audit-tools 0.28.0

package/audit-code-wrapper-opencode.mjs

@@ -0,0 +1,241 @@
+// Best-effort import of shared OpenCode permission helpers.
+// On a fresh checkout before `npm run build`, the dist may not exist yet;
+// buildMergedOpenCodeProjectConfig throws a clear error in that case.
+let mergeOpenCodeAgentPermissionRule;
+let withoutOpenCodeWildcard;
+let migrateOpenCodeGlobalExternalDirectory;
+export let sharedOpenCodePermissions = false;
+
+try {
+  const shared = await import('audit-tools/shared');
+  mergeOpenCodeAgentPermissionRule = shared.mergeOpenCodeAgentPermissionRule;
+  withoutOpenCodeWildcard = shared.withoutOpenCodeWildcard;
+  migrateOpenCodeGlobalExternalDirectory = shared.migrateOpenCodeGlobalExternalDirectory;
+  sharedOpenCodePermissions = true;
+} catch {
+  // shared not yet built — callers that need merge logic will throw below
+}
+
+export const OPENCODE_AUDIT_EDIT_PERMISSION = {
+  '*': 'ask',
+  '.audit-code/**': 'allow',
+  '.audit-tools/**': 'allow',
+};
+
+export const OPENCODE_AUDIT_EXTERNAL_DIRECTORY_PERMISSION = { '*': 'allow' };
+
+// Subcommands allowed for both the global bin and the dev wrapper.
+// Adding or removing a subcommand here applies to both invocation forms.
+const AUDIT_CODE_ALLOWED_SUBCOMMANDS = [
+  'ensure*',
+  'next-step*',
+  'prepare-dispatch*',
+  'submit-packet*',
+  'merge-and-ingest*',
+  'validate*',
+];
+// Extra subcommands that only make sense via the dev wrapper (not the global bin).
+const AUDIT_CODE_WRAPPER_EXTRA_SUBCOMMANDS = ['worker-run*'];
+// Subcommands denied for every invocation form.
+const AUDIT_CODE_DENIED_SUBCOMMANDS = ['synthesize*', 'cleanup*', 'requeue*', 'ingest-results*'];
+
+function buildAuditBashPermissions() {
+  /** @type {Record<string, 'allow' | 'deny'>} */
+  const perm = { '*': 'allow' };
+  // Deny rules for every form of invocation (bin, dist, wrapper).
+  for (const sub of AUDIT_CODE_DENIED_SUBCOMMANDS) {
+    perm[`audit-code ${sub}`] = 'deny';
+    perm[`*dist*index.js* ${sub}`] = 'deny';
+    perm[`*audit-code.mjs* ${sub}`] = 'deny';
+  }
+  // Allow rules: bare bin and each subcommand for both the global bin and wrapper.
+  perm['audit-code'] = 'allow';
+  for (const sub of AUDIT_CODE_ALLOWED_SUBCOMMANDS) {
+    perm[`audit-code ${sub}`] = 'allow';
+    perm[`*audit-code.mjs* ${sub}`] = 'allow';
+  }
+  perm['*audit-code.mjs'] = 'allow';
+  for (const sub of AUDIT_CODE_WRAPPER_EXTRA_SUBCOMMANDS) {
+    perm[`*audit-code.mjs* ${sub}`] = 'allow';
+  }
+  perm['*node* *auditor-lambda*dist*index.js* worker-run*'] = 'allow';
+  perm['git status*'] = 'allow';
+  perm['git diff*'] = 'allow';
+  perm['grep *'] = 'allow';
+  perm['Select-String *'] = 'allow';
+  perm['rm *'] = 'deny';
+  return perm;
+}
+
+export const OPENCODE_AUDIT_BASH_PERMISSION = buildAuditBashPermissions();
+
+function externalDirectoryPattern(path) {
+  return `${path.replace(/\\/g, '/').replace(/\/+$/u, '')}/**`;
+}
+
+function renderOpenCodeExternalDirectoryPermission() {
+  return { '*': 'allow' };
+}
+
+export function renderOpenCodePermissionConfig() {
+  return {
+    read: 'allow',
+    glob: 'allow',
+    grep: 'allow',
+    external_directory: renderOpenCodeExternalDirectoryPermission(),
+    edit: { ...OPENCODE_AUDIT_EDIT_PERMISSION },
+    bash: { ...OPENCODE_AUDIT_BASH_PERMISSION },
+  };
+}
+
+export function renderOpenCodeProjectConfig(_root) {
+  const auditPermission = renderOpenCodePermissionConfig();
+  return {
+    $schema: 'https://opencode.ai/config.json',
+    permission: auditPermission,
+    agent: {
+      auditor: {
+        description:
+          'Read-heavy audit orchestration agent for the /audit-code workflow.',
+        permission: {
+          ...auditPermission,
+          'auditor_*': 'allow',
+          question: 'allow',
+          task: 'allow',
+        },
+      },
+    },
+  };
+}
+
+function objectValue(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value
+    : {};
+}
+
+export function removeManagedOpenCodeCommand(commandConfig) {
+  const command = objectValue(commandConfig);
+  const { 'audit-code': _managedAuditCodeCommand, ...remaining } = command;
+  return remaining;
+}
+
+export function assertOpenCodeAuditPermissionConfig(permissionConfig, label) {
+  for (const tool of ['read', 'glob', 'grep']) {
+    if (permissionConfig?.[tool] !== 'allow') {
