nfunc-mcp 0.1.0

package/README.md

@@ -0,0 +1,395 @@
+# qa-mcp
+
+A local MCP server that gives Claude (or any MCP client) a full non-functional QA toolkit. Run Lighthouse, WCAG accessibility checks, and static code analysis — individually or all at once — and get back structured, prioritised findings you can act on immediately.
+
+---
+
+## Table of contents
+
+1. [What it does](#what-it-does)
+2. [Prerequisites](#prerequisites)
+3. [Install & build](#install--build)
+4. [Register with Claude Code](#register-with-claude-code)
+5. [Tools](#tools)
+6. [run_qa_gate — the main tool](#run_qa_gate--the-main-tool)
+   - [Inputs](#inputs)
+   - [Release readiness tiers](#release-readiness-tiers)
+   - [Composite score](#composite-score)
+   - [Scorecard](#scorecard)
+   - [Cross-tool corroboration](#cross-tool-corroboration)
+   - [HTML report](#html-report)
+   - [Output shape](#output-shape)
+7. [Individual tools](#individual-tools)
+8. [Priority system](#priority-system)
+9. [Project layout](#project-layout)
+10. [How to prompt](#how-to-prompt)
+
+---
+
+## What it does
+
+`qa-mcp` wires four QA tools into Claude's tool-use loop:
+
+| Capability | Tools | What it checks |
+|---|---|---|
+| Performance | Lighthouse | LCP, TTI, TBT, CLS, bundle size, caching |
+| Accessibility | Lighthouse + pa11y | WCAG 2 AA violations, ARIA, contrast, labels |
+| SEO | Lighthouse | Crawlability, robots.txt, meta, link text |
+| Best practices | Lighthouse | HTTPS, deprecated APIs, third-party cookies |
+| Code quality | ESLint | Dead code, undeclared vars, swallowed errors |
+| Security patterns | Semgrep | OWASP JS/TS patterns |
+
+The `run_qa_gate` orchestrator runs all of them in parallel, cross-correlates findings across tools, and produces a single structured report with a release readiness verdict, a composite health score, a per-tool scorecard, and a browser-openable HTML report.
+
+---
+
+## Prerequisites
+
+The following CLI tools must be available on your PATH:
+
+```bash
+npm install -g lighthouse      # Lighthouse
+npm install -g pa11y           # pa11y
+npm install -g eslint          # ESLint
+brew install semgrep           # Semgrep (or pip install semgrep)
+```
+
+Verify each is reachable:
+
+```bash
+lighthouse --version
+pa11y --version
+eslint --version
+semgrep --version
+```
+
+If a tool is missing, the gate still runs — that tool's scorecard entry will show `UNAVAILABLE` and its findings are omitted from the report.
+
+---
+
+## Install & build
+
+```bash
+git clone <repo-url>
+cd qa-mcp
+npm install
+npm run build
+```
+
+### Scripts
+
+| Script | Purpose |
+|---|---|
+| `npm run build` | Compile TypeScript → `dist/` |
+| `npm start` | Run the compiled server |
+| `npm run dev` | Run from source with hot reload (`tsx watch`) |
+
+---
+
+## Register with Claude Code
+
+### Option A — CLI (recommended)
+
+```bash
+claude mcp add qa-mcp -- node /absolute/path/to/qa-mcp/dist/index.js
+```
+
+### Option B — Manual config
+
+Add to `~/.claude.json` under `mcpServers`:
+
+```json
+{
+  "mcpServers": {
+    "qa-mcp": {
+      "command": "node",
+      "args": ["/absolute/path/to/qa-mcp/dist/index.js"]
+    }
+  }
+}
+```
+
+### Verify the connection
+
+1. Run `/mcp` in Claude Code — `qa-mcp` should show as `connected`.
