audit-tools 0.42.0 → 0.43.0

package/dist/shared/analyzers/binaryAcquisition.js

@@ -1,14 +1,122 @@
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+import { homedir } from "node:os";
+import { AUDIT_TOOLS_DIRNAME } from "../io/auditToolsPaths.js";
 import { runTracked } from "../tooling/exec.js";
+/**
+ * Per-USER cache root, deliberately NOT the system temp dir. Defaults to
+ * `~/.audit-tools/bincache`; `AUDIT_TOOLS_BINARY_CACHE` overrides it so a run can be
+ * pinned to an isolated cache — the same override shape as
+ * {@link analyzerCacheRoot}'s `AUDIT_TOOLS_ANALYZER_CACHE`, and what lets a test
+ * exercise the DEFAULT path without ever writing to the real home directory.
+ *
+ * The digest manifest beside a cached binary proves the bytes match what the manifest
+ * says — but an attacker who can write the cache dir writes BOTH, so a self-consistent
+ * pair inside a world-writable location proves nothing. The manifest only has meaning
+ * when the directory it lives in is not attacker-writable, which is what moving the
+ * default root under the user's home buys. `cacheDir` remains overridable per call for
+ * a caller that has its own private location.
+ *
+ * Consequence, deliberate: caches warmed under the old `<tmpdir>/audit-tools-bincache`
+ * are simply never consulted again — the first resolution under the new root
+ * re-downloads, or degrades to `unavailable` offline.
+ */
 function defaultCacheDir() {
-    return join(tmpdir(), "audit-tools-bincache");
+    const override = process.env.AUDIT_TOOLS_BINARY_CACHE;
+    if (override && override.trim().length > 0)
+        return override;
+    return join(homedir(), AUDIT_TOOLS_DIRNAME, "bincache");
+}
+/**
+ * Create the cache root restricted to its owner where the platform honours modes.
+ * On win32 the mode is ignored (ACLs govern), and the per-user home root is the
+ * protection there.
+ *
+ * ⚠ The mode applies AT CREATION ONLY. An existing directory keeps whatever mode it
+ * already has — `mkdirSync` does not chmod one it did not create — so a root that was
+ * created loosely by something else is not repaired here.
+ */
+function ensureCacheRoot(cacheDir) {
+    try {
+        mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+    }
+    catch {
+        /* a later mkdir of the version dir surfaces any real failure */
+    }
 }
 function exeName(binaryName, platform) {
     return platform === "win32" ? `${binaryName}.exe` : binaryName;
 }
+/** `unavailable` with its cause carried in BOTH forms — machine member + human note. */
+function unavailable(reason, note) {
+    return { status: "unavailable", command: null, reason, note };
+}
+/**
+ * Cache manifest filename. Written beside the cached executable at download time and
+ * the ONLY evidence that these bytes came from a checksum-verified acquisition.
+ */
+const CACHE_MANIFEST_FILENAME = ".audit-tools-binary.json";
+/** Remove a cache version dir wholesale; best-effort, never throws. */
+function purgeVersionDir(versionDir) {
+    try {
+        rmSync(versionDir, { recursive: true, force: true });
+    }
+    catch {
+        /* best-effort — a later resolution re-verifies regardless */
+    }
+}
+function writeCacheManifest(versionDir, spec, executablePath) {
+    try {
+        const manifest = {
+            binaryName: spec.binaryName,
+            version: spec.version,
+            executable_relative_path: relative(versionDir, executablePath).replace(/\\/g, "/"),
+            executable_sha256: sha256(readFileSync(executablePath)),
+        };
+        writeFileSync(join(versionDir, CACHE_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    }
+    catch {
+        /* An unwritable manifest simply means the next resolution re-downloads. */
+    }
+}
+/**
+ * The cached executable's path — but ONLY when its bytes still hash to the digest
+ * recorded when it was acquired. A missing, unreadable, or mismatched manifest, an
+ * escaping relative path, or drifted bytes all return null and the caller purges:
+ * filename existence is never sufficient to execute.
