audit-tools 0.28.0

package/dist/audit/orchestrator/executors.js

@@ -0,0 +1,114 @@
+/**
+ * Returns true when the executor identified by `id` is a host-delegation point
+ * (i.e. it pauses the deterministic pipeline and asks the active LLM agent to
+ * perform work) rather than a deterministic executor.
+ */
+export function isHostDelegationExecutor(id) {
+    const entry = EXECUTOR_REGISTRY.find((e) => e.id === id);
+    return entry?.kind === "host_delegation";
+}
+export const EXECUTOR_REGISTRY = [
+    {
+        id: "provider_confirmation_executor",
+        kind: "host_delegation",
+        obligation_ids: ["provider_confirmation"],
+    },
+    {
+        id: "intake_executor",
+        kind: "deterministic",
+        obligation_ids: ["repo_manifest", "file_disposition"],
+    },
+    {
+        id: "intent_checkpoint_executor",
+        kind: "host_delegation",
+        obligation_ids: ["intent_checkpoint_current"],
+    },
+    {
+        id: "structure_executor",
+        kind: "deterministic",
+        obligation_ids: ["structure_artifacts"],
+    },
+    {
+        id: "graph_enrichment_executor",
+        kind: "deterministic",
+        obligation_ids: ["graph_enrichment_current"],
+    },
+    {
+        id: "design_assessment_executor",
+        kind: "deterministic",
+        obligation_ids: ["design_assessment_current"],
+    },
+    {
+        id: "design_review_contract",
+        kind: "host_delegation",
+        obligation_ids: ["design_review_contract_completed"],
+    },
+    {
+        id: "design_review_conceptual",
+        kind: "host_delegation",
+        obligation_ids: ["design_review_conceptual_completed"],
+    },
+    {
+        id: "planning_executor",
+        kind: "deterministic",
+        obligation_ids: ["planning_artifacts"],
+    },
+    {
+        id: "result_ingestion_executor",
+        kind: "deterministic",
+        obligation_ids: ["audit_results_ingested"],
+    },
+    {
+        id: "runtime_validation_executor",
+        kind: "deterministic",
+        obligation_ids: ["runtime_validation_current"],
+    },
+    {
+        // No obligation_ids: dispatched only via an explicit preferredExecutor
+        // (imported runtime-validation evidence), never selected by the priority scan.
+        id: "runtime_validation_update_executor",
+        kind: "deterministic",
+        obligation_ids: [],
+    },
+    {
+        id: "synthesis_executor",
+        kind: "deterministic",
+        obligation_ids: ["synthesis_current"],
+    },
+    {
+        id: "synthesis_narrative_executor",
+        kind: "host_delegation",
+        obligation_ids: ["synthesis_narrative_current"],
+    },
+    {
+        // No obligation_ids: dispatched only via an explicit preferredExecutor
+        // (imported normalized external-analyzer results), never selected by the scan.
+        id: "external_analyzer_import_executor",
+        kind: "deterministic",
+        obligation_ids: [],
+    },
+    {
+        id: "auto_fix_executor",
+        kind: "deterministic",
+        obligation_ids: ["auto_fixes_applied"],
+    },
+    {
+        id: "syntax_resolution_executor",
+        kind: "deterministic",
+        obligation_ids: ["syntax_resolved"],
+    },
+    {
+        // Legacy host-delegation placeholder: no longer owns audit_tasks_completed
+        // (superseded by rolling_dispatch_executor). No obligation_ids; retained only
+        // so in-flight runs that still reference "agent" in a persisted artifact resolve.
+        id: "agent",
+        kind: "host_delegation",
+        obligation_ids: [],
+    },
+    {
+        id: "rolling_dispatch_executor",
+        kind: "host_delegation",
+        obligation_ids: ["audit_tasks_completed"],
+    },
+];
+//# sourceMappingURL=executors.js.map