+2. Ask Claude: *"Call the qa-mcp ping tool."*
+3. Expected response:
+   ```json
+   { "status": "ok", "timestamp": "2026-05-20T12:00:00.000Z" }
+   ```
+
+---
+
+## Tools
+
+| Tool | Description | Inputs |
+|---|---|---|
+| `ping` | Health check — confirms the server is up | — |
+| `run_lighthouse` | Full Lighthouse audit for a URL | `url` |
+| `run_accessibility_check` | pa11y WCAG audit for a URL | `url`, `standard` (optional), `ignore` (optional) |
+| `run_static_analysis` | ESLint + Semgrep scan for a local codebase | `path` |
+| `run_qa_gate` | All tools in parallel + correlation + HTML report | `url` and/or `path` |
+
+---
+
+## run_qa_gate — the main tool
+
+This is the tool to reach for in nearly every QA workflow. It replaces running tools individually and adds cross-tool intelligence on top.
+
+### Inputs
+
+Both inputs are **optional** — provide whichever you have. At least one is required.
+
+| Input | Type | When to provide |
+|---|---|---|
+| `url` | string (URL) | You have a running page — production, staging, preview URL, or localhost. Enables Lighthouse and pa11y. |
+| `path` | string (path) | You have a local codebase. Enables ESLint and Semgrep. |
+| `context` | string | Optional. Free-text description of the project (e.g. `"React e-commerce checkout"`). Helps Claude interpret results. |
+
+**URL only** — browser-based checks, static analysis skipped:
+```
+QA snapshot — https://staging.myapp.com
+```
+
+**Path only** — static analysis only, browser checks skipped:
+```
+QA snapshot — /path/to/my-feature-branch
+```
+
+**Both** — full suite:
+```
+QA snapshot — https://staging.myapp.com, code at /path/to/repo
+```
+
+### Release readiness tiers
+
+The `release_readiness` field replaces a binary pass/fail with four actionable tiers:
+
+| Value | Meaning | Condition |
+|---|---|---|
+| `BLOCKED` | Cannot ship — P1 issues exist | Any P1 finding |
+| `CONDITIONAL` | Shippable with caveats — track P2s before merging | P2 findings, no P1s |
+| `ADVISORY` | Safe to ship — P3s are tech debt to log | Only P3 findings |
+| `CLEAR` | No issues detected | Zero findings |
+
+### Composite score
+
+A single `composite_score` (0–100) gives a continuous health measure across all tools.
+
+**Formula:** Start at 100, deduct by finding severity:
+
+| Priority | Deduction |
+|---|---|
+| P1 | −15 per finding |
+| P2 | −7 per finding |
+| P3 | −3 per finding |
+
+Score is floored at 0. Tracks improvement over time — a score trending upward sprint-over-sprint is a healthy signal.
+
+### Scorecard
+
+A compact `scorecard` array gives a one-line status per tool:
+
+```json
+[
+  { "tool": "Lighthouse",       "gate": "WARN", "score": 75,
+    "breakdown": { "performance": 52, "accessibility": 98, "seo": 100, "best-practices": 58 } },
+  { "tool": "pa11y",            "gate": "PASS", "issues": 0 },
+  { "tool": "ESLint / Semgrep", "gate": "SKIPPED" }
+]
+```
+
+Gate values:
+
+| Gate | Meaning |
+|---|---|
+| `PASS` | No issues at this tool's threshold |
+| `WARN` | Issues exist but below the FAIL threshold |
+| `FAIL` | Issues at P1 level (or Lighthouse avg < 50) |
+| `SKIPPED` | Input not provided (URL or path not supplied) |
+| `UNAVAILABLE` | Tool was invoked but is not installed or errored |
+
+### Cross-tool corroboration
+
+When Lighthouse and pa11y independently flag the same accessibility gap, those findings are:
+
+1. **Merged** into a single entry in `corroborated_findings`
+2. **Priority-promoted** one tier (P3→P2, P2→P1)
+3. **Annotated** with `confidence: "high"` and `confirmed_by: ["lighthouse", "pa11y"]`
+
+These are the highest-confidence findings in any report — two independent tools agreeing is stronger evidence than either alone. They appear in their own dedicated section above all other findings, and bubble to the top of `top_issues`.
