audit-tools 0.28.0

package/dist/shared/types/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,0DAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,sCAAoC,CAAC;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;IAKhC;;;;;;OAMG;;IAEH,0EAA0E;;;;;;;;;;;;;;;;EAE1E,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;IAEjC,mEAAmE;;;;;;;;EAEnE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGjC,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAErE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa;;;;;;IAMxB,gEAAgE;;;;;;;;QAzEhE;;;;;;WAMG;;QAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;IA2E1E,yDAAyD;;IAEzD;;;;OAIG;;IAEH;;;;OAIG;;;QAjEH,mEAAmE;;;;;;;;;IAmEnE;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA1CH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4CrE,4EAA4E;;IAE5E,iFAAiF;;IAEjF,0EAA0E;;IAE1E,+EAA+E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE/E,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CASjE;AAED,eAAO,MAAM,0BAA0B;;;;;;;;IAQrC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;QAzBpC;;;;;;;WAOG;;QAEH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA5IH,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;WAIG;;QAEH;;;;WAIG;;;YAjEH,mEAAmE;;;;;;;;;QAmEnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA1CH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoH/E;;;;OAIG;;;;;;;QA/JH,gEAAgE;;;;;;;;YAzEhE;;;;;;eAMG;;YAEH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;;QA2E1E,yDAAyD;;QAEzD;;;;WAIG;;QAEH;;;;WAIG;;;YAjEH,mEAAmE;;;;;;;;;QAmEnE;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA1CH,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CrE,4EAA4E;;QAE5E,iFAAiF;;QAEjF,0EAA0E;;QAE1E,+EAA+E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0H/E,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7E,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/shared/types/finding.js