package/dist/audit/orchestrator/executors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executors.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/executors.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAU;IACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,EAAE,IAAI,KAAK,iBAAiB,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,uBAAuB,CAAC;KAC1C;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;KACtD;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,2BAA2B,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,qBAAqB,CAAC;KACxC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,0BAA0B,CAAC;KAC7C;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,2BAA2B,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,kCAAkC,CAAC;KACrD;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,oCAAoC,CAAC;KACvD;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,oBAAoB,CAAC;KACvC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,wBAAwB,CAAC;KAC3C;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,4BAA4B,CAAC;KAC/C;IACD;QACE,uEAAuE;QACvE,+EAA+E;QAC/E,EAAE,EAAE,oCAAoC;QACxC,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,EAAE;KACnB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,mBAAmB,CAAC;KACtC;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,6BAA6B,CAAC;KAChD;IACD;QACE,uEAAuE;QACvE,+EAA+E;QAC/E,EAAE,EAAE,mCAAmC;QACvC,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,EAAE;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,oBAAoB,CAAC;KACvC;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,CAAC,iBAAiB,CAAC;KACpC;IACD;QACE,2EAA2E;QAC3E,8EAA8E;QAC9E,kFAAkF;QAClF,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,EAAE;KACnB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,CAAC,uBAAuB,CAAC;KAC1C;CACF,CAAC"}

package/dist/audit/orchestrator/fileAnchors.d.ts

@@ -0,0 +1,33 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { GraphBundle } from "audit-tools/shared";
+export type FileAnchorKind = "boundary" | "import" | "export" | "symbol" | "route" | "keyword" | "graph" | "analyzer_signal";
+export interface FileAnchor {
+    kind: FileAnchorKind;
+    name: string;
+    line?: number;
+    detail?: string;
+}
+export interface FileAnchorSummary {
+    contract_version: "audit-code-file-anchors/v1alpha1";
+    path: string;
+    total_lines: number;
+    review_mode: "isolated_large_file";
+    scope_basis: string[];
+    anchors: FileAnchor[];
+    omitted_anchor_count: number;
+    counts: {
+        symbols: number;
+        routes: number;
+        keywords: number;
+        graph_edges: number;
+        analyzer_signals: number;
+    };
+}
+export declare function buildFileAnchorSummary(params: {
+    path: string;
+    content: string;
+    totalLines: number;
+    graphBundle?: GraphBundle;
+    externalAnalyzerResults?: ExternalAnalyzerResults;
+}): FileAnchorSummary;
+//# sourceMappingURL=fileAnchors.d.ts.map

package/dist/audit/orchestrator/fileAnchors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAnchors.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/fileAnchors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,oBAAoB,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,iBAAiB,CAAC;AAEtB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,kCAAkC,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,qBAAqB,CAAC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AA+LD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD,GAAG,iBAAiB,CA0FpB"}

