audit-tools 0.28.0

package/dist/audit/orchestrator/unitBuilder.js

@@ -0,0 +1,171 @@
+import { deriveBrowserExtensionLensesForPath, hasBrowserExtensionManifestFile, inferBrowserExtensionUnitKind, } from "../extractors/browserExtension.js";
+import { bucketFile } from "../extractors/bucketing.js";
+import { buildDispositionMap, isAuditExcludedStatus } from "../extractors/disposition.js";
+import { pathTokens, normalizeExtractorPath } from "../extractors/pathPatterns.js";
+import { sortLenses } from "./auditTaskUtils.js";
+const LENS_MAP = {
+    runtime: ["correctness", "maintainability", "tests", "observability"],
+    interface: ["correctness", "security", "reliability", "tests", "observability"],
+    data_layer: ["correctness", "data_integrity", "reliability", "tests"],
+    security_sensitive: ["security", "correctness", "reliability", "tests"],
+    concurrency_state: ["reliability", "performance", "correctness", "tests", "observability"],
+    tests: ["tests", "maintainability"],
+    tooling_scripts: ["correctness", "operability", "config_deployment"],
+    config_deployment: ["config_deployment", "reliability", "operability"],
+    docs_specs: ["maintainability"],
+    generated_vendor: ["maintainability"],
+    unknown: ["correctness"],
+};
+const MAX_RISK_SCORE = 10;
+function inferUnitKind(path, isBrowserExtensionProject = false) {
+    if (isBrowserExtensionProject) {
+        const extensionKind = inferBrowserExtensionUnitKind(path);
+        if (extensionKind) {
+            return extensionKind;
+        }
+    }
+    const normalized = path.toLowerCase();
+    if (normalized.startsWith("apps/") || normalized.startsWith("services/"))
+        return "service";
+    if (normalized.startsWith("packages/"))
+        return "package";
+    if (normalized.startsWith("infra/"))
+        return "infrastructure";
+    if (normalized.startsWith("scripts/") || normalized.startsWith("bin/"))
+        return "script";
+    if (normalized.includes("test") || normalized.includes("spec"))
+        return "test";
+    if (normalized.includes("api/") ||
+        normalized.includes("route") ||
+        normalized.includes("controller"))
+        return "interface";
+    if (normalized.includes("model") ||
+        normalized.includes("schema") ||
+        normalized.includes("migration") ||
+        normalized.includes("db/"))
+        return "data";
+    return "module";
+}
+function inferUnitId(path, kind) {
+    const parts = path.split("/");
+    const normalized = path.toLowerCase();
+    if ((parts[0] === "src" || parts[0] === "lib") && parts.length >= 3) {
+        if (["api", "routes", "controllers", "models", "db", "services"].includes(parts[1])) {
+            return `${parts[0]}-${parts[1]}-${parts[2]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
+        }
+    }
+    if ((parts[0] === "src" || parts[0] === "lib") && parts.length >= 2) {
+        return `${parts[0]}-${parts[1]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
+    }
+    if ((parts[0] === "tests" || parts[0] === "test") && parts.length >= 2) {
+        return `tests-${parts[1]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
+    }
+    if (parts.length >= 3) {
+        return `${parts[0]}-${parts[1]}`.replace(/[^a-zA-Z0-9_-]/g, "-");
+    }
+    if (parts.length === 2) {
+        return parts[0].replace(/[^a-zA-Z0-9_-]/g, "-");
+    }
+    if (normalized.endsWith(".json") ||
+        normalized.endsWith(".yaml") ||
+        normalized.endsWith(".yml") ||
+        normalized.endsWith(".toml") ||
+        normalized.endsWith(".sh") ||
+        normalized.includes("docker") ||
+        normalized.startsWith(".")) {
+        return "root-config";
+    }
+    return `${kind}-${path.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+}