@@ -0,0 +1,234 @@
+// Canonical machine contract for audit findings — the shape that flows from the
+// auditor's `audit-findings.json` into the remediator. Before Phase 0 `Finding`
+// was redefined in each package; this is the single source of truth. The
+// auditor narrows `lens` to its `Lens` union (via Omit) and the remediator uses
+// `Finding` directly. New optional fields (e.g. `theme_id`, added in Phase 6)
+// land here and propagate to both.
+//
+// A6: the contract is now defined ONCE as a zod schema; the TypeScript types are
+// `z.infer`red from it and the worker-facing JSON schema is generated from the
+// strict projection below (see `workerFindingSchema`). There is no longer a
+// hand-written JSON schema to drift from these types.
+import { z } from "zod";
+/** Canonical finding severity vocabulary (most-severe-first). */
+export const FindingSeveritySchema = z.enum([
+    "critical",
+    "high",
+    "medium",
+    "low",
+    "info",
+]);
+/** Canonical finding confidence vocabulary (most-confident-first). */
+export const FindingConfidenceSchema = z.enum(["high", "medium", "low"]);
+export const FindingLocationSchema = z.object({
+    path: z.string(),
+    line_start: z.number().int().optional(),
+    line_end: z.number().int().optional(),
+    symbol: z.string().optional(),
+    /**
+     * Verbatim text copied from this span, exactly as it appears in the cited
+     * file. The tool re-reads the file and content-matches this quote
+     * (whitespace/CRLF-normalized, matched on content not line numbers) to ground
+     * the finding; a finding whose quote does not re-verify is marked ungrounded
+     * (S7 anti-hallucination — grounding the claim, not attesting the read).
+     */
+    quoted_text: z.string().optional(),
+    /** Content hash of the file when the finding was planned (remediator). */
+    hash_at_plan_time: z.string().optional(),
+});
+/**
+ * Result of re-verifying a finding's cited verbatim span against disk. Attached
+ * by the auditor's grounding pass at ingest; a hallucinated or stale finding
+ * (quote not found on disk, or no quote provided) is surfaced as `ungrounded`
+ * rather than silently admitted as a confirmed finding.
+ *
+ * - `grounded`: the cited verbatim span re-verified against disk (S7 tier-1) or
+ *   an executable anchor CONFIRMED the behavior claim (tier-2). Admitted as fact.
+ * - `ungrounded`: the cited span did not re-verify, or no span was provided —
+ *   surfaced-but-not-confirmed. Stays in the admitted findings, flagged.
+ * - `refuted`: an executable anchor DISPROVED the claim (tier-2; e.g. a
+ *   madge-disproven cycle). Distinct from `ungrounded` ("couldn't verify"):
+ *   the tool actively disproved it, so it is quarantined-EXCLUDED from the
+ *   admitted contract (see `AuditFindingsReport.quarantined_findings`).
+ */
+export const FindingGroundingSchema = z.object({
+    status: z.enum(["grounded", "ungrounded", "refuted"]),
+    /** When ungrounded/refuted, which cited span(s) failed and why. */
+    reason: z.string().optional(),
+});
+/**
+ * What outcome of an executable anchor's command CONFIRMS the finding's claim.
+ * The worker declares the falsifiable condition; the tool runs the command and
+ * checks it, so the confirmed bit is the tool's run, never the model's word.
+ * `text` is required for the output_* kinds (the substring to look for).
+ */
+export const AnchorExpectationSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("exit_zero") }),
+    z.object({ kind: z.literal("exit_nonzero") }),
+    z.object({ kind: z.literal("output_includes"), text: z.string() }),
+    z.object({ kind: z.literal("output_excludes"), text: z.string() }),
+]);
+/**
+ * An executable anchor for a *behavior* claim ("throws" / "test fails" / "no
+ * cycle" / "unused symbol") — S7 tier-2. A read-only inspection command the tool
+ * runs to confirm or refute the claim; a refuting run quarantines the finding as
+ * ungrounded, exactly what disproved hallucinated cycle/symbol findings in the
+ * 452-self-audit. `command` is argv (run without a shell, from the repo root);
+ * the executable must be in the tool's inspection-only allowlist or the anchor is
+ * skipped (not auto-run). `confirm_if` is the falsifiable condition that, when
+ * the tool runs `command`, demonstrates the claim is true.
+ */
+export const ExecutableAnchorSchema = z.object({
+    command: z.array(z.string()).min(1),
+    confirm_if: AnchorExpectationSchema,
+    /** Optional human description of what running the command proves. */
+    claim: z.string().optional(),
+});
+export const FindingSchema = z.object({
+    id: z.string(),
+    title: z.string(),
+    category: z.string(),
+    severity: FindingSeveritySchema,
+    confidence: FindingConfidenceSchema,
+    /** Audit lens; the auditor narrows this to its `Lens` union. */
+    lens: z.string(),
+    summary: z.string(),
+    affected_files: z.array(FindingLocationSchema),
+    impact: z.string().optional(),
+    likelihood: z.string().optional(),
+    evidence: z.array(z.string()).optional(),
+    reproduction: z.array(z.string()).optional(),
+    systemic: z.boolean().optional(),
+    related_findings: z.array(z.string()).optional(),
+    /** Synthesis theme this finding belongs to (Phase 6). */
+    theme_id: z.string().optional(),
+    /**
+     * Whether at least one evidence entry cites a real repo path (and valid line)
+     * that exists on disk. Set by the remediator's deterministic grounding pass on
+     * LLM-extracted findings; absent on auditor-produced findings (already grounded).
+     */
+    evidence_grounded: z.boolean().optional(),
+    /**
+     * Result of the auditor's quote-and-verify grounding pass (S7): whether this
