api-tests-coverage 1.0.12 → 1.0.14

package/dist/src/pipeline/graph.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Coverage Knowledge Graph — the central data structure for the pipeline.
+ *
+ * Stores typed nodes and edges accumulated across all 6 pipeline stages.
+ * Provides lookup, traversal, merge, and serialization operations.
+ */
+import type { GraphNode, GraphEdge, GraphNodeType, GraphEdgeType, ConflictNode, StageName } from './types';
+export declare class CoverageKnowledgeGraph {
+    private nodes;
+    private edges;
+    addNode(node: GraphNode): void;
+    getNode(id: string): GraphNode | undefined;
+    hasNode(id: string): boolean;
+    removeNode(id: string): boolean;
+    getNodesByType(type: GraphNodeType): GraphNode[];
+    getNodesByStage(stage: StageName): GraphNode[];
+    getAllNodes(): GraphNode[];
+    get nodeCount(): number;
+    addEdge(edge: GraphEdge): void;
+    getEdge(id: string): GraphEdge | undefined;
+    hasEdge(id: string): boolean;
+    removeEdge(id: string): boolean;
+    /** Get all edges originating from a given node. */
+    getEdgesFrom(nodeId: string): GraphEdge[];
+    /** Get all edges pointing to a given node. */
+    getEdgesTo(nodeId: string): GraphEdge[];
+    /** Get all edges between two specific nodes (in either direction). */
+    getEdgesBetween(nodeIdA: string, nodeIdB: string): GraphEdge[];
+    /** Get all edges of a specific type. */
+    getEdgesByType(type: GraphEdgeType): GraphEdge[];
+    getAllEdges(): GraphEdge[];
+    get edgeCount(): number;
+    /**
+     * Get all nodes reachable from `startId` by following edges of the given types.
+     * BFS traversal, returns nodes in visit order. Cycle-safe.
+     */
+    getReachableNodes(startId: string, edgeTypes?: GraphEdgeType[]): GraphNode[];
+    /**
+     * Check whether a path from `startId` to `endId` passes through any node
+     * of the given type. Used by confidence scoring to detect mock boundaries.
+     */
+    hasNodeTypeOnPath(startId: string, endId: string, nodeType: GraphNodeType): boolean;
+    /**
+     * Merge another graph into this one. Returns conflicts for any nodes
+     * that exist in both graphs with different types (RULE: stage-disagreement).
+     */
+    merge(other: CoverageKnowledgeGraph): ConflictNode[];
+    toSerializable(): {
+        nodes: GraphNode[];
+        edges: GraphEdge[];
+    };
+    static fromSerializable(data: {
+        nodes: GraphNode[];
+        edges: GraphEdge[];
+    }): CoverageKnowledgeGraph;
+    clear(): void;
+}
+//# sourceMappingURL=graph.d.ts.map

package/dist/src/pipeline/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/pipeline/graph.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACV,MAAM,SAAS,CAAC;AAEjB,qBAAa,sBAAsB;IACjC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,KAAK,CAAqC;IAIlD,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAI9B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI1C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI/B,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE;IAIhD,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE;IAI9C,WAAW,IAAI,SAAS,EAAE;IAI1B,IAAI,SAAS,IAAI,MAAM,CAEtB;IAID,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAI9B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI1C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI/B,mDAAmD;IACnD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE;IAIzC,8CAA8C;IAC9C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE;IAIvC,sEAAsE;IACtE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE;IAQ9D,wCAAwC;IACxC,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE;IAIhD,WAAW,IAAI,SAAS,EAAE;IAI1B,IAAI,SAAS,IAAI,MAAM,CAEtB;IAID;;;OAGG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,SAAS,EAAE;IA4B5E;;;OAGG;IACH,iBAAiB,CACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,aAAa,GACtB,OAAO;IAiCV;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,YAAY,EAAE;IAwCpD,cAAc,IAAI;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,KAAK,EAAE,SAAS,EAAE,CAAA;KAAE;IAO5D,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,KAAK,EAAE,SAAS,EAAE,CAAA;KAAE,GAAG,sBAAsB;IAajG,KAAK,IAAI,IAAI;CAId"}

package/dist/src/pipeline/graph.js

@@ -0,0 +1,199 @@
+"use strict";
+/**
+ * Coverage Knowledge Graph — the central data structure for the pipeline.
