audit-tools 0.30.0 → 0.30.2

package/dist/audit/adapters/astGrep.d.ts

@@ -0,0 +1,30 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+/**
+ * One match from `ast-grep scan --json`. The matched file is `file`; a capture
+ * naming the edge target (e.g. a module specifier, a referenced path) is read
+ * from `metaVariables.single.<TARGET_META_VAR>.text`. Both are optional so a
+ * partial / malformed payload degrades rather than throwing.
+ */
+interface AstGrepMatch {
+    file?: string;
+    ruleId?: string;
+    metaVariables?: {
+        single?: Record<string, {
+            text?: string;
+        } | undefined>;
+    };
+}
+/**
+ * Normalize `ast-grep scan --json` output into language-neutral graph edges:
+ * one `matched-file → captured-target` edge per match whose target meta-variable
+ * resolves to a non-empty string distinct from the matched file. ast-grep is a
+ * structural matcher, so the target capture is whatever the operator's rule
+ * binds (a module specifier, a referenced symbol path); endpoint resolution
+ * against the repo path lookup happens downstream in the graph extractor.
+ *
+ * Degrades to an empty edge list on any malformed / missing field and never
+ * throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
+ */
+export declare function normalizeAstGrepJson(matches: AstGrepMatch[] | undefined, targetMetaVar?: string): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=astGrep.d.ts.map

package/dist/audit/adapters/astGrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astGrep.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/astGrep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AAGtC;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC,CAAC;KACxD,CAAC;CACH;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EACnC,aAAa,GAAE,MAAgC,GAC9C,uBAAuB,CA+BzB"}

package/dist/audit/adapters/astGrep.js

@@ -0,0 +1,46 @@
+import { normalizeGenericExternalEdges } from "./normalizeExternal.js";
+/** Default capture name holding the edge target path/specifier. */
+const DEFAULT_TARGET_META_VAR = "TARGET";
+/**
+ * Normalize `ast-grep scan --json` output into language-neutral graph edges:
+ * one `matched-file → captured-target` edge per match whose target meta-variable
+ * resolves to a non-empty string distinct from the matched file. ast-grep is a
+ * structural matcher, so the target capture is whatever the operator's rule
+ * binds (a module specifier, a referenced symbol path); endpoint resolution
+ * against the repo path lookup happens downstream in the graph extractor.
+ *
+ * Degrades to an empty edge list on any malformed / missing field and never
+ * throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
+ */
+export function normalizeAstGrepJson(matches, targetMetaVar = DEFAULT_TARGET_META_VAR) {
+    const candidates = [];
+    for (const match of Array.isArray(matches) ? matches : []) {
+        if (!match || typeof match !== "object")
+            continue;
+        const from = typeof match.file === "string" && match.file.trim().length > 0
+            ? match.file.trim()
+            : undefined;
+        const target = match.metaVariables?.single?.[targetMetaVar]?.text;
+        const to = typeof target === "string" && target.trim().length > 0
+            ? target.trim()
+            : undefined;
+        if (!from || !to)
+            continue;
+        candidates.push({
+            from,
+            to,
+            kind: "analyzer-dataflow-edge",
+            confidence: 0.7,
+            reason: typeof match.ruleId === "string"
+                ? `ast-grep rule '${match.ruleId}' links match to captured target.`
+                : "ast-grep structural match links file to captured target.",
+        });
+    }
+    return {
+        tool: "ast-grep",
+        generated_at: new Date().toISOString(),
+        graph_edges: normalizeGenericExternalEdges(candidates),
+        results: [],
+    };
+}
+//# sourceMappingURL=astGrep.js.map

package/dist/audit/adapters/astGrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astGrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/astGrep.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAgBvE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmC,EACnC,gBAAwB,uBAAuB;IAE/C,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACnB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;QAClE,MAAM,EAAE,GACN,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YACf,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAAE,SAAS;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,EAAE;YACF,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EACJ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAC9B,CAAC,CAAC,kBAAkB,KAAK,CAAC,MAAM,mCAAmC;gBACnE,CAAC,CAAC,0DAA0D;SACjE,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/codeql.d.ts

