redlinegate 0.0.1

package/dist/review/engines/api.js

@@ -0,0 +1,95 @@
+import { RedlineError } from "../../core/errors.js";
+// The api engine: the CLI calls a configured endpoint itself.
+//
+// Two dialects, per the v3 design. OpenAI-compatible is the important one — it
+// covers the fully local case at no cost, because Ollama, LM Studio and vLLM all
+// expose it, and a review that has to send a diff to a third party is a review
+// several of this organisation's markets cannot run at all.
+//
+// The endpoint is configured, never assumed, and the key comes from the
+// environment. A model name baked into the tool is a model nobody can change when
+// it is deprecated or when a market's regulator objects to it.
+const DEFAULTS = {
+    openai: { baseUrl: 'http://localhost:11434/v1', apiKeyEnv: 'OPENAI_API_KEY' },
+    anthropic: { baseUrl: 'https://api.anthropic.com/v1', apiKeyEnv: 'ANTHROPIC_API_KEY' },
+};
+export function createApiEngine(config, deps = {}) {
+    const doFetch = deps.fetch ?? ((url, init) => fetch(url, init));
+    const env = deps.env ?? process.env;
+    const defaults = DEFAULTS[config.provider];
+    if (!defaults) {
+        throw new RedlineError('usage', `unknown review provider "${config.provider}" — use "openai" (any OpenAI-compatible endpoint, including a local one) or "anthropic"`);
+    }
+    const baseUrl = (config.baseUrl ?? defaults.baseUrl).replace(/\/+$/, '');
+    const keyEnv = config.apiKeyEnv ?? defaults.apiKeyEnv;
+    return {
+        name: `api:${config.provider}`,
+        async review(request) {
+            const key = env[keyEnv];
+            // A local endpoint legitimately needs no key. A remote one that silently
+            // sent an unauthenticated request would fail confusingly at the far end.
+            const local = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])/.test(baseUrl);
+            if (!key && !local) {
+                throw new RedlineError('permission', `no API key: set ${keyEnv}`, `or point --engine at a local endpoint, which needs none`);
+            }
+            const { url, init, extract } = config.provider === 'anthropic'
+                ? anthropic(baseUrl, config.model, key, request)
+                : openai(baseUrl, config.model, key, request);
+            let response;
+            try {
+                response = await doFetch(url, init);
+            }
+            catch (error) {
+                throw new RedlineError('host', `could not reach the review endpoint at ${baseUrl}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (!response.ok) {
+                throw new RedlineError('host', `the review endpoint returned ${response.status}`);
+            }
+            return { kind: 'output', raw: extract(await response.json()) };
+        },
+    };
+}
+function openai(baseUrl, model, key, request) {
+    return {
+        url: `${baseUrl}/chat/completions`,
+        init: {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                ...(key ? { authorization: `Bearer ${key}` } : {}),
+            },
+            body: JSON.stringify({
+                model,
+                // Zero: a review is not a creative task, and two runs over the same diff
+                // disagreeing is how a team learns to disregard it.
+                temperature: 0,
+                messages: [{ role: 'user', content: request.prompt }],
+            }),
+        },
+        extract: (body) => body?.choices?.[0]?.message?.content ?? '',
+    };
+}
+function anthropic(baseUrl, model, key, request) {
+    return {
+        url: `${baseUrl}/messages`,
+        init: {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'anthropic-version': '2023-06-01',
+                ...(key ? { 'x-api-key': key } : {}),
+            },
+            body: JSON.stringify({
+                model,
+                max_tokens: 4096,
+                temperature: 0,
+                messages: [{ role: 'user', content: request.prompt }],
+            }),
+        },
+        extract: (body) => (body?.content ?? [])
+            .filter((block) => block.type === 'text')
+            .map((block) => block.text ?? '')
+            .join(''),
+    };
+}
+//# sourceMappingURL=api.js.map

