audit-tools 0.50.13 → 0.50.14

package/dist/audit/adapters/astGrep.js

@@ -1,46 +0,0 @@
-import { normalizeGenericExternalEdges } from "audit-tools/shared";
-/** Default capture name holding the edge target path/specifier. */
-const DEFAULT_TARGET_META_VAR = "TARGET";
-/**
- * Normalize `ast-grep scan --json` output into language-neutral graph edges:
- * one `matched-file → captured-target` edge per match whose target meta-variable
- * resolves to a non-empty string distinct from the matched file. ast-grep is a
- * structural matcher, so the target capture is whatever the operator's rule
- * binds (a module specifier, a referenced symbol path); endpoint resolution
- * against the repo path lookup happens downstream in the graph extractor.
- *
- * Degrades to an empty edge list on any malformed / missing field and never
- * throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
- */
-export function normalizeAstGrepJson(matches, targetMetaVar = DEFAULT_TARGET_META_VAR) {
-    const candidates = [];
-    for (const match of Array.isArray(matches) ? matches : []) {
-        if (!match || typeof match !== "object")
-            continue;
-        const from = typeof match.file === "string" && match.file.trim().length > 0
-            ? match.file.trim()
-            : undefined;
-        const target = match.metaVariables?.single?.[targetMetaVar]?.text;
-        const to = typeof target === "string" && target.trim().length > 0
-            ? target.trim()
-            : undefined;
-        if (!from || !to)
-            continue;
-        candidates.push({
-            from,
-            to,
-            kind: "analyzer-dataflow-edge",
-            confidence: 0.7,
-            reason: typeof match.ruleId === "string"
-                ? `ast-grep rule '${match.ruleId}' links match to captured target.`
-                : "ast-grep structural match links file to captured target.",
-        });
-    }
-    return {
-        tool: "ast-grep",
-        generated_at: new Date().toISOString(),
-        graph_edges: normalizeGenericExternalEdges(candidates),
-        results: [],
-    };
-}
-//# sourceMappingURL=astGrep.js.map

package/dist/audit/adapters/astGrep.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"astGrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/astGrep.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAgBnE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmC,EACnC,gBAAwB,uBAAuB;IAE/C,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACnB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;QAClE,MAAM,EAAE,GACN,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YACf,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAAE,SAAS;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,EAAE;YACF,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EACJ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAC9B,CAAC,CAAC,kBAAkB,KAAK,CAAC,MAAM,mCAAmC;gBACnE,CAAC,CAAC,0DAA0D;SACjE,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/codeql.d.ts

@@ -1,47 +0,0 @@
-import type { ExternalAnalyzerResults } from "audit-tools/shared";
-/**
- * Minimal SARIF 2.1.0 shape for CodeQL dataflow queries. Only the fields needed
- * to recover source→sink file edges from `codeFlows` are typed; everything is
- * optional so a partial / malformed report degrades rather than throwing.
- */
-interface SarifArtifactLocation {
-    uri?: string;
-}
-interface SarifLocation {
-    physicalLocation?: {
-        artifactLocation?: SarifArtifactLocation;
-    };
-}
-interface SarifThreadFlowLocation {
-    location?: SarifLocation;
-}
-interface SarifThreadFlow {
-    locations?: SarifThreadFlowLocation[];
-}
-interface SarifCodeFlow {
-    threadFlows?: SarifThreadFlow[];
-}
-interface SarifResult {
-    ruleId?: string;
-    codeFlows?: SarifCodeFlow[];
-}
-interface SarifRun {
-    results?: SarifResult[];
-}
-export interface CodeqlSarif {
-    runs?: SarifRun[];
-}
-/**
- * Normalize a CodeQL SARIF dataflow report into language-neutral graph edges:
- * for each result's code flow, emit one `source-file → sink-file` edge from the
- * first to the last thread-flow location whose file paths differ. CodeQL's
- * dataflow queries already model taint propagation, so the first/last locations
- * are the source and sink; downstream the graph extractor resolves the URIs
- * against the repo path lookup.
- *
- * Degrades to an empty edge list on any malformed / missing SARIF field and
- * never throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
- */
-export declare function normalizeCodeqlSarif(input: CodeqlSarif): ExternalAnalyzerResults;
-export {};
-//# sourceMappingURL=codeql.d.ts.map

