mjolnir-qa 2.0.2 → 2.1.0

package/dist/mcp/stdio.mjs

@@ -904,7 +904,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "2.0.2";
+const ENGINE_VERSION = "2.1.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -14455,13 +14455,15 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	for (const w of warnings) hooks.onConfigWarning?.(w);
 	applySeverityOverrides(findings, config);
 	const active = loadSuppressions(workspace.root).entries.filter((e) => e.status === "active");
-	const suppressionCount = active.length;
+	hooks.onPreSuppressionFindings?.([...findings]);
+	let suppressionCount = 0;
 	if (active.length > 0) {
 		const ruleOnly = new Set(active.filter((e) => !e.files?.length).map((e) => e.ruleId));
 		const kept = findings.filter((f) => {
 			if (ruleOnly.has(f.ruleId)) return false;
 			return !active.some((e) => e.files?.length && e.ruleId === f.ruleId && e.files.some((g) => pathMatchesGlob(f.file, g)));
 		});
+		suppressionCount = findings.length - kept.length;
 		findings.length = 0;
 		for (const f of kept) findings.push(f);
 	}
@@ -14780,6 +14782,7 @@ async function runScan(args, hooks = {}) {
 			scopeUnrecognized++;
 		}
 	});
+	hooks.onTestFilesDiscovered?.(testFiles);
 	const analysis = await runFileAnalysisPhase(findings, testFiles, workspace, activeRules, hooks, cache, rulesDigest, deadline, truncationReasons, declarationsByFile, fileProvenance, (ruleId, file, error) => {
 		rulesCrashed++;
 		hooks.onRuleCrash?.(ruleId, file, error);

package/dist/scan-pipeline-C_Rs4u8N.mjs

@@ -0,0 +1,2 @@
+import { m as runScan } from "./scan-pipeline-MQGUSey3.mjs";
+export { runScan };

