audit-tools 0.28.0

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,MAAM,IAAI,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,UAAU,GACV,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,mBAAmB,GACnB,eAAe,CAAC;AAEpB;qEACqE;AACrE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;0EAE0E;AAC1E,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAYlD,CAAC;AAEF;;;wCAGwC;AACxC,eAAO,MAAM,UAAU,EAAE,SAAS,IAAI,EAAmC,CAAC;AAE1E,yFAAyF;AACzF,eAAO,MAAM,cAAc,EAAE,SAAS,IAAI,EAEvB,CAAC;AAEpB,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAIpD;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;yEAOyE;AACzE,eAAO,MAAM,0BAA0B,qKAWrC,CAAC;AAEH,eAAO,MAAM,uBAAuB,0JAAqC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;EAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;IAmB1B;;;;;;OAMG;;IAEH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC;AAEpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA5BlC;;;;;;WAMG;;QAEH;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBH,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAtC5B;;;;;;eAMG;;YAEH;;;;;eAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CH,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/audit/types.js

@@ -0,0 +1,160 @@
+import { z } from "zod";
+import { FindingSchema } from "audit-tools/shared";
+/** Single source of truth for all lens metadata. Adding or renaming a lens
+ * requires a single edit here; `ALL_LENSES`, `ENABLED_LENSES`, and
+ * `LENS_ORDER` (in auditTaskUtils) are all derived from this registry. */
+export const LENS_REGISTRY = [
+    { id: "security", display_name: "Security", order_weight: 10, default_enabled: true },
+    { id: "correctness", display_name: "Correctness", order_weight: 20, default_enabled: true },
+    { id: "reliability", display_name: "Reliability", order_weight: 30, default_enabled: true },
+    { id: "data_integrity", display_name: "Data Integrity", order_weight: 40, default_enabled: true },
+    { id: "performance", display_name: "Performance", order_weight: 50, default_enabled: true },
+    { id: "architecture", display_name: "Architecture", order_weight: 60, default_enabled: true },
+    { id: "operability", display_name: "Operability", order_weight: 70, default_enabled: true },
+    { id: "config_deployment", display_name: "Config & Deployment", order_weight: 80, default_enabled: true },
+    { id: "observability", display_name: "Observability", order_weight: 90, default_enabled: true },
+    { id: "maintainability", display_name: "Maintainability", order_weight: 100, default_enabled: true },
+    { id: "tests", display_name: "Tests", order_weight: 110, default_enabled: true },
+];
+/** Canonical list of every valid {@link Lens}. Derived from {@link LENS_REGISTRY}
+ * — import {@link isLens} / `ALL_LENSES` instead of hand-copying lens lists into
+ * local guards, which drift (a copy omitting "observability" caused it to be
+ * wrongly rejected in flow requeue). */
+export const ALL_LENSES = LENS_REGISTRY.map((d) => d.id);
+/** Lenses enabled by default (all entries in the registry with default_enabled true). */
+export const ENABLED_LENSES = LENS_REGISTRY
+    .filter((d) => d.default_enabled)
+    .map((d) => d.id);
+export function isLens(value) {
+    return (typeof value === "string" && ALL_LENSES.includes(value));
+}
+export const FileRecordSchema = z.object({
+    path: z.string(),
+    language: z.string(),
+    size_bytes: z.number(),
+    hash: z.string().optional(),
+    excluded: z.boolean().optional(),
+    exclusion_reason: z.string().optional(),
+});
+export const RepoManifestSchema = z.object({
+    repository: z.object({
+        name: z.string(),
+        root: z.string().optional(),
+        default_branch: z.string().optional(),
+    }),
+    generated_at: z.string(),
+    files: z.array(FileRecordSchema),
+});
+export const AuditUnitSchema = z
+    .object({
+    unit_id: z.string(),
+    name: z.string(),
+    kind: z.string().optional(),