package/dist/audit/adapters/codeql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"codeql.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/codeql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,oBAAoB,CAAC;AAG5B;;;;GAIG;AACH,UAAU,qBAAqB;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AACD,UAAU,aAAa;IACrB,gBAAgB,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;KAAE,CAAC;CACjE;AACD,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AACD,UAAU,eAAe;IACvB,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACvC;AACD,UAAU,aAAa;IACrB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;AACD,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;CAC7B;AACD,UAAU,QAAQ;IAChB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AACD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;CACnB;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,uBAAuB,CAiChF"}

package/dist/audit/adapters/codeql.js

@@ -1,52 +0,0 @@
-import { normalizeGenericExternalEdges } from "audit-tools/shared";
-function locationUri(location) {
-    const uri = location?.location?.physicalLocation?.artifactLocation?.uri;
-    return typeof uri === "string" && uri.trim().length > 0 ? uri.trim() : undefined;
-}
-/**
- * Normalize a CodeQL SARIF dataflow report into language-neutral graph edges:
- * for each result's code flow, emit one `source-file → sink-file` edge from the
- * first to the last thread-flow location whose file paths differ. CodeQL's
- * dataflow queries already model taint propagation, so the first/last locations
- * are the source and sink; downstream the graph extractor resolves the URIs
- * against the repo path lookup.
- *
- * Degrades to an empty edge list on any malformed / missing SARIF field and
- * never throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
- */
-export function normalizeCodeqlSarif(input) {
-    const candidates = [];
-    for (const run of input.runs ?? []) {
-        for (const result of run?.results ?? []) {
-            for (const codeFlow of result?.codeFlows ?? []) {
-                for (const threadFlow of codeFlow?.threadFlows ?? []) {
-                    if (!threadFlow || typeof threadFlow !== "object")
-                        continue;
-                    const locations = Array.isArray(threadFlow.locations)
-                        ? threadFlow.locations
-                        : [];
-                    const from = locationUri(locations[0]);
-                    const to = locationUri(locations[locations.length - 1]);
-                    if (!from || !to)
-                        continue;
-                    candidates.push({
-                        from,
-                        to,
-                        kind: "analyzer-dataflow-edge",
-                        confidence: 0.7,
-                        reason: typeof result.ruleId === "string"
-                            ? `CodeQL query '${result.ruleId}' flows source → sink.`
-                            : "CodeQL dataflow flows source → sink.",
-                    });
-                }
-            }
-        }
-    }
-    return {
-        tool: "codeql",
-        generated_at: new Date().toISOString(),
-        graph_edges: normalizeGenericExternalEdges(candidates),
-        results: [],
-    };
-}
-//# sourceMappingURL=codeql.js.map

package/dist/audit/adapters/codeql.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codeql.js","sourceRoot":"","sources":["../../../src/audit/adapters/codeql.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAiCnE,SAAS,WAAW,CAAC,QAA6C;IAChE,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACxE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACrD,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;gBAC/C,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;oBACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;wBAAE,SAAS;oBAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnD,CAAC,CAAC,UAAU,CAAC,SAAS;wBACtB,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxD,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;wBAAE,SAAS;oBAC3B,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI;wBACJ,EAAE;wBACF,IAAI,EAAE,wBAAwB;wBAC9B,UAAU,EAAE,GAAG;wBACf,MAAM,EACJ,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;4BAC/B,CAAC,CAAC,iBAAiB,MAAM,CAAC,MAAM,wBAAwB;4BACxD,CAAC,CAAC,sCAAsC;qBAC7C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/coverageSummary.d.ts

@@ -1,9 +0,0 @@
-import type { ExternalAnalyzerResults } from "audit-tools/shared";
-interface CoverageFileSummary {
-    path: string;
-    lines_pct: number;
-    branches_pct?: number;
-}
-export declare function normalizeCoverageSummary(files: CoverageFileSummary[]): ExternalAnalyzerResults;
-export {};
-//# sourceMappingURL=coverageSummary.d.ts.map

package/dist/audit/adapters/coverageSummary.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"coverageSummary.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/coverageSummary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQlE,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAAE,GAC3B,uBAAuB,CAczB"}

