api-tests-coverage 1.0.13 → 1.0.14

package/dist/src/pipeline/orchestrator.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * Pipeline orchestrator — chains the 6 stages (SCA → AST → TIA → IAST → DAST → Merge)
+ * and executes them in sequence, threading the PipelineContext through each stage.
+ *
+ * Optional stages (IAST, DAST) are skipped gracefully when disabled or when
+ * their data files are missing. The orchestrator catches per-stage errors
+ * and records them in diagnostics (RULE-02: never skip a file entirely on error).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPipeline = runPipeline;
+exports.createPipelineContext = createPipelineContext;
+const graph_1 = require("./graph");
+const stageInterface_1 = require("./stageInterface");
+const scaStage_1 = require("./stages/sca/scaStage");
+const astStage_1 = require("./stages/ast/astStage");
+const tiaStage_1 = require("./stages/tia/tiaStage");
+const iastStage_1 = require("./stages/iast/iastStage");
+const dastStage_1 = require("./stages/dast/dastStage");
+const mergeStage_1 = require("./stages/merge/mergeStage");
+/**
+ * Run the full 6-stage coverage pipeline.
+ *
+ * @param options - Pipeline run options
+ * @returns PipelineRunResult with the final output, context, and timing information
+ */
+async function runPipeline(options) {
+    const startTime = Date.now();
+    // Build full config with defaults
+    const config = {
+        projectRoot: options.projectRoot,
+        ...stageInterface_1.DEFAULT_PIPELINE_CONFIG,
+        ...options.config,
+    };
+    // Initialize context
+    const context = {
+        projectRoot: options.projectRoot,
+        config,
+        graph: new graph_1.CoverageKnowledgeGraph(),
+        diagnostics: new Map(),
+        stageOutputs: new Map(),
+    };
+    // Build stage pipeline
+    const stages = [
+        new scaStage_1.ScaStage(),
+        new astStage_1.AstStage(),
+        new tiaStage_1.TiaStage(),
+    ];
+    // IAST and DAST are optional
+    if (config.enableIast) {
+        stages.push(new iastStage_1.IastStage());
+    }
+    if (config.enableDast) {
+        stages.push(new dastStage_1.DastStage());
+    }
+    // Merge is always last
+    stages.push(new mergeStage_1.MergeStage());
+    const stagesDurationMs = {};
+    // Execute stages in sequence
+    for (const stage of stages) {
+        const stageStart = Date.now();
+        if (!options.silent) {
+            // Log stage name — caller can capture stdout if needed
+        }
+        try {
+            await stage.execute(context);
+        }
+        catch (err) {
+            // Record error in diagnostics but don't fail the pipeline for optional stages
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            if (!context.diagnostics.has(stage.name)) {
+                context.diagnostics.set(stage.name, {
+                    stageName: stage.name,
+                    filesScanned: [],
+                    filesSkipped: [],
+                    durationMs: Date.now() - stageStart,
+                    metadata: { error: errorMsg, failed: true },
+                });
+            }
+            if (!stage.optional) {
+                throw new Error(`Pipeline stage '${stage.name}' failed: ${errorMsg}`);
+            }
+            // Optional stages are swallowed — continue pipeline
+        }
+        stagesDurationMs[stage.name] = Date.now() - stageStart;
+    }
+    // Get the merge output
+    const mergeOutput = context.stageOutputs.get('merge');
+    if (!mergeOutput) {
+        throw new Error('Pipeline merge stage did not produce output');
+    }
+    return {
+        output: mergeOutput,
+        context,
+        durationMs: Date.now() - startTime,
+        stagesDurationMs: stagesDurationMs,
+    };
+}
+/**
+ * Create a pipeline context for testing or manual usage.
+ */
+function createPipelineContext(projectRoot, configOverrides) {
+    const config = {
+        projectRoot,
+        ...stageInterface_1.DEFAULT_PIPELINE_CONFIG,
+        ...configOverrides,
+    };
+    return {
+        projectRoot,
+        config,
+        graph: new graph_1.CoverageKnowledgeGraph(),
+        diagnostics: new Map(),
+        stageOutputs: new Map(),
+    };
+}

