peaks-loop 4.0.54 → 4.1.1

package/dist/services/test-cache/test-cache-service.js

@@ -51,7 +51,8 @@ export function readTestCache(projectRoot, filePath) {
         const parsed = JSON.parse(raw);
         return parsed;
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }
@@ -100,7 +101,10 @@ export function isCacheable(projectRoot, filePath, testName) {
     if (!record)
         return { hit: false, reason: 'no-cache' };
     if (record.status !== 'passed') {
-        return { hit: false, reason: record.status === 'failed' ? 'previous-failed' : 'previous-skipped' };
+        return {
+            hit: false,
+            reason: record.status === 'failed' ? 'previous-failed' : 'previous-skipped'
+        };
     }
     return { hit: true, cached: record };
 }
@@ -148,7 +152,8 @@ export function detectTestFramework(projectRoot) {
     try {
         pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
     const all = {

package/dist/services/verdict/envelope-parsers.d.ts

@@ -0,0 +1,84 @@
+/**
+ * peaks-loop v2.13.3 — Envelope parsers (split from `envelopes.ts`).
+ *
+ * `envelopes.ts` exceeded the 300-raw-line file-size cap, so the
+ * finding-free parser mass — the `AnyEnvelope` discriminated-union
+ * projection, the security / perf / karpathy markdown parsers, the
+ * `AnyEnvelope → AggregatorInput` adapter, and the two markdown
+ * section / bullet readers — moved here verbatim. The finding-carrying
+ * helpers (`parseAuditMarkdown`, `parseKarpathyViolations`, `matchEnum`,
+ * `parseFindingBullet`) stay in `envelopes.ts`, which re-exports every
+ * name below so `./envelopes.js` stays the public import path.
+ *
+ * Cycle note: `envelopes.ts` and this file import each other. That is
+ * safe under `module: NodeNext` + `"type": "module"` because every
+ * cross-boundary reference is a hoisted function declaration (resolved
+ * at call time) or an erased `type` — neither module reads a value from
+ * the other at evaluation time.
+ */
+import { type PerfAuditEnvelope, type SecurityAuditEnvelope } from '../audit-independent/index.js';
+import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
+/**
+ * `kind` is the discriminator. The on-disk file format is unchanged;
+ * this field exists only in the TS type projection. The aggregator
+ * accepts both the legacy `{security, perf, ...}` shape and the new
+ * union via a thin adapter (`aggregateFromEnvelopes`).
+ */
+export type AnyEnvelope = {
+    kind: 'security';
+    envelope: SecurityAuditEnvelope;
+} | {
+    kind: 'perf';
+    envelope: PerfAuditEnvelope;
+} | {
+    kind: 'karpathy';
+    envelope: KarpathyEnvelope;
+} | {
+    kind: 'mut';
+    envelope: MutEnvelope;
+} | {
+    kind: 'qa';
+    envelope: QaEnvelope;
+};
+/**
+ * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
+ *
+ * Strategy (per PRD AC-1 mitigation):
+ *   1. Try JSON.parse first (back-compat with prior unit tests + any
+ *      consumer that passes a JSON string explicitly).
+ *   2. Fall back to markdown parse: extract `verdict:` from YAML
+ *      frontmatter, parse `## Findings` bullets in the body, return
+ *      a SecurityAuditEnvelope.
+ *   3. Return null when neither path yields a valid envelope.
+ */
+export declare function parseSecurityEnvelope(md: string): SecurityAuditEnvelope | null;
+export declare function parsePerfEnvelope(md: string): PerfAuditEnvelope | null;
+/**
+ * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
+ * We parse the 3 state lines that drive the aggregator:
+ *   - `gateAction: pass | warn | block`
+ *   - `verdict: pass | warn | block`  (alias for gateAction)
+ *   - `passed: true | false`
+ * Plus the violations list under a `## Violations` heading, where each
+ * bullet begins with `[SEVERITY] file:line — hint` and declares a
+ * guideline tag like `(simplicity-first)`.