@@ -0,0 +1,47 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+/**
+ * Minimal SARIF 2.1.0 shape for CodeQL dataflow queries. Only the fields needed
+ * to recover source→sink file edges from `codeFlows` are typed; everything is
+ * optional so a partial / malformed report degrades rather than throwing.
+ */
+interface SarifArtifactLocation {
+    uri?: string;
+}
+interface SarifLocation {
+    physicalLocation?: {
+        artifactLocation?: SarifArtifactLocation;
+    };
+}
+interface SarifThreadFlowLocation {
+    location?: SarifLocation;
+}
+interface SarifThreadFlow {
+    locations?: SarifThreadFlowLocation[];
+}
+interface SarifCodeFlow {
+    threadFlows?: SarifThreadFlow[];
+}
+interface SarifResult {
+    ruleId?: string;
+    codeFlows?: SarifCodeFlow[];
+}
+interface SarifRun {
+    results?: SarifResult[];
+}
+export interface CodeqlSarif {
+    runs?: SarifRun[];
+}
+/**
+ * Normalize a CodeQL SARIF dataflow report into language-neutral graph edges:
+ * for each result's code flow, emit one `source-file → sink-file` edge from the
+ * first to the last thread-flow location whose file paths differ. CodeQL's
+ * dataflow queries already model taint propagation, so the first/last locations
+ * are the source and sink; downstream the graph extractor resolves the URIs
+ * against the repo path lookup.
+ *
+ * Degrades to an empty edge list on any malformed / missing SARIF field and
+ * never throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
+ */
+export declare function normalizeCodeqlSarif(input: CodeqlSarif): ExternalAnalyzerResults;
+export {};
+//# sourceMappingURL=codeql.d.ts.map

package/dist/audit/adapters/codeql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeql.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/codeql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AAGtC;;;;GAIG;AACH,UAAU,qBAAqB;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AACD,UAAU,aAAa;IACrB,gBAAgB,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;KAAE,CAAC;CACjE;AACD,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AACD,UAAU,eAAe;IACvB,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACvC;AACD,UAAU,aAAa;IACrB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;AACD,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;CAC7B;AACD,UAAU,QAAQ;IAChB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AACD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;CACnB;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,uBAAuB,CAiChF"}

package/dist/audit/adapters/codeql.js

@@ -0,0 +1,52 @@
+import { normalizeGenericExternalEdges } from "./normalizeExternal.js";
+function locationUri(location) {
+    const uri = location?.location?.physicalLocation?.artifactLocation?.uri;
+    return typeof uri === "string" && uri.trim().length > 0 ? uri.trim() : undefined;
+}
+/**
+ * Normalize a CodeQL SARIF dataflow report into language-neutral graph edges:
+ * for each result's code flow, emit one `source-file → sink-file` edge from the
+ * first to the last thread-flow location whose file paths differ. CodeQL's
+ * dataflow queries already model taint propagation, so the first/last locations
+ * are the source and sink; downstream the graph extractor resolves the URIs
+ * against the repo path lookup.
+ *
+ * Degrades to an empty edge list on any malformed / missing SARIF field and
+ * never throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
+ */
+export function normalizeCodeqlSarif(input) {
+    const candidates = [];
+    for (const run of input.runs ?? []) {
+        for (const result of run?.results ?? []) {
+            for (const codeFlow of result?.codeFlows ?? []) {
+                for (const threadFlow of codeFlow?.threadFlows ?? []) {
+                    if (!threadFlow || typeof threadFlow !== "object")
+                        continue;
+                    const locations = Array.isArray(threadFlow.locations)
+                        ? threadFlow.locations
+                        : [];
+                    const from = locationUri(locations[0]);
+                    const to = locationUri(locations[locations.length - 1]);
+                    if (!from || !to)
+                        continue;
+                    candidates.push({
+                        from,
+                        to,
+                        kind: "analyzer-dataflow-edge",
+                        confidence: 0.7,
+                        reason: typeof result.ruleId === "string"
+                            ? `CodeQL query '${result.ruleId}' flows source → sink.`
+                            : "CodeQL dataflow flows source → sink.",
+                    });
+                }
+            }
+        }
+    }
+    return {
+        tool: "codeql",
+        generated_at: new Date().toISOString(),
+        graph_edges: normalizeGenericExternalEdges(candidates),
+        results: [],
+    };
+}
+//# sourceMappingURL=codeql.js.map