package/dist/audit/orchestrator/fileAnchors.js

@@ -0,0 +1,242 @@
+/**
+ * Graph buckets in `graph_bundle.json` that carry file-to-file edges relevant to
+ * large-file anchoring. Named here (rather than inlined as bare strings in the
+ * collection loop) so the set of scanned buckets is a single typed source of
+ * truth and each bucket key doubles as a typed fallback edge `kind`. `as const`
+ * narrows the element type from `string` to the literal union.
+ */
+const GRAPH_EDGE_BUCKETS = ["imports", "calls", "references"];
+const MAX_ANCHORS = 160;
+// Keywords that signal elevated-risk or review-worthy lines, grouped by concern:
+// auth/access:              auth, password, permission, role, secret, token
+// injection/execution:      deserialize, eval, exec, query, spawn, sql
+// crypto:                   decrypt, encrypt
+// concurrency/reliability:  cache, lock, race, retry, timeout, transaction
+// debt markers:             FIXME, TODO
+const KEYWORD_PATTERN = /\b(auth|password|permission|role|secret|token|deserialize|eval|exec|query|spawn|sql|decrypt|encrypt|cache|lock|race|retry|timeout|transaction|FIXME|TODO)\b/i;
+const SYMBOL_PATTERNS = [
+    {
+        kind: "import",
+        pattern: /^\s*import\s+(?:type\s+)?(?:[^"'()]*?\s+from\s+)?["']([^"']+)["']/,
+        label: "import",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\b/,
+        label: "function",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?class\s+([A-Za-z_$][\w$]*)\b/,
+        label: "class",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?interface\s+([A-Za-z_$][\w$]*)\b/,
+        label: "interface",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?type\s+([A-Za-z_$][\w$]*)\b/,
+        label: "type",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\b/,
+        label: "binding",
+    },
+    {
+        kind: "export",
+        pattern: /^\s*export\s+(?:type\s+)?(?:[^"'()]*?\s+from\s+["']([^"']+)["']|(?:default\s+)?(?:async\s+)?(?:function|class|const|let|var|interface|type)\s+([A-Za-z_$][\w$-]*))/,
+        label: "export",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?def\s+([A-Za-z_][\w]*)\b/,
+        label: "function",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:export\s+)?func\s+(?:\([^)]+\)\s*)?([A-Za-z_][\w]*)\b/,
+        label: "function",
+    },
+    {
+        kind: "symbol",
+        pattern: /^\s*(?:pub\s+)?fn\s+([A-Za-z_][\w]*)\b/,
+        label: "function",
+    },
+    {
+        kind: "route",
+        pattern: /\b(?:app|router|server)\s*\.\s*(get|post|put|patch|delete|use)\s*\(/i,
+        label: "route",
+    },
+    {
+        kind: "route",
+        pattern: /^\s*@(?:Get|Post|Put|Patch|Delete|Route|Controller)\b/,
+        label: "route",
+    },
+];
+function normalizePath(path) {
+    return path.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function truncate(value, maxLength) {
+    const normalized = value.replace(/\s+/g, " ").trim();
+    return normalized.length > maxLength
+        ? `${normalized.slice(0, maxLength - 3)}...`
+        : normalized;
+}
+function addAnchor(anchors, seen, anchor) {
+    const key = `${anchor.kind}\0${anchor.line ?? ""}\0${anchor.name}\0${anchor.detail ?? ""}`;
+    if (seen.has(key)) {
+        return;
+    }
+    seen.add(key);
+    anchors.push(anchor);
+}
+function collectGraphEdges(graphBundle, path) {
+    if (!graphBundle?.graphs) {
+        return [];
+    }
+    const normalizedPath = normalizePath(path).toLowerCase();
+    const edges = [];
+    // Typed as `string` (not the literal union) so the lookup resolves through the
+    // `[key: string]: unknown` index signature on `graphs` — the loop body then
+    // re-validates each entry's shape, matching the original deterministic parse.
+    for (const bucket of GRAPH_EDGE_BUCKETS) {
+        const raw = graphBundle.graphs[bucket];
+        if (!Array.isArray(raw)) {
+            continue;
+        }
+        for (const item of raw) {
+            const record = item;
+            if (item &&
+                typeof item === "object" &&
+                !Array.isArray(item) &&
+                typeof record.from === "string" &&
+                typeof record.to === "string") {
+                const from = normalizePath(record.from).toLowerCase();
+                const to = normalizePath(record.to).toLowerCase();
+                if (from === normalizedPath || to === normalizedPath) {
+                    edges.push({
+                        from: record.from,
+                        to: record.to,
+                        kind: typeof record.kind === "string" ? record.kind : bucket,
+                    });
+                }
+            }
+        }
+    }
+    return edges.sort((a, b) => (a.kind ?? "").localeCompare(b.kind ?? "") ||
+        a.from.localeCompare(b.from) ||
+        a.to.localeCompare(b.to));
+}
+function scanSymbol(line, lineNumber, anchors, seen) {
+    for (const { kind, pattern, label } of SYMBOL_PATTERNS) {
+        const match = line.match(pattern);
+        if (!match) {
+            continue;
+        }
+        const name = match.slice(1).find((value) => value && value.trim().length > 0) ?? label;
+        addAnchor(anchors, seen, {
+            kind,
+            name: truncate(name, 80),
+            line: lineNumber,
+            detail: truncate(`${label}: ${line}`, 180),
+        });
+        return kind;
+    }
+    return null;
+}
+function scanKeyword(line, lineNumber, anchors, seen) {
+    if (!KEYWORD_PATTERN.test(line)) {
+        return false;
+    }
+    addAnchor(anchors, seen, {
+        kind: "keyword",
+        name: truncate(line.match(KEYWORD_PATTERN)?.[1] ?? "keyword", 80),
+        line: lineNumber,
+        detail: truncate(line, 180),
+    });
+    return true;
+}
+export function buildFileAnchorSummary(params) {
+    const anchors = [];
+    const seen = new Set();
+    const path = normalizePath(params.path);
+    const lines = params.content.split(/\r?\n/);
+    let symbolCount = 0;
+    let routeCount = 0;
+    let keywordCount = 0;
+    addAnchor(anchors, seen, {
+        kind: "boundary",
+        name: "file_start",
+        line: 1,
+        detail: "Start of isolated large-file review boundary.",
+    });
+    if (params.totalLines > 1) {
+        addAnchor(anchors, seen, {
+            kind: "boundary",
+            name: "file_end",
+            line: params.totalLines,
+            detail: "End of isolated large-file review boundary.",
+        });
+    }
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const symbolKind = scanSymbol(line, lineNumber, anchors, seen);
+        if (symbolKind === "route")
+            routeCount += 1;
+        else if (symbolKind === "symbol")
+            symbolCount += 1;
+        if (scanKeyword(line, lineNumber, anchors, seen))
+            keywordCount += 1;
+    });
+    const graphEdges = collectGraphEdges(params.graphBundle, path);
+    for (const edge of graphEdges) {
+        addAnchor(anchors, seen, {
+            kind: "graph",
+            name: edge.kind ?? "edge",
+            detail: normalizePath(edge.from).toLowerCase() === path.toLowerCase()
+                ? `outbound: ${edge.to}`
+                : `inbound: ${edge.from}`,
+        });
+    }
+    const analyzerSignals = (params.externalAnalyzerResults?.results ?? [])
+        .filter((result) => normalizePath(result.path).toLowerCase() === path.toLowerCase())
+        .sort((a, b) => (a.line_start ?? 0) - (b.line_start ?? 0) ||
+        a.id.localeCompare(b.id));
+    for (const signal of analyzerSignals) {
+        addAnchor(anchors, seen, {
+            kind: "analyzer_signal",
+            name: truncate(signal.rule ?? signal.category, 80),
+            line: signal.line_start,
+            detail: truncate(signal.summary, 180),
+        });
+    }
+    const sorted = anchors.sort((a, b) => (a.line ?? Number.MAX_SAFE_INTEGER) - (b.line ?? Number.MAX_SAFE_INTEGER) ||
+        a.kind.localeCompare(b.kind) ||
+        a.name.localeCompare(b.name));
+    const boundedAnchors = sorted.slice(0, MAX_ANCHORS);
+    return {
+        contract_version: "audit-code-file-anchors/v1alpha1",
+        path,
+        total_lines: params.totalLines,
+        review_mode: "isolated_large_file",
+        scope_basis: [
+            "single assigned file",
+            "single review packet",
+            "mechanically extracted symbols, routes, graph edges, keywords, and analyzer signals",
+            "backend-owned submit-packet result write path",
+        ],
+        anchors: boundedAnchors,
+        omitted_anchor_count: Math.max(0, sorted.length - boundedAnchors.length),
+        counts: {
+            symbols: symbolCount,
+            routes: routeCount,
+            keywords: keywordCount,
+            graph_edges: graphEdges.length,
+            analyzer_signals: analyzerSignals.length,
+        },
+    };
+}
+//# sourceMappingURL=fileAnchors.js.map