+ */
+function verifiedCachedExecutable(versionDir, spec) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(versionDir, CACHE_MANIFEST_FILENAME), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!manifest ||
+        manifest.binaryName !== spec.binaryName ||
+        manifest.version !== spec.version ||
+        typeof manifest.executable_relative_path !== "string" ||
+        manifest.executable_relative_path.length === 0 ||
+        typeof manifest.executable_sha256 !== "string" ||
+        manifest.executable_sha256.length !== 64) {
+        return null;
+    }
+    const executablePath = join(versionDir, manifest.executable_relative_path);
+    const containment = relative(versionDir, executablePath);
+    if (containment.startsWith("..") || isAbsolute(containment))
+        return null;
+    try {
+        if (sha256(readFileSync(executablePath)) !== manifest.executable_sha256.toLowerCase()) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return executablePath;
+}
 /** Parse a `<sha256>␠␠<asset>` checksums file for one asset's expected digest. */
 export function expectedSha256For(checksumsText, assetName) {
     for (const line of checksumsText.split(/\r?\n/)) {
@@ -31,29 +139,34 @@ export async function resolveBinary(spec, options = {}) {
     const arch = options.arch ?? process.arch;
     const run = options.run ?? ((argv, cwd) => runTracked(argv, { cwd }));
     const cacheDir = options.cacheDir ?? defaultCacheDir();
-    // 1. PATH — already installed.
+    // 1. PATH — already installed. Nothing below this point runs, so a tool the machine
+    // already has must not cause a cache directory to be created as a side effect.
     const probe = run(spec.versionProbeArgs, process.cwd());
     if (!probe.error && probe.status === 0) {
         return { status: "path", command: spec.binaryName };
     }
-    // 2. cache — a previously-downloaded pinned binary.
+    // 2. cache — a previously-downloaded pinned binary, RE-VERIFIED on every
+    // resolution. The cache path is derivable from public pinned constants, so a
+    // file at the expected name is a claim, not a proof: it is executed only when its
+    // bytes still match the digest recorded at acquisition. Anything else — including
+    // a version dir a failed extraction left behind — is purged and re-acquired.
     const versionDir = join(cacheDir, `${spec.binaryName}-${spec.version}`);
-    const cachedPath = join(versionDir, exeName(spec.binaryName, platform));
-    if (existsSync(cachedPath)) {
-        return { status: "cached", command: cachedPath };
+    if (existsSync(versionDir)) {
+        const verified = verifiedCachedExecutable(versionDir, spec);
+        if (verified)
+            return { status: "cached", command: verified };
+        // Unverifiable bytes, or a dir a failed extraction left behind: purge so nothing
+        // half-written or pre-planted can become a later "cache hit".
+        purgeVersionDir(versionDir);
     }
     // 3. download — pinned release asset, SHA256-verified, then extracted.
     const fetch = options.fetch;
     if (!fetch) {
-        return { status: "unavailable", command: null, note: "no fetcher configured (offline)" };
+        return unavailable("offline", "no fetcher configured (offline)");
     }
     const assetName = spec.assetFor(platform, arch);
     if (!assetName) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `no release asset for ${platform}/${arch}`,
-        };
+        return unavailable("no_asset_for_platform", `no release asset for ${platform}/${arch}`);
     }
     let assetBytes;
     let checksumsBytes;
@@ -65,27 +178,25 @@ export async function resolveBinary(spec, options = {}) {
         assetBytes = await fetch(spec.releaseUrlForAsset(assetName));
     }
     catch (error) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `download failed: ${error instanceof Error ? error.message : String(error)}`,
-        };
+        return unavailable("download_failed", `download failed: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (!checksumsBytes || !assetBytes) {
-        return { status: "unavailable", command: null, note: "download returned no bytes" };
+        return unavailable("download_empty", "download returned no bytes");
     }
     const expected = expectedSha256For(Buffer.from(checksumsBytes).toString("utf8"), assetName);
     if (!expected) {
-        return { status: "unavailable", command: null, note: `no checksum for ${assetName}` };
+        return unavailable("no_checksum_for_asset", `no checksum for ${assetName}`);
     }
     const actual = sha256(assetBytes);
     if (actual !== expected) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`,
-        };
+        return unavailable("checksum_mismatch", `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`);
     }
+    // Only here — past the PATH probe, past a cache miss, past verification — is
+    // anything about to be WRITTEN. Creating the root any earlier would grow an empty
+    // cache directory on every resolution that never caches anything: a tool already on
+    // PATH, an offline degrade, an unsupported platform. Read paths only ever ask
+    // whether the directory exists.