+export { LENS_ORDER, sortLenses } from "./auditTaskUtils.js";
+function applyExtensionLensGuards(path, lenses) {
+    const n = path.toLowerCase();
+    if (n.endsWith(".schema.json") || n.endsWith(".schema.ts")) {
+        return lenses.filter((l) => l === "data_integrity");
+    }
+    if (n.endsWith(".json") || n.endsWith(".yaml") || n.endsWith(".yml")) {
+        return lenses.filter((l) => l !== "tests" && l !== "performance");
+    }
+    return lenses;
+}
+export function deriveRequiredLensesForPath(path, options = {}) {
+    const assignment = bucketFile(path);
+    const required = new Set();
+    for (const bucket of assignment.buckets) {
+        for (const lens of LENS_MAP[bucket]) {
+            required.add(lens);
+        }
+    }
+    if (options.isBrowserExtensionProject) {
+        for (const lens of deriveBrowserExtensionLensesForPath(path)) {
+            required.add(lens);
+        }
+    }
+    return applyExtensionLensGuards(path, sortLenses(required));
+}
+function inferCriticalFlows(files, requiredLenses) {
+    const flows = new Set();
+    const tokens = new Set(files.flatMap((f) => pathTokens(normalizeExtractorPath(f))));
+    if (tokens.has("auth") || tokens.has("session") || tokens.has("token")) {
+        flows.add("auth-session");
+    }
+    if (tokens.has("billing") || tokens.has("invoice") || tokens.has("payment")) {
+        flows.add("billing-payment");
+    }
+    if (tokens.has("queue") ||
+        tokens.has("worker") ||
+        tokens.has("job") ||
+        requiredLenses.includes("reliability")) {
+        flows.add("async-processing");
+    }
+    if (tokens.has("deploy") ||
+        tokens.has("docker") ||
+        requiredLenses.includes("config_deployment")) {
+        flows.add("deployment-config");
+    }
+    return [...flows];
+}
+export function buildUnitManifest(repoManifest, disposition) {
+    const units = new Map();
+    const isBrowserExtensionProject = hasBrowserExtensionManifestFile(repoManifest);
+    const dispositionMap = buildDispositionMap(disposition);
+    for (const file of repoManifest.files) {
+        const status = dispositionMap.get(file.path);
+        if (file.excluded || (status && isAuditExcludedStatus(status))) {
+            continue;
+        }
+        const kind = inferUnitKind(file.path, isBrowserExtensionProject);
+        const unitId = inferUnitId(file.path, kind);
+        const existing = units.get(unitId) ?? {
+            unit_id: unitId,
+            name: unitId,
+            kind,
+            files: [],
+            required_lenses: [],
+        };
+        if (!existing.files.includes(file.path)) {
+            existing.files.push(file.path);
+        }
+        const assignment = bucketFile(file.path);
+        const required = new Set(existing.required_lenses);
+        for (const lens of deriveRequiredLensesForPath(file.path, {
+            isBrowserExtensionProject,
+        })) {
+            required.add(lens);
+        }
+        existing.required_lenses = sortLenses(required);
+        const riskScore = new Set(assignment.buckets).size +
+            (assignment.buckets.includes("security_sensitive") ? 3 : 0) +
+            (assignment.buckets.includes("interface") ? 1 : 0) +
+            (assignment.buckets.includes("data_layer") ? 1 : 0);
+        existing.risk_score = Math.min(MAX_RISK_SCORE, Math.max(existing.risk_score ?? 0, riskScore));
+        existing.files = existing.files.sort((a, b) => a.localeCompare(b));
+        existing.critical_flows = inferCriticalFlows(existing.files, existing.required_lenses);
+        units.set(unitId, existing);
+    }
+    return {
+        units: [...units.values()].sort((a, b) => (b.risk_score ?? 0) - (a.risk_score ?? 0) ||
+            a.unit_id.localeCompare(b.unit_id)),
+    };
+}
+//# sourceMappingURL=unitBuilder.js.map

