audit-tools 0.30.3 → 0.30.5

package/dist/audit/contracts/workerSchemas.d.ts

@@ -327,6 +327,9 @@ export declare const WorkerAuditResultSchema: z.ZodObject<{
     notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     requires_followup: z.ZodOptional<z.ZodBoolean>;
     run_id: z.ZodOptional<z.ZodString>;
+    instance_id: z.ZodOptional<z.ZodString>;
+    identity_key: z.ZodOptional<z.ZodString>;
+    idempotency_key: z.ZodOptional<z.ZodString>;
 } & {
     lens: z.ZodEnum<["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment", "observability"]>;
     file_coverage: z.ZodArray<z.ZodObject<{
@@ -748,6 +751,7 @@ export declare const WorkerAuditResultSchema: z.ZodObject<{
         total_lines: number;
     }[];
     notes?: string[] | undefined;
+    run_id?: string | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -777,11 +781,13 @@ export declare const WorkerAuditResultSchema: z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    run_id?: string | undefined;
     followup_tasks?: string[] | undefined;
     agent_role?: string | undefined;
     requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
+    instance_id?: string | undefined;
+    identity_key?: string | undefined;
+    idempotency_key?: string | undefined;
 }, {
     unit_id: string;
     lens: "correctness" | "architecture" | "maintainability" | "security" | "reliability" | "performance" | "data_integrity" | "tests" | "operability" | "config_deployment" | "observability";
@@ -840,6 +846,7 @@ export declare const WorkerAuditResultSchema: z.ZodObject<{
         total_lines: number;
     }[];
     notes?: string[] | undefined;
+    run_id?: string | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -869,11 +876,13 @@ export declare const WorkerAuditResultSchema: z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    run_id?: string | undefined;
     followup_tasks?: string[] | undefined;
     agent_role?: string | undefined;
     requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
+    instance_id?: string | undefined;
+    identity_key?: string | undefined;
+    idempotency_key?: string | undefined;
 }>;
 /** The full worker submission: a non-empty array of AuditResults. */
 export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
@@ -884,6 +893,9 @@ export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
     notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     requires_followup: z.ZodOptional<z.ZodBoolean>;
     run_id: z.ZodOptional<z.ZodString>;
+    instance_id: z.ZodOptional<z.ZodString>;
+    identity_key: z.ZodOptional<z.ZodString>;
+    idempotency_key: z.ZodOptional<z.ZodString>;
 } & {
     lens: z.ZodEnum<["correctness", "architecture", "maintainability", "security", "reliability", "performance", "data_integrity", "tests", "operability", "config_deployment", "observability"]>;
     file_coverage: z.ZodArray<z.ZodObject<{
@@ -1305,6 +1317,7 @@ export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
         total_lines: number;
     }[];
     notes?: string[] | undefined;
+    run_id?: string | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -1334,11 +1347,13 @@ export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    run_id?: string | undefined;
     followup_tasks?: string[] | undefined;
     agent_role?: string | undefined;
     requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
+    instance_id?: string | undefined;
+    identity_key?: string | undefined;
+    idempotency_key?: string | undefined;
 }, {
     unit_id: string;
     lens: "correctness" | "architecture" | "maintainability" | "security" | "reliability" | "performance" | "data_integrity" | "tests" | "operability" | "config_deployment" | "observability";
@@ -1397,6 +1412,7 @@ export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
         total_lines: number;
     }[];
     notes?: string[] | undefined;
+    run_id?: string | undefined;
     verification?: {
         verified: boolean;
         needs_followup: boolean;
@@ -1426,11 +1442,13 @@ export declare const WorkerAuditResultsSchema: z.ZodArray<z.ZodObject<{
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
-    run_id?: string | undefined;
     followup_tasks?: string[] | undefined;
     agent_role?: string | undefined;
     requires_followup?: boolean | undefined;
     submitted_at?: string | undefined;
+    instance_id?: string | undefined;
+    identity_key?: string | undefined;
+    idempotency_key?: string | undefined;
 }>, "many">;
 /**
  * Registry of the worker-facing JSON schema files and the zod source each is

