code-auditor-mcp 4.1.1 → 5.0.1

package/dist/dismissals.js

@@ -31,6 +31,9 @@ const SCHEMA_VERSION = 1;
  * entry missing a non-empty `fingerprint`/`reason`), a config error is reported
  * to stderr and `null` is returned — the run proceeds with zero dismissals
  * rather than silently honouring a malformed suppression list.
+ *
+ * @param projectRoot - Project root that contains the dismissals file.
+ * @returns The parsed dismissals file, or null when absent or structurally invalid.
  */
 export function loadDismissals(projectRoot) {
     const filePath = path.join(projectRoot, DISMISSALS_FILENAME);
@@ -60,7 +63,14 @@ export function saveDismissals(projectRoot, dismissals) {
     writeFileSync(filePath, JSON.stringify(dismissals, null, 2) + '\n', 'utf-8');
 }
 // ── Mutation ─────────────────────────────────────────────────────────────────
-/** Build a dismissal entry from a live violation and a required reason. */
+/**
+ * Build a dismissal entry from a live violation and a required reason.
+ *
+ * @param violation - The live violation being dismissed.
+ * @param reason - Why the finding is dismissed (required, non-empty).
+ * @param toolVersion - Tool version (package.json) at dismissal time.
+ * @returns A dismissal entry keyed by the violation's fingerprint.
+ */
 export function buildDismissalEntry(violation, reason, toolVersion) {
     const input = buildFingerprintInput(violation);
     return {
@@ -76,6 +86,10 @@ export function buildDismissalEntry(violation, reason, toolVersion) {
 /**
  * Add (or replace) a dismissal entry, keyed by fingerprint. Idempotent: re-
  * dismissing an already-dismissed finding updates its reason and timestamp.
+ *
+ * @param projectRoot - Project root holding the dismissals file.
+ * @param entry - Dismissal entry to add or replace (keyed by fingerprint).
+ * @returns The updated dismissals file.
  */
 export function upsertDismissal(projectRoot, entry) {
     const dismissals = loadDismissals(projectRoot) ?? { schemaVersion: SCHEMA_VERSION, entries: [] };
@@ -92,6 +106,10 @@ export function upsertDismissal(projectRoot, entry) {
 // ── Matching ─────────────────────────────────────────────────────────────────
 /**
  * Partition a run's findings into dismissed vs active by fingerprint.
+ *
+ * @param violations - Findings from this run.
+ * @param dismissals - The committed dismissals file to match against.
+ * @returns Findings partitioned into dismissed and active.
  */
 export function matchDismissals(violations, dismissals) {
     const dismissalMap = new Map();
@@ -112,6 +130,9 @@ export function matchDismissals(violations, dismissals) {
  * Apply dismissals to a completed audit result: mark dismissed findings so the
  * gate skips them, and record the dismissed count in the summary (never subtracted
  * from `totalViolations`).
+ *
+ * @param result - Completed audit result whose findings are marked dismissed.
+ * @param projectRoot - Project root holding the dismissals file.
  */
 export function applyDismissals(result, projectRoot) {
     const dismissals = loadDismissals(projectRoot);

package/dist/dismissals.js.map

@@ -1 +1 @@
-{"version":3,"file":"dismissals.js","sourceRoot":"","sources":["../src/dismissals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAqC7C,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,KAAK,CACX,oEAAoE,cAAc,8BAA8B,QAAQ,EAAE,CAC3H,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACnC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACpH,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CACX,uBAAuB,OAAO,CAAC,MAAM,0DAA0D;gBAC7F,wEAAwE,QAAQ,EAAE,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,UAA0B;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,MAAc,EAAE,WAAmB;IAC3F,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAqB;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,cAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAuB,EACvB,UAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,WAAmB;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACzB,CAAe,CAAC,SAAS,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"dismissals.js","sourceRoot":"","sources":["../src/dismissals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAqC7C,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,KAAK,CACX,oEAAoE,cAAc,8BAA8B,QAAQ,EAAE,CAC3H,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACnC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACpH,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CACX,uBAAuB,OAAO,CAAC,MAAM,0DAA0D;gBAC7F,wEAAwE,QAAQ,EAAE,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,UAA0B;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC7D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,MAAc,EAAE,WAAmB;IAC3F,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAqB;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,cAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAuB,EACvB,UAA0B;IAE1B,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,WAAmB;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACzB,CAAe,CAAC,SAAS,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;AAC9C,CAAC"}

package/dist/enforcement/gate.d.ts

@@ -26,6 +26,7 @@ export interface GatingDecision {
  *
  * @param violations The full violation list for the audited file(s).
  * @param blockingSeverities Severities that block (the fixed all-three set).
+ * @returns The gating decision: blocking violations plus any resolution gaps.
  */
 export declare function computeGatingDecision(violations: Violation[], blockingSeverities: ReadonlySet<Severity>): GatingDecision;
 //# sourceMappingURL=gate.d.ts.map