+
+**Corroboration mapping (Rule 1):**
+
+| Lighthouse audit | pa11y technique |
+|---|---|
+| `color-contrast` | `.G18`, `.G145`, `.G174` |
+| `image-alt` | `.H37`, `.H67`, `.F65` |
+| `label` | `.H44`, `.F68`, `.H91.Input` |
+| `link-name` | `.H30`, `.H91.A.` |
+| `html-has-lang` | `.H57` |
+| `button-name` | `.H91.Button` |
+| *(and more)* | |
+
+**Performance ↔ code linkage (Rule 2):** If a Lighthouse performance finding's display value contains a filename that also appears in a static analysis finding, the static finding is added as `related_findings` on the Lighthouse entry. Findings are not merged — they remain linked by reference.
+
+### HTML report
+
+Every `run_qa_gate` call automatically writes a self-contained HTML file to `/tmp` and returns its path as `report_file`:
+
+```json
+{
+  "report_file": "file:///tmp/qa-report-myapp-com-1234567890.html"
+}
+```
+
+Open the path in any browser to get:
+
+- Release readiness banner (colour-coded)
+- Composite score gauge (SVG arc, 0–100)
+- Per-tool scorecard table
+- Cross-confirmed findings section (highlighted)
+- Collapsible finding cards grouped by P1 / P2 / P3
+- Evidence and selector for each finding
+
+No server required — the file is fully self-contained with inline CSS.
+
+### Output shape
+
+```jsonc
+{
+  "release_readiness": "BLOCKED",        // BLOCKED | CONDITIONAL | ADVISORY | CLEAR
+  "composite_score": 22,                 // 0–100
+  "report_file": "file:///tmp/qa-report-xxx.html",
+  "scorecard": [ ... ],                  // per-tool gate + score/issues
+  "eslint_config_used": "project",       // present only when path was supplied
+  "summary": "110 findings (101 P1, 9 P2) across 2 tools. ...",
+  "corroborated_findings": [ ... ],      // cross-confirmed, confidence: "high"
+  "top_issues": [ ... ],                 // top 3 findings (corroborated first)
+  "all_findings": [ ... ],               // all findings sorted by priority
+  "correlations_found": 1,
+  "errors": [ ... ]                      // present only if a tool errored
+}
+```
+
+Each finding:
+
+```jsonc
+{
+  "priority": "P1",                      // P1 | P2 | P3
+  "title": "Largest Contentful Paint",
+  "description": "Users see main content 34s after navigation...",
+  "evidence": { "audit_id": "largest-contentful-paint", "value": "34.3 s" },
+  "source_tool": "lighthouse",
+  // corroborated findings also have:
+  "confirmed_by": ["lighthouse", "pa11y"],
+  "confidence": "high"
+}
+```
+
+---
+
+## Individual tools
+
+### run_lighthouse
+
+Runs a full Lighthouse audit against a URL.
+
+```
+Run Lighthouse on https://myapp.com
+```
+
+Returns: `url`, `scores` (per category), `ttfb_ms`, `findings` (priority-ordered).
+
+### run_accessibility_check
+
+Runs pa11y against a URL at WCAG 2 AA by default. Returns only violations (errors) — use the CLI directly with `--include-notices --include-warnings` for the full checklist.
+
+```
+Run an accessibility check on https://myapp.com
+Run accessibility check at AAA standard on https://myapp.com
+```
+
+Returns: `url`, `standard`, `violation_count`, `findings`.
+
+### run_static_analysis
+
+Runs ESLint and Semgrep in parallel against a local directory. Automatically uses the project's own ESLint config if one is found; otherwise falls back to a QA-focused baseline config.
+
+```
+Run static analysis on /path/to/repo
+```
+
+Returns: `path`, `tools_run`, `eslint_config_used`, `issue_count`, `findings`, `warnings`.
