code-auditor-mcp 3.9.6 → 3.9.11

package/dist/services/auditJobService.js

@@ -10,14 +10,11 @@
  * The database handle is passed in explicitly (matching `ledger.ts`); callers
  * resolve the per-project DB via `CodeIndexDB.getInstance(undefined, projectRoot)`.
  */
-import path from 'node:path';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import { createLedgerRun, detectRunInput, getLedgerRun, patchLedgerRun, } from '../ledger.js';
-// Package version — read once at module load (mirrors auditRunner.ts).
-const __svcDirname = path.dirname(fileURLToPath(import.meta.url));
-const _pkg = JSON.parse(readFileSync(path.join(__svcDirname, '..', '..', 'package.json'), 'utf-8'));
-const TOOL_VERSION = String(_pkg.version || '0.0.0');
+// Package version — stamped into the build (see constants.ts), not read from
+// package.json at runtime, so a stale binary reports the version it was built as.
+import { PACKAGE_VERSION } from '../constants.js';
+const TOOL_VERSION = PACKAGE_VERSION;
 function toAuditJobRecord(detail) {
     let progress;
     if (detail.progressJson) {

package/dist/services/auditJobService.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditJobService.js","sourceRoot":"","sources":["../../src/services/auditJobService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,cAAc,CAAC;AAsCtB,uEAAuE;AACvE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACpG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AAErD,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,IAAI,QAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAqB,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAwB;QACvC,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,EAAkB,EAClB,WAAmB,EACnB,IAAI,GAAuB,EAAE;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAC7B,IAAI,CAAC,OAAO,IAAI,aAAa,EAC7B,IAAI,CAAC,OAAO,IAAI,KAAK,EACrB,IAAI,CAAC,KAAK,IAAI,KAAK,EACnB,WAAW,EACX,YAAY,CACb,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/E,kFAAkF;IAClF,OAAO,gBAAgB,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAkB,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAkB,EAClB,KAAa,EACb,KAA8B;IAE9B,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,WAAW,GAAmB,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,MAAyB,CAAC;IACrF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;IACnF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IACtF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IACvE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE5F,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACvC,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAkB,EAAE,KAAa,EAAE,QAA0B;IAC/F,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO;IACrC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"auditJobService.js","sourceRoot":"","sources":["../../src/services/auditJobService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,cAAc,CAAC;AAsCtB,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,IAAI,QAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAqB,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAwB;QACvC,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,EAAkB,EAClB,WAAmB,EACnB,IAAI,GAAuB,EAAE;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAC7B,IAAI,CAAC,OAAO,IAAI,aAAa,EAC7B,IAAI,CAAC,OAAO,IAAI,KAAK,EACrB,IAAI,CAAC,KAAK,IAAI,KAAK,EACnB,WAAW,EACX,YAAY,CACb,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/E,kFAAkF;IAClF,OAAO,gBAAgB,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAkB,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAkB,EAClB,KAAa,EACb,KAA8B;IAE9B,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,WAAW,GAAmB,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,MAAyB,CAAC;IACrF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;IACnF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IACtF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;IACvE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE5F,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACvC,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAkB,EAAE,KAAa,EAAE,QAA0B;IAC/F,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO;IACrC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/structuralSignature.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Spec 57 — structural AST signature.
+ *
+ * The telemetry payload describes *the shape* of the code a finding points at,
+ * so the service can cluster "these are all for-loops with a `.save()` inside"
+ * without ever receiving source text. The only thing this module reads off a
+ * node is `type` — the tree-sitter grammar kind (`for_statement`,
+ * `call_expression`, `identifier`, `string`, …) — a fixed, finite vocabulary.
+ * It never reads `getNodeText`/`getNodeName`/`raw`, so identifiers, string
+ * literals, table names, paths, and comments can never enter a signature.
+ *
+ * Acceptance 6 (the shipping gate) hinges on exactly this: a finding on code
+ * containing a secret + a table name + a distinctive identifier must produce a
+ * signature containing none of the three. The `structuralSignature.spec.ts`
+ * guard test asserts that directly.
+ */
+import type { AST, ASTNode } from './languages/types.js';
+export interface SignatureOptions {
+    /** Stop descending past this depth (default 8). Keeps the shape coarse. */
+    maxDepth?: number;
+    /** Stop after this many node kinds (default 128). Bounds large subtrees. */
+    maxNodes?: number;
+}
+/**
+ * Canonical structural signature of a node's subtree: a parenthesized pre-order
+ * encoding of node kinds. Only `type` is read; content is never touched, so the
+ * output is safe to transmit.