+ */
+export declare function parseKarpathyEnvelope(md: string): KarpathyEnvelope | null;
+/**
+ * Convert a partial list of `AnyEnvelope` values to the legacy
+ * `AggregatorInput` shape. `null` envelopes are skipped (a missing
+ * envelope is treated as "audit not run" — same semantics as
+ * `AggregatorInput` without that key).
+ */
+export declare function envelopesToAggregatorInput(list: ReadonlyArray<AnyEnvelope | null>): AggregatorInput;
+/** Extract the body of a `## Heading` section (text up to the next
+ *  `## ` heading or EOF). Returns null when the heading is absent. */
+export declare function extractSection(body: string, heading: string): string | null;
+/** Parse `## Findings` bullets. Accepts the 3 real v2.12.0 shapes. */
+export declare function parseFindingBullets(body: string): Array<{
+    dimension: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MED' | 'LOW';
+    file: string;
+    line: number;
+    hint: string;
+}>;

package/dist/services/verdict/envelope-parsers.js

@@ -0,0 +1,146 @@
+/**
+ * peaks-loop v2.13.3 — Envelope parsers (split from `envelopes.ts`).
+ *
+ * `envelopes.ts` exceeded the 300-raw-line file-size cap, so the
+ * finding-free parser mass — the `AnyEnvelope` discriminated-union
+ * projection, the security / perf / karpathy markdown parsers, the
+ * `AnyEnvelope → AggregatorInput` adapter, and the two markdown
+ * section / bullet readers — moved here verbatim. The finding-carrying
+ * helpers (`parseAuditMarkdown`, `parseKarpathyViolations`, `matchEnum`,
+ * `parseFindingBullet`) stay in `envelopes.ts`, which re-exports every
+ * name below so `./envelopes.js` stays the public import path.
+ *
+ * Cycle note: `envelopes.ts` and this file import each other. That is
+ * safe under `module: NodeNext` + `"type": "module"` because every
+ * cross-boundary reference is a hoisted function declaration (resolved
+ * at call time) or an erased `type` — neither module reads a value from
+ * the other at evaluation time.
+ */
+import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independent/index.js';
+import { matchEnum, parseAuditMarkdown, parseFindingBullet, parseKarpathyViolations } from './envelopes.js';
+// ─── 5 parsers (pure, never throw) ─────────────────────────────────────
+/**
+ * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
+ *
+ * Strategy (per PRD AC-1 mitigation):
+ *   1. Try JSON.parse first (back-compat with prior unit tests + any
+ *      consumer that passes a JSON string explicitly).
+ *   2. Fall back to markdown parse: extract `verdict:` from YAML
+ *      frontmatter, parse `## Findings` bullets in the body, return
+ *      a SecurityAuditEnvelope.
+ *   3. Return null when neither path yields a valid envelope.
+ */
+export function parseSecurityEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    // Path 1: JSON (legacy / back-compat)
+    try {
+        const jsonValue = JSON.parse(md);
+        if (isSecurityAuditEnvelope(jsonValue))
+            return jsonValue;
+    }
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        // not JSON — fall through to markdown parse
+    }
+    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
+    return parseAuditMarkdown(md, isSecurityAuditEnvelope);
+}
+export function parsePerfEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    // Path 1: JSON (legacy / back-compat)
+    try {
+        const jsonValue = JSON.parse(md);
+        if (isPerfAuditEnvelope(jsonValue))
+            return jsonValue;
+    }
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        // not JSON — fall through to markdown parse
+    }
+    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
+    return parseAuditMarkdown(md, isPerfAuditEnvelope);
+}
+/**
+ * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
+ * We parse the 3 state lines that drive the aggregator:
+ *   - `gateAction: pass | warn | block`
+ *   - `verdict: pass | warn | block`  (alias for gateAction)
+ *   - `passed: true | false`
+ * Plus the violations list under a `## Violations` heading, where each
+ * bullet begins with `[SEVERITY] file:line — hint` and declares a
+ * guideline tag like `(simplicity-first)`.