+ *
+ * Stores typed nodes and edges accumulated across all 6 pipeline stages.
+ * Provides lookup, traversal, merge, and serialization operations.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoverageKnowledgeGraph = void 0;
+class CoverageKnowledgeGraph {
+    constructor() {
+        this.nodes = new Map();
+        this.edges = new Map();
+    }
+    // ─── Node operations ────────────────────────────────────────────────
+    addNode(node) {
+        this.nodes.set(node.id, node);
+    }
+    getNode(id) {
+        return this.nodes.get(id);
+    }
+    hasNode(id) {
+        return this.nodes.has(id);
+    }
+    removeNode(id) {
+        return this.nodes.delete(id);
+    }
+    getNodesByType(type) {
+        return Array.from(this.nodes.values()).filter((n) => n.type === type);
+    }
+    getNodesByStage(stage) {
+        return Array.from(this.nodes.values()).filter((n) => n.sourceStage === stage);
+    }
+    getAllNodes() {
+        return Array.from(this.nodes.values());
+    }
+    get nodeCount() {
+        return this.nodes.size;
+    }
+    // ─── Edge operations ────────────────────────────────────────────────
+    addEdge(edge) {
+        this.edges.set(edge.id, edge);
+    }
+    getEdge(id) {
+        return this.edges.get(id);
+    }
+    hasEdge(id) {
+        return this.edges.has(id);
+    }
+    removeEdge(id) {
+        return this.edges.delete(id);
+    }
+    /** Get all edges originating from a given node. */
+    getEdgesFrom(nodeId) {
+        return Array.from(this.edges.values()).filter((e) => e.sourceNodeId === nodeId);
+    }
+    /** Get all edges pointing to a given node. */
+    getEdgesTo(nodeId) {
+        return Array.from(this.edges.values()).filter((e) => e.targetNodeId === nodeId);
+    }
+    /** Get all edges between two specific nodes (in either direction). */
+    getEdgesBetween(nodeIdA, nodeIdB) {
+        return Array.from(this.edges.values()).filter((e) => (e.sourceNodeId === nodeIdA && e.targetNodeId === nodeIdB) ||
+            (e.sourceNodeId === nodeIdB && e.targetNodeId === nodeIdA));
+    }
+    /** Get all edges of a specific type. */
+    getEdgesByType(type) {
+        return Array.from(this.edges.values()).filter((e) => e.type === type);
+    }
+    getAllEdges() {
+        return Array.from(this.edges.values());
+    }
+    get edgeCount() {
+        return this.edges.size;
+    }
+    // ─── Traversal helpers ──────────────────────────────────────────────
+    /**
+     * Get all nodes reachable from `startId` by following edges of the given types.
+     * BFS traversal, returns nodes in visit order. Cycle-safe.
+     */
+    getReachableNodes(startId, edgeTypes) {
+        const visited = new Set();
+        const queue = [startId];
+        const result = [];
+        while (queue.length > 0) {
+            const currentId = queue.shift();
+            if (visited.has(currentId))
+                continue;
+            visited.add(currentId);
+            const node = this.nodes.get(currentId);
+            if (node && currentId !== startId) {
+                result.push(node);
+            }
+            const outEdges = this.getEdgesFrom(currentId);
+            for (const edge of outEdges) {
+                if (!edgeTypes || edgeTypes.includes(edge.type)) {
+                    if (!visited.has(edge.targetNodeId)) {
+                        queue.push(edge.targetNodeId);
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Check whether a path from `startId` to `endId` passes through any node
+     * of the given type. Used by confidence scoring to detect mock boundaries.
