hullproof 0.0.0-stage → 0.5.0

package/dist/scanners/semgrep.js

@@ -0,0 +1,142 @@
+// Semgrep adapter. Runs the Hullproof rules in rules/semgrep/, plus an optional external rule pack folder (for example a rule pack of your own),
+// on the files git tracks, named one by one, with --no-git-ignore so Semgrep itself never calls git and the repository's
+// own ignore files cannot hide a tracked file.
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { cmp, sortUnique } from '../util.js';
+import { dirSha256, fileSha256, isRegularFile, relPath, sha256, sourceLine } from './common.js';
+import { inEdition, loadControls } from '../mapping/controls.js';
+import { mapHit } from '../mapping/map.js';
+const yamlIn = (dir) => readdirSync(dir).filter((n) => /\.ya?ml$/.test(n)).sort(cmp);
+// The rule files Semgrep runs, by file name: the engine's folder, then the pack. A pack file with the same name as an
+// engine file replaces it, so a pack may be a whole kit rules folder (identical files change nothing) or only the
+// files it adds. Throws when the pack folder is missing or holds no rule file.
+export function ruleFiles(dir, pack = null) {
+    const byName = new Map(yamlIn(dir).map((n) => [n, join(dir, n)]));
+    if (pack) {
+        if (!existsSync(pack))
+            throw new Error(`the rule pack folder ${basename(pack)} does not exist`);
+        const names = yamlIn(pack);
+        if (!names.length)
+            throw new Error(`the rule pack folder ${basename(pack)} holds no .yaml rule file`);
+        for (const n of names)
+            byName.set(n, join(pack, n));
+    }
+    return [...byName.keys()].sort(cmp).map((n) => byName.get(n));
+}
+// Reads rule ids and metadata.sec_ids from the rule files. The kit writes `- id: x` and `sec_ids: [A, B]` on one line
+// each; test/scanners.test.ts checks every rule has both.
+export function readRules(dir, pack = null) {
+    const out = [];
+    for (const path of ruleFiles(dir, pack)) {
+        const f = basename(path);
+        const version = 'sha256:' + fileSha256(path).slice(0, 16);
+        let cur = null;
+        for (const line of readFileSync(path, 'utf8').split('\n')) {
+            const id = /^\s*-\s+id:\s*([\w.-]+)\s*$/.exec(line)?.[1];
+            if (id) {
+                cur = { id, file: f, sec_ids: [], version };
+                out.push(cur);
+                continue;
+            }
+            const ids = /^\s*sec_ids:\s*\[(.*)\]\s*$/.exec(line)?.[1];
+            if (ids !== undefined && cur)
+                cur.sec_ids = sortUnique(ids.split(',').map((s) => s.trim()).filter(Boolean));
+        }
+    }
+    return out;
+}
+const TIMEOUT_SECONDS = '30';
+// Minified or generated files (a line longer than this) make Semgrep time out at random, which breaks byte identical
+// output. They are left out by this fixed rule and listed as tool errors of type "skipped: minified".
+const MAX_LINE = 1000;
+const minified = (p) => {
+    try {
+        return readFileSync(p, 'utf8').split('\n').some((l) => l.length > MAX_LINE);
+    }
+    catch {
+        return false;
+    }
+};
+const MAX_TARGET_BYTES = '1000000';
+export const adapter = {
+    id: 'semgrep',
+    tool: 'semgrep',
+    versionCommand: ['semgrep', '--version'],
+    testedVersions: '1.176.x',
+    needsNetwork: false,
+    applies: (stack) => stack.languages.length > 0 || stack.ci.length > 0,
+    notApplicableReason: (o) => (adapter.applies(o.stack) ? null : 'No source language or CI workflow was found, so there is nothing for the Semgrep rules to read.'),
+    configFiles: (ctx) => [join(ctx.rulesDir ?? '', 'semgrep')],
+    command: (ctx) => ['semgrep', 'scan', '--config', join(ctx.rulesDir ?? '', 'semgrep'), '--json', '--quiet',
+        '--metrics=off', '--disable-version-check', '--no-git-ignore', '--timeout', TIMEOUT_SECONDS, '--timeout-threshold', '3',
+        '--max-target-bytes', MAX_TARGET_BYTES],
+    parse: (stdout, ctx) => parseSemgrep(stdout, ctx, readRules(join(ctx.rulesDir ?? '', 'semgrep'), ctx.rulePack ?? null)).hits,
+    possibleSecIds: (o) => sortUnique(inEdition(readRules(join(o.rulesDir, 'semgrep'), o.rulePack ?? null).flatMap((r) => r.sec_ids), o.edition, loadControls(o.controlsPath))),
+    execute(o, env) {
+        const engineRules = join(env.rulesDir, 'semgrep');