+ */
+export function parseKarpathyEnvelope(md) {
+    if (typeof md !== 'string' || md.length === 0)
+        return null;
+    const gateAction = matchEnum(md, /^\s*(?:gateAction|verdict)\s*:\s*(pass|warn|block)\s*$/m);
+    const passedMatch = md.match(/^\s*passed\s*:\s*(true|false)\s*$/m);
+    if (gateAction === null || passedMatch === null)
+        return null;
+    const violations = parseKarpathyViolations(md);
+    return {
+        passed: passedMatch[1] === 'true',
+        violations,
+        gateAction
+    };
+}
+// ─── Adapter: union → AggregatorInput (zero call-site churn) ──────────
+/**
+ * Convert a partial list of `AnyEnvelope` values to the legacy
+ * `AggregatorInput` shape. `null` envelopes are skipped (a missing
+ * envelope is treated as "audit not run" — same semantics as
+ * `AggregatorInput` without that key).
+ */
+export function envelopesToAggregatorInput(list) {
+    const out = {};
+    for (const item of list) {
+        if (item === null)
+            continue;
+        if (item.kind === 'security')
+            out.security = item.envelope;
+        else if (item.kind === 'perf')
+            out.perf = item.envelope;
+        else if (item.kind === 'karpathy')
+            out.karpathy = item.envelope;
+        else if (item.kind === 'mut')
+            out.mut = item.envelope;
+        else if (item.kind === 'qa')
+            out.qa = item.envelope;
+    }
+    return out;
+}
+/** Extract the body of a `## Heading` section (text up to the next
+ *  `## ` heading or EOF). Returns null when the heading is absent. */
+export function extractSection(body, heading) {
+    const re = new RegExp(`^##\\s+${heading}\\s*$`, 'm');
+    const sectionStart = body.search(re);
+    if (sectionStart === -1)
+        return null;
+    const afterHeading = body.slice(sectionStart).split('\n');
+    // skip the heading line
+    afterHeading.shift();
+    // collect lines until next `## ` heading
+    const lines = [];
+    for (const line of afterHeading) {
+        if (/^##\s+/.test(line))
+            break;
+        lines.push(line);
+    }
+    return lines.join('\n').trim();
+}
+/** Parse `## Findings` bullets. Accepts the 3 real v2.12.0 shapes. */
+export function parseFindingBullets(body) {
+    const section = body.split(/^##\s+Findings\s*$/m)[1];
+    if (section === undefined)
+        return [];
+    const lines = section.split('\n').filter((l) => l.trim().startsWith('- '));
+    const out = [];
+    for (const line of lines) {
+        const v = parseFindingBullet(line);
+        if (v !== null)
+            out.push(v);
+    }
+    return out;
+}

package/dist/services/verdict/envelopes.d.ts

@@ -15,62 +15,18 @@
  * passed JSON explicitly) and adds a markdown fallback that extracts
  * `verdict:` from the frontmatter and parses `## Findings` bullets.
  *
- * Karpathy §2 (Simplicity First):
- *   - single file, ~210 lines, zero new IO.
- *   - re-uses existing strict-shape guards (isSecurityAuditEnvelope /
- *     isPerfAuditEnvelope) — no duplicate validation logic.
- *   - parsers return `null` on malformed input (mirrors loadMutReport's
- *     "missing → null" contract). Callers can detect "envelope missing"
- *     without throwing.
+ * Wave 5 file-size split: the `AnyEnvelope` projection, the security /
+ * perf / karpathy parsers, the adapter and the section / bullet readers
+ * moved verbatim to `./envelope-parsers.js` (re-exported below so
+ * `./envelopes.js` stays the public path). The finding-carrying
+ * markdown helpers stay here. The parent ↔ sibling cycle is safe under
+ * `module: NodeNext` + `"type": "module"` (hoisted function
+ * declarations + erased types, all resolved at call time).
  */
-import { type PerfAuditEnvelope, type SecurityAuditEnvelope } from '../audit-independent/index.js';
-import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
-/**
- * `kind` is the discriminator. The on-disk file format is unchanged;
- * this field exists only in the TS type projection. The aggregator
- * accepts both the legacy `{security, perf, ...}` shape and the new
- * union via a thin adapter (`aggregateFromEnvelopes`).