package/dist/enforcement/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,SAAS,EAAE,EACvB,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,GACxC,cAAc,CA8BhB"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,SAAS,EAAE,EACvB,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,GACxC,cAAc,CA8BhB"}

package/dist/enforcement/gate.js

@@ -26,6 +26,7 @@ import { getViolationRuleEntry } from '../analyzers/ruleRegistry.js';
  *
  * @param violations The full violation list for the audited file(s).
  * @param blockingSeverities Severities that block (the fixed all-three set).
+ * @returns The gating decision: blocking violations plus any resolution gaps.
  */
 export function computeGatingDecision(violations, blockingSeverities) {
     const blocking = [];

package/dist/enforcement/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAwBrE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAuB,EACvB,kBAAyC;IAEzC,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,6CAA6C;QAC7C,IAAI,CAAC,CAAC,YAAY;YAAE,SAAS;QAC7B,sEAAsE;QACtE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS;QAC1B,mDAAmD;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QAElD,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/enforcement/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAwBrE;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAuB,EACvB,kBAAyC;IAEzC,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,6CAA6C;QAC7C,IAAI,CAAC,CAAC,YAAY;YAAE,SAAS;QAC7B,sEAAsE;QACtE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS;QAC1B,mDAAmD;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QAElD,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC"}

package/dist/fingerprint.d.ts

@@ -11,6 +11,9 @@ export interface FingerprintInput {
  * The components are JSON-serialized in a fixed-order array so that a colon
  * or any other character inside a component cannot create an ambiguous
  * boundary.
+ *
+ * @param input - The canonical {analyzer, rule, file, symbol} tuple.
+ * @returns A hex SHA-256 digest of the canonical tuple.
  */
 export declare function fingerprint(input: FingerprintInput): string;
 /**
@@ -18,6 +21,9 @@ export declare function fingerprint(input: FingerprintInput): string;
  *
  * `rule` is required on Violation — it is the single source of truth for
  * rule identity. Every analyzer must set `rule` when constructing a violation.
+ *
+ * @param violation - The violation to derive the tuple from.
+ * @returns The canonical four-tuple for fingerprinting.
  */
 export declare function buildFingerprintInput(violation: Violation): FingerprintInput;
 //# sourceMappingURL=fingerprint.d.ts.map

package/dist/fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQ3D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAW5E"}
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQ3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAW5E"}

package/dist/fingerprint.js

@@ -19,14 +19,56 @@
  * rule id in a novel field, add that field HERE.
  */
 import { createHash } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
 import { extractSymbol } from './symbols.js';
 import { canonicalRuleId } from './ruleAliases.js';
+/**
+ * Canonicalize the `file` component of a fingerprint so the same physical file
+ * hashes identically however it was spelled. On macOS `/tmp` is a symlink to
+ * `/private/tmp`, so `changed -p /tmp/foo` (which carries the lexical path into
+ * every finding's `file`) and `dismiss` run from inside the project (whose
+ * `process.cwd()` is the resolved `/private/tmp/foo`) would otherwise produce
+ * two different fingerprints for the *same* finding — the exact workflow
+ * SKILL.md documents ("copy the fingerprint from `changed --json`, then
+ * `dismiss <fingerprint>`"). Resolving symlinks makes the tuple spelling-stable,
+ * mirroring `dataPaths.resolveRealPath`, which exists for the same reason.
+ *
+ * Only absolute paths are resolved: a relative `file` carries no symlink
+ * ambiguity, and resolving it against an arbitrary cwd would make the
+ * fingerprint cwd-dependent — the opposite of stable. The lookup is memoized
+ * because the same file path recurs across many findings and `realpathSync` is
+ * a syscall.
+ */
+const realpathCache = new Map();
+function normalizeFile(file) {
+    if (!file || !isAbsolute(file))
+        return file;
+    const cached = realpathCache.get(file);
+    if (cached !== undefined)
+        return cached;
+    let canonical;
+    try {
+        canonical = realpathSync(file);
+    }
+    catch {
+        // File may not exist (deleted since discovery, or an indexed file whose
+        // source is gone) — fall back to the lexical absolute path so the
+        // fingerprint stays deterministic for the same input string.
+        canonical = resolve(file);
+    }
+    realpathCache.set(file, canonical);
+    return canonical;
+}
 /**
  * Produce a stable hex SHA-256 digest from the canonical four-tuple.
  *
  * The components are JSON-serialized in a fixed-order array so that a colon
  * or any other character inside a component cannot create an ambiguous
  * boundary.
+ *
+ * @param input - The canonical {analyzer, rule, file, symbol} tuple.
+ * @returns A hex SHA-256 digest of the canonical tuple.
  */
 export function fingerprint(input) {
     const canonical = JSON.stringify([
@@ -42,6 +84,9 @@ export function fingerprint(input) {
  *
  * `rule` is required on Violation — it is the single source of truth for
  * rule identity. Every analyzer must set `rule` when constructing a violation.
+ *
+ * @param violation - The violation to derive the tuple from.
+ * @returns The canonical four-tuple for fingerprinting.
  */
 export function buildFingerprintInput(violation) {
     // Canonicalize through the rule-alias map (Spec 38 R5) so a rename does not
@@ -50,7 +95,7 @@ export function buildFingerprintInput(violation) {
     return {
         analyzer: violation.analyzer ?? '',
         rule,
-        file: violation.file ?? '',
+        file: normalizeFile(violation.file ?? ''),
         symbol: extractSymbol(violation),
     };
 }