package/dist/audit/adapters/codeql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeql.js","sourceRoot":"","sources":["../../../src/audit/adapters/codeql.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAiCvE,SAAS,WAAW,CAAC,QAA6C;IAChE,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACxE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACrD,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;gBAC/C,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;oBACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;wBAAE,SAAS;oBAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnD,CAAC,CAAC,UAAU,CAAC,SAAS;wBACtB,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxD,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;wBAAE,SAAS;oBAC3B,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI;wBACJ,EAAE;wBACF,IAAI,EAAE,wBAAwB;wBAC9B,UAAU,EAAE,GAAG;wBACf,MAAM,EACJ,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;4BAC/B,CAAC,CAAC,iBAAiB,MAAM,CAAC,MAAM,wBAAwB;4BACxD,CAAC,CAAC,sCAAsC;qBAC7C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/normalizeExternal.d.ts

@@ -1,4 +1,4 @@
-import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { ExternalAnalyzerGraphEdge, ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
 export declare function normalizeGenericExternalResults(tool: string, items: Array<{
     id?: string;
     category?: string;
@@ -10,4 +10,27 @@ export declare function normalizeGenericExternalResults(tool: string, items: Arr
     rule?: string;
     raw?: unknown;
 }>): ExternalAnalyzerResults;
+/**
+ * Normalize a raw list of edge candidates (from an external dataflow analyzer:
+ * ast-grep / broader-semgrep dataflow / CodeQL) into the language-neutral
+ * {@link ExternalAnalyzerGraphEdge} contract.
+ *
+ * Degrade-to-empty + deterministic by construction:
+ *  - any candidate missing a non-empty string `from`/`to`, or a self-edge
+ *    (`from === to`), is dropped — never throws on a malformed payload;
+ *  - duplicate (from,to,kind) triples collapse to one;
+ *  - output is sorted by from-then-to-then-kind so identical input yields
+ *    byte-identical output run to run.
+ *
+ * The returned shape is the wire contract carried on
+ * `ExternalAnalyzerResults.graph_edges`; the graph extractor resolves the
+ * endpoints against the repo path lookup and merges them into the edge set.
+ */
+export declare function normalizeGenericExternalEdges(candidates: Array<{
+    from?: unknown;
+    to?: unknown;
+    kind?: unknown;
+    confidence?: unknown;
+    reason?: unknown;
+}>): ExternalAnalyzerGraphEdge[];
 //# sourceMappingURL=normalizeExternal.d.ts.map

package/dist/audit/adapters/normalizeExternal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalizeExternal.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAoB5E,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC,GACD,uBAAuB,CA6BzB"}
+{"version":3,"file":"normalizeExternal.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AAoBtC,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC,GACD,uBAAuB,CA6BzB;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,KAAK,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC,GACD,yBAAyB,EAAE,CA4B7B"}

package/dist/audit/adapters/normalizeExternal.js

@@ -41,4 +41,54 @@ export function normalizeGenericExternalResults(tool, items) {
         })),
     };
 }
+function clampUnitInterval(value) {
+    return typeof value === "number" && Number.isFinite(value)
+        ? Math.min(1, Math.max(0, value))
+        : undefined;
+}
+/**
+ * Normalize a raw list of edge candidates (from an external dataflow analyzer:
+ * ast-grep / broader-semgrep dataflow / CodeQL) into the language-neutral
+ * {@link ExternalAnalyzerGraphEdge} contract.
+ *
+ * Degrade-to-empty + deterministic by construction:
+ *  - any candidate missing a non-empty string `from`/`to`, or a self-edge
+ *    (`from === to`), is dropped — never throws on a malformed payload;
+ *  - duplicate (from,to,kind) triples collapse to one;
+ *  - output is sorted by from-then-to-then-kind so identical input yields
+ *    byte-identical output run to run.
+ *
+ * The returned shape is the wire contract carried on
+ * `ExternalAnalyzerResults.graph_edges`; the graph extractor resolves the
+ * endpoints against the repo path lookup and merges them into the edge set.
+ */
+export function normalizeGenericExternalEdges(candidates) {
+    const deduped = new Map();
+    for (const candidate of Array.isArray(candidates) ? candidates : []) {
+        if (!candidate || typeof candidate !== "object")
+            continue;
+        const from = typeof candidate.from === "string" ? candidate.from.trim() : "";
+        const to = typeof candidate.to === "string" ? candidate.to.trim() : "";
+        if (from.length === 0 || to.length === 0 || from === to)
+            continue;
+        const kind = typeof candidate.kind === "string" && candidate.kind.trim().length > 0
+            ? candidate.kind.trim()
+            : undefined;
+        const confidence = clampUnitInterval(candidate.confidence);
+        const reason = typeof candidate.reason === "string" && candidate.reason.trim().length > 0
+            ? candidate.reason.trim()
+            : undefined;
+        const edge = { from, to };
+        if (kind !== undefined)
+            edge.kind = kind;
+        if (confidence !== undefined)
+            edge.confidence = confidence;
+        if (reason !== undefined)
+            edge.reason = reason;
+        deduped.set(`${from}\0${to}\0${kind ?? ""}`, edge);
+    }
+    return [...deduped.values()].sort((a, b) => a.from.localeCompare(b.from) ||
+        a.to.localeCompare(b.to) ||
+        (a.kind ?? "").localeCompare(b.kind ?? ""));
+}
 //# sourceMappingURL=normalizeExternal.js.map