+
+---
+
+## Priority system
+
+| Priority | Meaning | Lighthouse threshold | WCAG level | ESLint / Semgrep |
+|---|---|---|---|---|
+| P1 | Blocker — fix before shipping | Score < 50 | Level A | Semgrep security, ESLint error |
+| P2 | Warning — track before merging | Score 50–79 | Level AA | ESLint warning |
+| P3 | Advisory — log as tech debt | Score 80–89 | Level AAA | — |
+| *(suppressed)* | Passing — not reported | Score ≥ 90 | — | — |
+
+Corroborated findings are promoted one tier above where either tool would place them individually.
+
+---
+
+## Project layout
+
+```
+qa-mcp/
+├── src/
+│   ├── index.ts                         # MCP server bootstrap + tool registration
+│   ├── types.ts                         # Shared types (Finding, Priority)
+│   ├── config/
+│   │   └── qa-mcp-baseline.eslint.config.js  # Fallback ESLint config
+│   ├── tools/
+│   │   ├── qaGate.ts                    # Orchestrator — runs all tools, builds report
+│   │   ├── lighthouse.ts                # run_lighthouse tool
+│   │   ├── accessibility.ts             # run_accessibility_check tool
+│   │   └── staticAnalysis.ts            # run_static_analysis tool
+│   ├── mappers/
+│   │   ├── correlator.ts                # Cross-tool correlation engine (Rule 1 + 2)
+│   │   ├── defectFormatter.ts           # Raw tool output → Finding objects
+│   │   └── priorityMapper.ts            # Score/severity → P1/P2/P3
+│   └── utils/
+│       ├── reportGenerator.ts           # HTML report builder
+│       ├── shellRunner.ts               # CLI execution with timeout + error handling
+│       ├── outputParsers.ts             # JSON parsers for each tool's output
+│       ├── eslintConfigDetector.ts      # Detects project ESLint config
+│       └── toolResponse.ts             # MCP error response helpers
+├── dist/                                # Compiled output (gitignored)
+├── package.json
+├── tsconfig.json
+└── README.md
+```
+
+---
+
+## How to prompt
+
+The shortest working prompts:
+
+```
+# Full suite
+QA snapshot — https://myapp.com, code at /path/to/repo
+
+# URL only (Lighthouse + pa11y)
+QA snapshot — https://myapp.com
+
+# Local branch only (ESLint + Semgrep)
+QA snapshot — /path/to/my-feature-branch
+```
+
+Alternative trigger phrases (all invoke `run_qa_gate`):
+
+```
+Health check on https://myapp.com
+Is https://myapp.com ready to ship? Code at /path/to/repo
+Any red flags? /path/to/repo
+```
+
+After the run, Claude will surface the `report_file` path. Open it in your browser for the full visual dashboard.

package/dist/config/qa-mcp-baseline.eslint.config.js

@@ -0,0 +1,18 @@
+// QA MCP baseline ESLint config — purely bug-risk rules, no style/formatting.
+// Targets JS/JSX files only; TypeScript files require @typescript-eslint/parser.
+// Used as fallback when the target repo has no ESLint config of its own.