package/dist/audit/contracts/workerSchemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workerSchemas.d.ts","sourceRoot":"","sources":["../../../src/audit/contracts/workerSchemas.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,kFAAkF;AAClF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUrB,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBvB,CAAC;AAMZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAazB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAA0C,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CACxC,MAAM,EACN;IAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAaxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBhF"}
+{"version":3,"file":"workerSchemas.d.ts","sourceRoot":"","sources":["../../../src/audit/contracts/workerSchemas.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,kFAAkF;AAClF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUrB,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBvB,CAAC;AAMZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAazB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAA0C,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CACxC,MAAM,EACN;IAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAaxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBhF"}

package/dist/audit/contracts/wrapperResponse.d.ts

@@ -58,12 +58,12 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
             suggested_path: z.ZodString;
             description: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }, {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }>, "many">;
         suggested_commands: z.ZodArray<z.ZodString, "many">;
@@ -76,15 +76,15 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
             audit_results_path: z.ZodString;
             worker_command: z.ZodArray<z.ZodString, "many">;
         }, "strict", z.ZodTypeAny, {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;
             pending_audit_tasks_path?: string | undefined;
         }, {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;
@@ -103,8 +103,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
             runtime_validation_tasks: z.ZodNullable<z.ZodString>;
             friction_record: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -115,8 +115,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
             current_tasks: string | null;
             friction_record: string;
         }, {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -136,8 +136,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         repo_root: string;
         artifacts_dir: string;
         artifact_paths: {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -150,15 +150,15 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         };
         pending_obligations: string[];
         suggested_inputs: {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }[];
         suggested_commands: string[];
         interactive_provider_hint: string | null;
         active_review_run?: {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;
@@ -173,8 +173,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         repo_root: string;
         artifacts_dir: string;
         artifact_paths: {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -187,15 +187,15 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         };
         pending_obligations: string[];
         suggested_inputs: {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }[];
         suggested_commands: string[];
         interactive_provider_hint: string | null;
         active_review_run?: {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;
@@ -230,8 +230,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         repo_root: string;
         artifacts_dir: string;
         artifact_paths: {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -244,15 +244,15 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         };
         pending_obligations: string[];
         suggested_inputs: {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }[];
         suggested_commands: string[];
         interactive_provider_hint: string | null;
         active_review_run?: {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;
@@ -287,8 +287,8 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         repo_root: string;
         artifacts_dir: string;
         artifact_paths: {
-            current_prompt: string | null;
             session_config: string;
+            current_prompt: string | null;
             runtime_validation_tasks: string | null;
             audit_tasks: string | null;
             incoming_dir: string;
@@ -301,15 +301,15 @@ export declare const AuditCodeResponseSchema: z.ZodObject<{
         };
         pending_obligations: string[];
         suggested_inputs: {
-            description: string;
             flag: "--batch-results" | "--results" | "--updates" | "--external-analyzer-results";
+            description: string;
             suggested_path: string;
         }[];
         suggested_commands: string[];
         interactive_provider_hint: string | null;
         active_review_run?: {
-            worker_command: string[];
             run_id: string;
+            worker_command: string[];
             audit_results_path: string;
             task_path: string;
             prompt_path: string;