+        const pack = o.rulePack ?? null;
+        // With a pack, the merged rule files go into one folder in the scratch space, so Semgrep reads one --config folder
+        // and the config sha256 covers exactly the rules that ran.
+        let rulesDir = engineRules;
+        if (pack) {
+            const rules = readRules(engineRules, pack);
+            const twice = rules.map((r) => r.id).filter((id, i, a) => a.indexOf(id) !== i);
+            if (twice.length)
+                throw new Error(`rule id ${twice[0]} is in two rule files once the pack is added`);
+            rulesDir = join(env.scratch, 'rules');
+            mkdirSync(rulesDir);
+            for (const f of ruleFiles(engineRules, pack))
+                copyFileSync(f, join(rulesDir, basename(f)));
+        }
+        // ponytail: every tracked file goes on the command line; split into batches if a repository ever passes ARG_MAX.
+        const listed = o.targets ? new Set(o.targets) : env.tracked;
+        const files = listed ? [...listed].filter((f) => isRegularFile(join(o.repo, f))).sort(cmp) : [];
+        const skipped = files.filter((f) => /\.(js|mjs|cjs|ts|jsx|tsx|json|ya?ml|html|py)$/.test(f) && minified(join(o.repo, f)));
+        const targets = listed ? files.filter((f) => !skipped.includes(f)) : ['.'];
+        const base = adapter.command({ ...o, rulesDir: env.rulesDir });
+        const shown = [...base.map((a) => (a === join(env.rulesDir, 'semgrep') ? (pack ? '<engine>/rules/semgrep + <rule-pack>' : '<engine>/rules/semgrep') : a)),
+            listed ? `<${targets.length} ${o.targets ? 'listed' : 'tracked'} files, list sha256 ${sha256(targets.join('\n')).slice(0, 16)}>` : '.'];
+        // No file to read: Semgrep with no target would read the whole folder, so it is not called.
+        if (listed && targets.length === 0)
+            return { hits: [], toolErrors: [], commands: [shown], configSha256: dirSha256(rulesDir), scanned: [], exitCode: 0 };
+        const r = env.run([...base.map((a) => (a === join(env.rulesDir, 'semgrep') ? rulesDir : a)), ...targets]);
+        let parsed;
+        try {
+            parsed = JSON.parse(r.stdout);
+        }
+        catch {
+            throw new Error(`semgrep printed no JSON (exit ${r.status})`);
+        }
+        const out = parseSemgrep(r.stdout, o, readRules(rulesDir));
+        return {
+            hits: out.hits, toolErrors: [...out.errors, ...skipped.map((file) => ({ type: 'skipped: minified', file, rule_id: '' }))], commands: [shown], configSha256: dirSha256(rulesDir),
+            scanned: sortUnique(parsed.paths.scanned.map((p) => relPath(p, o.repo))), exitCode: r.status,
+        };
+    },
+};
+export function parseSemgrep(stdout, o, rules) {
+    const j = JSON.parse(stdout);
+    const controls = loadControls(o.controlsPath);
+    // check_id is prefixed with the rules folder written as a dotted path; the rule id is the known id it ends with.
+    const ruleOf = (checkId) => rules.find((r) => checkId === r.id || checkId.endsWith('.' + r.id));
+    const hits = j.results.map((x) => {
+        const rule = ruleOf(x.check_id);
+        const rule_id = rule?.id ?? x.check_id.split('.').pop();
+        const file = relPath(x.path, o.repo);
+        const meta = x.extra.metadata?.sec_ids ?? rule?.sec_ids ?? [];
+        const m = mapHit({ tool: 'semgrep', rule_id, file, metadataSecIds: meta }, o.edition, controls);
+        const secretRule = meta.some((id) => id.startsWith('SEC-SECRETS-'));
+        return {
+            tool: 'semgrep', rule_id, file, line: x.start.line, end_line: x.end.line, sec_ids: m.sec_ids,
+            severity_hint: x.extra.severity ?? null, message_key: `semgrep:${rule_id}`, rule_version: rule?.version ?? 'unknown',
+            evidence: secretRule ? null : sourceLine(o.repo, file, x.start.line), mapped_by: m.mapped_by, unmapped: m.sec_ids.length === 0,
+        };
+    });
+    const errors = j.errors.map((e) => ({
+        type: typeof e.type === 'string' ? e.type : Array.isArray(e.type) ? String(e.type[0]) : 'unknown',
+        file: e.path ? relPath(e.path, o.repo) : '',
+        rule_id: e.rule_id ? (ruleOf(e.rule_id)?.id ?? e.rule_id.split('.').pop()) : '',
+    }));
+    return { hits, errors };
+}