package/dist/audit/orchestrator/unitBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unitBuilder.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/unitBuilder.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAmB,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAc,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,QAAQ,GAA+B;IAC3C,OAAO,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,CAAC;IACrE,SAAS,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC;IAC/E,UAAU,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC;IACrE,kBAAkB,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC;IACvE,iBAAiB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC;IAC1F,KAAK,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACnC,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,mBAAmB,CAAC;IACpE,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,aAAa,CAAC;IACtE,UAAU,EAAE,CAAC,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;IACrC,OAAO,EAAE,CAAC,aAAa,CAAC;CACzB,CAAC;AACF,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,aAAa,CAAC,IAAY,EAAE,yBAAyB,GAAG,KAAK;IACpE,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC7D,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QACpE,OAAO,QAAQ,CAAC;IAClB,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9E,IACE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QAEjC,OAAO,WAAW,CAAC;IACrB,IACE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAE1B,OAAO,MAAM,CAAC;IAChB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAEtC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpE,IACE,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CACnE,KAAK,CAAC,CAAC,CAAC,CACT,EACD,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAClD,iBAAiB,EACjB,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,IACE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE7D,SAAS,wBAAwB,CAAC,IAAY,EAAE,MAAgB;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,UAAmD,EAAE;IAErD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,mCAAmC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,cAAwB;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IACD,IACE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACjB,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EACtC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;IACD,IACE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,cAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAC5C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,YAA0B,EAC1B,WAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/D,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;YACpC,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,eAAe,EAAE,EAAE;SACpB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,EAAE;YACxD,yBAAyB;SAC1B,CAAC,EAAE,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,QAAQ,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,SAAS,GACb,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI;YAChC,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAC5B,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,SAAS,CAAC,CAC9C,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,cAAc,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,eAAe,CACzB,CAAC;QAEF,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;YACzC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACrC;KACF,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator.d.ts