package/dist/audit/extractors/analyzers/acquisitionEngine.d.ts

@@ -0,0 +1,140 @@
+import { type AnalyzerSetting, type RunTrackedResult } from "audit-tools/shared";
+import type { ExternalAnalyzerResults, ExternalAnalyzerToolStatus } from "../../types/externalAnalyzer.js";
+/**
+ * F5 — external analyzer acquisition engine.
+ *
+ * On-demand acquisition + ephemeral execution of mature, ecosystem-native
+ * analyzers (eslint, ruff, cargo-clippy, …). Distinct from the in-tree
+ * `LanguageAnalyzer` registry (which enriches the regex floor from a resolved
+ * npm package directory): F5 *runs an external tool as a subprocess* and
+ * normalizes its native output through the EXISTING adapter seam
+ * (`normalizeExternal.ts`) into {@link ExternalAnalyzerResults}, which then
+ * re-enters the graph/risk artifacts through the shared
+ * CCU-analyzer-merge-helper-seam pair.
+ *
+ * Design invariants (all enforced here, never by host discretion):
+ *  - **No baked-in language→tool / OS→runner table.** Ecosystem is detected
+ *    deterministically from repo marker files; the runner (npx/pipx/cargo/bundle)
+ *    is capability-probed at RUNTIME (`--version`) before any tool spawn.
+ *  - **Single subprocess-SPAWN admission chokepoint** (`admitSpawn`): EVERY
+ *    non-DEFAULT candidate is gated on the per-run consent token regardless of
+ *    its `AnalyzerSetting` (auto|ephemeral|permanent) — even a `permanent`,
+ *    pre-installed tool cannot spawn without consent (CE-005). The small
+ *    value-curated DEFAULT set runs without prompting.
+ *  - **Own-vs-acquire boundary.** git-history / secret-scan are OWNED by F6 and
+ *    are rejected at registration — never acquired here.
+ *  - **Run-safety gate written once** (`runSafetyGate`): capability-probe, pin
+ *    version, read-only/sandboxed argv, degrade-to-empty.
+ *  - **Degrade-to-empty + report-skipped-never-silently.** Every candidate
+ *    yields exactly one {@link ExternalAnalyzerToolStatus}; a failure never
+ *    throws and never silently drops the candidate.
+ */
+/** Tool ids OWNED by F6 (git-history mining / secret scanning). Never acquired. */
+export declare const OWNED_TOOL_IDS: Set<string>;
+/** Ecosystem runners F5 knows how to drive. */
+export type EcosystemRunner = "npx" | "pipx" | "cargo" | "bundle";
+/**
+ * One acquirable external analyzer. `defaultRun: true` marks a member of the
+ * small value-curated set that may run without a consent token; everything else
+ * is gated on the per-run consent token at the spawn chokepoint.
+ */
+export interface ExternalAnalyzerCandidate {
+    /** Stable id; also the `analyzers.<id>` session-config key. */
+    id: string;
+    /** Runner that acquires + executes the tool ephemerally. */
+    runner: EcosystemRunner;
+    /** Pinned tool spec, e.g. "eslint@9" / "ruff==0.5.0" (pinned for reproducibility). */
+    spec: string;
+    /**
+     * Build the read-only argv for the tool given the resolved runner argv prefix
+     * and repo root. MUST NOT request fixes/writes — F5 is observe-only.
+     */
+    buildArgv(runnerPrefix: string[], root: string): string[];
+    /**
+     * Parse the tool's stdout into the generic item shape consumed by
+     * `normalizeGenericExternalResults`. Degrades to `[]` on any parse failure.
+     */
+    parse(stdout: string): Array<{
+        id?: string;
+        category?: string;
+        severity?: string;
+        path?: string;
+        line_start?: number;
+        line_end?: number;
+        summary?: string;
+        rule?: string;
+        raw?: unknown;
+        from?: unknown;
+        to?: unknown;
+    }>;
+    /** Whether this ecosystem is present (marker file detection). */
+    detect(root: string): boolean;
+    /** Member of the value-curated DEFAULT set (runs without prompting). */
+    defaultRun: boolean;
+}
+export declare function detectNodeEcosystem(root: string): boolean;
+export declare function detectPythonEcosystem(root: string): boolean;
+export declare function detectRustEcosystem(root: string): boolean;
+export declare function detectRubyEcosystem(root: string): boolean;
+export interface AcquisitionRunner {
+    (argv: string[], cwd: string): RunTrackedResult;
+}
+export interface AcquisitionEngineOptions {
+    /**
