coverage?: CoverageScansConfig;
+    security?: SecurityScansConfig;
+    intelligence?: IntelligenceScansConfig;
+}
+export interface ThresholdsConfig {
+    global?: number;
+    endpoint?: number;
+    parameter?: number;
+    business?: number;
+    integration?: number;
+    error?: number;
+    security?: number;
+    performance?: number;
+    resilience?: number;
+    compatibility?: number;
+    [key: string]: number | undefined;
+}
+export type QualityGateMode = 'strict' | 'warn';
+export interface QualityGateConfig {
+    enabled?: boolean;
+    failBuildOnThresholdMiss?: boolean;
+    mode?: QualityGateMode;
+}
+export interface ReportsConfig {
+    outputDir?: string;
+    formats?: ReportFormat[];
+}
+export interface GitHubPagesPublishingConfig {
+    enabled?: boolean;
+}
+export interface PublishingConfig {
+    enabled?: boolean;
+    githubPages?: GitHubPagesPublishingConfig;
+}
+export interface AiSummaryConfig {
+    enabled?: boolean;
+    collapsedByDefault?: boolean;
+}
+export interface DashboardConfig {
+    aiSummary?: AiSummaryConfig;
+}
+export interface AnalyzerConfig {
+    /** Config schema version; must be 1 for this release */
+    version: number;
+    project: ProjectConfig;
+    analysis: AnalysisConfig;
+    scans: ScansConfig;
+    mcp: McpConfig;
+    thresholds: ThresholdsConfig;
+    qualityGate: QualityGateConfig;
+    reports: ReportsConfig;
+    publishing: PublishingConfig;
+    dashboard: DashboardConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9C,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0CAA0C;IAC1C,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,iBAAiB,CAAC;QACzB,MAAM,CAAC,EAAE,iBAAiB,CAAC;QAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;QAC3B,IAAI,CAAC,EAAE,iBAAiB,CAAC;QACzB,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAC/B,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAC/B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAChC,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uCAAuC;IACvC,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,MAAM,YAAY,GACpB,UAAU,GACV,WAAW,GACX,UAAU,GACV,aAAa,GACb,OAAO,GACP,UAAU,GACV,aAAa,GACb,eAAe,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,qBAAqB,GACrB,iBAAiB,GACjB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,UAAU,CAAC;AAE1E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uDAAuD;IACvD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wDAAwD;IACxD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gEAAgE;IAChE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,2BAA2B,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAID,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,SAAS,EAAE,eAAe,CAAC;CAC5B"}

package/dist/src/config/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Central config — TypeScript type definitions.
+ *
+ * `AnalyzerConfig` is the single normalized config object consumed by every
+ * scanning module, CLI command, MCP client, report generator, and quality gate.
+ * All external consumers must import from this module, never from raw YAML.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/config/validateConfig.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Central config — schema validation.
+ *
+ * Validates a parsed YAML object against the AnalyzerConfig schema.
+ * On failure, throws with a field-level error message that includes
+ * the received value and an example of a valid value.
+ *
+ * Unknown top-level keys produce a warning in default mode and a hard
+ * error in strict mode (qualityGate.mode === 'strict').
+ */
+import type { AnalyzerConfig } from './types';
+/**
+ * Validate a raw parsed-YAML object.
+ *
+ * Returns the cast `AnalyzerConfig` on success.
+ * Throws with a field-level error message on validation failure.
+ *
+ * @param raw         Parsed YAML value (must be a plain object)
+ * @param strictMode  When true, unknown top-level keys are errors not warnings
+ */
+export declare function validateConfig(raw: unknown, strictMode?: boolean): Partial<AnalyzerConfig>;
+//# sourceMappingURL=validateConfig.d.ts.map

package/dist/src/config/validateConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateConfig.d.ts","sourceRoot":"","sources":["../../../src/config/validateConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyC9C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAmLxF"}