package/dist/audit/adapters/coverageSummary.js

@@ -1,18 +0,0 @@
-import { normalizeGenericExternalResults } from "audit-tools/shared";
-/** Minimum acceptable line coverage percentage; files below this are flagged. */
-const COVERAGE_THRESHOLD_LOW = 80;
-/** Line coverage percentage below which severity is escalated to "high" (otherwise "medium"). */
-const COVERAGE_SEVERITY_HIGH = 50;
-export function normalizeCoverageSummary(files) {
-    return normalizeGenericExternalResults("coverage-summary", files
-        .filter((file) => file.lines_pct < COVERAGE_THRESHOLD_LOW)
-        .map((file, index) => ({
-        id: `coverage-${index + 1}`,
-        category: "tests",
-        severity: file.lines_pct < COVERAGE_SEVERITY_HIGH ? "high" : "medium",
-        path: file.path,
-        summary: `Low line coverage: ${file.lines_pct}%${typeof file.branches_pct === "number" ? `, branch coverage ${file.branches_pct}%` : ""}.`,
-        raw: file,
-    })));
-}
-//# sourceMappingURL=coverageSummary.js.map

package/dist/audit/adapters/coverageSummary.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"coverageSummary.js","sourceRoot":"","sources":["../../../src/audit/adapters/coverageSummary.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,iGAAiG;AACjG,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAQlC,MAAM,UAAU,wBAAwB,CACtC,KAA4B;IAE5B,OAAO,+BAA+B,CACpC,kBAAkB,EAClB,KAAK;SACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,GAAG,sBAAsB,CAAC;SACzD,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrB,EAAE,EAAE,YAAY,KAAK,GAAG,CAAC,EAAE;QAC3B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACrE,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,sBAAsB,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1I,GAAG,EAAE,IAAI;KACV,CAAC,CAAC,CACN,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/eslint.d.ts

@@ -1,14 +0,0 @@
-import type { ExternalAnalyzerResults } from "audit-tools/shared";
-interface EslintResult {
-    filePath?: string;
-    messages?: Array<{
-        ruleId?: string | null;
-        severity?: number;
-        line?: number;
-        endLine?: number;
-        message?: string;
-    }>;
-}
-export declare function normalizeEslintJson(input: EslintResult[]): ExternalAnalyzerResults;
-export {};
-//# sourceMappingURL=eslint.d.ts.map

package/dist/audit/adapters/eslint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"eslint.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/eslint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGlE,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAiBD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,GACpB,uBAAuB,CAiBzB"}

package/dist/audit/adapters/eslint.js

@@ -1,28 +0,0 @@
-import { normalizeGenericExternalResults } from "audit-tools/shared";
-const ESLINT_SEVERITY_ERROR = 2;
-const ESLINT_SEVERITY_WARNING = 1;
-const ESLINT_SEVERITY_MAP = {
-    [ESLINT_SEVERITY_ERROR]: "medium",
-    [ESLINT_SEVERITY_WARNING]: "low",
-};
-function mapSeverity(value) {
-    // ESLint's JSON formatter emits 2 for errors and 1 for warnings.
-    if (typeof value !== "number") {
-        return "info";
-    }
-    return ESLINT_SEVERITY_MAP[value] ?? "info";
-}
-export function normalizeEslintJson(input) {
-    return normalizeGenericExternalResults("eslint", input.flatMap((file) => (file.messages ?? []).map((message, index) => ({
-        id: `${file.filePath ?? "unknown"}:${index + 1}`,
-        category: "maintainability",
-        severity: mapSeverity(message.severity),
-        path: file.filePath,
-        line_start: message.line,
-        line_end: message.endLine,
-        summary: message.message,
-        rule: message.ruleId ?? undefined,
-        raw: message,
-    }))));
-}
-//# sourceMappingURL=eslint.js.map

package/dist/audit/adapters/eslint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"eslint.js","sourceRoot":"","sources":["../../../src/audit/adapters/eslint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAarE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,mBAAmB,GAAG;IAC1B,CAAC,qBAAqB,CAAC,EAAE,QAAQ;IACjC,CAAC,uBAAuB,CAAC,EAAE,KAAK;CACxB,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc;IACjC,iEAAiE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAyC,CAAC,IAAI,MAAM,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAqB;IAErB,OAAO,+BAA+B,CACpC,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,KAAK,GAAG,CAAC,EAAE;QAChD,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,QAAQ;QACnB,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;QACjC,GAAG,EAAE,OAAO;KACb,CAAC,CAAC,CACJ,CACF,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/npmAudit.d.ts