+ *
+ * Example: `for_statement ( ) call_expression ( member_expression ( identifier property_identifier ) argument_list ( ) )`
+ */
+export declare function structuralSignature(node: ASTNode, opts?: SignatureOptions): string;
+/**
+ * Produce the structural signature for a finding at a 1-based source location.
+ * The located node is walked up to its function/class boundary before signing.
+ * Returns null when no node contains the location.
+ */
+export declare function signatureForLocation(ast: AST, location: {
+    line: number;
+    column: number;
+}, opts?: SignatureOptions): string | null;
+//# sourceMappingURL=structuralSignature.d.ts.map

package/dist/structuralSignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"structuralSignature.d.ts","sourceRoot":"","sources":["../src/structuralSignature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAGzD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,gBAAqB,GAAG,MAAM,CAsBtF;AAuDD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC1C,IAAI,GAAE,gBAAqB,GAC1B,MAAM,GAAG,IAAI,CAIf"}

package/dist/structuralSignature.js

@@ -0,0 +1,93 @@
+import { isFunctionType, isClassType } from './languages/tree-sitter/converter.js';
+/**
+ * Canonical structural signature of a node's subtree: a parenthesized pre-order
+ * encoding of node kinds. Only `type` is read; content is never touched, so the
+ * output is safe to transmit.
+ *
+ * Example: `for_statement ( ) call_expression ( member_expression ( identifier property_identifier ) argument_list ( ) )`
+ */
+export function structuralSignature(node, opts = {}) {
+    const maxDepth = opts.maxDepth ?? 8;
+    const maxNodes = opts.maxNodes ?? 128;
+    const parts = [];
+    let count = 0;
+    const walk = (n, depth) => {
+        if (count >= maxNodes)
+            return false;
+        count += 1;
+        parts.push(n.type);
+        const kids = n.children ?? [];
+        if (depth >= maxDepth || kids.length === 0)
+            return true;
+        parts.push('(');
+        for (const child of kids) {
+            if (!walk(child, depth + 1))
+                break;
+        }
+        parts.push(')');
+        return true;
+    };
+    walk(node, 0);
+    return parts.join(' ');
+}
+/**
+ * The node whose shape represents the finding's code: the nearest enclosing
+ * function/class/method boundary, else the nearest top-level statement, else the
+ * located node itself. Climbing to the function boundary means the signature
+ * captures the finding's *context* (the whole for-loop, not just the `.save()`),
+ * while `maxNodes` keeps a giant function from producing a giant signature.
+ */
+function findSignatureRoot(located) {
+    let funcOrClass = null;
+    let topLevel = null;
+    let cur = located;
+    while (cur) {
+        if (!funcOrClass && (isFunctionType(cur.type) || isClassType(cur.type))) {
+            funcOrClass = cur;
+        }
+        const parent = cur.parent;
+        if (parent && !parent.parent) {
+            // `parent` is the root — `cur` is a top-level statement/declaration.
+            if (!topLevel)
+                topLevel = cur;
+        }
+        cur = parent;
+    }
+    return funcOrClass ?? topLevel ?? located;
+}
+/**
+ * Locate the deepest node containing the given 1-based line/column.
+ * Returns null when the location is outside the tree.
+ */
+function findDeepestNodeAt(root, location) {
+    let best = null;
+    let bestDepth = -1;
+    const walk = (node, depth) => {
+        const s = node.location.start;
+        const e = node.location.end;
+        const contains = (s.line < location.line || (s.line === location.line && s.column <= location.column)) &&
+            (e.line > location.line || (e.line === location.line && e.column >= location.column));
+        if (!contains)
+            return;
+        if (depth > bestDepth) {
+            best = node;
+            bestDepth = depth;
+        }
+        for (const child of node.children ?? [])
+            walk(child, depth + 1);
+    };
+    walk(root, 0);
+    return best;
+}
+/**
+ * Produce the structural signature for a finding at a 1-based source location.
+ * The located node is walked up to its function/class boundary before signing.
+ * Returns null when no node contains the location.