+     */
+    hasNodeTypeOnPath(startId, endId, nodeType) {
+        const visited = new Set();
+        const queue = [[startId]];
+        while (queue.length > 0) {
+            const path = queue.shift();
+            const currentId = path[path.length - 1];
+            if (visited.has(currentId))
+                continue;
+            visited.add(currentId);
+            if (currentId === endId) {
+                // Check interior nodes (not start or end)
+                for (let i = 1; i < path.length - 1; i++) {
+                    const node = this.nodes.get(path[i]);
+                    if ((node === null || node === void 0 ? void 0 : node.type) === nodeType)
+                        return true;
+                }
+                return false;
+            }
+            const outEdges = this.getEdgesFrom(currentId);
+            for (const edge of outEdges) {
+                if (!visited.has(edge.targetNodeId)) {
+                    queue.push([...path, edge.targetNodeId]);
+                }
+            }
+        }
+        return false;
+    }
+    // ─── Merge ──────────────────────────────────────────────────────────
+    /**
+     * Merge another graph into this one. Returns conflicts for any nodes
+     * that exist in both graphs with different types (RULE: stage-disagreement).
+     */
+    merge(other) {
+        const conflicts = [];
+        let conflictCounter = 0;
+        for (const node of other.getAllNodes()) {
+            const existing = this.nodes.get(node.id);
+            if (existing) {
+                if (existing.type !== node.type) {
+                    conflicts.push({
+                        conflictId: `conflict-merge-${conflictCounter++}`,
+                        nodeId: node.id,
+                        type: 'stage-disagreement',
+                        stages: [existing.sourceStage, node.sourceStage],
+                        stageOutputs: {
+                            [existing.sourceStage]: { type: existing.type, label: existing.label },
+                            [node.sourceStage]: { type: node.type, label: node.label },
+                        },
+                        detail: `Node '${node.id}' has type '${existing.type}' from stage '${existing.sourceStage}' but type '${node.type}' from stage '${node.sourceStage}'`,
+                        suggestedAction: `Review both stage outputs for node '${node.id}' and determine the correct classification. Check if the node serves dual roles (e.g., a service that also defines endpoints).`,
+                        severity: 'warning',
+                    });
+                }
+                // Merge metadata from the newer stage
+                existing.metadata = { ...existing.metadata, ...node.metadata };
+            }
+            else {
+                this.nodes.set(node.id, { ...node });
+            }
+        }
+        for (const edge of other.getAllEdges()) {
+            if (!this.edges.has(edge.id)) {
+                this.edges.set(edge.id, { ...edge });
+            }
+        }
+        return conflicts;
+    }
+    // ─── Serialization ──────────────────────────────────────────────────
+    toSerializable() {
+        return {
+            nodes: this.getAllNodes(),
+            edges: this.getAllEdges(),
+        };
+    }
+    static fromSerializable(data) {
+        const graph = new CoverageKnowledgeGraph();
+        for (const node of data.nodes) {
+            graph.addNode(node);
+        }
+        for (const edge of data.edges) {
+            graph.addEdge(edge);
+        }
+        return graph;
+    }
+    // ─── Clear ──────────────────────────────────────────────────────────
+    clear() {
+        this.nodes.clear();
+        this.edges.clear();
+    }
+}
+exports.CoverageKnowledgeGraph = CoverageKnowledgeGraph;

package/dist/src/pipeline/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Pipeline module — Cascaded Multi-Stage Coverage Mapping Engine.
+ *
+ * Public API for the 6-stage pipeline: SCA → AST → TIA → IAST → DAST → Merge.