+export default [
+  {
+    files: ["**/*.js", "**/*.mjs", "**/*.cjs", "**/*.jsx"],
+    ignores: ["**/node_modules/**", "**/dist/**"],
+    rules: {
+      "no-unused-vars": "error",
+      "no-undef": "error",
+      eqeqeq: "error",
+      "no-unreachable": "error",
+      "no-console": "warn",
+      "no-empty": "error",
+      "no-constant-condition": "error",
+    },
+  },
+];

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { registerLighthouseTool } from "./tools/lighthouse.js";
+import { registerAccessibilityTool } from "./tools/accessibility.js";
+import { registerStaticAnalysisTool } from "./tools/staticAnalysis.js";
+import { registerQaGateTool } from "./tools/qaGate.js";
+const server = new McpServer({
+    name: "qa-mcp",
+    version: "0.1.0",
+});
+server.registerTool("ping", {
+    description: "Health-check tool. Returns ok status and current ISO timestamp.",
+    inputSchema: {},
+}, async () => {
+    const payload = {
+        status: "ok",
+        timestamp: new Date().toISOString(),
+    };
+    return {
+        content: [{ type: "text", text: JSON.stringify(payload) }],
+    };
+});
+registerLighthouseTool(server);
+registerAccessibilityTool(server);
+registerStaticAnalysisTool(server);
+registerQaGateTool(server);
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    console.error("qa-mcp fatal error:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,YAAY,CACjB,MAAM,EACN;IACE,WAAW,EAAE,iEAAiE;IAC9E,WAAW,EAAE,EAAE;CAChB,EACD,KAAK,IAAI,EAAE;IACT,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC/B,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAClC,0BAA0B,CAAC,MAAM,CAAC,CAAC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mappers/correlator.d.ts

@@ -0,0 +1,28 @@
+import type { Finding } from "../types.js";
+export interface CorrelatedFinding extends Finding {
+    id: string;
+    source_tool: string;
+    confirmed_by?: string[];
+    related_findings?: string[];
+}
+export interface ToolReports {
+    lighthouse: {
+        scores: Record<string, number>;
+        ttfb_ms: number | null;
+        findings: Finding[];
+    } | null;
+    a11y: {
+        violation_count: number;
+        findings: Finding[];
+    } | null;
+    static: {
+        issue_count: number;
+        findings: Finding[];
+    } | null;
+}
+export interface CorrelatorResult {
+    correlated_findings: CorrelatedFinding[];
+    unique_findings: CorrelatedFinding[];
+    correlations_count: number;
+}
+export declare function correlate(reports: ToolReports): CorrelatorResult;

package/dist/mappers/correlator.js

@@ -0,0 +1,132 @@
+const PRIORITY_ORDER = { P1: 0, P2: 1, P3: 2 };
+function promotePriority(p) {
+    if (p === "P3")
+        return "P2";
+    if (p === "P2")
+        return "P1";
+    return "P1";
+}
+// Maps Lighthouse accessibility audit IDs to substrings that appear inside the
+// pa11y rule_code for the same class of issue.  A leading "." prevents matching
+// partial segment names (e.g. ".H44" won't accidentally match ".1H44").
+const LH_TO_PA11Y_SUBSTRINGS = {
+    "color-contrast": [".G18", ".G145", ".G174"],
+    "image-alt": [".H37", ".H67", ".F65"],
+    label: [".H44", ".F68", ".H91.Input", ".H91.Select", ".H91.Textarea"],
+    "link-name": [".H30", ".H91.A."],
+    "document-title": [".H25", ".F89"],
+    "html-has-lang": [".H57"],
+    "frame-title": [".H64"],
+    "button-name": [".H91.Button"],
+    "select-name": [".H91.Select"],
+    "duplicate-id-aria": [".H93", ".F77"],
+};
+// Lighthouse performance audit IDs where Rule 2 (code linkage) is relevant.
+const PERFORMANCE_AUDIT_IDS = new Set([
+    "render-blocking-resources",
+    "unused-javascript",
+    "unused-css-rules",
+    "bootup-time",
+    "mainthread-work-breakdown",
+    "total-blocking-time",
+]);
+function makeId(tool, f) {
+    const e = f.evidence;
+    if (tool === "lighthouse")
+        return `lh:${String(e["audit_id"] ?? f.title)}`;
+    if (tool === "a11y") {
+        const code = String(e["rule_code"] ?? "").split(".").slice(-2).join(".");
+        const sel = String(e["selector"] ?? "").slice(0, 16);
+        return `a11y:${code}:${sel}`;
+    }
+    const basename = String(e["file"] ?? "").split("/").pop() ?? "";
+    return `static:${String(e["source"] ?? "")}:${basename}:${String(e["line"] ?? "")}`;
+}
+function tag(tool, findings) {
+    return findings.map((f) => ({ ...f, id: makeId(tool, f), source_tool: tool }));
+}
+// Rule 1 — Double-confirmed accessibility:
+// A Lighthouse accessibility finding and a pa11y finding that cover the same
+// WCAG technique are merged into one finding with priority promoted one tier
+// and confirmed_by set to both tools.