+ */
+export function signatureForLocation(ast, location, opts = {}) {
+    const located = findDeepestNodeAt(ast.root, location);
+    if (!located)
+        return null;
+    return structuralSignature(findSignatureRoot(located), opts);
+}
+//# sourceMappingURL=structuralSignature.js.map

package/dist/structuralSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"structuralSignature.js","sourceRoot":"","sources":["../src/structuralSignature.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AASnF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa,EAAE,IAAI,GAAqB,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAW,EAAE;QAClD,IAAI,KAAK,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,MAAM;QACrC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,IAAI,WAAW,GAAmB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAAmB,IAAI,CAAC;IACpC,IAAI,GAAG,GAAwB,OAAO,CAAC;IAEvC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAwB,GAAG,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,qEAAqE;YACrE,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,GAAG,CAAC;QAChC,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA0C;IAClF,IAAI,IAAI,GAAmB,IAAI,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC5B,MAAM,QAAQ,GACZ,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAQ,EACR,QAA0C,EAC1C,IAAI,GAAqB,EAAE;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,80 @@
+import type { Severity } from './types.js';
+/**
+ * The version of the telemetry *schema* — the payload shape itself — independent
+ * of the tool version. This is the cross-repo contract with the feedback service
+ * (`../services/src/index.ts`): both sides pin the same value, and a bump on one
+ * side without the other is caught by each repo's pinned-shape test. The `v`
+ * field below is the tool version, which changes every release while the schema
+ * stays put — it is *not* a schema version and must not be used as one.
+ */
+export declare const TELEMETRY_SCHEMA_VERSION = 2;
+/** The exact, minimal set of fields sent. Adding a field here is a security review. */
+export interface TelemetryPayload {
+    /** Payload schema version (the shape contract across repos), not the tool version. */
+    schema: number;
+    /** Anonymous install ID (random, generated locally) — groups submissions by source. */
+    install_id: string;
+    /** Tool version (package.json). */
+    v: string;
+    /** Canonical rule ID of the dismissed finding. */
+    rule: string;
+    /** Urgency level — critical | severe | high. */
+    level: Severity;
+    /** Dismissal reason, verbatim (the product — it is the human's words). */
+    reason: string;
+    /** Structural AST signature (grammar kinds only; no identifiers/literals). */
+    signature: string;
+    /** Coarse language/framework hint (e.g. `typescript`, `react`, `go`). */
+    lang: string;
+    /** ISO-8601 timestamp of the send. */
+    ts: string;
+}
+/** Coarse language/framework hint from a file path — never a path, just a class. */
+export declare function languageHint(filePath: string): string;
+export interface TelemetryPayloadInput {
+    install_id: string;
+    toolVersion: string;
+    rule: string;
+    level: Severity;
+    reason: string;
+    signature: string;
+    lang: string;
+}
+/** Assemble the payload. Timestamp is stamped at build time. */
+export declare function buildTelemetryPayload(input: TelemetryPayloadInput): TelemetryPayload;
+/** Human-readable preview, printed before any send so the user can review it. */
+export declare function formatTelemetryPreview(payload: TelemetryPayload): string;
+export interface TelemetryConfig {
+    enabled: boolean;
+    /** Endpoint URL. Empty/absent → telemetry is a no-op (nothing to send to). */
+    endpoint: string;
+}
+/**
+ * Resolve opt-in from the user-level config (see `installConfig.ts`): OFF unless
+ * the user explicitly enabled it via the `telemetry` MCP tool. `opts.endpoint` is
+ * a caller override (e.g. the local-dev `--telemetry-endpoint` flag).
+ */
+export declare function resolveTelemetryConfig(opts?: {
+    endpoint?: string;
+    dir?: string;
+}): TelemetryConfig;
+export interface TelemetrySendResult {
+    sent: boolean;
+    error?: string;
+}
+/**
+ * Send a payload to the feedback service. Best-effort: a missing endpoint, a
+ * network failure, a timeout, or a non-2xx response all resolve to
+ * `{ sent: false }` and never throw — telemetry can never block or fail a gate.
+ */
+export declare function sendTelemetry(payload: TelemetryPayload, endpoint: string, opts?: {
+    timeoutMs?: number;
+}): Promise<TelemetrySendResult>;
+/**
+ * Compute the structural signature for a finding at a file location. Reads the
+ * file, parses it, and signs the shape at that location. Returns null when the
+ * file can't be read/parsed or no node contains the location. Requires
+ * `initParsers()` to have been called by the caller.