+ */
+export type { PipelineConfidence, StageName, TestLayer, CoverageClass, AssertionSource, UrlResolution, ConflictType, ConflictSeverity, GraphNodeType, GraphEdgeType, GraphNode, GraphEdge, MockType, MockBoundary, ConflictNode, CoverageMapping, CoverageMappingItemType, StageDiagnostics, SkippedFile, PipelineSummary, PipelineSections, PipelineOutput, ConfidenceEvidence, } from './types';
+export type { PipelineConfig, PipelineContext, PipelineStage } from './stageInterface';
+export { DEFAULT_PIPELINE_CONFIG } from './stageInterface';
+export { CoverageKnowledgeGraph } from './graph';
+export { computeConfidence, computeBaseConfidence, applyConfidenceCaps, capConfidence, compareConfidence, minConfidence, hasMockBoundaryOnPath, hasPartialResolution, buildConfidenceEvidence, } from './confidence';
+export { runPipeline, createPipelineContext } from './orchestrator';
+export type { PipelineRunOptions, PipelineRunResult } from './orchestrator';
+export { ScaStage } from './stages/sca/scaStage';
+export { AstStage } from './stages/ast/astStage';
+export { TiaStage } from './stages/tia/tiaStage';
+export { IastStage } from './stages/iast/iastStage';
+export { DastStage } from './stages/dast/dastStage';
+export { MergeStage } from './stages/merge/mergeStage';
+export type { ScaOutput } from './stages/sca/types';
+export type { AstStageOutput } from './stages/ast/types';
+export type { TiaOutput } from './stages/tia/types';
+export type { IastOutput, IastEvent } from './stages/iast/types';
+export type { DastOutput, DastProbeResult } from './stages/dast/types';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/pipeline/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,aAAa,EACb,eAAe,EACf,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,SAAS,CAAC;AAGjB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGjD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACpE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAG5E,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACjE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/pipeline/index.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Pipeline module — Cascaded Multi-Stage Coverage Mapping Engine.
+ *
+ * Public API for the 6-stage pipeline: SCA → AST → TIA → IAST → DAST → Merge.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MergeStage = exports.DastStage = exports.IastStage = exports.TiaStage = exports.AstStage = exports.ScaStage = exports.createPipelineContext = exports.runPipeline = exports.buildConfidenceEvidence = exports.hasPartialResolution = exports.hasMockBoundaryOnPath = exports.minConfidence = exports.compareConfidence = exports.capConfidence = exports.applyConfidenceCaps = exports.computeBaseConfidence = exports.computeConfidence = exports.CoverageKnowledgeGraph = exports.DEFAULT_PIPELINE_CONFIG = void 0;
+var stageInterface_1 = require("./stageInterface");
+Object.defineProperty(exports, "DEFAULT_PIPELINE_CONFIG", { enumerable: true, get: function () { return stageInterface_1.DEFAULT_PIPELINE_CONFIG; } });
+// ─── Graph ───────────────────────────────────────────────────────────────────
+var graph_1 = require("./graph");
+Object.defineProperty(exports, "CoverageKnowledgeGraph", { enumerable: true, get: function () { return graph_1.CoverageKnowledgeGraph; } });
+// ─── Confidence ──────────────────────────────────────────────────────────────
+var confidence_1 = require("./confidence");
+Object.defineProperty(exports, "computeConfidence", { enumerable: true, get: function () { return confidence_1.computeConfidence; } });
+Object.defineProperty(exports, "computeBaseConfidence", { enumerable: true, get: function () { return confidence_1.computeBaseConfidence; } });
+Object.defineProperty(exports, "applyConfidenceCaps", { enumerable: true, get: function () { return confidence_1.applyConfidenceCaps; } });
+Object.defineProperty(exports, "capConfidence", { enumerable: true, get: function () { return confidence_1.capConfidence; } });
+Object.defineProperty(exports, "compareConfidence", { enumerable: true, get: function () { return confidence_1.compareConfidence; } });
+Object.defineProperty(exports, "minConfidence", { enumerable: true, get: function () { return confidence_1.minConfidence; } });
+Object.defineProperty(exports, "hasMockBoundaryOnPath", { enumerable: true, get: function () { return confidence_1.hasMockBoundaryOnPath; } });
+Object.defineProperty(exports, "hasPartialResolution", { enumerable: true, get: function () { return confidence_1.hasPartialResolution; } });
+Object.defineProperty(exports, "buildConfidenceEvidence", { enumerable: true, get: function () { return confidence_1.buildConfidenceEvidence; } });
+// ─── Orchestrator ────────────────────────────────────────────────────────────