package/dist/audit/orchestrator/fileAnchors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAnchors.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/fileAnchors.ts"],"names":[],"mappings":"AAqCA;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAU,CAAC;AAEvE,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,iFAAiF;AACjF,4EAA4E;AAC5E,uEAAuE;AACvE,6CAA6C;AAC7C,2EAA2E;AAC3E,wCAAwC;AACxC,MAAM,eAAe,GACnB,8JAA8J,CAAC;AACjK,MAAM,eAAe,GAAoE;IACvF;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,mEAAmE;QAC5E,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,gEAAgE;QACzE,KAAK,EAAE,UAAU;KAClB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,gDAAgD;QACzD,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,oDAAoD;QAC7D,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,+CAA+C;QACxD,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,4DAA4D;QACrE,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,oKAAoK;QAC7K,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,4CAA4C;QACrD,KAAK,EAAE,UAAU;KAClB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,8DAA8D;QACvE,KAAK,EAAE,UAAU;KAClB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,wCAAwC;QACjD,KAAK,EAAE,UAAU;KAClB;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,sEAAsE;QAC/E,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,uDAAuD;QAChE,KAAK,EAAE,OAAO;KACf;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,GAAG,SAAS;QAClC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK;QAC5C,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAChB,OAAqB,EACrB,IAAiB,EACjB,MAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAC3F,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoC,EAAE,IAAY;IAC3E,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK,MAAM,MAAM,IAAI,kBAAuC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAA+B,CAAC;YAC/C,IACE,IAAI;gBACJ,OAAO,IAAI,KAAK,QAAQ;gBACxB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAC/B,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAC7B,CAAC;gBACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClD,IAAI,IAAI,KAAK,cAAc,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,UAAkB,EAClB,OAAqB,EACrB,IAAiB;IAEjB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;QACvF,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvB,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,UAAkB,EAClB,OAAqB,EACrB,IAAiB;IAEjB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACvB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC;QACjE,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAMtC;IACC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,MAAM,EAAE,6CAA6C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,OAAO;YAAE,UAAU,IAAI,CAAC,CAAC;aACvC,IAAI,UAAU,KAAK,QAAQ;YAAE,WAAW,IAAI,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;YAAE,YAAY,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;YACzB,MAAM,EACJ,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;gBAC3D,CAAC,CAAC,aAAa,IAAI,CAAC,EAAE,EAAE;gBACxB,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,IAAI,EAAE,CAAC;SACpE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;SACnF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3B,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACvB,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAClD,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,gBAAgB,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAEpD,OAAO;QACL,gBAAgB,EAAE,kCAAkC;QACpD,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,sBAAsB;YACtB,sBAAsB;YACtB,qFAAqF;YACrF,+CAA+C;SAChD;QACD,OAAO,EAAE,cAAc;QACvB,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACxE,MAAM,EAAE;YACN,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,YAAY;YACtB,WAAW,EAAE,UAAU,CAAC,MAAM;YAC9B,gBAAgB,EAAE,eAAe,CAAC,MAAM;SACzC;KACF,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/fileIntegrity.d.ts