+ */
+export declare function signatureForFinding(filePath: string, line: number, column: number): string | null;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,KAAK,EAAE,QAAQ,CAAC;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;CACZ;AAID,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAID,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CAYpF;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAexE;AAID,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,eAAe,CAMjB;AAID,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAYf"}

package/dist/telemetry.js

@@ -0,0 +1,148 @@
+/**
+ * Spec 57 — opt-in dismissals telemetry.
+ *
+ * When the user dismisses a finding and has opted in, a small anonymized payload
+ * is sent to the feedback service. The payload is *shape + decision*, never
+ * code. The only code-derived field is the structural signature (`structuralSignature`),
+ * which is built from grammar kinds alone — identifiers, string literals, table
+ * names, paths, and source text are structurally impossible to include.
+ *
+ * The rules that make this safe and invisible to the gate:
+ *
+ *   - **opt-in** — nothing is sent unless the user opts in via the `telemetry` MCP
+ *     tool, and the payload is *printed before sending* so the user can review it.
+ *   - **offline never blocks** — `sendTelemetry` is best-effort: any network error
+ *     resolves to `{ sent: false }`, never throws, never affects the exit code.
+ *   - **no content** — the payload type has no field for a path, identifier,
+ *     literal, or source snippet, so none can leak by accident (acceptance 4).
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import path from 'node:path';
+import { parseFile } from './languages/adapterBridge.js';
+import { signatureForLocation } from './structuralSignature.js';
+import { getTelemetryOptIn } from './installConfig.js';
+// ── Payload ──────────────────────────────────────────────────────────────────
+/**
+ * The version of the telemetry *schema* — the payload shape itself — independent
+ * of the tool version. This is the cross-repo contract with the feedback service
+ * (`../services/src/index.ts`): both sides pin the same value, and a bump on one
+ * side without the other is caught by each repo's pinned-shape test. The `v`
+ * field below is the tool version, which changes every release while the schema
+ * stays put — it is *not* a schema version and must not be used as one.
+ */
+export const TELEMETRY_SCHEMA_VERSION = 2;
+// ── Language hint ────────────────────────────────────────────────────────────
+/** Coarse language/framework hint from a file path — never a path, just a class. */
+export function languageHint(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    switch (ext) {
+        case '.tsx':
+            return 'typescript-react';
+        case '.jsx':
+            return 'javascript-react';
+        case '.ts':
+            return 'typescript';
+        case '.js':
+            return 'javascript';
+        case '.go':
+            return 'go';
+        default:
+            return 'other';
+    }
+}
+/** Assemble the payload. Timestamp is stamped at build time. */
+export function buildTelemetryPayload(input) {
+    return {
+        schema: TELEMETRY_SCHEMA_VERSION,
+        install_id: input.install_id,
+        v: input.toolVersion,
+        rule: input.rule,
+        level: input.level,
+        reason: input.reason,
+        signature: input.signature,
+        lang: input.lang,
+        ts: new Date().toISOString(),
+    };
+}
+/** Human-readable preview, printed before any send so the user can review it. */
+export function formatTelemetryPreview(payload) {
+    return [
+        '',
+        '── Telemetry payload (preview — review before sending) ──',
+        `  schema:        ${payload.schema}`,
+        `  install ID:    ${payload.install_id}`,
+        `  tool version:  ${payload.v}`,
+        `  rule:          ${payload.rule}`,
+        `  urgency:       ${payload.level}`,
+        `  reason:        ${payload.reason}`,
+        `  signature:     ${payload.signature}`,
+        `  language:      ${payload.lang}`,
+        '  (no file paths, identifiers, literals, or source text are included)',
+        '',
+    ].join('\n');
+}
+/**
+ * Resolve opt-in from the user-level config (see `installConfig.ts`): OFF unless
+ * the user explicitly enabled it via the `telemetry` MCP tool. `opts.endpoint` is
+ * a caller override (e.g. the local-dev `--telemetry-endpoint` flag).
+ */
+export function resolveTelemetryConfig(opts = {}) {
+    const optIn = getTelemetryOptIn(opts.dir);
+    return {
+        enabled: optIn.enabled,
+        endpoint: opts.endpoint ?? optIn.endpoint,
+    };
+}
+/**
+ * Send a payload to the feedback service. Best-effort: a missing endpoint, a
+ * network failure, a timeout, or a non-2xx response all resolve to
+ * `{ sent: false }` and never throw — telemetry can never block or fail a gate.