+var orchestrator_1 = require("./orchestrator");
+Object.defineProperty(exports, "runPipeline", { enumerable: true, get: function () { return orchestrator_1.runPipeline; } });
+Object.defineProperty(exports, "createPipelineContext", { enumerable: true, get: function () { return orchestrator_1.createPipelineContext; } });
+// ─── Stage classes ───────────────────────────────────────────────────────────
+var scaStage_1 = require("./stages/sca/scaStage");
+Object.defineProperty(exports, "ScaStage", { enumerable: true, get: function () { return scaStage_1.ScaStage; } });
+var astStage_1 = require("./stages/ast/astStage");
+Object.defineProperty(exports, "AstStage", { enumerable: true, get: function () { return astStage_1.AstStage; } });
+var tiaStage_1 = require("./stages/tia/tiaStage");
+Object.defineProperty(exports, "TiaStage", { enumerable: true, get: function () { return tiaStage_1.TiaStage; } });
+var iastStage_1 = require("./stages/iast/iastStage");
+Object.defineProperty(exports, "IastStage", { enumerable: true, get: function () { return iastStage_1.IastStage; } });
+var dastStage_1 = require("./stages/dast/dastStage");
+Object.defineProperty(exports, "DastStage", { enumerable: true, get: function () { return dastStage_1.DastStage; } });
+var mergeStage_1 = require("./stages/merge/mergeStage");
+Object.defineProperty(exports, "MergeStage", { enumerable: true, get: function () { return mergeStage_1.MergeStage; } });

package/dist/src/pipeline/orchestrator.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pipeline orchestrator — chains the 6 stages (SCA → AST → TIA → IAST → DAST → Merge)
+ * and executes them in sequence, threading the PipelineContext through each stage.
+ *
+ * Optional stages (IAST, DAST) are skipped gracefully when disabled or when
+ * their data files are missing. The orchestrator catches per-stage errors
+ * and records them in diagnostics (RULE-02: never skip a file entirely on error).
+ */
+import type { PipelineConfig, PipelineContext } from './stageInterface';
+import type { PipelineOutput, StageName } from './types';
+/**
+ * Options for running the pipeline.
+ */
+export interface PipelineRunOptions {
+    /** Project root directory */
+    projectRoot: string;
+    /** Pipeline configuration (partial — defaults are merged) */
+    config?: Partial<Omit<PipelineConfig, 'projectRoot'>>;
+    /** If true, suppress console output */
+    silent?: boolean;
+}
+/**
+ * Result of a pipeline run.
+ */
+export interface PipelineRunResult {
+    output: PipelineOutput;
+    context: PipelineContext;
+    durationMs: number;
+    stagesDurationMs: Record<StageName, number>;
+}
+/**
+ * Run the full 6-stage coverage pipeline.
+ *
+ * @param options - Pipeline run options
+ * @returns PipelineRunResult with the final output, context, and timing information
+ */
+export declare function runPipeline(options: PipelineRunOptions): Promise<PipelineRunResult>;
+/**
+ * Create a pipeline context for testing or manual usage.
+ */
+export declare function createPipelineContext(projectRoot: string, configOverrides?: Partial<Omit<PipelineConfig, 'projectRoot'>>): PipelineContext;
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/src/pipeline/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../../src/pipeline/orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAiB,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAoB,MAAM,SAAS,CAAC;AAU3E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;IACtD,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoFzF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,GAC7D,eAAe,CAcjB"}

package/dist/src/pipeline/orchestrator.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * Pipeline orchestrator — chains the 6 stages (SCA → AST → TIA → IAST → DAST → Merge)
+ * and executes them in sequence, threading the PipelineContext through each stage.
+ *
+ * Optional stages (IAST, DAST) are skipped gracefully when disabled or when
+ * their data files are missing. The orchestrator catches per-stage errors
+ * and records them in diagnostics (RULE-02: never skip a file entirely on error).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPipeline = runPipeline;
+exports.createPipelineContext = createPipelineContext;
+const graph_1 = require("./graph");
+const stageInterface_1 = require("./stageInterface");
+const scaStage_1 = require("./stages/sca/scaStage");
+const astStage_1 = require("./stages/ast/astStage");
+const tiaStage_1 = require("./stages/tia/tiaStage");
+const iastStage_1 = require("./stages/iast/iastStage");
+const dastStage_1 = require("./stages/dast/dastStage");
+const mergeStage_1 = require("./stages/merge/mergeStage");
+/**
+ * Run the full 6-stage coverage pipeline.