@@ -0,0 +1,9 @@
+import type { RepoManifest } from "../types.js";
+export interface FileIntegrityResult {
+    changed_files: string[];
+    missing_files: string[];
+    io_errors: string[];
+    is_clean: boolean;
+}
+export declare function checkFileIntegrity(root: string, manifest: RepoManifest, scope?: string[]): Promise<FileIntegrityResult>;
+//# sourceMappingURL=fileIntegrity.d.ts.map

package/dist/audit/orchestrator/fileIntegrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileIntegrity.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/fileIntegrity.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAOD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,YAAY,EACtB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}

package/dist/audit/orchestrator/fileIntegrity.js

@@ -0,0 +1,58 @@
+import { hashContent } from "audit-tools/shared";
+import { readFile } from "node:fs/promises";
+import { join, isAbsolute } from "node:path";
+import { existsSync } from "node:fs";
+async function hashFile(absolutePath) {
+    const content = await readFile(absolutePath);
+    return hashContent(content);
+}
+export async function checkFileIntegrity(root, manifest, scope) {
+    const changed = [];
+    const missing = [];
+    const ioErrors = [];
+    const scopeSet = scope ? new Set(scope) : null;
+    const files = scopeSet
+        ? manifest.files.filter((f) => scopeSet.has(f.path))
+        : manifest.files;
+    for (const record of files) {
+        if (!record.hash)
+            continue;
+        const absolute = isAbsolute(record.path)
+            ? record.path
+            : join(root, record.path);
+        if (!existsSync(absolute)) {
+            missing.push(record.path);
+            continue;
+        }
+        try {
+            const currentHash = await hashFile(absolute);
+            if (currentHash !== record.hash) {
+                changed.push(record.path);
+            }
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+                missing.push(record.path);
+            }
+            else {
+                process.stderr.write(JSON.stringify({
+                    kind: "file_integrity_io_error",
+                    root,
+                    scope_size: files.length,
+                    file: record.path,
+                    code: code ?? String(err),
+                    ts: new Date().toISOString(),
+                }) + "\n");
+                ioErrors.push(record.path);
+            }
+        }
+    }
+    return {
+        changed_files: changed,
+        missing_files: missing,
+        io_errors: ioErrors,
+        is_clean: changed.length === 0 && missing.length === 0 && ioErrors.length === 0,
+    };
+}
+//# sourceMappingURL=fileIntegrity.js.map

package/dist/audit/orchestrator/fileIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileIntegrity.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/fileIntegrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAUrC,KAAK,UAAU,QAAQ,CAAC,YAAoB;IAC1C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,QAAsB,EACtB,KAAgB;IAEhB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAEnB,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,WAAW,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,yBAAyB;oBAC/B,IAAI;oBACJ,UAAU,EAAE,KAAK,CAAC,MAAM;oBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC;oBACzB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC7B,CAAC,GAAG,IAAI,CACV,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,QAAQ;QACnB,QAAQ,EACN,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/flowCoverage.d.ts