+    files: z.array(z.string()),
+    risk_score: z.number().min(0).max(10).optional(),
+    required_lenses: z.array(z.string()),
+    critical_flows: z.array(z.string()).optional(),
+})
+    .strict();
+export const UnitManifestSchema = z.object({
+    units: z.array(AuditUnitSchema),
+});
+/** Single source of truth for coverage-matrix classification statuses (mirrors
+ * the LENS_REGISTRY-derives-Lens pattern above). The value set is
+ * {unclassified, classified} plus the audit-excluded subset of
+ * FileDispositionStatus (excluded | generated | vendor | binary | doc_only)
+ * plus the scope/trivial-audit statuses written by scope.ts
+ * (out_of_scope_delta, out_of_scope_intent) and trivialAudit.ts
+ * (excluded_trivial). The coverage_matrix JSON schema is GENERATED from
+ * {@link CoverageMatrixSchema}, so it can never drift from this enum. */
+export const ClassificationStatusSchema = z.enum([
+    "unclassified",
+    "classified",
+    "excluded",
+    "generated",
+    "vendor",
+    "binary",
+    "doc_only",
+    "out_of_scope_delta",
+    "excluded_trivial",
+    "out_of_scope_intent",
+]);
+export const CLASSIFICATION_STATUSES = ClassificationStatusSchema.options;
+export const CoverageFileRecordSchema = z.object({
+    path: z.string(),
+    unit_ids: z.array(z.string()),
+    classification_status: ClassificationStatusSchema,
+    audit_status: z.string(),
+    required_lenses: z.array(z.string()),
+    completed_lenses: z.array(z.string()),
+});
+export const CoverageMatrixSchema = z.object({
+    files: z.array(CoverageFileRecordSchema),
+});
+export const AuditTaskSchema = z.object({
+    task_id: z.string(),
+    unit_id: z.string(),
+    pass_id: z.string(),
+    lens: z.string(),
+    file_paths: z.array(z.string()),
+    file_line_counts: z.record(z.string(), z.number()).optional(),
+    line_ranges: z
+        .array(z.object({
+        path: z.string(),
+        start: z.number(),
+        end: z.number(),
+    }))
+        .optional(),
+    inputs: z.record(z.string(), z.string()).optional(),
+    rationale: z.string(),
+    priority: z.enum(["high", "medium", "low"]).optional(),
+    /**
+     * Frozen, provider-neutral estimate of the content tokens this task's files
+     * contribute to a review prompt. Seeded deterministically at planning
+     * (byte-based) and refined/frozen by the estimate-review step. Authoritative
+     * input to just-in-time dispatch packetization — see
+     * docs/audit-workflow-design.md.
+     */
+    token_estimate: z.number().optional(),
+    /**
+     * Frozen, provider-neutral audit-risk score in [0,1] (likelihood × stakes of
+     * latent defects). Seeded deterministically from priority/lens/tags and
+     * refined/frozen by the estimate-review step. Drives just-in-time risk-mass
+     * packetization and model-tier routing; never a model/provider decision.
+     */
+    risk_estimate: z.number().optional(),
+    tags: z.array(z.string()).optional(),
+    status: z.enum(["pending", "complete"]).optional(),
+    completed_at: z.string().optional(),
+    completion_reason: z.string().optional(),
+});
+export const AuditVerificationSchema = z.object({
+    verified: z.boolean(),
+    needs_followup: z.boolean(),
+    concerns: z.array(z.string()).optional(),
+    coverage_concerns: z.array(z.string()).optional(),
+    confidence_concerns: z.array(z.string()).optional(),
+    followup_tasks: z.array(AuditTaskSchema).optional(),
+});
+export const AuditResultSchema = z.object({
+    task_id: z.string(),
+    unit_id: z.string(),
+    pass_id: z.string(),
+    lens: z.string(),
+    agent_role: z.string().optional(),
+    file_coverage: z.array(z.object({
+        path: z.string(),
+        total_lines: z.number(),
+    })),
+    // The auditor accepts any string as lens (canonical + custom); the shared
+    // FindingSchema already types lens as string, so a Finding here IS a
+    // SharedFinding (the former Omit<…,"lens"> narrowing was a no-op).