+function applyRule1(lhFindings, a11yFindings) {
+    const correlated = [];
+    const consumedLhIds = new Set();
+    const consumedA11yIds = new Set();
+    for (const lhF of lhFindings) {
+        const auditId = String(lhF.evidence["audit_id"] ?? "");
+        const substrings = LH_TO_PA11Y_SUBSTRINGS[auditId];
+        if (!substrings)
+            continue;
+        for (const a11yF of a11yFindings) {
+            if (consumedA11yIds.has(a11yF.id))
+                continue;
+            const ruleCode = String(a11yF.evidence["rule_code"] ?? "");
+            if (!substrings.some((s) => ruleCode.includes(s)))
+                continue;
+            // Use the better (lower index = higher priority) of the two raw priorities
+            // as the base, then promote it one tier.
+            const basePriority = PRIORITY_ORDER[lhF.priority] <= PRIORITY_ORDER[a11yF.priority]
+                ? lhF.priority
+                : a11yF.priority;
+            correlated.push({
+                id: `corr:lh+a11y:${auditId}`,
+                source_tool: "lighthouse+pa11y",
+                priority: promotePriority(basePriority),
+                title: lhF.title,
+                description: `[Lighthouse] ${lhF.description} ` +
+                    `[pa11y] ${a11yF.description} ` +
+                    `Two independent tools flagged the same accessibility gap — ` +
+                    `this cross-tool confirmation increases confidence that the issue is real and affects real users.`,
+                evidence: {
+                    ...lhF.evidence,
+                    pa11y_rule_code: ruleCode,
+                    pa11y_selector: a11yF.evidence["selector"] ?? "",
+                },
+                confirmed_by: ["lighthouse", "pa11y"],
+            });
+            consumedLhIds.add(lhF.id);
+            consumedA11yIds.add(a11yF.id);
+            break; // one correlation per Lighthouse finding
+        }
+    }
+    return { correlated, consumedLhIds, consumedA11yIds };
+}
+// Rule 2 — Performance ↔ code linkage:
+// If a Lighthouse performance finding's description or display value contains a
+// filename that also appears in a static analysis finding, the static finding is
+// added as a related_finding on the Lighthouse entry.
+// Note: full coverage requires the Lighthouse parser to extract resource URLs
+// from audit detail items — the current parser only surfaces displayValue, so
+// matches depend on whether filenames appear there.
+function applyRule2(lhFindings, staticFindings) {
+    if (staticFindings.length === 0)
+        return lhFindings;
+    return lhFindings.map((lhF) => {
+        const auditId = String(lhF.evidence["audit_id"] ?? "");
+        if (!PERFORMANCE_AUDIT_IDS.has(auditId))
+            return lhF;
+        const haystack = `${lhF.description} ${String(lhF.evidence["value"] ?? "")}`.toLowerCase();
+        const related = staticFindings
+            .filter((sf) => {
+            const basename = String(sf.evidence["file"] ?? "").split("/").pop() ?? "";
+            return basename.length > 3 && haystack.includes(basename.toLowerCase());
+        })
+            .map((sf) => sf.id);
+        return related.length > 0 ? { ...lhF, related_findings: related } : lhF;
+    });
+}
+export function correlate(reports) {
+    const lhTagged = tag("lighthouse", reports.lighthouse?.findings ?? []);
+    const a11yTagged = tag("a11y", reports.a11y?.findings ?? []);
+    const staticTagged = tag("static", reports.static?.findings ?? []);
+    const { correlated, consumedLhIds, consumedA11yIds } = applyRule1(lhTagged, a11yTagged);
+    const remainingLh = applyRule2(lhTagged.filter((f) => !consumedLhIds.has(f.id)), staticTagged);
+    const remainingA11y = a11yTagged.filter((f) => !consumedA11yIds.has(f.id));
+    return {
+        correlated_findings: correlated,