+    ensureCacheRoot(cacheDir);
     // Non-archived asset (e.g. osv-scanner): the verified bytes ARE the
     // executable — write directly to the cached path, no `tar` involved.
     if (spec.archived === false) {
@@ -101,14 +212,12 @@ export async function resolveBinary(spec, options = {}) {
                     /* best-effort */
                 }
             }
+            writeCacheManifest(versionDir, spec, resolved);
             return { status: "downloaded", command: resolved };
         }
         catch (error) {
-            return {
-                status: "unavailable",
-                command: null,
-                note: `write error: ${error instanceof Error ? error.message : String(error)}`,
-            };
+            purgeVersionDir(versionDir);
+            return unavailable("write_failed", `write error: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     // Verified — write the archive and extract it with the system `tar` (bsdtar
@@ -120,24 +229,20 @@ export async function resolveBinary(spec, options = {}) {
         const extract = run(["tar", "-xf", archivePath, "-C", versionDir], versionDir);
         rmSync(archivePath, { force: true });
         if (extract.error || extract.status !== 0) {
-            return {
-                status: "unavailable",
-                command: null,
-                note: `extract failed: ${extract.error?.message ?? `tar exit ${extract.status}`}`,
-            };
+            // Whatever tar managed to write before failing must NOT survive as a cache hit.
+            purgeVersionDir(versionDir);
+            return unavailable("extract_failed", `extract failed: ${extract.error?.message ?? `tar exit ${extract.status}`}`);
         }
     }
     catch (error) {
-        return {
-            status: "unavailable",
-            command: null,
-            note: `extract error: ${error instanceof Error ? error.message : String(error)}`,
-        };
+        purgeVersionDir(versionDir);
+        return unavailable("extract_failed", `extract error: ${error instanceof Error ? error.message : String(error)}`);
     }
     // Locate the executable (archives may nest it); chmod +x on POSIX.