+      throw new Error(`OpenCode ${label}.${tool} must be allow. Run "audit-code install --host opencode".`);
+    }
+  }
+  const externalDirectory = permissionConfig?.external_directory;
+  if (!externalDirectory || typeof externalDirectory !== 'object' || Array.isArray(externalDirectory)) {
+    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "audit-code install --host opencode".`);
+  }
+  if (externalDirectory['*'] !== 'allow') {
+    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "audit-code install --host opencode".`);
+  }
+  const edit = permissionConfig?.edit;
+  const bash = permissionConfig?.bash;
+  if (!edit || typeof edit !== 'object' || Array.isArray(edit)) {
+    throw new Error(`OpenCode ${label}.edit must allow audit-owned file paths. Run "audit-code install --host opencode".`);
+  }
+  for (const pattern of ['.audit-code/**', '.audit-tools/**']) {
+    if (edit[pattern] !== 'allow') {
+      throw new Error(`OpenCode ${label}.edit must allow ${pattern}. Run "audit-code install --host opencode".`);
+    }
+  }
+  if (!bash || typeof bash !== 'object' || Array.isArray(bash)) {
+    throw new Error(`OpenCode ${label}.bash must allow audit-code commands. Run "audit-code install --host opencode".`);
+  }
+  for (const pattern of [
+    'audit-code',
+    'audit-code ensure*',
+    'audit-code next-step*',
+    'audit-code prepare-dispatch*',
+    'audit-code submit-packet*',
+    'audit-code merge-and-ingest*',
+    '*audit-code.mjs',
+    '*audit-code.mjs* next-step*',
+    '*audit-code.mjs* submit-packet*',
+    '*audit-code.mjs* merge-and-ingest*',
+    '*audit-code.mjs* worker-run*',
+    '*node* *auditor-lambda*dist*index.js* worker-run*',
+  ]) {
+    if (bash[pattern] !== 'allow') {
+      throw new Error(`OpenCode ${label}.bash must allow ${pattern}. Run "audit-code install --host opencode".`);
+    }
+  }
+  for (const pattern of [
+    'audit-code synthesize*',
+    'audit-code cleanup*',
+    'audit-code requeue*',
+    'audit-code ingest-results*',
+    '*dist*index.js* synthesize*',
+    '*dist*index.js* cleanup*',
+    '*dist*index.js* requeue*',
+    '*dist*index.js* ingest-results*',
+    '*audit-code.mjs* synthesize*',
+    '*audit-code.mjs* cleanup*',
+    '*audit-code.mjs* requeue*',
+    '*audit-code.mjs* ingest-results*',
+  ]) {
+    if (bash[pattern] !== 'deny') {
+      throw new Error(`OpenCode ${label}.bash must deny ${pattern}. Run "audit-code install --host opencode".`);
+    }
+  }
+}
+
+function mergePermissionBlock(existingPermission, generatedPermission) {
+  const existing = objectValue(existingPermission);
+  return {
+    ...generatedPermission,
+    ...existing,
+    read: generatedPermission.read,
+    glob: generatedPermission.glob,
+    grep: generatedPermission.grep,
+    external_directory: mergeOpenCodeAgentPermissionRule(
+      existing.external_directory,
+      generatedPermission.external_directory,
+      OPENCODE_AUDIT_EXTERNAL_DIRECTORY_PERMISSION,
+    ),
+    edit: mergeOpenCodeAgentPermissionRule(
+      existing.edit,
+      generatedPermission.edit,
+      withoutOpenCodeWildcard(OPENCODE_AUDIT_EDIT_PERMISSION),
+    ),
+    bash: mergeOpenCodeAgentPermissionRule(
+      existing.bash,
+      generatedPermission.bash,
+      withoutOpenCodeWildcard(OPENCODE_AUDIT_BASH_PERMISSION),
+    ),
+  };
+}
+
+export function buildMergedOpenCodeProjectConfig(existing, root) {
+  if (!sharedOpenCodePermissions) {
+    throw new Error(
+      'audit-tools/shared is not available. Run "npm run build -w audit-tools/shared" before deploying OpenCode config.',
+    );
+  }
+  const generated = renderOpenCodeProjectConfig(root);
+  const mergedMcp = objectValue(existing.mcp);
+  delete mergedMcp.auditor;
+  const existingAuditor = objectValue(objectValue(existing.agent).auditor);
+  return {
+    ...existing,
+    $schema: existing.$schema ?? generated.$schema,
+    command: removeManagedOpenCodeCommand(existing.command),
+    mcp: mergedMcp,
+    permission: mergePermissionBlock(existing.permission, generated.permission),
+    agent: {
+      ...objectValue(existing.agent),
+      auditor: {
+        ...existingAuditor,
+        ...generated.agent.auditor,
+        permission: mergePermissionBlock(
+          existingAuditor.permission,
+          generated.agent.auditor.permission,
+        ),
+      },
+    },
+  };
+}