@@ -1,16 +0,0 @@
-import type { ExternalAnalyzerResults } from "audit-tools/shared";
-interface NpmAuditVuln {
-    name?: string;
-    severity?: string;
-    range?: string;
-    fixAvailable?: boolean | {
-        name?: string;
-        version?: string;
-    };
-}
-interface NpmAuditJson {
-    vulnerabilities?: Record<string, NpmAuditVuln>;
-}
-export declare function normalizeNpmAuditJson(input: NpmAuditJson): ExternalAnalyzerResults;
-export {};
-//# sourceMappingURL=npmAudit.d.ts.map

package/dist/audit/adapters/npmAudit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"npmAudit.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/npmAudit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGlE,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,UAAU,YAAY;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAChD;AAWD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,GAClB,uBAAuB,CAgBzB"}

package/dist/audit/adapters/npmAudit.js

@@ -1,24 +0,0 @@
-import { normalizeGenericExternalResults } from "audit-tools/shared";
-const NPM_SEVERITY_MAP = {
-    critical: "critical",
-    high: "high",
-    moderate: "medium",
-    medium: "medium",
-    low: "low",
-    info: "info",
-};
-export function normalizeNpmAuditJson(input) {
-    return normalizeGenericExternalResults("npm-audit", Object.entries(input.vulnerabilities ?? {}).map(([pkg, vuln], index) => {
-        const severity = NPM_SEVERITY_MAP[vuln.severity ?? ""] ?? "low";
-        return {
-            id: `npm-audit-${index}`,
-            category: "dependency_risk",
-            severity,
-            path: "package.json",
-            summary: `Package ${pkg} has a ${severity} severity vulnerability in range ${vuln.range ?? "unknown"}.`,
-            rule: pkg,
-            raw: vuln,
-        };
-    }));
-}
-//# sourceMappingURL=npmAudit.js.map

package/dist/audit/adapters/npmAudit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"npmAudit.js","sourceRoot":"","sources":["../../../src/audit/adapters/npmAudit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAarE,MAAM,gBAAgB,GAA2B;IAC/C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,KAAmB;IAEnB,OAAO,+BAA+B,CACpC,WAAW,EACX,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,aAAa,KAAK,EAAE;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,WAAW,GAAG,UAAU,QAAQ,oCAAoC,IAAI,CAAC,KAAK,IAAI,SAAS,GAAG;YACvG,IAAI,EAAE,GAAG;YACT,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/audit/adapters/semgrep.d.ts

@@ -1,42 +0,0 @@
-import type { ExternalAnalyzerResults } from "audit-tools/shared";
-interface SemgrepDataflowTraceNode {
-    location?: {
-        path?: string;
-    };
-}
-interface SemgrepResult {
-    check_id?: string;
-    path?: string;
-    start?: {
-        line?: number;
-    };
-    end?: {
-        line?: number;
-    };
-    extra?: {
-        severity?: string;
-        message?: string;
-        metadata?: {
-            category?: string;
-        };
-        dataflow_trace?: {
-            taint_source?: SemgrepDataflowTraceNode | SemgrepDataflowTraceNode[];
-            intermediate_vars?: SemgrepDataflowTraceNode[];
-            taint_sink?: SemgrepDataflowTraceNode | SemgrepDataflowTraceNode[];
-        };
-    };
-}
-interface SemgrepJson {
-    results?: SemgrepResult[];
-}
-export declare function normalizeSemgrepJson(input: SemgrepJson): ExternalAnalyzerResults;
-/**
- * Normalize semgrep's broader `--dataflow-traces` output into language-neutral
- * graph edges: one `taint-source → taint-sink` edge per result whose source and
- * sink resolve to distinct file paths. Intermediate vars are not edges (they are
- * within-file steps). Malformed / missing traces degrade to an empty edge list;
- * `normalizeGenericExternalEdges` dedupes + sorts so output is deterministic.
- */
-export declare function normalizeSemgrepDataflowJson(input: SemgrepJson): ExternalAnalyzerResults;
-export {};
-//# sourceMappingURL=semgrep.d.ts.map

package/dist/audit/adapters/semgrep.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,oBAAoB,CAAC;AAM5B,UAAU,wBAAwB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACjC,cAAc,CAAC,EAAE;YACf,YAAY,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,EAAE,CAAC;YACrE,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC/C,UAAU,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,EAAE,CAAC;SACpE,CAAC;KACH,CAAC;CACH;AAED,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AA6BD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB,uBAAuB,CAezB;AAwBD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,WAAW,GACjB,uBAAuB,CA0BzB"}