package/dist/review/engines/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../cli/review/engines/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,8DAA8D;AAC9D,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,kFAAkF;AAClF,+DAA+D;AAE/D,MAAM,QAAQ,GAA6E;IACzF,MAAM,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,gBAAgB,EAAE;IAC7E,SAAS,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,mBAAmB,EAAE;CACvF,CAAC;AAIF,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,OAAuD,EAAE;IAEzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,4BAA4B,MAAM,CAAC,QAAQ,yFAAyF,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;IAEtD,OAAO;QACL,IAAI,EAAE,OAAO,MAAM,CAAC,QAAQ,EAAE;QAC9B,KAAK,CAAC,MAAM,CAAC,OAAsB;YACjC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YACxB,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3E,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,mBAAmB,MAAM,EAAE,EAC3B,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAC1B,MAAM,CAAC,QAAQ,KAAK,WAAW;gBAC7B,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;gBAChD,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAElD,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,0CAA0C,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa,EAAE,GAAuB,EAAE,OAAsB;IAC7F,OAAO;QACL,GAAG,EAAE,GAAG,OAAO,mBAAmB;QAClC,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,yEAAyE;gBACzE,oDAAoD;gBACpD,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACtD,CAAC;SACmB;QACvB,OAAO,EAAE,CAAC,IAAa,EAAU,EAAE,CAChC,IAA2D,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;KACrG,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa,EAAE,GAAuB,EAAE,OAAsB;IAChG,OAAO;QACL,GAAG,EAAE,GAAG,OAAO,WAAW;QAC1B,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,mBAAmB,EAAE,YAAY;gBACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACtD,CAAC;SACmB;QACvB,OAAO,EAAE,CAAC,IAAa,EAAU,EAAE,CACjC,CAAE,IAAyD,EAAE,OAAO,IAAI,EAAE,CAAC;aACxE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;aACxC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aAChC,IAAI,CAAC,EAAE,CAAC;KACd,CAAC;AACJ,CAAC"}

package/dist/review/engines/embedded.js

@@ -0,0 +1,20 @@
+// The embedded engine: the assistant already running this command applies the
+// prompt itself.
+//
+// It returns the prompt rather than a review, and says so. That is not a stub —
+// it is the whole design for the case where the CLI is being run BY an assistant
+// (Claude Code, Copilot, Cursor), which already has a model and a context. Making
+// the CLI call a second model from inside the first one's session would pay twice
+// for a worse answer.
+export const embedded = {
+    name: 'embedded',
+    async review(request) {
+        return {
+            kind: 'prompt',
+            prompt: request.prompt,
+            note: 'embedded engine: apply the prompt above and return the JSON it asks for. ' +
+                'Run `redline review --engine api` to have the CLI call a model itself.',
+        };
+    },
+};
+//# sourceMappingURL=embedded.js.map

package/dist/review/engines/embedded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../cli/review/engines/embedded.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,sBAAsB;AACtB,MAAM,CAAC,MAAM,QAAQ,GAAiB;IACpC,IAAI,EAAE,UAAU;IAChB,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EACF,2EAA2E;gBAC3E,wEAAwE;SAC3E,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/review/engines/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/review/engines/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../cli/review/engines/types.ts"],"names":[],"mappings":""}

package/dist/review/glob.js

@@ -0,0 +1,29 @@
+// The subset of glob syntax the standards actually use, matched without a
+// dependency.
+//
+// `scripts/validate.mjs` already refuses a glob this cannot express: negation,
+// brace expansion and commas are rejected at build time because Copilot's
+// `applyTo` cannot express them either. So the grammar here is exactly `**`, `*`
+// and `?`, and anything else in a manifest is a build failure rather than a
+// silent mismatch at review time.
+export function minimatch(path, glob) {
+    const pattern = glob
+        .split('')
+        .reduce((acc, _c, i, chars) => {
+        if (i < acc.i)
+            return acc;
+        const rest = chars.slice(i).join('');
+        if (rest.startsWith('**/'))
+            return { out: `${acc.out}(?:.*/)?`, i: i + 3 };
+        if (rest.startsWith('**'))
+            return { out: `${acc.out}.*`, i: i + 2 };
+        const c = chars[i];
+        if (c === '*')
+            return { out: `${acc.out}[^/]*`, i: i + 1 };
+        if (c === '?')
+            return { out: `${acc.out}[^/]`, i: i + 1 };
+        return { out: acc.out + c.replace(/[.+^${}()|[\]\\]/g, '\\$&'), i: i + 1 };
+    }, { out: '', i: 0 }).out;
+    return new RegExp(`^${pattern}$`).test(path);
+}
+//# sourceMappingURL=glob.js.map

package/dist/review/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../cli/review/glob.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,cAAc;AACd,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,iFAAiF;AACjF,4EAA4E;AAC5E,kCAAkC;AAClC,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,EAAE,CAAC;SACT,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC,EACD,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAClB,CAAC,GAAG,CAAC;IAER,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/review/prompt.js