package/audit-code.mjs

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+
+import { runAuditCodeWrapper } from "./audit-code-wrapper-lib.mjs";
+
+try {
+  await runAuditCodeWrapper({
+    usageName: "audit-code.mjs",
+  });
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}

package/dispatch/lens-definitions.json

@@ -0,0 +1,46 @@
+{
+  "correctness": {
+    "description": "Logic errors, incorrect algorithm implementations, off-by-one bugs, type mismatches, wrong return values, incorrect state transitions, missing null/undefined guards, misuse of APIs. Focus on code that does the wrong thing.",
+    "do_not_report": "Style issues, naming problems, missing tests, or findings that belong to other lenses."
+  },
+  "maintainability": {
+    "description": "Code that is hard to change safely: excessive function length, deep nesting, tight coupling between unrelated modules, poor naming, magic constants, duplicated logic, inconsistent abstractions, unclear public APIs.",
+    "do_not_report": "Correctness bugs, test gaps, or operational concerns."
+  },
+  "tests": {
+    "description": "Test coverage gaps for important paths, tests that assert incorrect behavior (pinning bugs as expected), fragile or non-deterministic tests, missing negative/edge-case tests, tests that silently pass on stale builds (e.g. importing compiled dist/ rather than source).",
+    "do_not_report": "Source code bugs — report only issues with the tests themselves."
+  },
+  "security": {
+    "description": "Injection vulnerabilities (SQL, shell, path traversal), authentication/authorization flaws, secret exposure, insecure deserialization, privilege escalation, unsafe use of eval or child processes with user input.",
+    "do_not_report": "Performance or correctness issues that are not security-relevant."
+  },
+  "reliability": {
+    "description": "Failure modes without recovery, missing timeouts, unhandled promise rejections, race conditions, resource leaks (file handles, sockets, timers), incorrect retry logic, cascading failure risks.",
+    "do_not_report": "Correctness bugs that do not affect reliability under failure conditions."
+  },
+  "performance": {
+    "description": "Algorithmic inefficiencies (O(n²) where O(n) is possible), unnecessary re-computation, missing caching, synchronous blocking in hot paths, excessive memory allocation.",
+    "do_not_report": "Correctness bugs unrelated to performance."
+  },
+  "data_integrity": {
+    "description": "Missing input validation at trust boundaries, schema violations, inconsistent field naming across related schemas, data loss scenarios, missing required fields, enum values that are present in some schemas but not others.",
+    "do_not_report": "UI or presentation issues; operational or deployment concerns."
+  },
+  "operability": {
+    "description": "Missing or low-quality log output, error messages that don't help operators diagnose problems, missing progress indicators for long operations, no elapsed-time reporting, lack of dry-run or preview modes for destructive operations.",
+    "do_not_report": "Correctness bugs or deployment configuration."
+  },
+  "config_deployment": {
+    "description": "CI/CD pipeline correctness (wrong triggers, missing branch filters, floating version pins), deployment safety (no gate before publish, missing rollback), insecure secret handling in configs, mutable action tags that should be pinned to commit SHAs.",
+    "do_not_report": "Runtime code issues; findings that belong to other lenses."
+  },
+  "architecture": {
+    "description": "Big-picture design, conceptual elegance, over-engineering, under-engineering, appropriate use of abstractions, and identifying opportunities where custom code should be replaced by third-party tools or standard libraries. Flag structural findings that span multiple components as 'systemic: true'.",
+    "do_not_report": "Minor style issues, localized logic bugs, or formatting."
+  },
+  "observability": {
+    "description": "Logging quality, telemetry, distributed tracing context, meaningful metrics, and error reporting context.",
+    "do_not_report": "Correctness bugs or deployment configuration."
+  }
+}