+ *
+ * @param options - Pipeline run options
+ * @returns PipelineRunResult with the final output, context, and timing information
+ */
+async function runPipeline(options) {
+    const startTime = Date.now();
+    // Build full config with defaults
+    const config = {
+        projectRoot: options.projectRoot,
+        ...stageInterface_1.DEFAULT_PIPELINE_CONFIG,
+        ...options.config,
+    };
+    // Initialize context
+    const context = {
+        projectRoot: options.projectRoot,
+        config,
+        graph: new graph_1.CoverageKnowledgeGraph(),
+        diagnostics: new Map(),
+        stageOutputs: new Map(),
+    };
+    // Build stage pipeline
+    const stages = [
+        new scaStage_1.ScaStage(),
+        new astStage_1.AstStage(),
+        new tiaStage_1.TiaStage(),
+    ];
+    // IAST and DAST are optional
+    if (config.enableIast) {
+        stages.push(new iastStage_1.IastStage());
+    }
+    if (config.enableDast) {
+        stages.push(new dastStage_1.DastStage());
+    }
+    // Merge is always last
+    stages.push(new mergeStage_1.MergeStage());
+    const stagesDurationMs = {};
+    // Execute stages in sequence
+    for (const stage of stages) {
+        const stageStart = Date.now();
+        if (!options.silent) {
+            // Log stage name — caller can capture stdout if needed
+        }
+        try {
+            await stage.execute(context);
+        }
+        catch (err) {
+            // Record error in diagnostics but don't fail the pipeline for optional stages
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            if (!context.diagnostics.has(stage.name)) {
+                context.diagnostics.set(stage.name, {
+                    stageName: stage.name,
+                    filesScanned: [],
+                    filesSkipped: [],
+                    durationMs: Date.now() - stageStart,
+                    metadata: { error: errorMsg, failed: true },
+                });
+            }
+            if (!stage.optional) {
+                throw new Error(`Pipeline stage '${stage.name}' failed: ${errorMsg}`);
+            }
+            // Optional stages are swallowed — continue pipeline
+        }
+        stagesDurationMs[stage.name] = Date.now() - stageStart;
+    }
+    // Get the merge output
+    const mergeOutput = context.stageOutputs.get('merge');
+    if (!mergeOutput) {
+        throw new Error('Pipeline merge stage did not produce output');
+    }
+    return {
+        output: mergeOutput,
+        context,
+        durationMs: Date.now() - startTime,
+        stagesDurationMs: stagesDurationMs,
+    };
+}
+/**
+ * Create a pipeline context for testing or manual usage.
+ */
+function createPipelineContext(projectRoot, configOverrides) {
+    const config = {
+        projectRoot,
+        ...stageInterface_1.DEFAULT_PIPELINE_CONFIG,
+        ...configOverrides,
+    };
+    return {
+        projectRoot,
+        config,
+        graph: new graph_1.CoverageKnowledgeGraph(),
+        diagnostics: new Map(),
+        stageOutputs: new Map(),
+    };
+}

package/dist/src/pipeline/stageInterface.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pipeline stage interface and execution context.
+ *
+ * Every stage in the 6-stage pipeline (SCA → AST → TIA → IAST → DAST → Merge)
+ * implements `PipelineStage`. The `PipelineContext` is threaded through all
+ * stages and accumulates the knowledge graph, diagnostics, and stage outputs.