@@ -0,0 +1,7 @@
+import type { AuditTask, UnitManifest } from "./types.js";
+export interface TaskBuildOptions {
+    pass_prefix?: string;
+    limit_lenses?: string[];
+}
+export declare function buildAuditTasks(unitManifest: UnitManifest, options?: TaskBuildOptions | string): AuditTask[];
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/audit/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/audit/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAQ,YAAY,EAAE,MAAM,YAAY,CAAC;AAQhE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAkED,wBAAgB,eAAe,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,GAAE,gBAAgB,GAAG,MAAW,GACtC,SAAS,EAAE,CAuBb"}

package/dist/audit/orchestrator.js

@@ -0,0 +1,68 @@
+import { coerceJsonObjectArg } from "audit-tools/shared";
+function isRecord(value) {
+    return value !== null && typeof value === "object";
+}
+function assertStringArray(value, label) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new TypeError(`${label} must be an array of strings.`);
+    }
+}
+function assertLensArray(value, label) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new TypeError(`${label} must be an array of strings.`);
+    }
+}
+function assertUnitManifest(value) {
+    if (!isRecord(value) || !Array.isArray(value.units)) {
+        throw new TypeError("buildAuditTasks requires unitManifest.units to be an array.");
+    }
+    value.units.forEach((unit, index) => {
+        const label = `unitManifest.units[${index}]`;
+        if (!isRecord(unit)) {
+            throw new TypeError(`${label} must be an object.`);
+        }
+        if (typeof unit.unit_id !== "string" || unit.unit_id.length === 0) {
+            throw new TypeError(`${label}.unit_id must be a non-empty string.`);
+        }
+        if (typeof unit.name !== "string" || unit.name.length === 0) {
+            throw new TypeError(`${label}.name must be a non-empty string.`);
+        }
+        assertStringArray(unit.files, `${label}.files`);
+        assertLensArray(unit.required_lenses, `${label}.required_lenses`);
+    });
+}
+function normalizedOptions(rawOptions) {
+    const options = coerceJsonObjectArg(rawOptions, "buildAuditTasks options");
+    if (options.pass_prefix !== undefined && typeof options.pass_prefix !== "string") {
+        throw new TypeError("buildAuditTasks options.pass_prefix must be a string.");
+    }
+    if (options.limit_lenses !== undefined) {
+        assertLensArray(options.limit_lenses, "buildAuditTasks options.limit_lenses");
+    }
+    return {
+        passPrefix: options.pass_prefix ?? "pass",
+        allowed: options.limit_lenses ? new Set(options.limit_lenses) : null,
+    };
+}
+export function buildAuditTasks(unitManifest, options = {}) {
+    assertUnitManifest(unitManifest);
+    const { allowed, passPrefix } = normalizedOptions(options);
+    const tasks = [];
+    for (const unit of unitManifest.units) {
+        for (const lens of unit.required_lenses) {
+            if (allowed && !allowed.has(lens)) {
+                continue;
+            }
+            tasks.push({
+                task_id: `${unit.unit_id}:${lens}`,
+                unit_id: unit.unit_id,
+                pass_id: `${passPrefix}:${lens}`,
+                lens,
+                file_paths: unit.files,
+                rationale: `Audit ${unit.name} under the ${lens} lens.`,
+            });
+        }
+    }
+    return tasks;
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/audit/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/audit/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAWzD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,sBAAsB,KAAK,GAAG,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QACnE,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAmB;IAI5C,MAAM,OAAO,GAAG,mBAAmB,CACjC,UAA0D,EAC1D,yBAAyB,CAC1B,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;IAChF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACzC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAwB,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,YAA0B,EAC1B,UAAqC,EAAE;IAEvC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;gBAClC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,UAAU,IAAI,IAAI,EAAE;gBAChC,IAAI;gBACJ,UAAU,EAAE,IAAI,CAAC,KAAK;gBACtB,SAAS,EAAE,SAAS,IAAI,CAAC,IAAI,cAAc,IAAI,QAAQ;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/prompts/renderWorkerPrompt.d.ts