- */
-export type AnyEnvelope = {
-    kind: 'security';
-    envelope: SecurityAuditEnvelope;
-} | {
-    kind: 'perf';
-    envelope: PerfAuditEnvelope;
-} | {
-    kind: 'karpathy';
-    envelope: KarpathyEnvelope;
-} | {
-    kind: 'mut';
-    envelope: MutEnvelope;
-} | {
-    kind: 'qa';
-    envelope: QaEnvelope;
-};
-/**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
- *
- * Strategy (per PRD AC-1 mitigation):
- *   1. Try JSON.parse first (back-compat with prior unit tests + any
- *      consumer that passes a JSON string explicitly).
- *   2. Fall back to markdown parse: extract `verdict:` from YAML
- *      frontmatter, parse `## Findings` bullets in the body, return
- *      a SecurityAuditEnvelope.
- *   3. Return null when neither path yields a valid envelope.
- */
-export declare function parseSecurityEnvelope(md: string): SecurityAuditEnvelope | null;
-export declare function parsePerfEnvelope(md: string): PerfAuditEnvelope | null;
-/**
- * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
- * We parse the 3 state lines that drive the aggregator:
- *   - `gateAction: pass | warn | block`
- *   - `verdict: pass | warn | block`  (alias for gateAction)
- *   - `passed: true | false`
- * Plus the violations list under a `## Violations` heading, where each
- * bullet begins with `[SEVERITY] file:line — hint` and declares a
- * guideline tag like `(simplicity-first)`.
- */
-export declare function parseKarpathyEnvelope(md: string): KarpathyEnvelope | null;
+import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope } from './verdict-aggregator.js';
+export { envelopesToAggregatorInput, parseKarpathyEnvelope, parsePerfEnvelope, parseSecurityEnvelope } from './envelope-parsers.js';
+export type { AnyEnvelope } from './envelope-parsers.js';
+export declare function parseKarpathyViolations(md: string): KarpathyEnvelope['violations'];
 /**
  * Mut envelope is JSON. Mirrors `loadMutReport`'s contract: missing
  * fields → null. The strict shape matches `MutReportJson` in
@@ -83,10 +39,44 @@ export declare function parseMutEnvelope(json: unknown): MutEnvelope | null;
  * optionally carries a `reportPath:` line. Anything else → null.
  */
 export declare function parseQaEnvelope(md: string): QaEnvelope | null;
+type AuditEnvelopeGuard<T> = (v: unknown) => v is T;
 /**
- * Convert a partial list of `AnyEnvelope` values to the legacy
- * `AggregatorInput` shape. `null` envelopes are skipped (a missing
- * envelope is treated as "audit not run" — same semantics as
- * `AggregatorInput` without that key).
+ * Parse a v2.12.0 audit markdown file:
+ *   ---
+ *   schemaVersion: 1
+ *   verdict: warn
+ *   violationsCount: 1
+ *   ---
+ *   ## Summary
+ *   Test security envelope for dogfood.
+ *
+ *   ## Findings
+ *   - HIGH: hardcoded password in src/auth.ts:42
+ *
+ *   ## Verdict
+ *   verdict: warn
+ *   CRITICAL: 0
+ *
+ * Strategy:
+ *   1. Strip YAML frontmatter (`---\n...\n---\n`). The frontmatter
+ *      `verdict:` line is the source of truth — the body's `## Verdict`
+ *      block is corroborating.
+ *   2. Pull `verdict` from frontmatter (regex, line-anchored).
+ *   3. Parse `## Findings` bullets — accept 3 real v2.12.0 shapes:
+ *        a. `- [SEV] dim @ file:line — hint` (rendered by renderSecurityAuditArtifact)
+ *        b. `- HIGH: hint in file:line` (real dogfood fixture shape)
+ *        c. `- (none)` — empty
+ *   4. Build a candidate envelope and run through the strict-shape
+ *      guard. Return null if the guard rejects (per the parser
+ *      contract: parsers never throw).