package/dispatch/merge-results.mjs

@@ -0,0 +1,110 @@
+import { resolve, join } from "node:path";
+import { readFileSync, writeFileSync, readdirSync, existsSync } from "node:fs";
+import { validateResult } from "./validate.mjs";
+
+const runIdIdx = process.argv.indexOf("--run-id");
+if (runIdIdx === -1 || !process.argv[runIdIdx + 1]) {
+  console.error("Usage: node dispatch/merge-results.mjs --run-id <run_id> [--artifacts-dir <dir>]");
+  process.exit(1);
+}
+const runId = process.argv[runIdIdx + 1];
+
+const artifactsDirIdx = process.argv.indexOf("--artifacts-dir");
+// Default must match where the orchestrator/wrapper actually writes runs:
+// <root>/.audit-tools/audit (COR-bf5c7331). The prior `.audit-artifacts`
+// default resolved to a directory the pipeline never populates.
+const artifactsDir = artifactsDirIdx !== -1 && process.argv[artifactsDirIdx + 1]
+  ? resolve(process.argv[artifactsDirIdx + 1])
+  : join(process.cwd(), ".audit-tools", "audit");
+
+const taskResultsDir = join(artifactsDir, "runs", runId, "task-results");
+const auditResultsPath = join(artifactsDir, "runs", runId, "run-results.json");
+const failedTasksPath = join(artifactsDir, "runs", runId, "failed-tasks.json");
+const tasksPath = join(artifactsDir, "runs", runId, "pending-audit-tasks.json");
+
+// Build task map for validation context
+const taskMap = {};
+if (existsSync(tasksPath)) {
+  try {
+    const tasks = JSON.parse(readFileSync(tasksPath, "utf8"));
+    for (const task of tasks) {
+      taskMap[task.task_id] = task;
+    }
+  } catch (e) {
+    process.stderr.write(`[warn] Could not read pending-audit-tasks.json; line-count validation will be skipped: ${e.message}\n`);
+  }
+}
+
+if (!existsSync(taskResultsDir)) {
+  console.error(`task-results directory not found: ${taskResultsDir}`);
+  process.exit(1);
+}
+
+const files = readdirSync(taskResultsDir).filter(f => f.endsWith(".json"));
+
+const passing = [];
+const failing = [];
+
+for (const filename of files) {
+  const filePath = join(taskResultsDir, filename);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(filePath, "utf8"));
+  } catch (e) {
+    failing.push({ task_id: filename, errors: [`Invalid JSON: ${e.message}`] });
+    continue;
+  }
+
+  // Expand top-level AuditResult[] arrays — a worker that emits an array
+  // payload must not be treated as one invalid object (INV-01 / COR-bf5c7331).
+  const candidates = Array.isArray(parsed) ? parsed : [parsed];
+  for (const resultObj of candidates) {
+    const taskId = resultObj?.task_id;
+    const task = (taskId && taskMap[taskId]) ? taskMap[taskId] : null;
+    const { valid, errors } = validateResult(resultObj, task);
+
+    if (valid) {
+      passing.push(resultObj);
+    } else {
+      failing.push({ task_id: taskId ?? filename, errors });
+    }
+  }
+}
+
+writeFileSync(auditResultsPath, JSON.stringify(passing, null, 2));
+
+if (failing.length > 0) {
+  writeFileSync(failedTasksPath, JSON.stringify(failing, null, 2));
+  process.stderr.write(`${failing.length} task(s) failed validation and were excluded:\n`);
+  for (const f of failing) {
+    for (const err of f.errors) {
+      process.stderr.write(`  ✗ ${f.task_id}: ${err}\n`);
+    }
+  }
+}
+
+const total = passing.length + failing.length;
+// FND-OBS-bf5c7331: emit a structured JSON summary line to stdout so callers
+// get a machine-readable payload alongside the human-readable text line.
+// Both are written to stdout; the JSON summary line always comes first so
+// programmatic consumers can parse it without stripping the text line.
+process.stdout.write(
+  JSON.stringify({
+    ts: new Date().toISOString(),
+    source: "audit-code:merge-results",
+    event: "merge_summary",
+    total,
+    accepted: passing.length,
+    rejected: failing.length,
+    audit_results_path: auditResultsPath,
+    ...(failing.length > 0 ? { failed_tasks_path: failedTasksPath } : {}),
+  }) + "\n",
+);
+console.log(`✓ ${passing.length}/${total} tasks valid → ${auditResultsPath}`);
+if (failing.length > 0) {
+  console.log("  Re-run those tasks in the next cycle.");
+}
+
+// Exit non-zero when any result failed validation so callers can detect
+// partial merges and avoid treating them as clean success (INV-03 / COR-bf5c7331-2).
+process.exit(failing.length > 0 ? 1 : 0);