+ */
+export async function sendTelemetry(payload, endpoint, opts = {}) {
+    if (!endpoint)
+        return { sent: false };
+    const timeoutMs = opts.timeoutMs ?? 2000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!response.ok) {
+            return { sent: false, error: `HTTP ${response.status}` };
+        }
+        return { sent: true };
+    }
+    catch (error) {
+        clearTimeout(timer);
+        return { sent: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+// ── Signature from a finding ─────────────────────────────────────────────────
+/**
+ * Compute the structural signature for a finding at a file location. Reads the
+ * file, parses it, and signs the shape at that location. Returns null when the
+ * file can't be read/parsed or no node contains the location. Requires
+ * `initParsers()` to have been called by the caller.
+ */
+export function signatureForFinding(filePath, line, column) {
+    try {
+        if (!existsSync(filePath))
+            return null;
+        const content = readFileSync(filePath, 'utf-8');
+        const ast = parseFile(filePath, content);
+        if (!ast)
+            return null;
+        const signature = signatureForLocation(ast, { line, column });
+        ast.dispose?.();
+        return signature;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAwB1C,gFAAgF;AAEhF,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,kBAAkB,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,kBAAkB,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAcD,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,OAAO;QACL,MAAM,EAAE,wBAAwB;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,CAAC,EAAE,KAAK,CAAC,WAAW;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,OAAyB;IAC9D,OAAO;QACL,EAAE;QACF,2DAA2D;QAC3D,oBAAoB,OAAO,CAAC,MAAM,EAAE;QACpC,oBAAoB,OAAO,CAAC,UAAU,EAAE;QACxC,oBAAoB,OAAO,CAAC,CAAC,EAAE;QAC/B,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAClC,oBAAoB,OAAO,CAAC,KAAK,EAAE;QACnC,oBAAoB,OAAO,CAAC,MAAM,EAAE;QACpC,oBAAoB,OAAO,CAAC,SAAS,EAAE;QACvC,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAClC,uEAAuE;QACvE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAI,GAAwC,EAAE;IAE9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;KAC1C,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,QAAgB,EAChB,IAAI,GAA2B,EAAE;IAEjC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -114,6 +114,13 @@ export interface Violation {
      * `severityCap` soften-in-place mechanism.
      */
     gateExcluded?: boolean;
+    /**
+     * Spec 57 — true when a committed dismissal matches this finding's
+     * fingerprint. A dismissed finding never blocks the gate, but it is still
+     * counted in `summary.totalViolations` — dismissal never silently reduces the
+     * total; the reduced count is reported separately as `summary.dismissed`.
+     */
+    dismissed?: boolean;
     violationType?: string;
     symbol?: string;
     principle?: string;
@@ -148,6 +155,28 @@ export interface Violation {
      */
     resolution?: Resolution;
 }
+/**
+ * A coverage diagnostic — a per-occurrence record that the analyzer could not
+ * *see* a region of the code, as distinct from a {@link Violation}, which says
+ * the code is wrong. Diagnostics are never blocking: the gate only ever reads
+ * violations. They are surfaced (counted, with file + line) in the report's
+ * coverage section and in the `metadata.diagnostics` channel alongside
+ * `zero-files` / `no-result` ("the tool couldn't do its job").
+ */
+export interface CoverageDiagnostic {
+    /** Owning analyzer (e.g. `schema`, `dependency-graph`). */
+    analyzerName: string;
+    /** The diagnostic kind — currently `unresolved-query` or `unresolved-dynamic-import`. */
+    kind: 'unresolved-query' | 'unresolved-dynamic-import';
+    /** Human-readable explanation of what could not be resolved. */
+    message: string;
+    /** File the unresolved construct is in. */
+    file: string;
+    /** 1-based line of the unresolved construct. */
+    line: number;
+    /** Kind-specific detail (e.g. `{ identifier }` or `{ expression }`). */
+    details?: Record<string, unknown>;
+}
 /**
  * Per-rule coverage classification — emitted on every audit.