     const resolved = findExecutable(versionDir, exeName(spec.binaryName, platform));
     if (!resolved) {
-        return { status: "unavailable", command: null, note: "binary not found in archive" };
+        purgeVersionDir(versionDir);
+        return unavailable("not_found_in_archive", "binary not found in archive");
     }
     if (platform !== "win32") {
         try {
@@ -147,6 +252,7 @@ export async function resolveBinary(spec, options = {}) {
             /* best-effort */
         }
     }
+    writeCacheManifest(versionDir, spec, resolved);
     return { status: "downloaded", command: resolved };
 }
 /** Shallow-then-recursive search for `name` under `dir`. */

package/dist/shared/analyzers/binaryAcquisition.js.map

@@ -1 +1 @@
-{"version":3,"file":"binaryAcquisition.js","sourceRoot":"","sources":["../../../src/shared/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AA6EvE,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB,EAAE,QAAyB;IAC5D,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,SAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IAEvD,+BAA+B;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,wBAAwB,QAAQ,IAAI,IAAI,EAAE;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,UAA6B,CAAC;IAClC,IAAI,cAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,kBAAkB,GACtB,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;YACvC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QAC1B,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1E,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAChC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5C,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,SAAS,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,yBAAyB,SAAS,cAAc,QAAQ,SAAS,MAAM,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,gBAAgB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,mBAAmB,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,OAAO,CAAC,MAAM,EAAE,EAAE;aAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"binaryAcquisition.js","sourceRoot":"","sources":["../../../src/shared/analyzers/binaryAcquisition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AAgHvE;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB,EAAE,QAAyB;IAC5D,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAClB,MAA+B,EAC/B,IAAY;IAEZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAW3D,uEAAuE;AACvE,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAkB,EAClB,IAAgB,EAChB,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAwB;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wBAAwB,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;YAClF,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;SACxD,CAAC;QACF,aAAa,CACX,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,EACzC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACxC,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,UAAkB,EAClB,IAAgB;IAEhB,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CACnB,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CACzC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,QAAQ;QACT,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACvC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QACjC,OAAO,QAAQ,CAAC,wBAAwB,KAAK,QAAQ;QACrD,QAAQ,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;QAC9C,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;QAC9C,QAAQ,CAAC,iBAAiB,CAAC,MAAM,KAAK,EAAE,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,KAAK,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,SAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IAEvD,oFAAoF;IACpF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,kFAAkF;IAClF,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC7D,iFAAiF;QACjF,8DAA8D;QAC9D,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,uBAAuB,EACvB,wBAAwB,QAAQ,IAAI,IAAI,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,UAA6B,CAAC;IAClC,IAAI,cAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,kBAAkB,GACtB,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;YACvC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QAC1B,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1E,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,iBAAiB,EACjB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAChC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5C,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,uBAAuB,EAAE,mBAAmB,SAAS,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,WAAW,CAChB,mBAAmB,EACnB,yBAAyB,SAAS,cAAc,QAAQ,SAAS,MAAM,GAAG,CAC3E,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,gCAAgC;IAChC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE1B,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,UAAU,CAAC,CAAC;YAC5B,OAAO,WAAW,CAChB,cAAc,EACd,gBAAgB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,gFAAgF;YAChF,eAAe,CAAC,UAAU,CAAC,CAAC;YAC5B,OAAO,WAAW,CAChB,gBAAgB,EAChB,mBAAmB,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,OAAO,CAAC,MAAM,EAAE,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,WAAW,CAChB,gBAAgB,EAChB,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,WAAW,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/analyzers/candidates.d.ts

@@ -1,4 +1,5 @@
 import type { ExternalAnalyzerCandidate } from "./acquisitionEngine.js";
+import type { ExternalAnalyzerParseReport } from "./types.js";
 /**
  * The value-curated EXTERNAL analyzer candidate registry. This is the only place
  * concrete tools are named; the engine is tool-agnostic. Membership in the
@@ -13,11 +14,11 @@ declare const GITLEAKS_VERSION = "8.21.2";
  * the engine's generic item shape. The raw secret value is NEVER carried through
  * (Secret/Match are dropped) so the persisted artifact cannot leak a credential.
  */
-declare function parseGitleaks(report: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseGitleaks(report: string): ExternalAnalyzerParseReport;
 declare const gitleaksCandidate: ExternalAnalyzerCandidate;
 declare const semgrepCandidate: ExternalAnalyzerCandidate;
 declare const eslintCandidate: ExternalAnalyzerCandidate;
-declare function parseKnip(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseKnip(stdout: string): ExternalAnalyzerParseReport;
 declare const knipCandidate: ExternalAnalyzerCandidate;
 /**
  * Parse jscpd's JSON reporter output (`{ duplicates: [{ firstFile, secondFile,
@@ -27,7 +28,7 @@ declare const knipCandidate: ExternalAnalyzerCandidate;
  * normalization path, not to a candidate's own parse function (same as
  * parseKnip/parseEslint/parseSemgrep above).