package/dispatch/validate-result.mjs

@@ -0,0 +1,59 @@
+import { resolve, join } from "node:path";
+import { readFileSync, existsSync } from "node:fs";
+import { validateResult } from "./validate.mjs";
+
+const runIdIdx = process.argv.indexOf("--run-id");
+const taskIdIdx = process.argv.indexOf("--task-id");
+const artifactsDirIdx = process.argv.indexOf("--artifacts-dir");
+
+const runId = runIdIdx !== -1 ? process.argv[runIdIdx + 1] : undefined;
+const taskId = taskIdIdx !== -1 ? process.argv[taskIdIdx + 1] : undefined;
+
+if (!runId || !taskId) {
+  console.error("Usage: node dispatch/validate-result.mjs --run-id <run_id> --task-id <task_id> [--artifacts-dir <dir>]");
+  process.exit(1);
+}
+
+// Default must match where the orchestrator/wrapper actually writes runs:
+// <root>/.audit-tools/audit (COR-bf5c7331), not the legacy `.audit-artifacts`.
+const artifactsDir = artifactsDirIdx !== -1 && process.argv[artifactsDirIdx + 1]
+  ? resolve(process.argv[artifactsDirIdx + 1])
+  : join(process.cwd(), ".audit-tools", "audit");
+
+const sanitized = taskId.replace(/[^a-zA-Z0-9_-]/g, "_");
+const resultPath = join(artifactsDir, "runs", runId, "task-results", sanitized + ".json");
+
+if (!existsSync(resultPath)) {
+  console.error(`File not found: ${resultPath}`);
+  process.exit(1);
+}
+
+let resultObj;
+try {
+  resultObj = JSON.parse(readFileSync(resultPath, "utf8"));
+} catch (e) {
+  console.error(`Invalid JSON in ${resultPath}: ${e.message}`);
+  process.exit(1);
+}
+
+const tasksPath = join(artifactsDir, "runs", runId, "pending-audit-tasks.json");
+let task = null;
+if (existsSync(tasksPath)) {
+  try {
+    const tasks = JSON.parse(readFileSync(tasksPath, "utf8"));
+    task = tasks.find(t => t.task_id === taskId) ?? null;
+  } catch (e) {
+    process.stderr.write(`[warn] Could not read pending-audit-tasks.json; line-count validation will be skipped: ${e.message}\n`);
+  }
+}
+
+const { valid, errors } = validateResult(resultObj, task);
+
+if (valid) {
+  console.log("✓ valid:", taskId);
+  process.exit(0);
+} else {
+  console.error("✗ invalid:", taskId);
+  console.error(JSON.stringify(errors, null, 2));
+  process.exit(1);
+}