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCHEMA_DESCRIPTION } from "./schema.js";
+const read = (root, relPath) => readFileSync(join(root, relPath), 'utf8').trimEnd();
+export function buildPrompt(opts) {
+    const { manifest, scope } = opts;
+    const sections = [
+        read(opts.root, manifest.core.source),
+        ...scope.stacks.map((id) => read(opts.root, manifest.stacks[id].source)),
+    ];
+    return [
+        'You are reviewing a change against this organisation\'s engineering standard.',
+        '',
+        `Profile: ${scope.profile}. Applicable stacks: ${scope.stacks.join(', ') || 'core only'}.`,
+        'These are the ONLY rules in scope. Do not apply a rule that is not written below,',
+        'and do not cite a rule id that does not appear below — a finding you cannot point at',
+        'a rule for is not a finding.',
+        '',
+        '--- RULES ---',
+        '',
+        ...sections,
+        '',
+        '--- THE CHANGE ---',
+        '',
+        '```diff',
+        opts.diff,
+        '```',
+        '',
+        '--- WHAT TO RETURN ---',
+        '',
+        'Return JSON and nothing else, against this schema:',
+        '',
+        SCHEMA_DESCRIPTION,
+        '',
+        'Rules for what you return:',
+        '- Only lines this change ADDED. An existing pattern the change merely touches is',
+        '  explicitly out of scope — see "What NOT to flag" in the rules above.',
+        '- One finding per problem. If the same rule is broken in several places, report the',
+        '  first and say "and N similar" in the problem.',
+        '- If you cannot describe the input that breaks it, it is not a finding. Return fewer.',
+        '- If nothing qualifies, return {"findings": []}. An empty review is a valid review and',
+        '  is a better answer than a manufactured one.',
+    ].join('\n');
+}
+//# sourceMappingURL=prompt.js.map

package/dist/review/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../cli/review/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAgBjD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CACrD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;AAEtD,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG;QACf,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QACrC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,CAAC,CAAC;KAC1E,CAAC;IAEF,OAAO;QACL,+EAA+E;QAC/E,EAAE;QACF,YAAY,KAAK,CAAC,OAAO,wBAAwB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,GAAG;QAC1F,mFAAmF;QACnF,sFAAsF;QACtF,8BAA8B;QAC9B,EAAE;QACF,eAAe;QACf,EAAE;QACF,GAAG,QAAQ;QACX,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,SAAS;QACT,IAAI,CAAC,IAAI;QACT,KAAK;QACL,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,4BAA4B;QAC5B,kFAAkF;QAClF,wEAAwE;QACxE,qFAAqF;QACrF,iDAAiD;QACjD,uFAAuF;QACvF,wFAAwF;QACxF,+CAA+C;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/review/rules.js

@@ -0,0 +1,25 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+// The rule ids in scope, parsed from the same markdown the prompt carries.
+//
+// Parsed from the source rather than taken from a list, so the set the model is
+// validated against is exactly the set it was shown. Two lists would drift, and
+// the drift would appear as a model "inventing" a rule that was in the prompt all
+// along — which is the kind of bug that gets blamed on the model for a year.
+const RULE_ID = /^-\s+`([a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*)`/gm;
+export function loadRuleIds(root, manifest, stacks) {
+    const ids = new Set();
+    const sources = [manifest.core.source, ...stacks.map((id) => manifest.stacks[id].source)];
+    for (const source of sources) {
+        const body = readFileSync(join(root, source), 'utf8');
+        for (const match of body.matchAll(RULE_ID))
+            ids.add(match[1]);
+    }
+    // Reserved by the standard for a real problem no rule covers. It is in the
+    // core markdown as prose rather than as a rule bullet, so the parse above does
+    // not find it, and rejecting it would silence exactly the finding the standard
+    // asks for when the catalogue has a gap.
+    ids.add('core/uncatalogued');
+    return ids;
+}
+//# sourceMappingURL=rules.js.map

package/dist/review/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../cli/review/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,2EAA2E;AAC3E,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,mDAAmD,CAAC;AAEpE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAkB,EAAE,MAAgB;IAC5E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACjE,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/review/schema.js