+     * finding's cited verbatim span re-verified against disk. Absent until the
+     * grounding pass runs at ingest.
+     */
+    grounding: FindingGroundingSchema.optional(),
+    /**
+     * Optional executable anchor for a behavior claim (S7 tier-2). The tool runs
+     * the read-only `command` at ingest and folds the verdict into `grounding`: a
+     * refuting run marks the finding ungrounded (quarantined) with the run as the
+     * reason, a confirming run grounds it; an inconclusive/skipped run leaves the
+     * quote-and-verify (tier-1) grounding in place. Absent for findings with no
+     * runnable behavior claim.
+     */
+    executable_anchor: ExecutableAnchorSchema.optional(),
+    /** Contract-pipeline goal this generated remediation finding belongs to. */
+    contract_goal_id: z.string().optional(),
+    /** Contract-pipeline obligation IDs this finding/task is intended to satisfy. */
+    contract_obligation_ids: z.array(z.string()).optional(),
+    /** Contract-pipeline verification obligation IDs this task must prove. */
+    verification_obligation_ids: z.array(z.string()).optional(),
+    /** Commands recommended by the implementation DAG for focused verification. */
+    targeted_commands: z.array(z.string()).optional(),
+});
+/** Report-level grouping of findings into parallelizable units of work. */
+export const WorkBlockSchema = z.object({
+    id: z.string(),
+    finding_ids: z.array(z.string()),
+    unit_ids: z.array(z.string()),
+    owned_files: z.array(z.string()),
+    max_severity: FindingSeveritySchema,
+    rationale: z.string(),
+    depends_on: z.array(z.string()),
+});
+/** A synthesis theme: a root cause spanning several findings (Phase 6). */
+export const FindingThemeSchema = z.object({
+    theme_id: z.string(),
+    title: z.string(),
+    root_cause: z.string(),
+    finding_ids: z.array(z.string()),
+    suggested_fix_pattern: z.string(),
+});
+/**
+ * The optional LLM synthesis-narrative payload (Phase 6). Produced by a single
+ * cached host/provider pass over the deterministic findings and merged into
+ * `audit-findings.json`. Omitted entirely when no provider is available.
+ */
+export const SynthesisNarrativeSchema = z.object({
+    themes: z.array(FindingThemeSchema),
+    executive_summary: z.string().optional(),
+    top_risks: z.array(z.string()).optional(),
+});
+/**
+ * Extract the canonical identity subset from a Finding, dropping any
+ * contract-pipeline overlay fields (contract_goal_id, contract_obligation_ids,
+ * verification_obligation_ids, targeted_commands). This is the stable,
+ * pipeline-portable representation of what a finding IS, separate from how it
+ * participates in a particular remediation run.
+ *
+ * INV-shared-core-05 invariant: the result must be derivable without knowing
+ * which contract-pipeline fields are present, and must round-trip through JSON
+ * without carrying any contract_* fields.
+ */
+export function findingIdentity(finding) {
+    return {
+        id: finding.id,
+        title: finding.title,
+        severity: finding.severity,
+        lens: finding.lens,
+        affected_files: finding.affected_files,
+        summary: finding.summary,
+    };
+}
+export const AuditFindingsSummarySchema = z.object({
+    finding_count: z.number(),
+    work_block_count: z.number(),
+    severity_breakdown: z.record(z.string(), z.number()),
+    audited_file_count: z.number(),
+    excluded_file_count: z.number(),
+    runtime_validation_status_breakdown: z.record(z.string(), z.number()),
+    lens_breakdown: z.record(z.string(), z.number()).optional(),
+    /**
+     * Per-status counts of the auditor's grounding pass (S7): `grounded`
+     * (re-verified against disk or anchor-confirmed), `ungrounded`
+     * (surfaced-but-not-confirmed), `refuted` (anchor-DISPROVED →
+     * quarantined-excluded). Counted over ALL findings incl. the
+     * quarantined-refuted ones, so a non-zero `refuted` reflects findings that were
+     * dropped from the admitted set. Absent when no finding carried a verdict.
+     */
+    grounding_status_breakdown: z.record(z.string(), z.number()).optional(),
+    /**
+     * Units/tasks stranded by a partial-completion terminal (empty-pool or
+     * livelock guard). Distinct from `budget_deferred_task_count` (planned
+     * deferrals) — these units could not be dispatched because the provider pool
+     * was exhausted before dispatch completed. Present only when a
+     * `partial_completion_terminal` was set on the active-dispatch artifact.
+     */
+    stranded_unit_count: z.number().optional(),
+});
+/**
+ * The canonical `audit-findings.json` contract. Deterministic fields are always
+ * present; narrative fields (themes/executive_summary/top_risks) are added by
+ * the optional Phase 6 synthesis-narrative pass and omitted without a provider.
+ */
+export const AuditFindingsReportSchema = z.object({
+    contract_version: z.string(),
+    summary: AuditFindingsSummarySchema,
+    findings: z.array(FindingSchema),
+    work_blocks: z.array(WorkBlockSchema),
+    /**
+     * Findings a tool-executable anchor REFUTED (S7 tier-2 disproof). Recorded here
+     * but kept OUT of `findings`/`work_blocks` so a disproven claim never merges as
+     * actionable fact — quarantine, not delete. Absent when nothing was refuted.
+     */
+    quarantined_findings: z.array(FindingSchema).optional(),
+    /** Paths excluded from the audit per the intent checkpoint, with reasons. */
+    excluded_scope: z
+        .array(z.object({ path: z.string(), reason: z.string() }))
+        .optional(),
+    themes: z.array(FindingThemeSchema).optional(),
+    executive_summary: z.string().optional(),
+    top_risks: z.array(z.string()).optional(),
+});
+//# sourceMappingURL=finding.js.map