package/dispatch/validate.mjs

@@ -0,0 +1,16 @@
+import { validateAuditResults } from "../dist/audit/validation/auditResults.js";
+
+/**
+ * @param {object} resultObj  — parsed JSON from a task-results file
+ * @param {object|null} task  — the matching AuditTask from pending-audit-tasks.json, or null
+ * @returns {{ valid: boolean, errors: string[] }}
+ */
+export function validateResult(resultObj, task) {
+  const tasks = task ? [task] : [];
+  const lineIndex = task?.file_line_counts ?? {};
+  const issues = validateAuditResults([resultObj], tasks, { lineIndex });
+  const errors = issues
+    .filter(i => i.severity === "error")
+    .map(i => `${i.path}: ${i.message}`);
+  return { valid: errors.length === 0, errors };
+}

package/dist/audit/adapters/coverageSummary.d.ts

@@ -0,0 +1,9 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+interface CoverageFileSummary {
+    path: string;
+    lines_pct: number;
+    branches_pct?: number;
+}
+export declare function normalizeCoverageSummary(files: CoverageFileSummary[]): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=coverageSummary.d.ts.map

package/dist/audit/adapters/coverageSummary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverageSummary.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/coverageSummary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAQ5E,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAAE,GAC3B,uBAAuB,CAczB"}

package/dist/audit/adapters/coverageSummary.js

@@ -0,0 +1,18 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+/** Minimum acceptable line coverage percentage; files below this are flagged. */
+const COVERAGE_THRESHOLD_LOW = 80;
+/** Line coverage percentage below which severity is escalated to "high" (otherwise "medium"). */
+const COVERAGE_SEVERITY_HIGH = 50;
+export function normalizeCoverageSummary(files) {
+    return normalizeGenericExternalResults("coverage-summary", files
+        .filter((file) => file.lines_pct < COVERAGE_THRESHOLD_LOW)
+        .map((file, index) => ({
+        id: `coverage-${index + 1}`,
+        category: "tests",
+        severity: file.lines_pct < COVERAGE_SEVERITY_HIGH ? "high" : "medium",
+        path: file.path,
+        summary: `Low line coverage: ${file.lines_pct}%${typeof file.branches_pct === "number" ? `, branch coverage ${file.branches_pct}%` : ""}.`,
+        raw: file,
+    })));
+}
+//# sourceMappingURL=coverageSummary.js.map

package/dist/audit/adapters/coverageSummary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverageSummary.js","sourceRoot":"","sources":["../../../src/audit/adapters/coverageSummary.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,iGAAiG;AACjG,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAQlC,MAAM,UAAU,wBAAwB,CACtC,KAA4B;IAE5B,OAAO,+BAA+B,CACpC,kBAAkB,EAClB,KAAK;SACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,GAAG,sBAAsB,CAAC;SACzD,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrB,EAAE,EAAE,YAAY,KAAK,GAAG,CAAC,EAAE;QAC3B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACrE,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,sBAAsB,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1I,GAAG,EAAE,IAAI;KACV,CAAC,CAAC,CACN,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/eslint.d.ts

@@ -0,0 +1,14 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+interface EslintResult {
+    filePath?: string;
+    messages?: Array<{
+        ruleId?: string | null;
+        severity?: number;
+        line?: number;
+        endLine?: number;
+        message?: string;
+    }>;
+}
+export declare function normalizeEslintJson(input: EslintResult[]): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=eslint.d.ts.map

package/dist/audit/adapters/eslint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslint.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/eslint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAiBD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,GACpB,uBAAuB,CAiBzB"}