package/dist/scanners/trivy.js

@@ -0,0 +1,65 @@
+// Trivy adapter: `trivy config` only, so misconfiguration checks on IaC, Kubernetes, Helm and Dockerfiles. No image is
+// pulled. The checks are the ones built into the Trivy binary (--skip-check-update, an empty cache folder), so the rule
+// set is fixed by the Trivy version, and network is blocked unless allowed (Terraform remote modules then do not load).
+import { join } from 'node:path';
+import { cmp, sortUnique } from '../util.js';
+import { isRegularFile, relPath, sourceLine } from './common.js';
+import { inEdition, loadControls } from '../mapping/controls.js';
+import { mapHit, tableSecIds } from '../mapping/map.js';
+// Pinned so a Trivy update cannot add a scanner silently. The list is Trivy 0.75.0's default.
+const MISCONFIG_SCANNERS = 'azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot,ansible';
+export const adapter = {
+    id: 'trivy',
+    tool: 'trivy',
+    versionCommand: ['trivy', '--version'],
+    testedVersions: '0.75.x',
+    needsNetwork: false,
+    applies: (stack) => stack.iac.length > 0 || stack.containers.length > 0,
+    notApplicableReason: (o) => (adapter.applies(o.stack) ? null : 'No infrastructure as code, Kubernetes, Helm or container file was found, so Trivy has nothing to check.'),
+    configFiles: () => [],
+    command: () => ['trivy', 'config', '--format', 'json', '--quiet', '--skip-check-update', '--skip-version-check',
+        '--disable-telemetry', '--include-non-failures', '--misconfig-scanners', MISCONFIG_SCANNERS, '--cache-dir', '<empty-dir>', '.'],
+    parse: (stdout, ctx) => parseTrivy(stdout, ctx, 'unknown').hits,
+    possibleSecIds: (o) => sortUnique(inEdition(tableSecIds('trivy'), o.edition, loadControls(o.controlsPath))),
+    execute(o, env) {
+        const argv = adapter.command(o).map((a) => (a === '<empty-dir>' ? env.scratch : a));
+        const shown = adapter.command(o);
+        const r = env.run(argv);
+        if (r.status !== 0)
+            throw new Error(`trivy exited with ${r.status ?? r.error}`);
+        const out = parseTrivy(r.stdout, o, `trivy ${env.version} built in checks`, env.tracked);
+        return { hits: out.hits, commands: [shown], configSha256: null, scanned: out.scanned, exitCode: r.status, toolErrors: [] };
+    },
+};
+// Terraform results come per module folder as well as per file; a folder target stands for the tracked .tf files in it.
+export function parseTrivy(stdout, o, ruleVersion, tracked = null) {
+    const controls = loadControls(o.controlsPath);
+    const j = JSON.parse(stdout);
+    const hits = [];
+    const scanned = new Set();
+    for (const res of j.Results ?? []) {
+        if (res.Class !== 'config')
+            continue;
+        const target = relPath(res.Target, o.repo);
+        if (tracked && !isRegularFile(join(o.repo, target))) {
+            const prefix = target === '.' ? '' : target + '/';
+            for (const f of tracked)
+                if (f.startsWith(prefix) && !f.slice(prefix.length).includes('/') && /\.tf(\.json)?$/.test(f))
+                    scanned.add(f);
+        }
+        else
+            scanned.add(target);
+        for (const m of res.Misconfigurations ?? []) {
+            if (m.Status !== 'FAIL')
+                continue;
+            const line = m.CauseMetadata?.StartLine ?? 0;
+            const mapped = mapHit({ tool: 'trivy', rule_id: m.ID, file: target }, o.edition, controls);
+            hits.push({
+                tool: 'trivy', rule_id: m.ID, file: target, line, end_line: m.CauseMetadata?.EndLine ?? line, sec_ids: mapped.sec_ids,
+                severity_hint: m.Severity ?? null, message_key: `trivy:${m.ID}`, rule_version: ruleVersion,
+                evidence: sourceLine(o.repo, target, line), mapped_by: mapped.mapped_by, unmapped: !mapped.sec_ids.length,
+            });
+        }
+    }
+    return { hits, scanned: [...scanned].sort(cmp) };
+}