@@ -0,0 +1,3 @@
+import { type WorkerTask } from "../types/workerSession.js";
+export declare function renderWorkerPrompt(task: WorkerTask): string;
+//# sourceMappingURL=renderWorkerPrompt.d.ts.map

package/dist/audit/prompts/renderWorkerPrompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderWorkerPrompt.d.ts","sourceRoot":"","sources":["../../../src/audit/prompts/renderWorkerPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EAGhB,MAAM,2BAA2B,CAAC;AAqBnC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAmF3D"}

package/dist/audit/prompts/renderWorkerPrompt.js

@@ -0,0 +1,87 @@
+import { usesDeferredWorkerCommand, } from "../types/workerSession.js";
+function renderArgv(task) {
+    return JSON.stringify(task.worker_command);
+}
+function renderAccessSection(access) {
+    const lines = ["", "## File access"];
+    if (access.read_paths.length > 0) {
+        lines.push(`Read: ${access.read_paths.join(", ")}`);
+    }
+    if (access.write_paths.length > 0) {
+        lines.push(`Write: ${access.write_paths.join(", ")}`);
+    }
+    if (access.forbidden_patterns && access.forbidden_patterns.length > 0) {
+        lines.push(`Forbidden: ${access.forbidden_patterns.join(", ")}`);
+    }
+    lines.push("Do not read or write files outside these paths.");
+    return lines;
+}
+export function renderWorkerPrompt(task) {
+    const commandArgv = renderArgv(task);
+    if (task.preferred_executor === "agent" && task.audit_results_path) {
+        const tasksPath = task.pending_audit_tasks_path ??
+            `${task.artifacts_dir}/audit_tasks.json`;
+        const lines = [
+            `Audit run: ${task.run_id}`,
+            `Repository root: ${task.repo_root}`,
+            "Set the shell/tool workdir to the repository root before executing worker_command.",
+            `Read: ${tasksPath}`,
+            "Scope: review only the tasks listed in the Read file. Do not add tasks,",
+            "edit source files, remediate findings, run unrelated audits, or write result_path.",
+            "Use host Read and Grep tools for source inspection. Do not use shell search commands.",
+            "For each listed task: read the assigned file_paths under the specified lens,",
+            "using targeted reads/searches where they give complete enough evidence without loading unrelated context,",
+            "and emit exactly one AuditResult object with:",
+            "  task_id, unit_id, pass_id, lens (copy from task),",
+            "  file_coverage: [{path, total_lines}] — coverage stat; use file_line_counts[path] from the task",
+            "    (advisory: a count mismatch is a warning, not an error — findings are grounded by quoted_text below),",
+            "  findings: [] or array of finding objects.",
+            "Each finding: id, title, category, severity, confidence, lens, summary,",
+            "  affected_files [{path, line_start, line_end, symbol, quoted_text}] (objects, not strings; min 1 entry),",
+            "  evidence [strings] (min 1 entry).",
+            "Grounding (required): at least one affected_files entry must include quoted_text — a short",
+            "  verbatim span copied EXACTLY from that file at the cited lines. The tool re-reads it and",
+            "  content-matches against disk; a finding whose quoted_text is not found on disk (or is omitted)",
+            "  is marked ungrounded and surfaced for review. Quote real code that exists; never paraphrase.",
+            "  Matching is on content (whitespace-normalized), so exact line numbers may safely drift.",
+            "Behavior claims (a cycle, an unused symbol, 'throws', a failing check) may also add an",
+            "  executable_anchor {command:[argv], confirm_if:{kind: exit_zero|exit_nonzero|output_includes|output_excludes, text?}}.",
+            "  The tool RUNS the read-only command from the repo root and confirms or REFUTES the claim — a refuting run",
+            "  quarantines the finding. Inspection tools only (grep/rg/findstr/madge/ast-grep, or read-only git grep/log/diff/show);",
+            "  off-allowlist commands (node/npm/…) are skipped, not run. e.g. {command:['madge','--circular','src'],",
+            "  confirm_if:{kind:'output_includes', text:'src/a.ts'}} to prove a cycle, or grep to prove a symbol's (non-)existence.",
+            "For tasks tagged lens_verification: do not write direct findings; use findings: []",
+            "  and include verification {verified, needs_followup, concerns, coverage_concerns,",
+            "  confidence_concerns, followup_tasks}.",
+            "Constraint: line_end must not exceed total_lines for that file.",
+            "Windows PowerShell: do not pipe an inline foreach statement directly into ConvertTo-Json.",
+            "Assign the foreach output to a variable first, then pipe that variable to ConvertTo-Json.",
+            "PowerShell also unwraps single-element arrays: @(@{...}) collapses to one object, so a one-result",
+            "submission serializes as an object (not a 1-element array) and is rejected. Wrap it yourself:",
+            "'[' + (ConvertTo-Json $obj -Depth 12) + ']', or build the array with Write-Output -NoEnumerate.",
+            `Write only the JSON array of AuditResult objects to: ${task.audit_results_path}`,
+        ];
+        lines.push("Optional — never let this delay or replace the audit result: if you hit task", "ambiguity, tool friction, or unclear instructions, you MAY append one JSON", `reflection line to ${task.artifacts_dir}/agent-feedback.jsonl with shape:`, "  {task_id, lens, instruction_clarity (clear|mostly_clear|ambiguous|unclear),", "   ambiguities: [string], tool_friction: [string], suggestions: [string],", "   severity (info|low|medium|high)}. One object per line; never overwrite existing lines.");
+        if (usesDeferredWorkerCommand(task)) {
+            lines.push("Deferred mode: write results, do not execute worker_command.");
+        }
+        else {
+            lines.push("After writing audit_results_path, execute worker_command from task.json exactly.", "The worker command ingests audit_results_path and writes result_path.", `Command: ${commandArgv}`);
+        }
+        if (task.access) {
+            lines.push(...renderAccessSection(task.access));
+        }
+        return lines.join("\n");
+    }
+    return [
+        `Task: ${task.run_id}`,
+        `Executor: ${task.preferred_executor}`,
+        `Repository root: ${task.repo_root}`,
+        "Set the shell/tool workdir to the repository root before executing worker_command.",
+        "Execute worker_command from task.json exactly.",
+        `Command: ${commandArgv}`,
+        "Write result to: " + task.result_path,
+        "Stop after completion.",
+    ].join("\n");
+}
+//# sourceMappingURL=renderWorkerPrompt.js.map