package/dist/audit/adapters/semgrep.js

@@ -1,93 +0,0 @@
-import { normalizeGenericExternalEdges, normalizeGenericExternalResults, } from "audit-tools/shared";
-/**
- * Maps semgrep's native uppercase severity strings to the lowercase enum values
- * required by ExternalAnalyzerResultsSchema. Case-insensitive lookup so
- * any casing variant is handled uniformly.
- *
- * Semgrep → schema:
- *   CRITICAL → 'critical'
- *   ERROR    → 'high'
- *   WARNING  → 'medium'
- *   INFO     → 'info'
- *
- * Any other / undefined value returns undefined so
- * normalizeGenericExternalResults can apply its own fallback.
- */
-function normalizeSemgrepSeverity(raw) {
-    if (raw === undefined)
-        return undefined;
-    switch (raw.toUpperCase()) {
-        case "CRITICAL": return "critical";
-        case "ERROR": return "high";
-        case "WARNING": return "medium";
-        case "INFO": return "info";
-        default: return undefined;
-    }
-}
-export function normalizeSemgrepJson(input) {
-    return normalizeGenericExternalResults("semgrep", (input.results ?? []).map((result) => ({
-        id: result.check_id,
-        category: result.extra?.metadata?.category ?? "security",
-        severity: normalizeSemgrepSeverity(result.extra?.severity),
-        path: result.path,
-        line_start: result.start?.line,
-        line_end: result.end?.line,
-        summary: result.extra?.message,
-        rule: result.check_id,
-        raw: result,
-    })));
-}
-function dataflowNodePath(node) {
-    const path = node?.location?.path;
-    return typeof path === "string" && path.trim().length > 0
-        ? path.trim()
-        : undefined;
-}
-function firstDataflowPath(value) {
-    if (Array.isArray(value)) {
-        for (const node of value) {
-            const path = dataflowNodePath(node);
-            if (path)
-                return path;
-        }
-        return undefined;
-    }
-    return dataflowNodePath(value);
-}
-/**
- * Normalize semgrep's broader `--dataflow-traces` output into language-neutral
- * graph edges: one `taint-source → taint-sink` edge per result whose source and
- * sink resolve to distinct file paths. Intermediate vars are not edges (they are
- * within-file steps). Malformed / missing traces degrade to an empty edge list;
- * `normalizeGenericExternalEdges` dedupes + sorts so output is deterministic.
- */
-export function normalizeSemgrepDataflowJson(input) {
-    const candidates = [];
-    for (const result of input.results ?? []) {
-        if (!result || typeof result !== "object")
-            continue;
-        const trace = result.extra?.dataflow_trace;
-        if (!trace)
-            continue;
-        const from = firstDataflowPath(trace.taint_source);
-        const to = firstDataflowPath(trace.taint_sink);
-        if (!from || !to)
-            continue;
-        candidates.push({
-            from,
-            to,
-            kind: "analyzer-dataflow-edge",
-            confidence: 0.7,
-            reason: typeof result.check_id === "string"
-                ? `semgrep dataflow trace '${result.check_id}' flows source → sink.`
-                : "semgrep dataflow trace flows source → sink.",
-        });
-    }
-    return {
-        tool: "semgrep-dataflow",
-        generated_at: new Date().toISOString(),
-        graph_edges: normalizeGenericExternalEdges(candidates),
-        results: [],
-    };
-}
-//# sourceMappingURL=semgrep.js.map

package/dist/audit/adapters/semgrep.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../../src/audit/adapters/semgrep.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AA2B5B;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAC/B,GAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC,CAAI,OAAO,MAAM,CAAC;QAC/B,KAAK,SAAS,CAAC,CAAE,OAAO,QAAQ,CAAC;QACjC,KAAK,MAAM,CAAC,CAAK,OAAO,MAAM,CAAC;QAC/B,OAAO,CAAC,CAAS,OAAO,SAAS,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,OAAO,+BAA+B,CACpC,SAAS,EACT,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC,QAAQ;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,UAAU;QACxD,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1D,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI;QAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;QAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,GAAG,EAAE,MAAM;KACZ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;IAClC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAwE;IAExE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAkB;IAElB,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAAE,SAAS;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,EAAE;YACF,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EACJ,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACjC,CAAC,CAAC,2BAA2B,MAAM,CAAC,QAAQ,wBAAwB;gBACpE,CAAC,CAAC,6CAA6C;SACpD,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,WAAW,EAAE,6BAA6B,CAAC,UAAU,CAAC;QACtD,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/audit/cli/dispatch.d.ts