package/dist/src/pipeline/stageInterface.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pipeline stage interface and execution context.
+ *
+ * Every stage in the 6-stage pipeline (SCA → AST → TIA → IAST → DAST → Merge)
+ * implements `PipelineStage`. The `PipelineContext` is threaded through all
+ * stages and accumulates the knowledge graph, diagnostics, and stage outputs.
+ */
+import type { CoverageKnowledgeGraph } from './graph';
+import type { StageName, StageDiagnostics } from './types';
+import type { AstAnalysisConfig } from '../config/types';
+export interface PipelineConfig {
+    projectRoot: string;
+    enableIast: boolean;
+    enableDast: boolean;
+    /** DAST probing rate limit in requests/second. Default: 10. (RULE-17) */
+    dastRateLimit: number;
+    /** Abstract layer traversal depth cap. Default: 5. (RULE-05) */
+    traversalDepthCap: number;
+    /** Per-file timeout in ms. Default: 30000. (RULE-16) */
+    fileTimeoutMs: number;
+    /** Path to IAST events file. Default: 'iast-events.json' in project root. */
+    iastEventsPath?: string;
+    /** Path to DAST results file. Default: 'dast-results.json' in project root. */
+    dastResultsPath?: string;
+    /** Existing AST analysis config (passed through to analyzers). */
+    astConfig?: AstAnalysisConfig;
+}
+export declare const DEFAULT_PIPELINE_CONFIG: Omit<PipelineConfig, 'projectRoot'>;
+export interface PipelineContext {
+    projectRoot: string;
+    config: PipelineConfig;
+    graph: CoverageKnowledgeGraph;
+    diagnostics: Map<StageName, StageDiagnostics>;
+    /** Accumulated output from each completed stage. */
+    stageOutputs: Map<StageName, unknown>;
+}
+export interface PipelineStage<TOutput = unknown> {
+    /** Stage identifier. */
+    readonly name: StageName;
+    /** If true, the pipeline continues even if this stage is skipped or fails. */
+    readonly optional: boolean;
+    /** Execute the stage, enriching the context's graph and diagnostics. */
+    execute(context: PipelineContext): Promise<TOutput>;
+}
+//# sourceMappingURL=stageInterface.d.ts.map

package/dist/src/pipeline/stageInterface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stageInterface.d.ts","sourceRoot":"","sources":["../../../src/pipeline/stageInterface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIzD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAMvE,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,GAAG,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC9C,oDAAoD;IACpD,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACvC;AAID,MAAM,WAAW,aAAa,CAAC,OAAO,GAAG,OAAO;IAC9C,wBAAwB;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD"}

package/dist/src/pipeline/stageInterface.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Pipeline stage interface and execution context.
+ *
+ * Every stage in the 6-stage pipeline (SCA → AST → TIA → IAST → DAST → Merge)
+ * implements `PipelineStage`. The `PipelineContext` is threaded through all
+ * stages and accumulates the knowledge graph, diagnostics, and stage outputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PIPELINE_CONFIG = void 0;
+exports.DEFAULT_PIPELINE_CONFIG = {
+    enableIast: false,
+    enableDast: false,
+    dastRateLimit: 10,
+    traversalDepthCap: 5,
+    fileTimeoutMs: 30000,
+};

package/dist/src/pipeline/stages/ast/abstractLayerTraversal.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Abstract layer traversal — resolves inherited assertions, imported helpers,
+ * fixture injections, and page objects across the inheritance chain.
+ *
+ * Implements the spec's abstract layer resolution with a configurable depth cap
+ * (default 5, RULE-05). When the cap is reached, resolution is marked as 'partial'.
+ * Cycles are detected and broken (RULE-15).
+ */
+import type { CrossFileSymbolTable } from './types';
+import type { TraversalResult } from './types';
+/**
+ * Traverse the inheritance chain starting from a test class to resolve
+ * assertions, HTTP calls, and helper references from base classes.
+ *
+ * @param className - The test class/suite to start from
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth (RULE-05: default 5)
+ */
+export declare function traverseInheritanceChain(className: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+/**
+ * Resolve an imported helper function by following the import chain.
+ *
+ * @param functionName - The helper function to resolve
+ * @param fromFile - The file importing the helper
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+export declare function resolveImportedHelper(functionName: string, fromFile: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+/**
+ * Resolve fixture-injected assertions and HTTP calls.
+ * Traces @BeforeEach/beforeEach/pytest fixtures/@Autowired patterns.
+ *
+ * @param fixtureName - The fixture function name
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+export declare function resolveFixtureInjection(fixtureName: string, table: CrossFileSymbolTable, depthCap?: number): TraversalResult;
+//# sourceMappingURL=abstractLayerTraversal.d.ts.map