+    findings: z.array(FindingSchema),
+    notes: z.array(z.string()).optional(),
+    requires_followup: z.boolean().optional(),
+    followup_tasks: z.array(z.string()).optional(),
+    verification: AuditVerificationSchema.optional(),
+    run_id: z.string().optional(),
+    submitted_at: z.string().optional(),
+});
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyBnD;;0EAE0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAA8B;IACtD,EAAE,EAAE,EAAE,UAAU,EAAY,YAAY,EAAE,UAAU,EAAY,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,gBAAgB,EAAM,YAAY,EAAE,gBAAgB,EAAM,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,cAAc,EAAQ,YAAY,EAAE,cAAc,EAAQ,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,aAAa,EAAS,YAAY,EAAE,aAAa,EAAS,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,mBAAmB,EAAG,YAAY,EAAE,qBAAqB,EAAC,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,eAAe,EAAO,YAAY,EAAE,eAAe,EAAO,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;IACzG,EAAE,EAAE,EAAE,iBAAiB,EAAK,YAAY,EAAE,iBAAiB,EAAK,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;IAC1G,EAAE,EAAE,EAAE,OAAO,EAAe,YAAY,EAAE,OAAO,EAAe,YAAY,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;CAC3G,CAAC;AAEF;;;wCAGwC;AACxC,MAAM,CAAC,MAAM,UAAU,GAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAoB,aAAa;KACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpB,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CAChC,CAAC,CAAC;AAWH;;;;;;;yEAOyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,cAAc;IACd,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,oBAAoB;IACpB,kBAAkB;IAClB,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC,OAAO,CAAC;AAI1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,qBAAqB,EAAE,0BAA0B;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CACzC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;KAChB,CAAC,CACH;SACA,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC,CACH;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC"}

package/dist/audit/validation/anchorGrounding.d.ts

@@ -0,0 +1,49 @@
+import { ANCHOR_ALLOWLIST, GIT_READONLY_SUBCOMMANDS, isAllowedAnchorCommand } from "audit-tools/shared";
+import type { AllowlistedExecOutcome, AllowlistedExecRunner, Finding, FindingGrounding } from "audit-tools/shared";
+export { isAllowedAnchorCommand, ANCHOR_ALLOWLIST, GIT_READONLY_SUBCOMMANDS };
+/** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
+export declare const ANCHOR_TIMEOUT_MS = 60000;
+/**
+ * The effective per-anchor timeout. The 60s default suits the common anchors
+ * (madge/grep/rg/git) but a legitimately slow check on a large repo would be
+ * silently killed → `inconclusive`; `AUDIT_CODE_ANCHOR_TIMEOUT_MS` (a positive
+ * integer in ms) lets an operator raise it per run without code changes. Read
+ * per-call to mirror `AUDIT_CODE_DISABLE_ANCHORS` (no import-time capture).
+ */
+export declare function resolveAnchorTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * Bounded concurrency for the ingest grounding pass. Anchors spawn child
+ * processes, so a serial pass over many anchored findings costs the *sum* of
+ * their runtimes — noticeably slow in practice. Grounding each finding under a
+ * pool of this size turns that into ~N/cap batches while capping concurrent
+ * spawns so the audited machine is not thrashed. CPU-derived, clamped to [2, 8].
+ */
+export declare const ANCHOR_GROUNDING_CONCURRENCY: number;
+/** Outcome of actually running an anchor command (injectable for tests). */
+export type AnchorRunOutcome = AllowlistedExecOutcome;
+export type AnchorRunner = AllowlistedExecRunner;
+/** Verdict of an anchor run, folded into the finding's grounding by the caller. */
+export interface AnchorResult {
+    status: "confirmed" | "refuted" | "inconclusive" | "skipped";
+    summary: string;
+    /** Last lines of the command output, for display. */
+    evidence?: string[];
+}
+/**
+ * Run a finding's executable anchor (if any) and return the verdict. Pure of any
+ * finding mutation — the caller folds the result into `grounding` via
+ * {@link combineGroundingWithAnchor}. Returns `undefined` when the finding has
+ * no anchor (nothing to run).
+ */
+export declare function verifyFindingAnchor(repoRoot: string, finding: Finding, run?: AnchorRunner): Promise<AnchorResult | undefined>;
+/**
+ * Fold an anchor verdict into the quote-and-verify (tier-1) grounding. A
+ * confirming run grounds the finding (a verified behavior claim outranks a
+ * missing quote); a refuting run quarantines it (the cited code may exist, but
+ * the behavior claim is false); an inconclusive/skipped/absent anchor leaves the
+ * tier-1 verdict in place.