package/dist/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AASnD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM;KACb,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB;IACxD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAEnD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,IAAI;QACJ,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AASnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,kEAAkE;QAClE,6DAA6D;QAC7D,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM;KACb,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB;IACxD,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAEnD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/functionScanner.d.ts

@@ -15,12 +15,20 @@ export interface ScanOptions {
 }
 /**
  * Scan directory for functions
+ *
+ * @param dirPath - Directory to scan for TS/JS files.
+ * @param options - Scan options (extensions, includes/excludes, unused-import config).
+ * @returns Function metadata for every function found in the directory.
  */
 export declare function scanDirectoryForFunctions(dirPath: string, options?: ScanOptions & {
     unusedImportsConfig?: AuditOptions['unusedImportsConfig'];
 }): Promise<FunctionMetadata[]>;
 /**
  * Extract functions from a single file (convenience wrapper that reads the file).
+ *
+ * @param filePath - Path of the file to read and extract from.
+ * @param options - Optional unused-import config forwarded to extraction.
+ * @returns Function metadata for the file's functions.
  */
 export declare function extractFunctionsFromFile(filePath: string, options?: {
     unusedImportsConfig?: AuditOptions['unusedImportsConfig'];
@@ -28,11 +36,25 @@ export declare function extractFunctionsFromFile(filePath: string, options?: {
 /**
  * Extract functions from source content (no file I/O — usable by both the
  * audit runner and the index sync path).
+ *
+ * @param content - Source text to parse and extract from.
+ * @param filePath - Path used to resolve the language and relative imports.
+ * @param options - Optional unused-import config.
+ * @returns Function metadata extracted from the source.
  */
 export declare function extractFunctionsFromSource(content: string, filePath: string, options?: {
     unusedImportsConfig?: AuditOptions['unusedImportsConfig'];
 }): FunctionMetadata[];
 export declare const scanFunctionsInFile: typeof extractFunctionsFromFile;
+/**
+ * Scan a directory for functions using a compatibility-friendly option shape.
+ * Delegates to {@link scanDirectoryForFunctions}, translating `recursive` and
+ * `fileTypes` into its include-path and extension options.
+ *
+ * @param dirPath - Directory to scan.
+ * @param options - Optional recursion toggle and file-type filter.
+ * @returns Function metadata for every function found.
+ */
 export declare function scanFunctionsInDirectory(dirPath: string, options?: {
     recursive?: boolean;
     fileTypes?: string[];
@@ -41,6 +63,13 @@ export declare function scanFunctionsInDirectory(dirPath: string, options?: {
  * Function Scanner class for compatibility
  */
 export declare class FunctionScanner {
-    scanFunctions(content: string, filePath: string, language: string): Promise<FunctionMetadata[]>;
+    /**
+     * Extract functions from source content via the shared extraction path.
+     *
+     * @param content - Source text to parse and extract from.
+     * @param filePath - Path used to resolve the language.
+     * @returns Function metadata for the source's functions.
+     */
+    scanFunctions(content: string, filePath: string): Promise<FunctionMetadata[]>;
 }
 //# sourceMappingURL=functionScanner.d.ts.map

package/dist/functionScanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"functionScanner.d.ts","sourceRoot":"","sources":["../src/functionScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6C5D,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GAAG;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACpF,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmC7B;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACtE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAG7B;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACtE,gBAAgB,EAAE,CA+YpB;AA0DD,eAAO,MAAM,mBAAmB,iCAA2B,CAAC;AAE5D,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACtD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK7B;AAED;;GAEG;AACH,qBAAa,eAAe;IACpB,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAM/B"}
+{"version":3,"file":"functionScanner.d.ts","sourceRoot":"","sources":["../src/functionScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA8C5D,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GAAG;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACpF,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmC7B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACtE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAG7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,qBAAqB,CAAC,CAAA;CAAE,GACtE,gBAAgB,EAAE,CAmMpB;AAuPD,eAAO,MAAM,mBAAmB,iCAA2B,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACtD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK7B;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAQ/B"}