package/dist/src/pipeline/stages/ast/abstractLayerTraversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstractLayerTraversal.d.ts","sourceRoot":"","sources":["../../../../../src/pipeline/stages/ast/abstractLayerTraversal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CA4EjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CA2EjB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,GAAE,MAAU,GACnB,eAAe,CAuCjB"}

package/dist/src/pipeline/stages/ast/abstractLayerTraversal.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * Abstract layer traversal — resolves inherited assertions, imported helpers,
+ * fixture injections, and page objects across the inheritance chain.
+ *
+ * Implements the spec's abstract layer resolution with a configurable depth cap
+ * (default 5, RULE-05). When the cap is reached, resolution is marked as 'partial'.
+ * Cycles are detected and broken (RULE-15).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.traverseInheritanceChain = traverseInheritanceChain;
+exports.resolveImportedHelper = resolveImportedHelper;
+exports.resolveFixtureInjection = resolveFixtureInjection;
+/**
+ * Traverse the inheritance chain starting from a test class to resolve
+ * assertions, HTTP calls, and helper references from base classes.
+ *
+ * @param className - The test class/suite to start from
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth (RULE-05: default 5)
+ */
+function traverseInheritanceChain(className, table, depthCap = 5) {
+    const visited = new Set();
+    const resolvedAssertions = [];
+    const resolvedHttpCalls = [];
+    const unresolvedChain = [];
+    let maxDepth = 0;
+    let cycleDetected = false;
+    function traverse(name, depth) {
+        var _a;
+        if (depth > depthCap) {
+            unresolvedChain.push(`${name} (depth cap ${depthCap} reached)`);
+            return;
+        }
+        if (visited.has(name)) {
+            cycleDetected = true;
+            unresolvedChain.push(`${name} (cycle detected)`);
+            return;
+        }
+        visited.add(name);
+        maxDepth = Math.max(maxDepth, depth);
+        // Find the class declaration
+        const classDecl = table.classes.get(name);
+        if (!classDecl) {
+            if (depth > 0) {
+                unresolvedChain.push(`${name} (class not found)`);
+            }
+            return;
+        }
+        // Get the semantic model for this class's file
+        const model = table.models.get(classDecl.filePath);
+        if (!model) {
+            unresolvedChain.push(`${name} (model not found for ${classDecl.filePath})`);
+            return;
+        }
+        // Collect assertions from this class's model
+        for (const assertion of model.assertions) {
+            resolvedAssertions.push(assertion);
+        }
+        // Collect HTTP calls from this class's functions
+        for (const methodName of classDecl.methods) {
+            const func = (_a = model.functions.get(methodName)) !== null && _a !== void 0 ? _a : model.functions.get(`${name}.${methodName}`);
+            if (func) {
+                resolvedHttpCalls.push(...func.bodyHttpCalls);
+            }
+        }
+        // Recurse into base class
+        if (classDecl.extendsClass) {
+            traverse(classDecl.extendsClass, depth + 1);
+        }
+    }
+    traverse(className, 0);
+    const resolution = unresolvedChain.length > 0 ? 'partial' : 'full';
+    const assertionSource = maxDepth === 0
+        ? 'direct'
+        : resolvedAssertions.length > 0
+            ? 'inherited'
+            : 'unresolved';
+    return {
+        resolvedAssertions,
+        resolvedHttpCalls,
+        assertionSource,
+        traversalDepth: maxDepth,
+        resolution,
+        unresolvedChain: unresolvedChain.length > 0 ? unresolvedChain : undefined,
+        cycleDetected,
+    };
+}
+/**
+ * Resolve an imported helper function by following the import chain.
+ *
+ * @param functionName - The helper function to resolve
+ * @param fromFile - The file importing the helper
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+function resolveImportedHelper(functionName, fromFile, table, depthCap = 5) {
+    const visited = new Set();
+    const resolvedAssertions = [];
+    const resolvedHttpCalls = [];
+    const unresolvedChain = [];
+    let maxDepth = 0;
+    let cycleDetected = false;
+    function resolve(funcName, file, depth) {
+        var _a;
+        if (depth > depthCap) {
+            unresolvedChain.push(`${funcName} in ${file} (depth cap reached)`);
+            return;
+        }
+        const key = `${file}::${funcName}`;
+        if (visited.has(key)) {
+            cycleDetected = true;
+            unresolvedChain.push(`${funcName} in ${file} (cycle detected)`);
+            return;
+        }
+        visited.add(key);
+        maxDepth = Math.max(maxDepth, depth);
+        const model = table.models.get(file);
+        if (!model) {
+            unresolvedChain.push(`${funcName} (model not found for ${file})`);
+            return;
+        }
+        // Find the function in the model
+        const func = model.functions.get(funcName);
+        if (!func) {
+            // Try imported files
+            const importedFiles = (_a = table.importGraph.get(file)) !== null && _a !== void 0 ? _a : [];
+            for (const importedFile of importedFiles) {
+                const importedModel = table.models.get(importedFile);
+                if (importedModel === null || importedModel === void 0 ? void 0 : importedModel.functions.has(funcName)) {
+                    resolve(funcName, importedFile, depth + 1);
+                    return;
+                }
+            }
+            unresolvedChain.push(`${funcName} (function not found in ${file})`);
+            return;
+        }
+        // Collect HTTP calls from this function
+        resolvedHttpCalls.push(...func.bodyHttpCalls);
+        // Collect any assertions from the model that relate to this function
+        for (const assertion of model.assertions) {
+            resolvedAssertions.push(assertion);
+        }
+        // Follow called functions recursively
+        for (const calledFunc of func.calledFunctions) {
+            resolve(calledFunc, file, depth + 1);
+        }
+    }
+    resolve(functionName, fromFile, 0);
+    const resolution = unresolvedChain.length > 0 ? 'partial' : 'full';
+    const assertionSource = resolvedAssertions.length > 0 ? 'helper' : 'unresolved';
+    return {
+        resolvedAssertions,
+        resolvedHttpCalls,
+        assertionSource,
+        traversalDepth: maxDepth,
+        resolution,
+        unresolvedChain: unresolvedChain.length > 0 ? unresolvedChain : undefined,
+        cycleDetected,
+    };
+}
+/**
+ * Resolve fixture-injected assertions and HTTP calls.
+ * Traces @BeforeEach/beforeEach/pytest fixtures/@Autowired patterns.
+ *
+ * @param fixtureName - The fixture function name
+ * @param table - The cross-file symbol table
+ * @param depthCap - Maximum traversal depth
+ */
+function resolveFixtureInjection(fixtureName, table, depthCap = 5) {
+    const resolvedAssertions = [];
+    const resolvedHttpCalls = [];
+    const unresolvedChain = [];
+    let maxDepth = 0;
+    let found = false;
+    // Search all models for the fixture function
+    for (const [filePath, model] of table.models) {
+        const func = model.functions.get(fixtureName);
+        if (!func)
+            continue;
+        found = true;
+        maxDepth = 1;
+        // Collect HTTP calls from the fixture
+        resolvedHttpCalls.push(...func.bodyHttpCalls);
+        // Check if fixture has assertions
+        for (const assertion of model.assertions) {
+            resolvedAssertions.push(assertion);
+        }
+        break; // Use first match
+    }
+    if (!found) {
+        unresolvedChain.push(`${fixtureName} (fixture not found)`);
+    }
+    return {
+        resolvedAssertions,
+        resolvedHttpCalls,
+        assertionSource: found ? 'fixture' : 'unresolved',
+        traversalDepth: maxDepth,
+        resolution: found ? 'full' : 'partial',
+        unresolvedChain: unresolvedChain.length > 0 ? unresolvedChain : undefined,
+        cycleDetected: false,
+    };
+}