@@ -1,10 +0,0 @@
-/**
- * Provider-neutral audit handoff boundary.
- *
- * Audit-tools derives the pending semantic-review tasks, publishes their
- * complete workload, and validates the host's bound results. It does not
- * launch workers, admit packets, choose a backend, or track execution quota.
- */
-export { buildPendingAuditTasks } from "./dispatch/packetFilter.js";
-export { dropAcceptedResults, ingestAuditHostResults, prepareAuditHostHandoff, type AuditHostIngestSummary, type AuditHostResultMap, type AuditHostResultMapEntry, type AuditHostTask, type AuditHostWorkItem, type AuditHostWorkload, type PreparedAuditHostHandoff, } from "./dispatch/hostHandoff.js";
-//# sourceMappingURL=dispatch.d.ts.map

package/dist/audit/cli/dispatch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC"}

package/dist/audit/cli/dispatch.js

@@ -1,10 +0,0 @@
-/**
- * Provider-neutral audit handoff boundary.
- *
- * Audit-tools derives the pending semantic-review tasks, publishes their
- * complete workload, and validates the host's bound results. It does not
- * launch workers, admit packets, choose a backend, or track execution quota.
- */
-export { buildPendingAuditTasks } from "./dispatch/packetFilter.js";
-export { dropAcceptedResults, ingestAuditHostResults, prepareAuditHostHandoff, } from "./dispatch/hostHandoff.js";
-//# sourceMappingURL=dispatch.js.map

package/dist/audit/cli/dispatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/audit/cli/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GAQxB,MAAM,2BAA2B,CAAC"}

package/dist/audit/cli/paths.d.ts

@@ -1,2 +0,0 @@
-export declare const packageRoot: string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/audit/cli/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/audit/cli/paths.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW,QAKvB,CAAC"}

package/dist/audit/cli/paths.js

@@ -1,10 +0,0 @@
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-// Absolute path to the package root (the single `audit-tools` package). Computed
-// relative to this module's location (src/audit/cli/ in source, dist/audit/cli/
-// when built), so it stays correct regardless of which command module imports it.
-// Three levels up reaches the package root, which holds the packaged asset dirs
-// (dispatch/, schemas/, skills/). Shared by renderSemanticReviewStep and
-// cmdRunToCompletion to locate packaged assets when preparing dispatch.
-export const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
-//# sourceMappingURL=paths.js.map

package/dist/audit/cli/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/audit/cli/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,IAAI,CACL,CAAC"}

package/dist/audit/orchestrator/chunking.d.ts

@@ -1,6 +0,0 @@
-export interface LineRange {
-    start: number;
-    end: number;
-}
-export declare function chunkLineCount(totalLines: number, chunkSize?: number): LineRange[];
-//# sourceMappingURL=chunking.d.ts.map

package/dist/audit/orchestrator/chunking.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunking.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/chunking.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,SAAM,GACd,SAAS,EAAE,CAeb"}

package/dist/audit/orchestrator/chunking.js

@@ -1,14 +0,0 @@
-export function chunkLineCount(totalLines, chunkSize = 200) {
-    if (totalLines <= 0) {
-        return [];
-    }
-    const ranges = [];
-    let start = 1;
-    while (start <= totalLines) {
-        const end = Math.min(start + chunkSize - 1, totalLines);
-        ranges.push({ start, end });
-        start = end + 1;
-    }
-    return ranges;
-}
-//# sourceMappingURL=chunking.js.map

package/dist/audit/orchestrator/chunking.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunking.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/chunking.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,SAAS,GAAG,GAAG;IAEf,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/audit/orchestrator/continuityScore.d.ts

@@ -1,2 +0,0 @@
-export { computeContinuityScores } from "audit-tools/shared";
-//# sourceMappingURL=continuityScore.d.ts.map

package/dist/audit/orchestrator/continuityScore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"continuityScore.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/continuityScore.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/orchestrator/continuityScore.js