@@ -0,0 +1,5 @@
+import type { CoverageMatrix } from "../types.js";
+import type { FlowCoverageManifest } from "../types/flowCoverage.js";
+import type { CriticalFlowManifest } from "audit-tools/shared";
+export declare function buildFlowCoverage(criticalFlows: CriticalFlowManifest, coverageMatrix: CoverageMatrix): FlowCoverageManifest;
+//# sourceMappingURL=flowCoverage.d.ts.map

package/dist/audit/orchestrator/flowCoverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flowCoverage.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/flowCoverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAQ,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAS/D,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,EACnC,cAAc,EAAE,cAAc,GAC7B,oBAAoB,CAgDtB"}

package/dist/audit/orchestrator/flowCoverage.js

@@ -0,0 +1,46 @@
+import { isLens } from "../types.js";
+function lensSetForFlow(concerns) {
+    // COR-59c25418: use the single-source-of-truth `isLens` guard so all valid
+    // lenses (including maintainability, architecture, tests, config_deployment)
+    // are accepted rather than a hardcoded subset.
+    return concerns.filter((concern) => isLens(concern));
+}
+export function buildFlowCoverage(criticalFlows, coverageMatrix) {
+    const coverageByPath = new Map(coverageMatrix.files.map((file) => [file.path, file]));
+    const flows = criticalFlows.flows.map((flow) => {
+        const flowPaths = Array.isArray(flow.paths)
+            ? flow.paths.filter((path) => typeof path === "string")
+            : [];
+        const required = lensSetForFlow(Array.isArray(flow.concerns)
+            ? flow.concerns.filter((concern) => typeof concern === "string")
+            : []);
+        const completed = new Set();
+        for (const path of flowPaths) {
+            const record = coverageByPath.get(path);
+            if (!record || record.audit_status === "excluded") {
+                continue;
+            }
+            for (const lens of record.completed_lenses) {
+                if (required.includes(lens)) {
+                    completed.add(lens);
+                }
+            }
+        }
+        const completed_lenses = [...completed];
+        const status = required.every((lens) => completed_lenses.includes(lens))
+            ? "complete"
+            : completed_lenses.length > 0
+                ? "partial"
+                : "pending";
+        return {
+            flow_id: flow.id,
+            paths: flowPaths,
+            required_lenses: required,
+            completed_lenses,
+            status,
+            notes: [`Derived from ${flowPaths.length} path(s).`],
+        };
+    });
+    return { flows };
+}
+//# sourceMappingURL=flowCoverage.js.map

package/dist/audit/orchestrator/flowCoverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flowCoverage.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/flowCoverage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAOrC,SAAS,cAAc,CAAC,QAAkB;IACxC,2EAA2E;IAC3E,6EAA6E;IAC7E,+CAA+C;IAC/C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAmB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAmC,EACnC,cAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACtD,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,cAAc,CAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAC5D;YACH,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC3C,IAAK,QAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QACxC,MAAM,MAAM,GACV,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS,CAAC;QAElB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,QAAQ;YACzB,gBAAgB;YAChB,MAAM;YACN,KAAK,EAAE,CAAC,gBAAgB,SAAS,CAAC,MAAM,WAAW,CAAC;SACrD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/audit/orchestrator/flowPlanning.d.ts