package/dist/audit/prompts/renderWorkerPrompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderWorkerPrompt.js","sourceRoot":"","sources":["../../../src/audit/prompts/renderWorkerPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,SAAS,UAAU,CAAC,IAAgB;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IACpD,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,kBAAkB,KAAK,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACnE,MAAM,SAAS,GACb,IAAI,CAAC,wBAAwB;YAC7B,GAAG,IAAI,CAAC,aAAa,mBAAmB,CAAC;QAC3C,MAAM,KAAK,GAAG;YACZ,cAAc,IAAI,CAAC,MAAM,EAAE;YAC3B,oBAAoB,IAAI,CAAC,SAAS,EAAE;YACpC,oFAAoF;YACpF,SAAS,SAAS,EAAE;YACpB,yEAAyE;YACzE,oFAAoF;YACpF,uFAAuF;YACvF,8EAA8E;YAC9E,2GAA2G;YAC3G,+CAA+C;YAC/C,qDAAqD;YACrD,kGAAkG;YAClG,2GAA2G;YAC3G,6CAA6C;YAC7C,yEAAyE;YACzE,2GAA2G;YAC3G,qCAAqC;YACrC,4FAA4F;YAC5F,4FAA4F;YAC5F,kGAAkG;YAClG,gGAAgG;YAChG,2FAA2F;YAC3F,wFAAwF;YACxF,yHAAyH;YACzH,6GAA6G;YAC7G,yHAAyH;YACzH,yGAAyG;YACzG,wHAAwH;YACxH,oFAAoF;YACpF,oFAAoF;YACpF,yCAAyC;YACzC,iEAAiE;YACjE,2FAA2F;YAC3F,2FAA2F;YAC3F,mGAAmG;YACnG,+FAA+F;YAC/F,iGAAiG;YACjG,wDAAwD,IAAI,CAAC,kBAAkB,EAAE;SAClF,CAAC;QAEF,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,4EAA4E,EAC5E,sBAAsB,IAAI,CAAC,aAAa,mCAAmC,EAC3E,+EAA+E,EAC/E,2EAA2E,EAC3E,2FAA2F,CAC5F,CAAC;QAEF,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,kFAAkF,EAClF,uEAAuE,EACvE,YAAY,WAAW,EAAE,CAC1B,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,SAAS,IAAI,CAAC,MAAM,EAAE;QACtB,aAAa,IAAI,CAAC,kBAAkB,EAAE;QACtC,oBAAoB,IAAI,CAAC,SAAS,EAAE;QACpC,oFAAoF;QACpF,gDAAgD;QAChD,YAAY,WAAW,EAAE;QACzB,mBAAmB,GAAG,IAAI,CAAC,WAAW;QACtC,wBAAwB;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/audit/providers/claudeCodeProvider.d.ts

@@ -0,0 +1,11 @@
+import type { ClaudeCodeConfig, spawnLoggedCommand } from "audit-tools/shared";
+import { ClaudeCodeProvider } from "audit-tools/shared";
+export declare const ACTIVE_CLAUDE_CODE_SESSION_MESSAGE: string;
+/**
+ * Construct the shared ClaudeCodeProvider with audit-code's options. The
+ * auditor only skips permissions when `dangerously_skip_permissions: true` is
+ * set explicitly (skipPermissionsDefault stays false).
+ */
+export declare function createClaudeCodeProvider(config?: ClaudeCodeConfig, launchCommand?: typeof spawnLoggedCommand): ClaudeCodeProvider;
+export { ClaudeCodeProvider } from "audit-tools/shared";
+//# sourceMappingURL=claudeCodeProvider.d.ts.map

package/dist/audit/providers/claudeCodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeProvider.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/claudeCodeProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAQ5B,eAAO,MAAM,kCAAkC,QAI3C,CAAC;AAEL;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,GAAE,gBAAqB,EAC7B,aAAa,CAAC,EAAE,OAAO,kBAAkB,GACxC,kBAAkB,CASpB;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/providers/claudeCodeProvider.js

@@ -0,0 +1,23 @@
+import { ClaudeCodeProvider, buildActiveClaudeCodeSessionMessage, } from "audit-tools/shared";
+// The claude-code provider class is single-sourced in audit-tools/shared
+// (drift-plan E4). This module only carries audit-code's intended delta — the
+// session-config path quoted in the nested-session guard message — and binds it
+// via a factory; it defines no provider class body of its own. audit-code keeps
+// the safe skip-permissions default (off unless explicitly configured).
+export const ACTIVE_CLAUDE_CODE_SESSION_MESSAGE = buildActiveClaudeCodeSessionMessage({
+    sessionConfigPath: ".audit-tools/audit/session-config.json",
+    slashCommand: "/audit-code",
+});
+/**
+ * Construct the shared ClaudeCodeProvider with audit-code's options. The
+ * auditor only skips permissions when `dangerously_skip_permissions: true` is
+ * set explicitly (skipPermissionsDefault stays false).
+ */
+export function createClaudeCodeProvider(config = {}, launchCommand) {
+    return new ClaudeCodeProvider(config, {
+        skipPermissionsDefault: false,
+        activeSessionMessage: ACTIVE_CLAUDE_CODE_SESSION_MESSAGE,
+    }, launchCommand);
+}
+export { ClaudeCodeProvider } from "audit-tools/shared";
+//# sourceMappingURL=claudeCodeProvider.js.map