package/dist/{scan-pipeline-D3Yk2cef.mjs → scan-pipeline-MQGUSey3.mjs}

@@ -945,7 +945,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "2.0.2";
+const ENGINE_VERSION = "2.1.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1489,6 +1489,10 @@ function globBody(glob) {
 	}
 	return re;
 }
+/** Anchored full-path glob — the primitive the matcher builds on. */
+function globToRegExp(glob) {
+	return new RegExp(`^${globBody(glob)}$`);
+}
 /** Defaults-only matcher for callers that have no scan context. */
 const DEFAULT_IGNORE_MATCHER = createMatcherFromPatterns([]);
 /**
@@ -11946,6 +11950,22 @@ function parseManifest(filePath) {
 	if (filePath.endsWith("pyproject.toml")) return parsePyprojectToml(filePath);
 	if (filePath.endsWith("pom.xml")) return parsePomXml(filePath);
 }
+/**
+* Given a set of starting files (e.g. test files), return all files
+* transitively reachable through the dependency graph.
+*/
+function getReachableFiles(fromFiles, graph) {
+	const reachable = /* @__PURE__ */ new Set();
+	const stack = [...fromFiles];
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (current === void 0) continue;
+		if (reachable.has(current)) continue;
+		reachable.add(current);
+		for (const dep of graph.getDependencies(current)) if (!reachable.has(dep)) stack.push(dep);
+	}
+	return [...reachable].sort();
+}
 //#endregion
 //#region src/engine/incremental-analysis.ts
 /**
@@ -12521,7 +12541,7 @@ const HEADLINES = {
 	critical: "The hammer is cracked — {n} findings break its edge.",
 	warning: "The hammer holds — but {n} findings weigh it down.",
 	trusted: "Held in worthy hands — {n} findings remain.",
-	forged: "Forged complete. Zero findings. The suite is clean.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
 	unmeasured: "No tests found — the hammer cannot be weighed."
 };
 const RUNES = {
@@ -14062,12 +14082,12 @@ function loadSuppressions(root) {
 	};
 }
 function renderSuppressions(report) {
-	if (report.total === 0) return "\nNo suppressed findings. Full transparency maintained.\n";
+	if (report.total === 0) return "\nNo configured suppression entries.\n";
 	const lines = [
 		"",
 		sectionHeader("QUALITY GOVERNANCE", ui),
 		"",
-		`Suppressed findings: ${report.total}`,
+		`Configured entries:    ${report.total}`,
 		`Active:              ${report.active}`,
 		`Expired:             ${report.expired}`,
 		""
@@ -14931,13 +14951,15 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	for (const w of warnings) hooks.onConfigWarning?.(w);
 	applySeverityOverrides(findings, config);
 	const active = loadSuppressions(workspace.root).entries.filter((e) => e.status === "active");
-	const suppressionCount = active.length;
+	hooks.onPreSuppressionFindings?.([...findings]);
+	let suppressionCount = 0;
 	if (active.length > 0) {
 		const ruleOnly = new Set(active.filter((e) => !e.files?.length).map((e) => e.ruleId));
 		const kept = findings.filter((f) => {
 			if (ruleOnly.has(f.ruleId)) return false;
 			return !active.some((e) => e.files?.length && e.ruleId === f.ruleId && e.files.some((g) => pathMatchesGlob(f.file, g)));
 		});
+		suppressionCount = findings.length - kept.length;
 		findings.length = 0;
 		for (const f of kept) findings.push(f);
 	}
@@ -15256,6 +15278,7 @@ async function runScan(args, hooks = {}) {
 			scopeUnrecognized++;
 		}
 	});
+	hooks.onTestFilesDiscovered?.(testFiles);
 	const analysis = await runFileAnalysisPhase(findings, testFiles, workspace, activeRules, hooks, cache, rulesDigest, deadline, truncationReasons, declarationsByFile, fileProvenance, (ruleId, file, error) => {
 		rulesCrashed++;
 		hooks.onRuleCrash?.(ruleId, file, error);
@@ -15306,4 +15329,4 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { SCAN_ADAPTERS as $, box as A, headlineFor as B, buildFooter as C, plainContext as D, panel as E, scoreGauge as F, capForTier as G, EVIDENCE as H, shouldColorize as I, massCeiling as J, computeDimensions as K, shouldUseAscii as L, padTo as M, palette as N, sectionHeader as O, sanitizeData as P, resolveGitPath as Q, wrapText as R, FLAKE_GLYPH as S, isValidCategory as St, okIcon as T, TINT as U, BADGE_BAND as V, TRUST as W, RULES as X, RETIRED_RULE_IDS as Y, getRule as Z, summarizeForensicVerdicts as _, QA_IMPACT_LABELS as _t, applyPostScanProcessing as a, parseTsFile as at, renderSuppressions as b, deriveEvidenceLevel as bt, discoverAndParseRuntimeReport as c, createIgnoreMatcher as ct, isValidFindingRecord as d, loadConfig as dt, SEARCHED_FOR as et, pathMatchesGlob as f, isRecord as ft, selectAdapter as g, DEDUCTIONS as gt, scan_pipeline_exports as h, MEASURED_FP as ht, SUITE_INVALIDATING_RULE_IDS as i, computeCodeText as it, measure as j, severityIcon as k, discoverTestFilesPhase as l, isLintFixtureDir as lt, runScan as m, ENGINE_VERSION as mt, KNOWN_RULE_IDS as n, parseAzurePipeline as nt, assembleScanResult as o, detectFrameworks as ot, runFileAnalysisPhase as p, parseJsonFile as pt, deductionFor as q, OVERLAP_META_BY_RULE_ID as r, parseWorkflow as rt, buildUniversalRules as s, DEFAULT_IGNORE_MATCHER as st, EVIDENCE_OVERRIDES as t, isAzurePipelineFixture as tt, fallbackWorkspace as u, ConfigValidationError as ut, loadLocalRules as v, RULE_CATEGORIES as vt, nextStep as w, runForensics as x, isAdvisoryFinding as xt, loadSuppressions as y, SEVERITY_ORDER as yt, deriveScoreState as z };