package/dist/audit/adapters/normalizeExternal.js.map

@@ -1 +1 @@
-{"version":3,"file":"normalizeExternal.js","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAIA,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,QAAQ,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC;QACzB,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAY,EACZ,KAUE;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,6BAA6B;YACpC,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,yBAAyB;SAClC,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"normalizeExternal.js","sourceRoot":"","sources":["../../../src/audit/adapters/normalizeExternal.ts"],"names":[],"mappings":"AAOA,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,QAAQ,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC;QACzB,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;QAC3B,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAY,EACZ,KAUE;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,6BAA6B;YACpC,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,yBAAyB;SAClC,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAME;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC7D,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAC1D,MAAM,IAAI,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAClE,MAAM,IAAI,GACR,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,MAAM,GACV,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,GAA8B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrD,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACzC,IAAI,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAC7C,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/semgrep.d.ts

@@ -1,23 +1,42 @@
 import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
-interface SemgrepJson {
-    results?: Array<{
-        check_id?: string;
+interface SemgrepDataflowTraceNode {
+    location?: {
         path?: string;
-        start?: {
-            line?: number;
-        };
-        end?: {
-            line?: number;
+    };
+}
+interface SemgrepResult {
+    check_id?: string;
+    path?: string;
+    start?: {
+        line?: number;
+    };
+    end?: {
+        line?: number;
+    };
+    extra?: {
+        severity?: string;
+        message?: string;
+        metadata?: {
+            category?: string;
         };
-        extra?: {
-            severity?: string;
-            message?: string;
-            metadata?: {
-                category?: string;
-            };
+        dataflow_trace?: {
+            taint_source?: SemgrepDataflowTraceNode | SemgrepDataflowTraceNode[];
+            intermediate_vars?: SemgrepDataflowTraceNode[];
+            taint_sink?: SemgrepDataflowTraceNode | SemgrepDataflowTraceNode[];
         };
-    }>;
+    };
+}
+interface SemgrepJson {
+    results?: SemgrepResult[];
 }
 export declare function normalizeSemgrepJson(input: SemgrepJson): ExternalAnalyzerResults;
+/**
+ * Normalize semgrep's broader `--dataflow-traces` output into language-neutral
+ * graph edges: one `taint-source → taint-sink` edge per result whose source and
+ * sink resolve to distinct file paths. Intermediate vars are not edges (they are
+ * within-file steps). Malformed / missing traces degrade to an empty edge list;
+ * `normalizeGenericExternalEdges` dedupes + sorts so output is deterministic.
+ */
+export declare function normalizeSemgrepDataflowJson(input: SemgrepJson): ExternalAnalyzerResults;
 export {};
 //# sourceMappingURL=semgrep.d.ts.map

package/dist/audit/adapters/semgrep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,KAAK,CAAC,EAAE;YACN,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SAClC,CAAC;KACH,CAAC,CAAC;CACJ;AA6BD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB,uBAAuB,CAezB"}
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AAMtC,UAAU,wBAAwB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACjC,cAAc,CAAC,EAAE;YACf,YAAY,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,EAAE,CAAC;YACrE,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC/C,UAAU,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,EAAE,CAAC;SACpE,CAAC;KACH,CAAC;CACH;AAED,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AA6BD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB,uBAAuB,CAezB;AAwBD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,WAAW,GACjB,uBAAuB,CA0BzB"}