package/dist/scanners/types.js

@@ -0,0 +1 @@
+export {};

package/dist/types/check.js

@@ -0,0 +1 @@
+export {};

package/dist/types/codemap.js

@@ -0,0 +1 @@
+export {};

package/dist/types/findings.js

@@ -0,0 +1,5 @@
+// The findings record (the JSON inside the hullproof-findings block of report.findings.md), schema 1.1.0.
+// The schema file is schemas/findings.schema.json, a copy of the kit's docs/hullproof/findings.schema.json; the kit file is the
+// source of truth and the copy is checked by test/schemas.test.ts. Field limits (lengths, counts, patterns) live in the schema;
+// cross field rules live in the kit's validate-findings.mjs. The engine writes schema_version "1.1.0".
+export {};

package/dist/types/hunt.js

@@ -0,0 +1 @@
+export {};

package/dist/types/index.js

@@ -0,0 +1 @@
+export { STACK_CATEGORIES } from './stack.js';

package/dist/types/prove.js

@@ -0,0 +1 @@
+export {};

package/dist/types/results.js

@@ -0,0 +1,2 @@
+// results.json: the per requirement result list the kit gate (hullproof-gate.mjs, loadResults) already reads.
+export {};

package/dist/types/scan.js

@@ -0,0 +1 @@
+export {};

package/dist/types/stack.js

@@ -0,0 +1,5 @@
+// stack.json, written by `hullproof discover`. JSON schema: schemas/stack.schema.json. Documented in docs/INTERFACES.md.
+export const STACK_CATEGORIES = [
+    'languages', 'runtimes', 'frameworks', 'package_managers', 'data_stores', 'auth', 'payments', 'ai',
+    'hosting', 'iac', 'containers', 'ci', 'mobile',
+];

package/dist/util.js

@@ -0,0 +1,71 @@
+// Small helpers shared by every module.
+// Code unit order. Never localeCompare: its result depends on the machine's locale.
+export const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+export const sortUnique = (xs) => [...new Set(xs)].sort(cmp);
+function sortKeys(v) {
+    if (Array.isArray(v))
+        return v.map(sortKeys);
+    if (v && typeof v === 'object') {
+        const out = {};
+        for (const k of Object.keys(v).sort(cmp)) {
+            const x = v[k];
+            if (x !== undefined)
+                out[k] = sortKeys(x);
+        }
+        return out;
+    }
+    return v;
+}
+// The engine's one JSON writer: sorted keys, two space indent, LF, final newline. Same value, same bytes.
+export const stableJson = (v) => JSON.stringify(sortKeys(v), null, 2) + '\n';
+// The same sorted JSON on one line, for a block that must stay under a size limit.
+export const stableJsonCompact = (v) => JSON.stringify(sortKeys(v)) + '\n';
+// Glob to RegExp. Supports *, **, ?, [...] and {a,b}. A pattern with no slash matches the file name at any depth;
+// a pattern with a slash matches the whole repository relative path.
+function globBody(p) {
+    let out = '';
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c === '*') {
+            if (p[i + 1] === '*') {
+                if (p[i + 2] === '/') {
+                    out += '(?:.*/)?';
+                    i += 2;
+                }
+                else {
+                    out += '.*';
+                    i += 1;
+                }
+            }
+            else
+                out += '[^/]*';
+        }
+        else if (c === '?')
+            out += '[^/]';
+        else if (c === '[' && p.indexOf(']', i + 1) > i + 1) {
+            const j = p.indexOf(']', i + 1);
+            const cls = p.slice(i + 1, j);
+            out += '[' + (cls[0] === '!' ? '^' + cls.slice(1) : cls).replace(/\\/g, '\\\\') + ']';
+            i = j;
+        }
+        else if (c === '{' && p.indexOf('}', i) > i) {
+            const j = p.indexOf('}', i);
+            out += '(?:' + p.slice(i + 1, j).split(',').map(globBody).join('|') + ')';
+            i = j;
+        }
+        else if (c === '\\' && i + 1 < p.length) {
+            out += escapeRe(p[i + 1]);
+            i++;
+        }
+        else
+            out += escapeRe(c);
+    }
+    return out;
+}
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+export function globToRegExp(glob) {
+    const anchored = glob.includes('/');
+    const p = glob.startsWith('/') ? glob.slice(1) : glob;
+    return new RegExp(anchored ? `^${globBody(p)}$` : `^(?:.*/)?${globBody(p)}$`);
+}
+export { globBody };