+ */
+import type { CoverageKnowledgeGraph } from './graph';
+import type { StageName, StageDiagnostics } from './types';
+import type { AstAnalysisConfig } from '../config/types';
+export interface PipelineConfig {
+    projectRoot: string;
+    enableIast: boolean;
+    enableDast: boolean;
+    /** DAST probing rate limit in requests/second. Default: 10. (RULE-17) */
+    dastRateLimit: number;
+    /** Abstract layer traversal depth cap. Default: 5. (RULE-05) */
+    traversalDepthCap: number;
+    /** Per-file timeout in ms. Default: 30000. (RULE-16) */
+    fileTimeoutMs: number;
+    /** Path to IAST events file. Default: 'iast-events.json' in project root. */
+    iastEventsPath?: string;
+    /** Path to DAST results file. Default: 'dast-results.json' in project root. */
+    dastResultsPath?: string;
+    /** Existing AST analysis config (passed through to analyzers). */
+    astConfig?: AstAnalysisConfig;
+}
+export declare const DEFAULT_PIPELINE_CONFIG: Omit<PipelineConfig, 'projectRoot'>;
+export interface PipelineContext {
+    projectRoot: string;
+    config: PipelineConfig;
+    graph: CoverageKnowledgeGraph;
+    diagnostics: Map<StageName, StageDiagnostics>;
+    /** Accumulated output from each completed stage. */
+    stageOutputs: Map<StageName, unknown>;
+}
+export interface PipelineStage<TOutput = unknown> {
+    /** Stage identifier. */
+    readonly name: StageName;
+    /** If true, the pipeline continues even if this stage is skipped or fails. */
+    readonly optional: boolean;
+    /** Execute the stage, enriching the context's graph and diagnostics. */
+    execute(context: PipelineContext): Promise<TOutput>;
+}
+//# sourceMappingURL=stageInterface.d.ts.map

package/dist/src/pipeline/stageInterface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stageInterface.d.ts","sourceRoot":"","sources":["../../../src/pipeline/stageInterface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIzD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAMvE,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,GAAG,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC9C,oDAAoD;IACpD,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACvC;AAID,MAAM,WAAW,aAAa,CAAC,OAAO,GAAG,OAAO;IAC9C,wBAAwB;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD"}

package/dist/src/pipeline/stageInterface.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Pipeline stage interface and execution context.
+ *
+ * Every stage in the 6-stage pipeline (SCA → AST → TIA → IAST → DAST → Merge)
+ * implements `PipelineStage`. The `PipelineContext` is threaded through all
+ * stages and accumulates the knowledge graph, diagnostics, and stage outputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PIPELINE_CONFIG = void 0;
+exports.DEFAULT_PIPELINE_CONFIG = {
+    enableIast: false,
+    enableDast: false,
+    dastRateLimit: 10,
+    traversalDepthCap: 5,
+    fileTimeoutMs: 30000,
+};

package/dist/src/pipeline/stages/ast/abstractLayerTraversal.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Abstract layer traversal — resolves inherited assertions, imported helpers,
+ * fixture injections, and page objects across the inheritance chain.
+ *
+ * Implements the spec's abstract layer resolution with a configurable depth cap
+ * (default 5, RULE-05). When the cap is reached, resolution is marked as 'partial'.
+ * Cycles are detected and broken (RULE-15).
+ */
+import type { CrossFileSymbolTable } from './types';
+import type { TraversalResult } from './types';
+/**
+ * Traverse the inheritance chain starting from a test class to resolve
+ * assertions, HTTP calls, and helper references from base classes.
+ *
+ * @param className - The test class/suite to start from
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth (RULE-05: default 5)
+ */
+export declare function traverseInheritanceChain(className: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+/**
+ * Resolve an imported helper function by following the import chain.
+ *
+ * @param functionName - The helper function to resolve
+ * @param fromFile - The file importing the helper
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+export declare function resolveImportedHelper(functionName: string, fromFile: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+/**
+ * Resolve fixture-injected assertions and HTTP calls.
+ * Traces @BeforeEach/beforeEach/pytest fixtures/@Autowired patterns.
+ *
+ * @param fixtureName - The fixture function name
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+export declare function resolveFixtureInjection(fixtureName: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+//# sourceMappingURL=abstractLayerTraversal.d.ts.map

package/dist/src/pipeline/stages/ast/abstractLayerTraversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstractLayerTraversal.d.ts","sourceRoot":"","sources":["../../../../../src/pipeline/stages/ast/abstractLayerTraversal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CA4EjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CA2EjB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CAuCjB"}