+     * Per-run consent token. REQUIRED to spawn any non-DEFAULT candidate (and any
+     * candidate whose setting is ephemeral/permanent). Absent ⇒ only the DEFAULT
+     * set runs; everything else is reported `skipped` with a consent note.
+     */
+    consentToken?: string;
+    /** Per-analyzer settings (auto|ephemeral|permanent|skip|repo). */
+    analyzers?: Record<string, AnalyzerSetting>;
+    /** Injectable command runner; defaults to the shared runTracked. */
+    run?: AcquisitionRunner;
+    /** Injectable logger; defaults to a no-op (degrade quietly to status records). */
+    log?: (...args: unknown[]) => void;
+}
+/**
+ * Single subprocess-SPAWN admission chokepoint. Returns the reason a spawn is
+ * NOT admitted, or `undefined` when admitted. The DEFAULT set is admitted
+ * without a token; EVERY other candidate — including `permanent`/`ephemeral`
+ * pre-installed tools — requires the per-run consent token (CE-005).
+ */
+export declare function admitSpawn(candidate: ExternalAnalyzerCandidate, setting: AnalyzerSetting, consentToken: string | undefined): string | undefined;
+/**
+ * The run-safety gate, written once: capability-probe the runner, then (if the
+ * probe passes) the caller may spawn the pinned, read-only argv. Returns the
+ * probe outcome so a missing runner degrades to an empty result + a status.
+ */
+export declare function runSafetyGate(candidate: ExternalAnalyzerCandidate, run: AcquisitionRunner, root: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface AcquisitionOutcome {
+    results: ExternalAnalyzerResults;
+    status: ExternalAnalyzerToolStatus;
+}
+/**
+ * Acquire + run ONE external analyzer candidate ephemerally, normalizing its
+ * output through the adapter seam. Never throws; always returns exactly one
+ * {@link ExternalAnalyzerToolStatus} alongside the (possibly empty) results.
+ */
+export declare function runExternalAnalyzer(candidate: ExternalAnalyzerCandidate, root: string, options?: AcquisitionEngineOptions): AcquisitionOutcome;
+/**
+ * Register external analyzer candidates, rejecting any whose id is OWNED by F6
+ * (git-history/secret-scan). Returns the accepted candidates; the own-vs-acquire
+ * boundary is enforced HERE so an owned tool can never enter the engine.
+ */
+export declare function registerExternalAnalyzers(candidates: ExternalAnalyzerCandidate[]): ExternalAnalyzerCandidate[];
+export interface RunAllOutcome {
+    results: ExternalAnalyzerResults[];
+    statuses: ExternalAnalyzerToolStatus[];
+}
+/**
+ * Drive the whole registered candidate set through the engine for one repo,
+ * collecting one status per candidate. Owned tools are rejected at registration;
+ * each survivor passes through the spawn-admission chokepoint and run-safety gate.
+ */
+export declare function runAcquisitionEngine(candidates: ExternalAnalyzerCandidate[], root: string, options?: AcquisitionEngineOptions): RunAllOutcome;
+//# sourceMappingURL=acquisitionEngine.d.ts.map

package/dist/audit/extractors/analyzers/acquisitionEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquisitionEngine.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/acquisitionEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mFAAmF;AACnF,eAAO,MAAM,cAAc,aAMzB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,MAAM,EAAE,eAAe,CAAC;IACxB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1D;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,EAAE,CAAC,EAAE,OAAO,CAAC;KACd,CAAC,CAAC;IACH,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AA0BD,MAAM,WAAW,iBAAiB;IAChC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,oEAAoE;IACpE,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,yBAAyB,EACpC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,yBAAyB,EACpC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgB9C;AAaD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,0BAA0B,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,yBAAyB,EACpC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,kBAAkB,CA6GpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,yBAAyB,EAAE,GACtC,yBAAyB,EAAE,CAO7B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,QAAQ,EAAE,0BAA0B,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,yBAAyB,EAAE,EACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,wBAA6B,GACrC,aAAa,CAYf"}