package/dist/version.js

@@ -0,0 +1,2 @@
+// The engine version.
+export const ENGINE_VERSION = '0.5.0';

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "hullproof",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.0",
+  "description": "Hullproof Engine: deterministic, stack aware security checks and release gate for AI built apps.",
+  "license": "Apache-2.0",
+  "author": "Rare Phronesis Limited",
+  "homepage": "https://github.com/jt247/hullproof-engine",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jt247/hullproof-engine.git"
+  },
+  "bugs": {
+    "url": "https://github.com/jt247/hullproof-engine/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "hullproof": "dist/cli.js"
+  },
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.ts bench/*.test.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "build": "node build.mjs",
+    "prepack": "node build.mjs",
+    "discover": "node src/cli.ts discover"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "typescript": "^7.0.2"
+  },
+  "files": [
+    "dist",
+    "src",
+    "checks",
+    "detectors",
+    "rules",
+    "schemas",
+    "packs",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ]
+}

package/packs/android/fixture-result.json

@@ -0,0 +1,43 @@
+{
+  "detect": {
+    "expected": [
+      "android",
+      "kotlin"
+    ],
+    "found": [
+      "android",
+      "kotlin"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": true,
+      "flaws": {
+        "false_findings": 0,
+        "found": 2,
+        "planted": 7
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 3,
+        "extra": 0,
+        "matched": 3,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/packs/android/fail and test/fixtures/packs/android/pass",
+      "source": "node bench/packs-measure.ts android (key kept outside the repository)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "Android app in Kotlin: seven planted configuration flaws and a fixed copy. Five of the seven are settled by checks that belong to the Pro edition. Written before the Android extractor existed."
+  ],
+  "pack": "android",
+  "proof": [],
+  "schema": 1
+}

package/packs/android/pack.json

@@ -0,0 +1,56 @@
+{
+  "schema": 1,
+  "id": "android",
+  "name": "Kotlin and Android",
+  "summary": "AndroidManifest.xml, the network security configuration and exported components read into the code map, with a check for secrets written into configuration files. Kotlin source is not read.",
+  "edition": "free",
+  "languages": [
+    "kotlin",
+    "java"
+  ],
+  "frameworks": [
+    "android"
+  ],
+  "level": "L2",
+  "limits": [
+    "Kotlin and Java source is not read, so what a handler does with an incoming intent is not in the map."
+  ],
+  "parts": {
+    "detectors": [
+      "kotlin",
+      "android"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/mobile.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/mobile.ts"
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.mobile-secret-in-config"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/config-checks.ts"
+      },
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/packs/android/fail",
+    "fixed_dir": "test/fixtures/packs/android/pass",
+    "internal": true,
+    "answer_keys": [
+      "outside_repo"
+    ],
+    "result": "packs/android/fixture-result.json"
+  }
+}