package/dist/src/pipeline/stages/ast/astStage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AST Stage — Stage 2 of the coverage pipeline.
+ *
+ * Wraps the existing AST analysis orchestrator and extends it with:
+ * - Multi-file analysis: parses all discovered files and builds a cross-file symbol table
+ * - Abstract layer traversal: resolves inherited assertions, helpers, fixtures
+ * - Graph building: converts analysis results into GraphNode[] and GraphEdge[]
+ *
+ * The AST stage reads the SCA output (from context.stageOutputs) to determine
+ * which languages and frameworks are present, enabling targeted analysis heuristics.
+ */
+import type { PipelineStage, PipelineContext } from '../../stageInterface';
+import type { AstStageOutput } from './types';
+export declare class AstStage implements PipelineStage<AstStageOutput> {
+    readonly name: "ast";
+    readonly optional = false;
+    execute(context: PipelineContext): Promise<AstStageOutput>;
+}
+//# sourceMappingURL=astStage.d.ts.map

package/dist/src/pipeline/stages/ast/astStage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astStage.d.ts","sourceRoot":"","sources":["../../../../../src/pipeline/stages/ast/astStage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAkB9C,qBAAa,QAAS,YAAW,aAAa,CAAC,cAAc,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,QAAQ,CAAC,QAAQ,SAAS;IAEpB,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;CAyKjE"}