package/dist/audit/adapters/semgrep.js

@@ -1,4 +1,4 @@
-import { normalizeGenericExternalResults } from "./normalizeExternal.js";
+import { normalizeGenericExternalEdges, normalizeGenericExternalResults, } from "./normalizeExternal.js";
 /**
  * Maps semgrep's native uppercase severity strings to the lowercase enum values
  * required by ExternalAnalyzerResultsSchema. Case-insensitive lookup so
@@ -37,4 +37,57 @@ export function normalizeSemgrepJson(input) {
         raw: result,
     })));
 }
+function dataflowNodePath(node) {
+    const path = node?.location?.path;
+    return typeof path === "string" && path.trim().length > 0
+        ? path.trim()
+        : undefined;
+}
+function firstDataflowPath(value) {
+    if (Array.isArray(value)) {
+        for (const node of value) {
+            const path = dataflowNodePath(node);
+            if (path)
+                return path;
+        }
+        return undefined;
+    }
+    return dataflowNodePath(value);
+}
+/**
+ * Normalize semgrep's broader `--dataflow-traces` output into language-neutral
+ * graph edges: one `taint-source → taint-sink` edge per result whose source and
+ * sink resolve to distinct file paths. Intermediate vars are not edges (they are
+ * within-file steps). Malformed / missing traces degrade to an empty edge list;
+ * `normalizeGenericExternalEdges` dedupes + sorts so output is deterministic.
+ */
+export function normalizeSemgrepDataflowJson(input) {
+    const candidates = [];
+    for (const result of input.results ?? []) {
+        if (!result || typeof result !== "object")
+            continue;
+        const trace = result.extra?.dataflow_trace;
+        if (!trace)
+            continue;
+        const from = firstDataflowPath(trace.taint_source);
+        const to = firstDataflowPath(trace.taint_sink);
+        if (!from || !to)
+            continue;
+        candidates.push({
+            from,
+            to,
+            kind: "analyzer-dataflow-edge",
+            confidence: 0.7,
+            reason: typeof result.check_id === "string"
+                ? `semgrep dataflow trace '${result.check_id}' flows source → sink.`
+                : "semgrep dataflow trace flows source → sink.",
+        });
+    }
+    return {
+        tool: "semgrep-dataflow",
+        generated_at: new Date().toISOString(),
+        graph_edges: normalizeGenericExternalEdges(candidates),
+        results: [],
+    };
+}
 //# sourceMappingURL=semgrep.js.map

package/dist/audit/adapters/semgrep.js.map

@@ -1 +1 @@
-{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAgBzE;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAC/B,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC,CAAI,OAAO,MAAM,CAAC;QAC/B,KAAK,SAAS,CAAC,CAAE,OAAO,QAAQ,CAAC;QACjC,KAAK,MAAM,CAAC,CAAK,OAAO,MAAM,CAAC;QAC/B,OAAO,CAAC,CAAS,OAAO,SAAS,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,OAAO,+BAA+B,CACpC,SAAS,EACT,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC,QAAQ;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,UAAU;QACxD,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI;QAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;QAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,GAAG,EAAE,MAAM;KACZ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AA2BhC;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAC/B,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC,CAAI,OAAO,MAAM,CAAC;QAC/B,KAAK,SAAS,CAAC,CAAE,OAAO,QAAQ,CAAC;QACjC,KAAK,MAAM,CAAC,CAAK,OAAO,MAAM,CAAC;QAC/B,OAAO,CAAC,CAAS,OAAO,SAAS,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,OAAO,+BAA+B,CACpC,SAAS,EACT,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC,QAAQ;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,UAAU;QACxD,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI;QAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;QAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,GAAG,EAAE,MAAM;KACZ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;IAClC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAwE;IAExE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAkB;IAElB,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAAE,SAAS;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,EAAE;YACF,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EACJ,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACjC,CAAC,CAAC,2BAA2B,MAAM,CAAC,QAAQ,wBAAwB;gBACpE,CAAC,CAAC,6CAA6C;SACpD,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/cli/mergeAndIngestCommand.d.ts