package/packs/dotnet/fixture-result.json

@@ -0,0 +1,62 @@
+{
+  "detect": {
+    "expected": [
+      "aspnet-core",
+      "csharp"
+    ],
+    "found": [
+      "aspnet-core",
+      "csharp",
+      "entity-framework"
+    ]
+  },
+  "engine": "0.5.0",
+  "measured": "2026-10-14",
+  "measurements": [
+    {
+      "blind_key": true,
+      "flaws": {
+        "false_findings": 0,
+        "found": 6,
+        "planted": 6
+      },
+      "kind": "synthetic",
+      "mapped": {
+        "expected": 11,
+        "extra": 0,
+        "matched": 11,
+        "what": "entry points"
+      },
+      "name": "test/fixtures/packs/dotnet/fail and test/fixtures/packs/dotnet/pass",
+      "source": "node bench/packs-measure.ts dotnet (key kept outside the repository)",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    },
+    {
+      "blind_key": true,
+      "flaws": null,
+      "kind": "third_party",
+      "mapped": {
+        "expected": 25,
+        "extra": 0,
+        "matched": 25,
+        "what": "entry points (real route registrations)"
+      },
+      "name": "realworld-apps/aspnetcore-realworld-example-app (seeded sample of its route registrations)",
+      "source": "bench/PHASE6C-MEASURED-2026-10-14.md, recall by bench/phase6c-sample.ts with seed 20261017, three byte identical ci runs",
+      "stability": {
+        "identical": true,
+        "runs": 3
+      }
+    }
+  ],
+  "notes": [
+    "ASP.NET Core 8 with controllers and minimal APIs: six planted flaws and a fixed copy. Written before the .NET extractor existed. Route token convention: [controller] is replaced by the lower case controller name.",
+    "2026-10-14: the first flaw also accepts check.map.read-by-id-without-owner, which was built in step 6c after these fixtures missed the flaw."
+  ],
+  "pack": "dotnet",
+  "proof": [],
+  "schema": 1
+}

package/packs/dotnet/pack.json

@@ -0,0 +1,88 @@
+{
+  "schema": 1,
+  "id": "dotnet",
+  "name": ".NET and ASP.NET Core",
+  "summary": "ASP.NET Core controllers and minimal APIs with [Authorize], [AllowAnonymous], RequireAuthorization and a fallback policy: entry points, protections and checks.",
+  "edition": "free",
+  "languages": [
+    "csharp"
+  ],
+  "frameworks": [
+    "aspnet-core"
+  ],
+  "level": "L2",
+  "limits": [
+    "Conventional routing (MapControllerRoute) is not read. Planted flaws were not measured on a real application."
+  ],
+  "parts": {
+    "detectors": [
+      "csharp",
+      "aspnet-core"
+    ],
+    "extractors": [
+      {
+        "file": "src/map/dotnet.ts"
+      },
+      {
+        "file": "src/map/cblocks.ts"
+      }
+    ],
+    "auth_patterns": [
+      {
+        "file": "src/map/light-profiles.ts"
+      }
+    ],
+    "checks": [
+      {
+        "id": "check.map.admin-route-without-role"
+      },
+      {
+        "id": "check.map.data-read-without-auth"
+      },
+      {
+        "id": "check.map.mutating-route-without-auth"
+      },
+      {
+        "id": "check.map.privileged-action-without-audit"
+      },
+      {
+        "id": "check.map.privileged-field-from-request"
+      },
+      {
+        "id": "check.map.redirect-from-request"
+      },
+      {
+        "id": "check.map.request-url-fetched"
+      },
+      {
+        "id": "check.map.webhook-verify-before-use"
+      },
+      {
+        "id": "check.map.write-by-id-without-owner"
+      },
+      {
+        "id": "check.map.read-by-id-without-owner"
+      },
+      {
+        "id": "check.authz.owner-filter-on-id-read"
+      },
+      {
+        "id": "check.authz.admin-role-check"
+      }
+    ],
+    "mapping": [
+      {
+        "file": "src/checks/map/entry-checks.ts"
+      }
+    ]
+  },
+  "fixture": {
+    "dir": "test/fixtures/packs/dotnet/fail",
+    "fixed_dir": "test/fixtures/packs/dotnet/pass",
+    "internal": true,
+    "answer_keys": [
+      "outside_repo"
+    ],
+    "result": "packs/dotnet/fixture-result.json"
+  }
+}