@@ -0,0 +1,8 @@
+import type { CriticalFlowManifest } from "audit-tools/shared";
+export interface FlowReviewBlock {
+    flow_id: string;
+    lens: string;
+    file_paths: string[];
+}
+export declare function claimFlowReviewBlocks(criticalFlows: CriticalFlowManifest, pendingByLens: Map<string, Set<string>>, assigned: Set<string>): FlowReviewBlock[];
+//# sourceMappingURL=flowPlanning.d.ts.map

package/dist/audit/orchestrator/flowPlanning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flowPlanning.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/flowPlanning.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAY/D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,oBAAoB,EACnC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EACvC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,eAAe,EAAE,CA4DnB"}

package/dist/audit/orchestrator/flowPlanning.js

@@ -0,0 +1,65 @@
+const FLOW_REVIEW_LENSES = [
+    "security",
+    "reliability",
+    "correctness",
+    "data_integrity",
+    "operability",
+    "performance",
+    "observability",
+];
+function lensPathKey(lens, path) {
+    return `${lens}:${path}`;
+}
+function flowLensPriority(lens) {
+    const index = FLOW_REVIEW_LENSES.indexOf(lens);
+    return index >= 0 ? index : FLOW_REVIEW_LENSES.length;
+}
+export function claimFlowReviewBlocks(criticalFlows, pendingByLens, assigned) {
+    const candidates = [];
+    for (const flow of criticalFlows.flows) {
+        const flowPaths = [...new Set(flow.paths)].sort((a, b) => a.localeCompare(b));
+        const desiredLenses = flow.concerns
+            .filter((concern) => FLOW_REVIEW_LENSES.includes(concern))
+            .sort((a, b) => flowLensPriority(a) - flowLensPriority(b));
+        for (const lens of desiredLenses) {
+            const pendingPaths = pendingByLens.get(lens);
+            if (!pendingPaths || pendingPaths.size === 0) {
+                continue;
+            }
+            const filePaths = flowPaths.filter((path) => pendingPaths.has(path));
+            if (filePaths.length === 0) {
+                continue;
+            }
+            candidates.push({
+                flow_id: flow.id,
+                lens,
+                file_paths: filePaths,
+            });
+        }
+    }
+    candidates.sort((a, b) => {
+        const sizeDelta = b.file_paths.length - a.file_paths.length;
+        if (sizeDelta !== 0)
+            return sizeDelta;
+        const lensDelta = flowLensPriority(a.lens) - flowLensPriority(b.lens);
+        if (lensDelta !== 0)
+            return lensDelta;
+        return a.flow_id.localeCompare(b.flow_id);
+    });
+    const blocks = [];
+    for (const candidate of candidates) {
+        const unclaimedPaths = candidate.file_paths.filter((path) => !assigned.has(lensPathKey(candidate.lens, path)));
+        if (unclaimedPaths.length === 0) {
+            continue;
+        }
+        for (const path of unclaimedPaths) {
+            assigned.add(lensPathKey(candidate.lens, path));
+        }
+        blocks.push({
+            ...candidate,
+            file_paths: unclaimedPaths,
+        });
+    }
+    return blocks;
+}
+//# sourceMappingURL=flowPlanning.js.map

package/dist/audit/orchestrator/flowPlanning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flowPlanning.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/flowPlanning.ts"],"names":[],"mappings":"AAGA,MAAM,kBAAkB,GAAW;IACjC,UAAU;IACV,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,eAAe;CAChB,CAAC;AAQF,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAI,kBAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,aAAmC,EACnC,aAAuC,EACvC,QAAqB;IAErB,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ;aAChC,MAAM,CAAC,CAAC,OAAO,EAAmB,EAAE,CACnC,kBAAkB,CAAC,QAAQ,CAAC,OAAe,CAAC,CAC7C;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,IAAI;gBACJ,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5D,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,SAAS;YACZ,UAAU,EAAE,cAAc;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/audit/orchestrator/flowRequeue.d.ts

@@ -0,0 +1,6 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { AuditTask, CoverageMatrix } from "../types.js";
+import type { FlowCoverageManifest } from "../types/flowCoverage.js";
+import type { CriticalFlowManifest } from "audit-tools/shared";
+export declare function buildFlowRequeueTasks(criticalFlows: CriticalFlowManifest, flowCoverage: FlowCoverageManifest, coverageMatrix: CoverageMatrix, externalAnalyzerResults?: ExternalAnalyzerResults): AuditTask[];
+//# sourceMappingURL=flowRequeue.d.ts.map

package/dist/audit/orchestrator/flowRequeue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flowRequeue.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/flowRequeue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAQ,MAAM,aAAa,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA4B/D,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,oBAAoB,EACnC,YAAY,EAAE,oBAAoB,EAClC,cAAc,EAAE,cAAc,EAC9B,uBAAuB,CAAC,EAAE,uBAAuB,GAChD,SAAS,EAAE,CAuEb"}