+export { massCeiling as $, box as A, isAdvisoryFinding as At, headlineFor as B, buildFooter as C, buildEvidenceGraph as Ct, plainContext as D, RULE_CATEGORIES as Dt, panel as E, QA_IMPACT_LABELS as Et, scoreGauge as F, buildDependencyGraph as G, EVIDENCE as H, shouldColorize as I, classifyProvenance as J, getReachableFiles as K, shouldUseAscii as L, padTo as M, palette as N, sectionHeader as O, SEVERITY_ORDER as Ot, sanitizeData as P, deductionFor as Q, wrapText as R, FLAKE_GLYPH as S, ENGINE_VERSION as St, okIcon as T, DEDUCTIONS as Tt, TINT as U, BADGE_BAND as V, TRUST as W, capForTier as X, computeAgenticProfile as Y, computeDimensions as Z, summarizeForensicVerdicts as _, ConfigValidationError as _t, applyPostScanProcessing as a, SEARCHED_FOR as at, renderSuppressions as b, isRecord as bt, discoverAndParseRuntimeReport as c, parseWorkflow as ct, isValidFindingRecord as d, parseTsFile as dt, RETIRED_RULE_IDS as et, pathMatchesGlob as f, detectFrameworks as ft, selectAdapter as g, isLintFixtureDir as gt, scan_pipeline_exports as h, globToRegExp as ht, SUITE_INVALIDATING_RULE_IDS as i, SCAN_ADAPTERS as it, measure as j, isValidCategory as jt, severityIcon as k, deriveEvidenceLevel as kt, discoverTestFilesPhase as l, parseYamlGuarded as lt, runScan as m, createIgnoreMatcher as mt, KNOWN_RULE_IDS as n, getRule as nt, assembleScanResult as o, isAzurePipelineFixture as ot, runFileAnalysisPhase as p, DEFAULT_IGNORE_MATCHER as pt, correlateFindings as q, OVERLAP_META_BY_RULE_ID as r, resolveGitPath as rt, buildUniversalRules as s, parseAzurePipeline as st, EVIDENCE_OVERRIDES as t, RULES as tt, fallbackWorkspace as u, computeCodeText as ut, loadLocalRules as v, isSuppressionActive as vt, nextStep as w, MEASURED_FP as wt, runForensics as x, parseJsonFile as xt, loadSuppressions as y, loadConfig as yt, deriveScoreState as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {
@@ -25,15 +25,18 @@
     "mcp": "node dist/mcp/stdio.mjs",
     "test": "vitest run",
     "bench:scan": "tsx scripts/bench-scan.ts .mjolnir --files 300",
-    "test:stress": "vitest run --config vitest.stress.config.ts",
+    "test:stress": "vitest run --config vitest.stress.config.ts && node tests/stress/soak.mjs && node tests/stress/concurrent.mjs",
     "test:coverage": "vitest run --coverage",
+    "test:coverage:ci": "vitest run --coverage --no-file-parallelism --testTimeout=120000 --hookTimeout=120000",
     "coverage:ratchet": "node scripts/check-coverage-ratchet.mjs",
+    "audit:ci": "npm audit --audit-level=moderate",
     "test:watch": "vitest",
     "lint": "eslint . --max-warnings=0 && prettier --check .",
     "format": "prettier --write .",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsx scripts/typecheck-fixtures.ts",
-    "certify": "npm run lint && npm run typecheck && npm run test && npx vitest run tests/contract/",
-    "ci-local": "npm run certify && npm run brand:doctor && npm run brand:doctor:selftest && npm run brand:fonts:check",
+    "certify": "npm run build && npm run lint && npm run typecheck && npm run test && npx vitest run tests/contract/",
+    "certify:ci": "npm run build && npm run lint && npm run typecheck && npm run test:coverage:ci && npx vitest run tests/contract/",
+    "ci-local": "npm run certify:ci && npm run test:property && npm run test:fuzz && npm run coverage:ratchet && npm run audit:ci && npm run brand:doctor && npm run brand:doctor:selftest && npm run brand:fonts:check && npm run site:doctor && npm run ci-local:parity",
     "golden:update": "tsx tests/golden/gen.ts",
     "detector-hashes:update": "tsx scripts/generate-detector-hashes.ts",
     "corpus:regression": "tsx tests/corpus/audit.ts",
@@ -66,6 +69,9 @@
     "changelog:check": "tsx scripts/check-changelog.ts --expect-version $(node -p \"require('./package.json').version\")",
     "reporter:version-check": "tsx scripts/check-reporter-version.ts",
     "self-scan": "node dist/cli.mjs .",
+    "ci-local:parity": "node scripts/check-ci-local-parity.mjs",
+    "test:property": "node scripts/check-property-runs.mjs && vitest run --config vitest.property.config.ts",
+    "test:fuzz": "vitest run --config vitest.fuzz.config.ts",
     "prepare": "husky",
     "prepublishOnly": "npm run build",
     "docs:architecture": "tsx scripts/generate-readme-architecture.ts",
@@ -107,6 +113,8 @@
     "yaml": "^2.5.0"
   },
   "devDependencies": {
+    "@commitlint/cli": "^19.8.1",
+    "@commitlint/config-conventional": "^19.8.1",
     "@eslint/js": "^10.0.1",
     "@playwright/test": "^1.50.0",
     "@types/node": "^26.4.0",

package/dist/scan-pipeline-C0ka-RmX.mjs

@@ -1,2 +0,0 @@
-import { m as runScan } from "./scan-pipeline-D3Yk2cef.mjs";
-export { runScan };