  */
-declare function parseJscpd(report: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseJscpd(report: string): ExternalAnalyzerParseReport;
 declare const jscpdCandidate: ExternalAnalyzerCandidate;
 declare const OSV_SCANNER_VERSION = "2.4.0";
 /**
@@ -39,7 +40,7 @@ declare const OSV_SCANNER_VERSION = "2.4.0";
  * raw vulnerability id, so CVE/GHSA aliases for the same underlying issue
  * don't fan out into duplicate items.
  */
-declare function parseOsvScanner(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseOsvScanner(stdout: string): ExternalAnalyzerParseReport;
 declare const osvScannerCandidate: ExternalAnalyzerCandidate;
 declare const clippyCandidate: ExternalAnalyzerCandidate;
 declare const rubocopCandidate: ExternalAnalyzerCandidate;
@@ -50,7 +51,7 @@ declare const HADOLINT_VERSION = "2.14.0";
  * message }]`. `level` ∈ error|warning|info|style. Degrades to `[]` on
  * empty/malformed/non-array input.
  */
-declare function parseHadolint(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseHadolint(stdout: string): ExternalAnalyzerParseReport;
 declare const hadolintCandidate: ExternalAnalyzerCandidate;
 declare const ACTIONLINT_VERSION = "1.7.12";
 /**
@@ -58,7 +59,7 @@ declare const ACTIONLINT_VERSION = "1.7.12";
  * against actionlint's template output: `[{ message, filepath, line, column,
  * kind }]`. Degrades to `[]` on empty/malformed/non-array input.
  */
-declare function parseActionlint(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseActionlint(stdout: string): ExternalAnalyzerParseReport;
 declare const actionlintCandidate: ExternalAnalyzerCandidate;
 /**
  * Parse type-coverage's `--json --detail` stdout — grounded against
@@ -66,14 +67,14 @@ declare const actionlintCandidate: ExternalAnalyzerCandidate;
  * line, character, text }] }`. Each `anys` entry is one implicit/explicit `any`
  * site; degrades to `[]` on empty/malformed input or a missing `anys` array.
  */
-declare function parseTypeCoverage(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseTypeCoverage(stdout: string): ExternalAnalyzerParseReport;
 declare const typeCoverageCandidate: ExternalAnalyzerCandidate;
 /**
  * Parse lizard's CSV output (default: `lizard -l <languages> --csv <path>`).
  * CSV format: "NLOC,CCN,Token,PARAM,Length,Location,File,Function"
  * Degrades to `[]` on parse failure; reports lead findings for complexity overages.
  */
-declare function parseLizard(stdout: string): ReturnType<ExternalAnalyzerCandidate["parse"]>;
+declare function parseLizard(stdout: string): ExternalAnalyzerParseReport;
 declare const lizardCandidate: ExternalAnalyzerCandidate;
 /** The curated external analyzer candidate set. `defaultRun` marks the consent-free default members. */
 export declare const EXTERNAL_ANALYZER_CANDIDATES: ExternalAnalyzerCandidate[];