package/dist/audit/providers/claudeCodeProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeProvider.js","sourceRoot":"","sources":["../../../src/audit/providers/claudeCodeProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,mCAAmC,GACpC,MAAM,oBAAoB,CAAC;AAE5B,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAC7C,mCAAmC,CAAC;IAClC,iBAAiB,EAAE,wCAAwC;IAC3D,YAAY,EAAE,aAAa;CAC5B,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA2B,EAAE,EAC7B,aAAyC;IAEzC,OAAO,IAAI,kBAAkB,CAC3B,MAAM,EACN;QACE,sBAAsB,EAAE,KAAK;QAC7B,oBAAoB,EAAE,kCAAkC;KACzD,EACD,aAAa,CACd,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/providers/constants.d.ts

@@ -0,0 +1,2 @@
+export { LOCAL_SUBPROCESS_PROVIDER_NAME, CODEX_PROVIDER_NAME, ANTIGRAVITY_PROVIDER_NAME, } from "audit-tools/shared";
+//# sourceMappingURL=constants.d.ts.map

package/dist/audit/providers/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC"}

package/dist/audit/providers/constants.js

@@ -0,0 +1,2 @@
+export { LOCAL_SUBPROCESS_PROVIDER_NAME, CODEX_PROVIDER_NAME, ANTIGRAVITY_PROVIDER_NAME, } from "audit-tools/shared";
+//# sourceMappingURL=constants.js.map

package/dist/audit/providers/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/audit/providers/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC"}

package/dist/audit/providers/index.d.ts

@@ -0,0 +1,14 @@
+import type { FreshSessionProvider, ResolvedProviderName, SessionConfig } from "audit-tools/shared";
+/**
+ * Auto-resolution and provider wiring are single-sourced in `audit-tools/shared`.
+ * The claude-code / opencode provider classes are shared too; this module only
+ * injects audit-code's bound factories (the sole delta is the claude-code
+ * skip-permissions default — off — and the nested-session guard message) and
+ * attributes the auto-fallback warning to `audit-code`.
+ */
+export declare function resolveFreshSessionProviderName(name: string | undefined, sessionConfig?: SessionConfig, options?: {
+    env?: NodeJS.ProcessEnv;
+    commandExists?: (command: string) => boolean;
+}): ResolvedProviderName;
+export declare function createFreshSessionProvider(name: string | undefined, sessionConfig?: SessionConfig): FreshSessionProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAI5B;;;;;;GAMG;AAEH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,GAAE,aAAkB,EACjC,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC,GACL,oBAAoB,CAEtB;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,GAAE,aAAkB,GAChC,oBAAoB,CAMtB"}

package/dist/audit/providers/index.js

@@ -0,0 +1,21 @@
+import { createFreshSessionProvider as createSharedFreshSessionProvider, resolveFreshSessionProviderName as resolveSharedFreshSessionProviderName, } from "audit-tools/shared";
+import { createClaudeCodeProvider } from "./claudeCodeProvider.js";
+import { createOpenCodeProvider } from "./opencodeProvider.js";
+/**
+ * Auto-resolution and provider wiring are single-sourced in `audit-tools/shared`.
+ * The claude-code / opencode provider classes are shared too; this module only
+ * injects audit-code's bound factories (the sole delta is the claude-code
+ * skip-permissions default — off — and the nested-session guard message) and
+ * attributes the auto-fallback warning to `audit-code`.
+ */
+export function resolveFreshSessionProviderName(name, sessionConfig = {}, options = {}) {
+    return resolveSharedFreshSessionProviderName(name, sessionConfig, options);
+}
+export function createFreshSessionProvider(name, sessionConfig = {}) {
+    return createSharedFreshSessionProvider(name, sessionConfig, {
+        orchestratorName: "audit-code",
+        createClaudeCodeProvider: (config) => createClaudeCodeProvider(config),
+        createOpenCodeProvider: (config) => createOpenCodeProvider(config),
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/audit/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,IAAI,gCAAgC,EAC9D,+BAA+B,IAAI,qCAAqC,GACzE,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;GAMG;AAEH,MAAM,UAAU,+BAA+B,CAC7C,IAAwB,EACxB,gBAA+B,EAAE,EACjC,UAGI,EAAE;IAEN,OAAO,qCAAqC,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAwB,EACxB,gBAA+B,EAAE;IAEjC,OAAO,gCAAgC,CAAC,IAAI,EAAE,aAAa,EAAE;QAC3D,gBAAgB,EAAE,YAAY;QAC9B,wBAAwB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACtE,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC;KACnE,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/providers/opencodeProvider.d.ts