+ */
+export declare function combineGroundingWithAnchor(tier1: FindingGrounding, anchor: AnchorResult | undefined): FindingGrounding;
+/** One evidence line summarising the anchor run, appended to the finding's evidence. */
+export declare function anchorEvidenceLine(anchor: AnchorResult): string;
+//# sourceMappingURL=anchorGrounding.d.ts.map

package/dist/audit/validation/anchorGrounding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchorGrounding.d.ts","sourceRoot":"","sources":["../../../src/audit/validation/anchorGrounding.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEL,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EAGvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EAGrB,OAAO,EACP,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AAE9E,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,QAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAGxC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,qBAAqB,CAAC;AASjD,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAsDD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,GAAE,YAAkC,GACtC,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA0DnC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,gBAAgB,CAalB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAE/D"}

package/dist/audit/validation/anchorGrounding.js

@@ -0,0 +1,183 @@
+/**
+ * Executable-anchor grounding for behavior claims (S7 tier-2).
+ *
+ * Tier-1 (quoteGrounding) proves a finding *cites code that exists*. It cannot
+ * prove a *behavior* claim — "there is a cycle", "this symbol is unused", "this
+ * throws". Those are exactly the claims that shipped as **not real** in the
+ * 452-self-audit (a hallucinated cycle, two const-compare mistakes), caught only
+ * by deterministically re-running `madge`/`grep`. Tier-2 attaches a read-only
+ * command to such a claim, the tool runs it, and the confirmed bit is the tool's
+ * run — never the model's word. A refuting run quarantines the finding.
+ *
+ * SAFETY. The command is model-authored, so it runs only when both its
+ * executable AND its arguments pass the shared **default-deny allowlist**
+ * (`isAllowedAnchorCommand` — CRIT ARC-a06a3945: validates args, not just the
+ * executable, so `rg --pre`, `ast-grep --rewrite`, non-read-only git, etc. are
+ * refused). It runs under a timeout, with the host-signalling env stripped, and
+ * never via a shell — all owned by the shared `runAllowlistedReadOnlyCommand`
+ * runner. Anything off the allowlist is *skipped* (recorded, not run) and the
+ * finding falls back to tier-1 grounding. The whole pass can be disabled with
+ * `AUDIT_CODE_DISABLE_ANCHORS=1`; the per-anchor timeout (60s default) can be
+ * raised with `AUDIT_CODE_ANCHOR_TIMEOUT_MS` for slow checks on large repos.
+ */
+import { availableParallelism } from "node:os";
+import { ALLOWLISTED_EXEC_TIMEOUT_MS, ANCHOR_ALLOWLIST, GIT_READONLY_SUBCOMMANDS, isAllowedAnchorCommand, normalizeForMatch, runAllowlistedReadOnlyCommand, } from "audit-tools/shared";
+// Re-export the allowlist authority so existing audit-code import sites
+// (`../validation/anchorGrounding.js`) keep working — the implementation is now
+// single-sourced in shared (drift-plan E2; CRIT arg-validation).
+export { isAllowedAnchorCommand, ANCHOR_ALLOWLIST, GIT_READONLY_SUBCOMMANDS };
+/** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
+export const ANCHOR_TIMEOUT_MS = ALLOWLISTED_EXEC_TIMEOUT_MS;
+/**
+ * The effective per-anchor timeout. The 60s default suits the common anchors
+ * (madge/grep/rg/git) but a legitimately slow check on a large repo would be
+ * silently killed → `inconclusive`; `AUDIT_CODE_ANCHOR_TIMEOUT_MS` (a positive
+ * integer in ms) lets an operator raise it per run without code changes. Read
+ * per-call to mirror `AUDIT_CODE_DISABLE_ANCHORS` (no import-time capture).
+ */
+export function resolveAnchorTimeoutMs(env = process.env) {
+    const override = Number(env.AUDIT_CODE_ANCHOR_TIMEOUT_MS);
+    return Number.isFinite(override) && override > 0 ? override : ANCHOR_TIMEOUT_MS;
+}
+/**
+ * Bounded concurrency for the ingest grounding pass. Anchors spawn child
+ * processes, so a serial pass over many anchored findings costs the *sum* of
+ * their runtimes — noticeably slow in practice. Grounding each finding under a
+ * pool of this size turns that into ~N/cap batches while capping concurrent
+ * spawns so the audited machine is not thrashed. CPU-derived, clamped to [2, 8].