@@ -1,4 +1,32 @@
-import type { AuditResult } from "../types.js";
+import type { AuditResult, AuditTask } from "../types.js";
+/**
+ * Validate each pending task's result, classifying into passing/failing/notDispatched.
+ * Reads results from the result-map paths or falls back to the task_id lookup table
+ * for tasks recovered from non-canonical files.
+ */
+/**
+ * Build, per dispatched packet_id, the list of member task_ids assigned to it
+ * (excluding the synthetic `__prior_dispatch__` sentinel, which is not a real
+ * packet). Used to rebind a worker result mistakenly keyed under the packet_id
+ * onto its sole OUTSTANDING member.
+ */
+export declare function packetMembersByPacketId(entries: Array<{
+    task_id: string;
+    packet_id: string;
+}>): Map<string, string[]>;
+export declare function validateAndCollectResults(allTasks: AuditTask[], entryByTaskId: Map<string, {
+    result_path: string;
+    task_id: string;
+    packet_id: string;
+}>, fallbackByTaskId: Map<string, unknown>, packetMembers: Map<string, string[]>): Promise<{
+    passing: AuditResult[];
+    failing: Array<{
+        task_id: string;
+        errors: string[];
+    }>;
+    notDispatched: string[];
+    recoveredCount: number;
+}>;
 /**
  * Grounding pass (S7): re-verify each finding against disk before it is admitted
  * as fact. Tier-1 (quote-and-verify) re-reads the cited verbatim span and

package/dist/audit/cli/mergeAndIngestCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mergeAndIngestCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/mergeAndIngestCommand.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AA6T1D;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA2CvE;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsOhC;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrE"}
+{"version":3,"file":"mergeAndIngestCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/mergeAndIngestCommand.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAqN1D;;;;GAIG;AACH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GACrD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CASvB;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,SAAS,EAAE,EACrB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACnC,OAAO,CAAC;IACT,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CA0ID;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA2CvE;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuOhC;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrE"}