@@ -0,0 +1,5 @@
+import type { OpenCodeConfig, spawnLoggedCommand } from "audit-tools/shared";
+import { OpenCodeProvider } from "audit-tools/shared";
+export declare function createOpenCodeProvider(config?: OpenCodeConfig, launchCommand?: typeof spawnLoggedCommand): OpenCodeProvider;
+export { OpenCodeProvider } from "audit-tools/shared";
+//# sourceMappingURL=opencodeProvider.d.ts.map

package/dist/audit/providers/opencodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodeProvider.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/opencodeProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAOtD,wBAAgB,sBAAsB,CACpC,MAAM,GAAE,cAAmB,EAC3B,aAAa,CAAC,EAAE,OAAO,kBAAkB,GACxC,gBAAgB,CAElB;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/providers/opencodeProvider.js

@@ -0,0 +1,10 @@
+import { OpenCodeProvider } from "audit-tools/shared";
+// The opencode provider class is single-sourced in audit-tools/shared
+// (drift-plan E4). opencode has no skip-permissions flag, so there is no
+// per-orchestrator delta — this module is a thin construction shim with no
+// provider class body of its own.
+export function createOpenCodeProvider(config = {}, launchCommand) {
+    return new OpenCodeProvider(config, launchCommand);
+}
+export { OpenCodeProvider } from "audit-tools/shared";
+//# sourceMappingURL=opencodeProvider.js.map

package/dist/audit/providers/opencodeProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencodeProvider.js","sourceRoot":"","sources":["../../../src/audit/providers/opencodeProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,kCAAkC;AAElC,MAAM,UAAU,sBAAsB,CACpC,SAAyB,EAAE,EAC3B,aAAyC;IAEzC,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/quota/discoveredLimits.d.ts

@@ -0,0 +1,27 @@
+export interface DiscoveredRateLimits {
+    requests_per_minute?: number | null;
+    input_tokens_per_minute?: number | null;
+    output_tokens_per_minute?: number | null;
+    /** Discovered context window for the dispatch model (capability handshake). */
+    context_tokens?: number | null;
+    /** Discovered output cap for the dispatch model (capability handshake). */
+    output_tokens?: number | null;
+    source: string;
+}
+export interface DiscoveredLimitsCacheEntry {
+    requests_per_minute?: number;
+    input_tokens_per_minute?: number;
+    output_tokens_per_minute?: number;
+    discovered_at: string;
+    source: string;
+}
+export interface DiscoveredLimitsCache {
+    version: 1;
+    entries: Record<string, DiscoveredLimitsCacheEntry>;
+}
+export declare function readDiscoveredLimitsCache(): Promise<DiscoveredLimitsCache>;
+export declare function writeDiscoveredLimitsCache(cache: DiscoveredLimitsCache): Promise<void>;
+export declare function updateDiscoveredLimits(providerModelKey: string, limits: DiscoveredRateLimits): Promise<void>;
+export declare function lookupDiscoveredLimits(providerModelKey: string): Promise<DiscoveredRateLimits | null>;
+export declare function mergeDiscoveredLimits(...sources: (DiscoveredRateLimits | null | undefined)[]): DiscoveredRateLimits | null;
+//# sourceMappingURL=discoveredLimits.d.ts.map

package/dist/audit/quota/discoveredLimits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoveredLimits.d.ts","sourceRoot":"","sources":["../../../src/audit/quota/discoveredLimits.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACrD;AAMD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAsBhF;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5F;AAED,wBAAsB,sBAAsB,CAC1C,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,sBAAsB,CAC1C,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAgBtC;AAED,wBAAgB,qBAAqB,CACnC,GAAG,OAAO,EAAE,CAAC,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACtD,oBAAoB,GAAG,IAAI,CAe7B"}