+        unique_findings: [...remainingLh, ...remainingA11y, ...staticTagged],
+        correlations_count: correlated.length,
+    };
+}
+//# sourceMappingURL=correlator.js.map

package/dist/mappers/correlator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlator.js","sourceRoot":"","sources":["../../src/mappers/correlator.ts"],"names":[],"mappings":"AA+BA,MAAM,cAAc,GAA6B,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAEzE,SAAS,eAAe,CAAC,CAAW;IAClC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;AACxE,MAAM,sBAAsB,GAA6B;IACvD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;IAC5C,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC;IACrE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;IAChC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;IAClC,eAAe,EAAE,CAAC,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,MAAM,CAAC;IACvB,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB;IACnB,kBAAkB;IAClB,aAAa;IACb,2BAA2B;IAC3B,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,IAAY,EAAE,CAAU;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrB,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,MAAM,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,UAAU,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,QAAmB;IAC5C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,2CAA2C;AAC3C,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,SAAS,UAAU,CACjB,UAA+B,EAC/B,YAAiC;IAMjC,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAE5D,2EAA2E;YAC3E,yCAAyC;YACzC,MAAM,YAAY,GAChB,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC5D,CAAC,CAAC,GAAG,CAAC,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YAErB,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,gBAAgB,OAAO,EAAE;gBAC7B,WAAW,EAAE,kBAAkB;gBAC/B,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC;gBACvC,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EACT,gBAAgB,GAAG,CAAC,WAAW,GAAG;oBAClC,WAAW,KAAK,CAAC,WAAW,GAAG;oBAC/B,6DAA6D;oBAC7D,kGAAkG;gBACpG,QAAQ,EAAE;oBACR,GAAG,GAAG,CAAC,QAAQ;oBACf,eAAe,EAAE,QAAQ;oBACzB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE;iBACjD;gBACD,YAAY,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;aACtC,CAAC,CAAC;YAEH,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,yCAAyC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AACxD,CAAC;AAED,uCAAuC;AACvC,gFAAgF;AAChF,iFAAiF;AACjF,sDAAsD;AACtD,8EAA8E;AAC9E,8EAA8E;AAC9E,oDAAoD;AACpD,SAAS,UAAU,CACjB,UAA+B,EAC/B,cAAmC;IAEnC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,CAAC;QAEpD,MAAM,QAAQ,GACZ,GAAG,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAE5E,MAAM,OAAO,GAAG,cAAc;aAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YACb,MAAM,QAAQ,GACZ,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAEnE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,UAAU,CAC/D,QAAQ,EACR,UAAU,CACX,CAAC;IAEF,MAAM,WAAW,GAAG,UAAU,CAC5B,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAChD,YAAY,CACb,CAAC;IACF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,mBAAmB,EAAE,UAAU;QAC/B,eAAe,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACpE,kBAAkB,EAAE,UAAU,CAAC,MAAM;KACtC,CAAC;AACJ,CAAC"}

package/dist/mappers/defectFormatter.d.ts

@@ -0,0 +1,15 @@
+import type { LighthouseAuditRef, Pa11yViolation } from "../utils/outputParsers.js";
+import type { Finding } from "../types.js";
+export declare function formatLighthouseFinding(audit: LighthouseAuditRef): Finding | null;
+export interface StaticAnalysisIssue {
+    source: "eslint" | "semgrep";
+    file: string;
+    line: number;
+    column?: number;
+    ruleId: string;
+    message: string;
+    severity: number | string;
+    category?: string;
+}
+export declare function formatStaticAnalysisFinding(issue: StaticAnalysisIssue): Finding | null;
+export declare function formatA11yFinding(violation: Pa11yViolation): Finding | null;