package/dist/audit/cli/mergeAndIngestCommand.js

@@ -1,7 +1,7 @@
 import { readFile, readdir, rm } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { isFileMissingError, mapWithConcurrency, readJsonFile, writeJsonFile } from "audit-tools/shared";
-import { validateAuditResults } from "../validation/auditResults.js";
+import { validateAuditResults, defaultFindingLensFromResult } from "../validation/auditResults.js";
 import { verifyFindingGrounding } from "../validation/quoteGrounding.js";
 import { ANCHOR_GROUNDING_CONCURRENCY, anchorEvidenceLine, combineGroundingWithAnchor, verifyFindingAnchor, } from "../validation/anchorGrounding.js";
 import { runAuditStep } from "./auditStep.js";
@@ -192,7 +192,24 @@ async function scanTaskResults(taskResultsDir, expectedPaths) {
  * Reads results from the result-map paths or falls back to the task_id lookup table
  * for tasks recovered from non-canonical files.
  */
-async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTaskId) {
+/**
+ * Build, per dispatched packet_id, the list of member task_ids assigned to it
+ * (excluding the synthetic `__prior_dispatch__` sentinel, which is not a real
+ * packet). Used to rebind a worker result mistakenly keyed under the packet_id
+ * onto its sole OUTSTANDING member.
+ */
+export function packetMembersByPacketId(entries) {
+    const byPacket = new Map();
+    for (const entry of entries) {
+        if (entry.packet_id === "__prior_dispatch__")
+            continue;
+        const members = byPacket.get(entry.packet_id) ?? [];
+        members.push(entry.task_id);
+        byPacket.set(entry.packet_id, members);
+    }
+    return byPacket;
+}
+export async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTaskId, packetMembers) {
     const passing = [];
     const failing = [];
     // Pending tasks that were NOT dispatched this round. Not failures — they
@@ -202,6 +219,51 @@ async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTask
     // Results recovered by task_id from packet result files. The host writes one
     // array file per packet, so this is the normal collection path, not an error.
     let recoveredCount = 0;
+    // OUTSTANDING (still-pending) members keyed by their dispatched packet_id.
+    // A multi-member packet that was partially answered then re-queued keeps only
+    // its still-pending members here, so a result keyed under the packet_id is
+    // rebound to the SOLE outstanding member (never to an already-answered one,
+    // and never when >1 member is still outstanding — that would be ambiguous).
+    const outstandingIds = new Set(allTasks.map((t) => t.task_id));
+    const outstandingMembersByPacketId = new Map();
+    for (const [packetId, members] of packetMembers) {
+        const stillOutstanding = members.filter((id) => outstandingIds.has(id));
+        if (stillOutstanding.length > 0) {
+            outstandingMembersByPacketId.set(packetId, stillOutstanding);
+        }
+    }
+    /**
+     * A worker that keyed its result under the synthetic packet_id (not the
+     * assigned member task_id — the deepening non-convergence leak) leaves the
+     * member's own result missing. Recover it by binding the packet-id-keyed
+     * result to the packet's SOLE outstanding member, then rewrite its task_id to
+     * the member id so the identity gates pass. Returns the rebound object or null.
+     */
+    function rebindPacketIdKeyedResult(member) {
+        const entry = entryByTaskId.get(member.task_id);
+        const packetId = entry?.packet_id;
+        if (!packetId || packetId === "__prior_dispatch__")
+            return null;
+        const stillOutstanding = outstandingMembersByPacketId.get(packetId) ?? [];
+        if (stillOutstanding.length !== 1 || stillOutstanding[0] !== member.task_id) {
+            return null; // ambiguous (≠1 outstanding member) — never guess.
+        }
+        const keyed = fallbackByTaskId.get(packetId);
+        if (!keyed || typeof keyed !== "object" || Array.isArray(keyed))
+            return null;
+        // The worker stamped EVERY identity field from the packet (task_id, unit_id,
+        // pass_id, lens), not just task_id — so rebinding only task_id leaves the
+        // pass_id/unit_id/lens mismatching the member and the result still rejects.
+        // Identity is the tool's authority (not the worker's), so force all four from
+        // the assigned member's metadata. The findings/coverage payload is untouched.
+        return {
+            ...keyed,
+            task_id: member.task_id,
+            unit_id: member.unit_id,
+            pass_id: member.pass_id,
+            lens: member.lens,
+        };
+    }
     for (const task of allTasks) {
         const entry = entryByTaskId.get(task.task_id);
         let obj;
@@ -212,7 +274,7 @@ async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTask
             }
             catch (e) {
                 if (isFileMissingError(e)) {
-                    const fallback = fallbackByTaskId.get(task.task_id);
+                    const fallback = fallbackByTaskId.get(task.task_id) ?? rebindPacketIdKeyedResult(task);
                     if (fallback) {
                         recoveredCount++;
                         obj = fallback;
@@ -239,7 +301,7 @@ async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTask
             // against). Recover it by task_id so it ingests instead of looping forever
             // as "pending"; only when no such file exists is the task genuinely held
             // back for the next dispatch (not a failure).
-            const fallback = fallbackByTaskId.get(task.task_id);
+            const fallback = fallbackByTaskId.get(task.task_id) ?? rebindPacketIdKeyedResult(task);
             if (!fallback) {
                 notDispatched.push(task.task_id);
                 continue;
@@ -247,6 +309,10 @@ async function validateAndCollectResults(allTasks, entryByTaskId, fallbackByTask
             recoveredCount++;
             obj = fallback;
         }
+        // Force-default findings[].lens from the AuditResult lens before validation
+        // (weaker/deepening workers set only the top-level lens; the validator
+        // requires a non-empty per-finding lens). Mutates the recovered object.
+        defaultFindingLensFromResult([obj]);
         const record = obj && typeof obj === "object" && !Array.isArray(obj)
             ? obj
             : undefined;
@@ -377,7 +443,7 @@ export async function mergeAndIngest(params) {
             `task-results/ ignored: ${spuriousFiles.join(", ")}\n`);
     }
     // Phase 3: validate each task's result and classify into passing/failing/notDispatched.
-    const { passing, failing, notDispatched, recoveredCount } = await validateAndCollectResults(allTasks, entryByTaskId, fallbackByTaskId);
+    const { passing, failing, notDispatched, recoveredCount } = await validateAndCollectResults(allTasks, entryByTaskId, fallbackByTaskId, packetMembersByPacketId(resultMap.entries));
     if (recoveredCount > 0) {
         process.stderr.write(`[merge-and-ingest] Recovered ${recoveredCount} result(s) by task_id from packet result files.\n`);
     }