audit-tools 0.30.3 → 0.30.4

package/dist/shared/repair/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `audit-tools/shared/repair` — the single-sourced emit-validate-repair seam (O3).
+ * Both orchestrators import the seam from here so the staged repair policy cannot
+ * drift between the two halves of the pipeline.
+ */
+export type { RepairValidationError, RepairValidationResult, RepairCoercion, RepairCoercionResult, RepairPatcher, RepairContract, RepairStatus, RepairStage, RepairRedispatch, RepairOutcome, RunEmitValidateRepairOptions, } from './emitValidateRepair.js';
+export { runEmitValidateRepair } from './emitValidateRepair.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/repair/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/repair/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/shared/repair/index.js

@@ -0,0 +1,2 @@
+export { runEmitValidateRepair } from './emitValidateRepair.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/repair/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/repair/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/shared/stableStringify.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The single deterministic JSON serializer for content hashing across the
+ * codebase (INV-CK-2 / content-key-seam-fail-2). Object keys are sorted, so two
+ * structurally-equal values with differently-ordered keys serialize identically.
+ * `undefined` is normalized to `null` (both top-level and inside arrays) so a
+ * present-but-undefined field can never change the hash.
+ *
+ * There must be exactly ONE such serializer — never write a second. Both the
+ * artifact-freshness metadata hash (`src/audit/orchestrator/artifactFreshness.ts`,
+ * which re-exports this) and the content-key seam (`src/shared/contentKey.ts`)
+ * route through this function.
+ */
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=stableStringify.d.ts.map

package/dist/shared/stableStringify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stableStringify.d.ts","sourceRoot":"","sources":["../../src/shared/stableStringify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CActD"}

package/dist/shared/stableStringify.js

@@ -0,0 +1,28 @@
+/**
+ * The single deterministic JSON serializer for content hashing across the
+ * codebase (INV-CK-2 / content-key-seam-fail-2). Object keys are sorted, so two
+ * structurally-equal values with differently-ordered keys serialize identically.
+ * `undefined` is normalized to `null` (both top-level and inside arrays) so a
+ * present-but-undefined field can never change the hash.
+ *
+ * There must be exactly ONE such serializer — never write a second. Both the
+ * artifact-freshness metadata hash (`src/audit/orchestrator/artifactFreshness.ts`,
+ * which re-exports this) and the content-key seam (`src/shared/contentKey.ts`)
+ * route through this function.
+ */
+export function stableStringify(value) {
+    if (value === undefined) {
+        return "null";
+    }
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item ?? null)).join(",")}]`;
+    }
+    const entries = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+}
+//# sourceMappingURL=stableStringify.js.map

package/dist/shared/stableStringify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stableStringify.js","sourceRoot":"","sources":["../../src/shared/stableStringify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.30.3",
+  "version": "0.30.4",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",

package/schemas/audit_result.schema.json

@@ -496,6 +496,15 @@
     "submitted_at": {
       "type": "string",
       "format": "date-time"
+    },
+    "instance_id": {
+      "type": "string"
+    },
+    "identity_key": {
+      "type": "string"
+    },
+    "idempotency_key": {
+      "type": "string"
     }
   },
   "required": [

package/schemas/audit_results.schema.json

@@ -498,6 +498,15 @@
       "submitted_at": {
         "type": "string",
         "format": "date-time"
+      },
+      "instance_id": {
+        "type": "string"
+      },
+      "identity_key": {
+        "type": "string"
+      },
+      "idempotency_key": {
+        "type": "string"
       }
     },
     "required": [