  */
-export declare function envelopesToAggregatorInput(list: ReadonlyArray<AnyEnvelope | null>): AggregatorInput;
+export declare function parseAuditMarkdown<T>(md: string, guard: AuditEnvelopeGuard<T>): T | null;
+/** Parse a single finding bullet. Returns null on malformed input. */
+export declare function parseFindingBullet(line: string): {
+    dimension: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MED' | 'LOW';
+    file: string;
+    line: number;
+    hint: string;
+} | null;
+export declare function matchEnum(md: string, regex: RegExp): string | null;

package/dist/services/verdict/envelopes.js

@@ -1,95 +1,7 @@
-/**
- * peaks-loop v2.13.3 — Envelope unification (AC-1: real markdown parse).
- *
- * The 5 input envelopes feeding `aggregateVerdict()` have always been
- * heterogeneous (peaks-security-audit / peaks-perf-audit / karpathy /
- * peaks-mut / peaks-qa). v2.13.1 shipped precedence wiring without
- * touching the on-disk shapes. v2.13.2 introduced a discriminated-union
- * type projection `AnyEnvelope` and 5 pure parser functions.
- *
- * v2.13.3 dogfood bug #1: parseSecurity/Perf previously only supported
- * a JSON.parse path. The real v2.12.0 audit files at
- * `.peaks/_runtime/<sid>/audit/security.md` and `audit/perf.md` are
- * YAML frontmatter + markdown body — NOT JSON. The fix preserves
- * the JSON.parse path (back-compat for unit tests + any consumer that
- * passed JSON explicitly) and adds a markdown fallback that extracts
- * `verdict:` from the frontmatter and parses `## Findings` bullets.
- *
- * Karpathy §2 (Simplicity First):
- *   - single file, ~210 lines, zero new IO.
- *   - re-uses existing strict-shape guards (isSecurityAuditEnvelope /
- *     isPerfAuditEnvelope) — no duplicate validation logic.
- *   - parsers return `null` on malformed input (mirrors loadMutReport's
- *     "missing → null" contract). Callers can detect "envelope missing"
- *     without throwing.
- */
-import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independent/index.js';
-// ─── 5 parsers (pure, never throw) ─────────────────────────────────────
-/**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
- *
- * Strategy (per PRD AC-1 mitigation):
- *   1. Try JSON.parse first (back-compat with prior unit tests + any
- *      consumer that passes a JSON string explicitly).
- *   2. Fall back to markdown parse: extract `verdict:` from YAML
- *      frontmatter, parse `## Findings` bullets in the body, return
- *      a SecurityAuditEnvelope.
- *   3. Return null when neither path yields a valid envelope.
- */
-export function parseSecurityEnvelope(md) {
-    if (typeof md !== 'string' || md.length === 0)
-        return null;
-    // Path 1: JSON (legacy / back-compat)
-    try {
-        const jsonValue = JSON.parse(md);
-        if (isSecurityAuditEnvelope(jsonValue))
-            return jsonValue;
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        // not JSON — fall through to markdown parse
-    }
-    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
-    return parseAuditMarkdown(md, isSecurityAuditEnvelope);
-}
-export function parsePerfEnvelope(md) {
-    if (typeof md !== 'string' || md.length === 0)
-        return null;
-    // Path 1: JSON (legacy / back-compat)
-    try {
-        const jsonValue = JSON.parse(md);
-        if (isPerfAuditEnvelope(jsonValue))
-            return jsonValue;
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        // not JSON — fall through to markdown parse
-    }
-    // Path 2: real v2.12.0 markdown (YAML frontmatter + body)
-    return parseAuditMarkdown(md, isPerfAuditEnvelope);
-}
-/**
- * Karpathy review is stored as markdown (`.peaks/_runtime/<sid>/rd/karpathy-review.md`).
- * We parse the 3 state lines that drive the aggregator:
- *   - `gateAction: pass | warn | block`
- *   - `verdict: pass | warn | block`  (alias for gateAction)
- *   - `passed: true | false`
- * Plus the violations list under a `## Violations` heading, where each
- * bullet begins with `[SEVERITY] file:line — hint` and declares a
- * guideline tag like `(simplicity-first)`.