+ */
+export const ANCHOR_GROUNDING_CONCURRENCY = Math.max(2, Math.min(8, availableParallelism()));
+/**
+ * The single read-only command runner for anchor verification — the shared
+ * allowlisted runner (argv-only, env-stripped, timeout-killed). Exposed under
+ * the local name so injected test runners and callers are unchanged.
+ */
+const defaultAnchorRunner = runAllowlistedReadOnlyCommand;
+function tailEvidence(output) {
+    const lines = output.trim().length > 0 ? output.trim().split(/\r?\n/) : [];
+    if (lines.length <= 10)
+        return lines;
+    return [
+        `[... truncated: showing last 10 of ${lines.length} lines ...]`,
+        ...lines.slice(-10),
+    ];
+}
+function truncate(text, max = 80) {
+    return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+/**
+ * Evaluate whether the run satisfies the declared confirm_if condition. Returns
+ * `null` when the condition is malformed (output_* with no text), so the caller
+ * records the anchor inconclusive rather than guessing a polarity.
+ */
+function evaluateExpectation(expectation, exitCode, output) {
+    switch (expectation.kind) {
+        case "exit_zero":
+            return {
+                confirmed: exitCode === 0,
+                detail: `command exited ${exitCode} (confirmed iff exit 0)`,
+            };
+        case "exit_nonzero":
+            return {
+                confirmed: exitCode !== null && exitCode !== 0,
+                detail: `command exited ${exitCode} (confirmed iff non-zero exit)`,
+            };
+        case "output_includes":
+        case "output_excludes": {
+            if (typeof expectation.text !== "string" || expectation.text.trim() === "") {
+                return null;
+            }
+            const present = normalizeForMatch(output).includes(normalizeForMatch(expectation.text));
+            const confirmed = expectation.kind === "output_includes" ? present : !present;
+            return {
+                confirmed,
+                detail: `output ${present ? "contains" : "does not contain"} "${truncate(expectation.text)}"`,
+            };
+        }
+    }
+}
+/**
+ * Run a finding's executable anchor (if any) and return the verdict. Pure of any
+ * finding mutation — the caller folds the result into `grounding` via
+ * {@link combineGroundingWithAnchor}. Returns `undefined` when the finding has
+ * no anchor (nothing to run).
+ */
+export async function verifyFindingAnchor(repoRoot, finding, run = defaultAnchorRunner) {
+    const anchor = finding.executable_anchor;
+    if (!anchor ||
+        !Array.isArray(anchor.command) ||
+        anchor.command.length === 0 ||
+        !anchor.confirm_if) {
+        return undefined;
+    }
+    if (process.env.AUDIT_CODE_DISABLE_ANCHORS === "1") {
+        return {
+            status: "skipped",
+            summary: "executable-anchor verification disabled (AUDIT_CODE_DISABLE_ANCHORS=1)",
+        };
+    }
+    if (!isAllowedAnchorCommand(anchor.command)) {
+        return {
+            status: "skipped",
+            summary: `\`${anchor.command.join(" ")}\` is not on the inspection-only anchor allowlist (executable or arguments refused); not auto-run`,
+        };
+    }
+    const timeoutMs = resolveAnchorTimeoutMs();
+    const outcome = await run(anchor.command, repoRoot, timeoutMs);
+    const display = anchor.command.join(" ");
+    if (outcome.spawn_error) {
+        return {
+            status: "inconclusive",
+            summary: `could not run anchor \`${display}\`: ${outcome.spawn_error}`,
+            evidence: tailEvidence(outcome.output),
+        };
+    }
+    if (outcome.timed_out) {
+        return {
+            status: "inconclusive",
+            summary: `anchor \`${display}\` timed out after ${timeoutMs}ms`,
+            evidence: tailEvidence(outcome.output),
+        };
+    }
+    const verdict = evaluateExpectation(anchor.confirm_if, outcome.exit_code, outcome.output);
+    if (verdict === null) {
+        return {
+            status: "inconclusive",
+            summary: `malformed anchor: ${anchor.confirm_if.kind} requires a non-empty \`text\``,
+            evidence: tailEvidence(outcome.output),
+        };
+    }
+    return {
+        status: verdict.confirmed ? "confirmed" : "refuted",
+        summary: `${verdict.confirmed ? "confirmed" : "REFUTED"} by \`${display}\` — ${verdict.detail}`,
+        evidence: tailEvidence(outcome.output),
+    };
+}
+/**
+ * Fold an anchor verdict into the quote-and-verify (tier-1) grounding. A
+ * confirming run grounds the finding (a verified behavior claim outranks a
+ * missing quote); a refuting run quarantines it (the cited code may exist, but
+ * the behavior claim is false); an inconclusive/skipped/absent anchor leaves the
+ * tier-1 verdict in place.