@@ -1,9 +0,0 @@
-// Continuity scoring is single-sourced in `audit-tools/shared`
-// (`computeContinuityScores`) so the audit and remediate orchestrators bias on
-// the IDENTICAL scorer — the auditor/remediator mirroring the harvest core
-// (`deriveAccessMemoryFromEvents`) already established. Audit consumes it to bias
-// review-packet ordering (`orderReviewPackets`); remediate to bias file-ownership
-// sub-wave admission. This re-export keeps audit's import sites stable; the byte-
-// identical behaviour is unchanged from the pre-extraction audit-local scorer.
-export { computeContinuityScores } from "audit-tools/shared";
-//# sourceMappingURL=continuityScore.js.map

package/dist/audit/orchestrator/continuityScore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"continuityScore.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/continuityScore.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+EAA+E;AAC/E,2EAA2E;AAC3E,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,+EAA+E;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/orchestrator/fileAnchors.d.ts

@@ -1,69 +0,0 @@
-import type { ExternalAnalyzerResults, AnalyzerLeadProvenance } from "audit-tools/shared";
-import type { GraphBundle } from "audit-tools/shared";
-export type FileAnchorKind = "boundary" | "import" | "export" | "symbol" | "route" | "keyword" | "graph" | "analyzer_signal";
-export interface FileAnchor {
-    kind: FileAnchorKind;
-    name: string;
-    line?: number;
-    /**
-     * Approximate END line of a `symbol`-kind anchor's body (increment 2d,
-     * `path::symbol` slicing). Computed deterministically as the line before the
-     * next top-level declaration boundary (`symbol`/`route` start), clamped to the
-     * file's line count — a lightweight, language-neutral, brace-agnostic extent
-     * (no nesting awareness). Advisory ONLY: it seeds a targeted symbol-span read
-     * so a worker need not re-read a whole god-file, but the worker always
-     * fail-safes to reading more when evidence crosses the span. Present only on
-     * `symbol` anchors that have a `line`; absent everywhere else.
-     */
-    end_line?: number;
-    detail?: string;
-    /**
-     * Content-anchored lead identity (item C), present only on `analyzer_signal`
-     * anchors whose source signal carried one. Rendered into the packet prompt so
-     * the worker can copy it verbatim into `analyzer_provenance` on a finding
-     * born from this lead.
-     */
-    provenance?: AnalyzerLeadProvenance;
-}
-export interface FileAnchorSummary {
-    contract_version: "audit-code-file-anchors/v1alpha1";
-    path: string;
-    total_lines: number;
-    review_mode: "isolated_large_file";
-    scope_basis: string[];
-    anchors: FileAnchor[];
-    omitted_anchor_count: number;
-    counts: {
-        symbols: number;
-        routes: number;
-        keywords: number;
-        graph_edges: number;
-        analyzer_signals: number;
-    };
-}
-/**
- * Path-keyed index of external-analyzer signal anchors (rule/line/summary),
- * built ONCE per dispatch from the whole `externalAnalyzerResults` set so
- * per-task/per-file prompt rendering is an O(1) map read rather than an
- * O(tasks × files × total-results) re-flatten. Key = normalized lowercased
- * path; each bucket is pre-sorted by (line_start, id), matching the original
- * per-path ordering. See {@link analyzerSignalAnchorsForPath} for the reader.
- */
-export type AnalyzerSignalAnchorIndex = Map<string, FileAnchor[]>;
-export declare function buildAnalyzerSignalAnchorIndex(externalAnalyzerResults: ExternalAnalyzerResults[] | undefined): AnalyzerSignalAnchorIndex;
-/**
- * External-analyzer signal anchors (rule/line/summary) for one path — an O(1)
- * read of the pre-built {@link AnalyzerSignalAnchorIndex}. Split out of
- * {@link buildFileAnchorSummary} so packet-level prompt rendering (any
- * multi-file packet, not just isolated-large-file mode) can surface the same
- * grounded lead detail without paying for whole-file content scanning.
- */
-export declare function analyzerSignalAnchorsForPath(path: string, index: AnalyzerSignalAnchorIndex | undefined): FileAnchor[];
-export declare function buildFileAnchorSummary(params: {
-    path: string;
-    content: string;
-    totalLines: number;
-    graphBundle?: GraphBundle;
-    externalAnalyzerResults?: ExternalAnalyzerResults[];
-}): FileAnchorSummary;
-//# sourceMappingURL=fileAnchors.d.ts.map