- */
-export function parseKarpathyEnvelope(md) {
-    if (typeof md !== 'string' || md.length === 0)
-        return null;
-    const gateAction = matchEnum(md, /^\s*(?:gateAction|verdict)\s*:\s*(pass|warn|block)\s*$/m);
-    const passedMatch = md.match(/^\s*passed\s*:\s*(true|false)\s*$/m);
-    if (gateAction === null || passedMatch === null)
-        return null;
-    const violations = parseKarpathyViolations(md);
-    return {
-        passed: passedMatch[1] === 'true',
-        violations,
-        gateAction
-    };
-}
+import { extractSection, parseFindingBullets } from './envelope-parsers.js';
+// ─── Re-exports: parsers that live in ./envelope-parsers.js ───────────
+export { envelopesToAggregatorInput, parseKarpathyEnvelope, parsePerfEnvelope, parseSecurityEnvelope } from './envelope-parsers.js';
+// ─── Karpathy violation reader (called by parseKarpathyEnvelope) ───────
 const KARPATHY_GUIDELINES = [
     'think-before-coding',
     'simplicity-first',
@@ -97,7 +9,7 @@ const KARPATHY_GUIDELINES = [
     'goal-driven-execution'
 ];
 const KARPATHY_SEVERITIES = ['CRITICAL', 'HIGH', 'MED', 'LOW'];
-function parseKarpathyViolations(md) {
+export function parseKarpathyViolations(md) {
     const section = md.split(/^##\s+Violations\s*$/m)[1];
     if (section === undefined)
         return [];
@@ -108,7 +20,11 @@ function parseKarpathyViolations(md) {
         if (m === null)
             continue;
         const [, severity, file, lineNo, hint, guideline] = m;
-        if (severity === undefined || file === undefined || lineNo === undefined || hint === undefined || guideline === undefined)
+        if (severity === undefined ||
+            file === undefined ||
+            lineNo === undefined ||
+            hint === undefined ||
+            guideline === undefined)
             continue;
         if (!KARPATHY_SEVERITIES.includes(severity))
             continue;
@@ -180,31 +96,6 @@ export function parseQaEnvelope(md) {
         ...(reportPathMatch !== null ? { reportPath: reportPathMatch[1].trim() } : {})
     };
 }
-// ─── Adapter: union → AggregatorInput (zero call-site churn) ──────────
-/**
- * Convert a partial list of `AnyEnvelope` values to the legacy
- * `AggregatorInput` shape. `null` envelopes are skipped (a missing
- * envelope is treated as "audit not run" — same semantics as
- * `AggregatorInput` without that key).
- */
-export function envelopesToAggregatorInput(list) {
-    const out = {};
-    for (const item of list) {
-        if (item === null)
-            continue;
-        if (item.kind === 'security')
-            out.security = item.envelope;
-        else if (item.kind === 'perf')
-            out.perf = item.envelope;
-        else if (item.kind === 'karpathy')
-            out.karpathy = item.envelope;
-        else if (item.kind === 'mut')
-            out.mut = item.envelope;
-        else if (item.kind === 'qa')
-            out.qa = item.envelope;
-    }
-    return out;
-}
 /**
  * Parse a v2.12.0 audit markdown file:
  *   ---
@@ -235,7 +126,7 @@ export function envelopesToAggregatorInput(list) {
  *      guard. Return null if the guard rejects (per the parser
  *      contract: parsers never throw).
  */
-function parseAuditMarkdown(md, guard) {
+export function parseAuditMarkdown(md, guard) {
     const frontmatterMatch = md.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
     // The v2.12.0 audit artifact contract is YAML frontmatter + body.