package/dist/shared/types/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../../src/shared/types/finding.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,4EAA4E;AAC5E,sDAAsD;AAEtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,uBAAuB;IACnC,qEAAqE;IACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,uBAAuB;IACnC,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,yDAAyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iFAAiF;IACjF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,0EAA0E;IAC1E,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,+EAA+E;IAC/E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;CAClC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAoBH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,mCAAmC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;;OAMG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,OAAO,EAAE,0BAA0B;IACnC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACvD,6EAA6E;IAC7E,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACzD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}

package/dist/shared/types/flows.d.ts

@@ -0,0 +1,84 @@
+import { z } from "zod";
+export declare const FlowConfidenceLevelSchema: z.ZodEnum<["high", "low"]>;
+export declare const FLOW_CONFIDENCE_LEVELS: ["high", "low"];
+export type FlowConfidenceLevel = z.infer<typeof FlowConfidenceLevelSchema>;
+/** A critical user or system flow that must be covered by the audit. */
+export declare const CriticalFlowSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    entrypoints: z.ZodArray<z.ZodString, "many">;
+    paths: z.ZodArray<z.ZodString, "many">;
+    concerns: z.ZodArray<z.ZodString, "many">;
+    confidence: z.ZodOptional<z.ZodEnum<["high", "low"]>>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    name: string;
+    entrypoints: string[];
+    paths: string[];
+    concerns: string[];
+    notes?: string[] | undefined;
+    confidence?: "high" | "low" | undefined;
+}, {
+    id: string;
+    name: string;
+    entrypoints: string[];
+    paths: string[];
+    concerns: string[];
+    notes?: string[] | undefined;
+    confidence?: "high" | "low" | undefined;
+}>;
+export type CriticalFlow = z.infer<typeof CriticalFlowSchema>;
+/** The set of critical flows inferred from intake artifacts. */
+export declare const CriticalFlowManifestSchema: z.ZodObject<{
+    flows: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        entrypoints: z.ZodArray<z.ZodString, "many">;
+        paths: z.ZodArray<z.ZodString, "many">;
+        concerns: z.ZodArray<z.ZodString, "many">;
+        confidence: z.ZodOptional<z.ZodEnum<["high", "low"]>>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        name: string;
+        entrypoints: string[];
+        paths: string[];
+        concerns: string[];
+        notes?: string[] | undefined;
+        confidence?: "high" | "low" | undefined;
+    }, {
+        id: string;
+        name: string;
+        entrypoints: string[];
+        paths: string[];
+        concerns: string[];
+        notes?: string[] | undefined;
+        confidence?: "high" | "low" | undefined;
+    }>, "many">;
+    fallback_required: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    flows: {
+        id: string;
+        name: string;
+        entrypoints: string[];
+        paths: string[];
+        concerns: string[];
+        notes?: string[] | undefined;
+        confidence?: "high" | "low" | undefined;
+    }[];
+    fallback_required?: boolean | undefined;
+}, {
+    flows: {
+        id: string;
+        name: string;
+        entrypoints: string[];
+        paths: string[];
+        concerns: string[];
+        notes?: string[] | undefined;
+        confidence?: "high" | "low" | undefined;
+    }[];
+    fallback_required?: boolean | undefined;
+}>;
+export type CriticalFlowManifest = z.infer<typeof CriticalFlowManifestSchema>;
+//# sourceMappingURL=flows.d.ts.map

package/dist/shared/types/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../../src/shared/types/flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,yBAAyB,4BAA0B,CAAC;AACjE,eAAO,MAAM,sBAAsB,iBAAoC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,wEAAwE;AACxE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;EAUpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/shared/types/flows.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+export const FlowConfidenceLevelSchema = z.enum(["high", "low"]);
+export const FLOW_CONFIDENCE_LEVELS = FlowConfidenceLevelSchema.options;
+/** A critical user or system flow that must be covered by the audit. */
+export const CriticalFlowSchema = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    entrypoints: z.array(z.string()),
+    paths: z.array(z.string()),
+    concerns: z.array(z.string()),
+    confidence: FlowConfidenceLevelSchema.optional(),
+    notes: z.array(z.string()).optional(),
+})
+    .strict();
+/** The set of critical flows inferred from intake artifacts. */
+export const CriticalFlowManifestSchema = z
+    .object({
+    flows: z.array(CriticalFlowSchema),
+    fallback_required: z.boolean().optional(),
+})
+    .strict();
+//# sourceMappingURL=flows.js.map

package/dist/shared/types/flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.js","sourceRoot":"","sources":["../../../src/shared/types/flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,OAAO,CAAC;AAGxE,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,gEAAgE;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAClC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC"}