  * @see buildCoverageReport() in pipeline.ts
@@ -209,6 +238,8 @@ export interface AnalyzerResult {
         file: string;
         error: string;
     }>;
+    /** Per-occurrence coverage diagnostics (non-blocking). */
+    diagnostics?: CoverageDiagnostic[];
     /** Number of files processed by the analyzer. */
     filesProcessed?: number;
     /** Arbitrary metrics bag — used by cross-domain, visualizations, etc. */
@@ -266,6 +297,9 @@ export interface VisitorResult {
     violations: Violation[];
     facts: Record<string, unknown>;
     indexFacts?: IndexFactsEntry[];
+    /** Per-occurrence coverage diagnostics (non-blocking). Collected into
+     *  `metadata.diagnostics` by the pipeline. */
+    diagnostics?: CoverageDiagnostic[];
 }
 /** Return type from stage-3/4 reducer reduce(). */
 export interface ReducerResult {
@@ -283,6 +317,9 @@ export interface ReducerResult {
      * `context.readSource` do not need to report here.
      */
     consumedFiles?: string[];
+    /** Per-occurrence coverage diagnostics (non-blocking). Collected into
+     *  `metadata.diagnostics` by the pipeline. */
+    diagnostics?: CoverageDiagnostic[];
 }
 /** Per-file visitor — runs on every AST in stage 2. */
 export interface Stage2Visitor {
@@ -470,6 +507,9 @@ export interface PipelineResult {
             analyzerName: string;
             kind: string;
             message: string;
+            file?: string;
+            line?: number;
+            details?: Record<string, unknown>;
         }>;
         coverage?: RuleCoverage[];
         /** Spec 29: Per-table provenance catalog from schema reducer */
@@ -576,6 +616,12 @@ export interface AuditSummary {
         type: string;
         count: number;
     }>;
+    /**
+     * Spec 57 — number of findings cleared by a committed dismissal. Reported
+     * alongside `totalViolations` ("43 findings, 3 dismissed"), never subtracted
+     * from it. Absent/0 when no dismissals apply.
+     */
+    dismissed?: number;
 }
 export interface AuditResult {
     timestamp: Date;
@@ -597,11 +643,15 @@ export interface AuditResult {
         provenanceResolutionMs?: number;
         /** Blast radius impact for changed functions (Spec 14 R6 — scoped audits only). */
         blastRadius?: BlastRadiusImpact;
-        /** Zero-files or missing-result diagnostics (v3.4.8 — verify:dist gate hardening). */
+        /** Zero-files / missing-result diagnostics plus per-occurrence coverage
+         *  diagnostics (unresolved SQL/specifier). Non-blocking — see CoverageDiagnostic. */
         diagnostics?: Array<{
             analyzerName: string;
             kind: string;
             message: string;
+            file?: string;
+            line?: number;
+            details?: Record<string, unknown>;
         }>;
         baseline?: {
             present: boolean;
@@ -647,6 +697,9 @@ export interface AuditResult {
         inputPresence?: InputPresence;
         /** Spec 44: per-file accounting (analyzed vs. dropped, with reasons). */
         fileAccounting?: FileAccountingSummary;
+        /** Spec 50 R2 — which config layer supplied each size threshold (default,
+         *  project-config, project-lint-config, preset:<id>). */
+        thresholdSources?: ThresholdSource[];
     };
 }
 /** Thrown when an in-process audit is stopped via AbortSignal (parent cancel or soft budget). */
@@ -832,6 +885,24 @@ export interface AuditMetadata {
         defaultValue: unknown;
         effectiveValue: unknown;
     }>;
+    /** Spec 50 R2 — which config layer supplied each size threshold. */
+    thresholdSources?: ThresholdSource[];
+}
+/**
+ * Spec 50 R2 — a size threshold and the config layer that supplied its value.
+ * Surfaces in audit metadata and `print-config` so a threshold that came from
+ * the project's ESLint config (vs. a default or an explicit .codeauditor.json)
+ * is named, not archaeology.
+ */
+export interface ThresholdSource {
+    /** Dot-notation key within the analyzer namespace, e.g. `solid.maxLinesPerMethod`. */
+    key: string;
+    /** The effective value the run used. */
+    value: unknown;
+    /** Where the value came from: `default`, `project-config`, `project-lint-config`, `preset:<id>`, `path-profile:<name>`. */
+    source: string;
+    /** The analyzer's runtime default (for the `[differs from default]` display). */
+    defaultValue: unknown;
 }
 export interface BaseAnalyzerOptions {
     verbose?: boolean;