     // The CLI also writes a body-only variant (no frontmatter) when the
@@ -270,46 +161,17 @@ function parseAuditMarkdown(md, guard) {
     };
     return guard(candidate) ? candidate : null;
 }
-/** Extract the body of a `## Heading` section (text up to the next
- *  `## ` heading or EOF). Returns null when the heading is absent. */
-function extractSection(body, heading) {
-    const re = new RegExp(`^##\\s+${heading}\\s*$`, 'm');
-    const sectionStart = body.search(re);
-    if (sectionStart === -1)
-        return null;
-    const afterHeading = body.slice(sectionStart).split('\n');
-    // skip the heading line
-    afterHeading.shift();
-    // collect lines until next `## ` heading
-    const lines = [];
-    for (const line of afterHeading) {
-        if (/^##\s+/.test(line))
-            break;
-        lines.push(line);
-    }
-    return lines.join('\n').trim();
-}
-/** Parse `## Findings` bullets. Accepts the 3 real v2.12.0 shapes. */
-function parseFindingBullets(body) {
-    const section = body.split(/^##\s+Findings\s*$/m)[1];
-    if (section === undefined)
-        return [];
-    const lines = section.split('\n').filter((l) => l.trim().startsWith('- '));
-    const out = [];
-    for (const line of lines) {
-        const v = parseFindingBullet(line);
-        if (v !== null)
-            out.push(v);
-    }
-    return out;
-}
 /** Parse a single finding bullet. Returns null on malformed input. */
-function parseFindingBullet(line) {
+export function parseFindingBullet(line) {
     // Shape A (rendered by renderSecurityAuditArtifact): `- [SEV] dim @ file:line — hint`
     const a = line.match(/^\s*-\s*\[(CRITICAL|HIGH|MED|LOW)\]\s+(\S+)\s+@\s+([^:\s]+):(\d+)\s+[—-]\s+(.+)$/);
     if (a !== null) {
         const [, severity, dimension, file, lineNo, hint] = a;
-        if (severity === undefined || dimension === undefined || file === undefined || lineNo === undefined || hint === undefined)
+        if (severity === undefined ||
+            dimension === undefined ||
+            file === undefined ||
+            lineNo === undefined ||
+            hint === undefined)
             return null;
         return {
             severity: severity,
@@ -342,7 +204,7 @@ function parseFindingBullet(line) {
     // future dimension-extraction contract. Already covered above.
     return null;
 }
-function matchEnum(md, regex) {
+export function matchEnum(md, regex) {
     const m = md.match(regex);
     return m === null ? null : m[1];
 }

package/dist/services/verdict/verdict-aggregator.js

@@ -49,7 +49,15 @@ export function aggregateVerdict(input) {
         const env = input.security;
         elevate(env.verdict);
         for (const v of env.violations) {
-            pushFix(state, { source: 'security-audit', sources: ['security-audit'], signal: env.verdict, severity: v.severity, file: v.file, line: v.line, hint: v.hint }, { file: v.file, line: v.line, hint: v.hint });
+            pushFix(state, {
+                source: 'security-audit',
+                sources: ['security-audit'],
+                signal: env.verdict,
+                severity: v.severity,
+                file: v.file,
+                line: v.line,
+                hint: v.hint
+            }, { file: v.file, line: v.line, hint: v.hint });
         }
     }
     // 2. Perf audit envelope (v2.12.0 schema — preserved).
@@ -57,7 +65,15 @@ export function aggregateVerdict(input) {
         const env = input.perf;
         elevate(env.verdict);
         for (const v of env.violations) {
-            pushFix(state, { source: 'perf-audit', sources: ['perf-audit'], signal: env.verdict, severity: v.severity, file: v.file, line: v.line, hint: v.hint }, { file: v.file, line: v.line, hint: v.hint });
+            pushFix(state, {
+                source: 'perf-audit',
+                sources: ['perf-audit'],
+                signal: env.verdict,
+                severity: v.severity,
+                file: v.file,
+                line: v.line,
+                hint: v.hint
+            }, { file: v.file, line: v.line, hint: v.hint });
         }
     }
     // 3. Karpathy reviewer — gateAction drives precedence.
@@ -65,7 +81,15 @@ export function aggregateVerdict(input) {
         const env = input.karpathy;
         elevate(env.gateAction);
         for (const v of env.violations) {
-            pushFix(state, { source: 'karpathy-reviewer', sources: ['karpathy-reviewer'], signal: env.gateAction, severity: v.severity, file: v.file, line: v.line, hint: v.hint }, { file: v.file, line: v.line, hint: v.hint });
+            pushFix(state, {
+                source: 'karpathy-reviewer',
+                sources: ['karpathy-reviewer'],
+                signal: env.gateAction,
+                severity: v.severity,
+                file: v.file,
+                line: v.line,
+                hint: v.hint
+            }, { file: v.file, line: v.line, hint: v.hint });
         }
     }
     // 4. peaks-mut — passed:false → block with per-violation reason.