package/dist/shared/analyzers/candidates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"candidates.d.ts","sourceRoot":"","sources":["../../../src/shared/analyzers/candidates.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAaxE;;;;;;;GAOG;AAKH,QAAA,MAAM,gBAAgB,WAAW,CAAC;AAkDlC;;;;GAIG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAqCrF;AAED,QAAA,MAAM,iBAAiB,EAAE,yBA4BxB,CAAC;AAiCF,QAAA,MAAM,gBAAgB,EAAE,yBAevB,CAAC;AAqCF,QAAA,MAAM,eAAe,EAAE,yBAetB,CAAC;AAkBF,iBAAS,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAyEjF;AAED,QAAA,MAAM,aAAa,EAAE,yBA2BpB,CAAC;AA+FF;;;;;;;GAOG;AACH,iBAAS,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAkClF;AAED,QAAA,MAAM,cAAc,EAAE,yBA4BrB,CAAC;AAOF,QAAA,MAAM,mBAAmB,UAAU,CAAC;AA2BpC;;;;;;;;GAQG;AACH,iBAAS,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CA+DvF;AAED,QAAA,MAAM,mBAAmB,EAAE,yBAoB1B,CAAC;AAKF,QAAA,MAAM,eAAe,EAAE,yBAmBtB,CAAC;AAKF,QAAA,MAAM,gBAAgB,EAAE,yBAkBvB,CAAC;AAOF,QAAA,MAAM,gBAAgB,WAAW,CAAC;AA2BlC;;;;;GAKG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CA6BrF;AAED,QAAA,MAAM,iBAAiB,EAAE,yBAiBxB,CAAC;AAOF,QAAA,MAAM,kBAAkB,WAAW,CAAC;AAkCpC;;;;GAIG;AACH,iBAAS,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CA2BvF;AAED,QAAA,MAAM,mBAAmB,EAAE,yBAkB1B,CAAC;AAKF;;;;;GAKG;AACH,iBAAS,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CA4BzF;AAED,QAAA,MAAM,qBAAqB,EAAE,yBAkB5B,CAAC;AA0CF;;;;GAIG;AACH,iBAAS,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAuCnF;AAED,QAAA,MAAM,eAAe,EAAE,yBA0BtB,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,4BAA4B,EAAE,yBAAyB,EAanE,CAAC;AAEF,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,CAAC"}
+{"version":3,"file":"candidates.d.ts","sourceRoot":"","sources":["../../../src/shared/analyzers/candidates.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAUxE,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,YAAY,CAAC;AAIpB;;;;;;;GAOG;AAKH,QAAA,MAAM,gBAAgB,WAAW,CAAC;AAqElC;;;;GAIG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAuClE;AAED,QAAA,MAAM,iBAAiB,EAAE,yBA4BxB,CAAC;AAiCF,QAAA,MAAM,gBAAgB,EAAE,yBAevB,CAAC;AAuCF,QAAA,MAAM,eAAe,EAAE,yBAetB,CAAC;AAkBF,iBAAS,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAyE9D;AAED,QAAA,MAAM,aAAa,EAAE,yBA2BpB,CAAC;AA+FF;;;;;;;GAOG;AACH,iBAAS,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAkC/D;AAED,QAAA,MAAM,cAAc,EAAE,yBA4BrB,CAAC;AAOF,QAAA,MAAM,mBAAmB,UAAU,CAAC;AA2BpC;;;;;;;;GAQG;AACH,iBAAS,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CA+DpE;AAED,QAAA,MAAM,mBAAmB,EAAE,yBAoB1B,CAAC;AAKF,QAAA,MAAM,eAAe,EAAE,yBAmBtB,CAAC;AAKF,QAAA,MAAM,gBAAgB,EAAE,yBAkBvB,CAAC;AAOF,QAAA,MAAM,gBAAgB,WAAW,CAAC;AA2BlC;;;;;GAKG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CA+BlE;AAED,QAAA,MAAM,iBAAiB,EAAE,yBAiBxB,CAAC;AAOF,QAAA,MAAM,kBAAkB,WAAW,CAAC;AAkCpC;;;;GAIG;AACH,iBAAS,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CA6BpE;AAED,QAAA,MAAM,mBAAmB,EAAE,yBAkB1B,CAAC;AAKF;;;;;GAKG;AACH,iBAAS,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CA4BtE;AAED,QAAA,MAAM,qBAAqB,EAAE,yBAkB5B,CAAC;AA0CF;;;;GAIG;AACH,iBAAS,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAgDhE;AAED,QAAA,MAAM,eAAe,EAAE,yBA0BtB,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,4BAA4B,EAAE,yBAAyB,EAanE,CAAC;AAEF,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,WAAW,GACZ,CAAC"}