+ */
+export function combineGroundingWithAnchor(tier1, anchor) {
+    if (!anchor)
+        return tier1;
+    if (anchor.status === "confirmed")
+        return { status: "grounded" };
+    if (anchor.status === "refuted") {
+        // A refuting run DISPROVED the claim — distinct from tier-1 `ungrounded`
+        // ("couldn't verify"). It is quarantined-EXCLUDED at synthesis, not merely
+        // surfaced, so it can never merge as actionable fact.
+        return {
+            status: "refuted",
+            reason: `executable anchor refuted the claim: ${anchor.summary}`,
+        };
+    }
+    return tier1;
+}
+/** One evidence line summarising the anchor run, appended to the finding's evidence. */
+export function anchorEvidenceLine(anchor) {
+    return `anchor: ${anchor.summary}`;
+}
+//# sourceMappingURL=anchorGrounding.js.map

package/dist/audit/validation/anchorGrounding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchorGrounding.js","sourceRoot":"","sources":["../../../src/audit/validation/anchorGrounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAU5B,wEAAwE;AACxE,gFAAgF;AAChF,iEAAiE;AACjE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;AAE9E,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC,GAAG,CAClD,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CACpC,CAAC;AAMF;;;;GAIG;AACH,MAAM,mBAAmB,GAAiB,6BAA6B,CAAC;AAUxE,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO;QACL,sCAAsC,KAAK,CAAC,MAAM,aAAa;QAC/D,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,WAA8B,EAC9B,QAAuB,EACvB,MAAc;IAEd,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,WAAW;YACd,OAAO;gBACL,SAAS,EAAE,QAAQ,KAAK,CAAC;gBACzB,MAAM,EAAE,kBAAkB,QAAQ,yBAAyB;aAC5D,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,SAAS,EAAE,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;gBAC9C,MAAM,EAAE,kBAAkB,QAAQ,gCAAgC;aACnE,CAAC;QACJ,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAChD,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CACpC,CAAC;YACF,MAAM,SAAS,GACb,WAAW,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,OAAO;gBACL,SAAS;gBACT,MAAM,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG;aAC9F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAAgB,EAChB,MAAoB,mBAAmB;IAEvC,MAAM,MAAM,GAAiC,OAAO,CAAC,iBAAiB,CAAC;IACvE,IACE,CAAC,MAAM;QACP,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,MAAM,CAAC,UAAU,EAClB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG,EAAE,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,wEAAwE;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,mGAAmG;SAC1I,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,0BAA0B,OAAO,OAAO,OAAO,CAAC,WAAW,EAAE;YACtE,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,YAAY,OAAO,sBAAsB,SAAS,IAAI;YAC/D,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CACjC,MAAM,CAAC,UAAU,EACjB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,qBAAqB,MAAM,CAAC,UAAU,CAAC,IAAI,gCAAgC;YACpF,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;SACvC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,SAAS,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE;QAC/F,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAuB,EACvB,MAAgC;IAEhC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,yEAAyE;QACzE,2EAA2E;QAC3E,sDAAsD;QACtD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,wCAAwC,MAAM,CAAC,OAAO,EAAE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,OAAO,WAAW,MAAM,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/dist/audit/validation/artifacts.d.ts

@@ -0,0 +1,4 @@
+import type { ArtifactBundle } from "../io/artifacts.js";
+import { type ValidationIssue } from "audit-tools/shared";
+export declare function validateArtifactBundle(bundle: ArtifactBundle): ValidationIssue[];
+//# sourceMappingURL=artifacts.d.ts.map

package/dist/audit/validation/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../src/audit/validation/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,oBAAoB,CAAC;AA0U5B,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,cAAc,GACrB,eAAe,EAAE,CA8BnB"}