package/dist/audit/adapters/eslint.js

@@ -0,0 +1,28 @@
+import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+const ESLINT_SEVERITY_ERROR = 2;
+const ESLINT_SEVERITY_WARNING = 1;
+const ESLINT_SEVERITY_MAP = {
+    [ESLINT_SEVERITY_ERROR]: "medium",
+    [ESLINT_SEVERITY_WARNING]: "low",
+};
+function mapSeverity(value) {
+    // ESLint's JSON formatter emits 2 for errors and 1 for warnings.
+    if (typeof value !== "number") {
+        return "info";
+    }
+    return ESLINT_SEVERITY_MAP[value] ?? "info";
+}
+export function normalizeEslintJson(input) {
+    return normalizeGenericExternalResults("eslint", input.flatMap((file) => (file.messages ?? []).map((message, index) => ({
+        id: `${file.filePath ?? "unknown"}:${index + 1}`,
+        category: "maintainability",
+        severity: mapSeverity(message.severity),
+        path: file.filePath,
+        line_start: message.line,
+        line_end: message.endLine,
+        summary: message.message,
+        rule: message.ruleId ?? undefined,
+        raw: message,
+    }))));
+}
+//# sourceMappingURL=eslint.js.map

package/dist/audit/adapters/eslint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslint.js","sourceRoot":"","sources":["../../../src/audit/adapters/eslint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAazE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,mBAAmB,GAAG;IAC1B,CAAC,qBAAqB,CAAC,EAAE,QAAQ;IACjC,CAAC,uBAAuB,CAAC,EAAE,KAAK;CACxB,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc;IACjC,iEAAiE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAyC,CAAC,IAAI,MAAM,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAqB;IAErB,OAAO,+BAA+B,CACpC,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,KAAK,GAAG,CAAC,EAAE;QAChD,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,QAAQ;QACnB,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;QACjC,GAAG,EAAE,OAAO;KACb,CAAC,CAAC,CACJ,CACF,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/normalizeExternal.d.ts

@@ -0,0 +1,13 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+export declare function normalizeGenericExternalResults(tool: string, items: Array<{
+    id?: string;
+    category?: string;
+    severity?: string;
+    path?: string;
+    line_start?: number;
+    line_end?: number;
+    summary?: string;
+    rule?: string;
+    raw?: unknown;
+}>): ExternalAnalyzerResults;
+//# sourceMappingURL=normalizeExternal.d.ts.map

package/dist/audit/adapters/normalizeExternal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeExternal.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAoB5E,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC,GACD,uBAAuB,CA6BzB"}

package/dist/audit/adapters/normalizeExternal.js

@@ -0,0 +1,44 @@
+function normalizeExternalSeverity(value) {
+    switch (value?.toLowerCase()) {
+        case "critical": return "critical";
+        case "error":
+        case "high": return "high";
+        case "warning":
+        case "moderate":
+        case "medium": return "medium";
+        case "low": return "low";
+        case "info":
+        case "note":
+        case "hint": return "info";
+        default: return "info";
+    }
+}
+export function normalizeGenericExternalResults(tool, items) {
+    const valid = items.filter((item) => item.path && item.summary);
+    const dropped = items.length - valid.length;
+    if (dropped > 0) {
+        process.stderr.write(JSON.stringify({
+            event: "normalizer_findings_dropped",
+            tool,
+            dropped,
+            total: items.length,
+            reason: "missing path or summary",
+        }) + "\n");
+    }
+    return {
+        tool,
+        generated_at: new Date().toISOString(),
+        results: valid.map((item, index) => ({
+            id: item.id ?? `${tool}-${index + 1}`,
+            category: item.category ?? "unknown",
+            severity: normalizeExternalSeverity(item.severity),
+            path: item.path,
+            line_start: item.line_start,
+            line_end: item.line_end,
+            summary: item.summary,
+            rule: item.rule,
+            raw: item.raw,
+        })),
+    };
+}
+//# sourceMappingURL=normalizeExternal.js.map

package/dist/audit/adapters/normalizeExternal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeExternal.js","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAIA,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,QAAQ,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC;QACzB,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAY,EACZ,KAUE;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,6BAA6B;YACpC,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,yBAAyB;SAClC,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/npmAudit.d.ts

@@ -0,0 +1,16 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+interface NpmAuditVuln {
+    name?: string;
+    severity?: string;
+    range?: string;
+    fixAvailable?: boolean | {
+        name?: string;
+        version?: string;
+    };
+}
+interface NpmAuditJson {
+    vulnerabilities?: Record<string, NpmAuditVuln>;
+}
+export declare function normalizeNpmAuditJson(input: NpmAuditJson): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=npmAudit.d.ts.map