@@ -0,0 +1,84 @@
+import { isSeverity } from "../core/severity.js";
+export const SCHEMA_DESCRIPTION = `{
+  "findings": [
+    {
+      "rule": "<stack>/<slug>, exactly as written in the rules above",
+      "severity": "BLOCKER" | "HIGH" | "SUGGESTION",
+      "file": "path/as/given/in/the/diff.ts",
+      "line": <line number in the new file>,
+      "problem": "one sentence: what breaks, and the input that breaks it",
+      "fix": "one sentence: the concrete change"
+    }
+  ]
+}`;
+/**
+ * Validate a model's JSON against the schema.
+ *
+ * `knownRules` is the applicable rule set. A finding citing a rule outside it is
+ * rejected — not corrected, not passed through. A model that cites a rule the
+ * prompt did not contain has not applied the standard, it has recalled one, and
+ * the id is what every measurement is keyed on.
+ */
+export function parseReview(raw, knownRules) {
+    const findings = [];
+    const rejected = [];
+    let parsed;
+    try {
+        // A model will wrap JSON in a fence more often than not. Tolerating that is
+        // not the same as tolerating malformed output.
+        const fenced = /```(?:json)?\s*([\s\S]*?)```/.exec(raw);
+        parsed = JSON.parse(fenced?.[1] ?? raw);
+    }
+    catch (error) {
+        return {
+            findings,
+            rejected: [{ raw, reason: `not valid JSON: ${error instanceof Error ? error.message : String(error)}` }],
+        };
+    }
+    const list = parsed?.findings;
+    if (!Array.isArray(list)) {
+        return { findings, rejected: [{ raw: parsed, reason: 'no "findings" array' }] };
+    }
+    for (const item of list) {
+        const f = item;
+        const reject = (reason) => {
+            rejected.push({ raw: item, reason });
+        };
+        if (typeof f['rule'] !== 'string' || !knownRules.has(f['rule'])) {
+            reject(`cites "${String(f['rule'])}", which is not one of the rules this review was given`);
+            continue;
+        }
+        if (!isSeverity(f['severity'])) {
+            reject(`severity "${String(f['severity'])}" is not BLOCKER, HIGH or SUGGESTION`);
+            continue;
+        }
+        if (typeof f['file'] !== 'string' || f['file'] === '') {
+            reject('no file');
+            continue;
+        }
+        const line = typeof f['line'] === 'number' ? f['line'] : Number.parseInt(String(f['line']), 10);
+        if (!Number.isInteger(line) || line < 1) {
+            reject(`line "${String(f['line'])}" is not a line number`);
+            continue;
+        }
+        if (typeof f['problem'] !== 'string' || f['problem'].trim() === '') {
+            reject('no problem statement — a finding nobody can act on is not a finding');
+            continue;
+        }
+        findings.push({
+            rule: f['rule'],
+            severity: f['severity'],
+            file: f['file'],
+            line,
+            problem: f['problem'].trim(),
+            fix: typeof f['fix'] === 'string' ? f['fix'].trim() : '',
+        });
+    }
+    return { findings, rejected };
+}
+/** The output contract. Rendered here and nowhere else. */
+export function renderFinding(finding) {
+    const body = finding.fix ? `${finding.problem} ${finding.fix}` : finding.problem;
+    return `Redline/${finding.severity} [${finding.rule}]: ${body}`;
+}
+//# sourceMappingURL=schema.js.map

package/dist/review/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../cli/review/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,qBAAqB,CAAC;AA2BhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;EAWhC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,UAAuB;IAC9D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAE9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,4EAA4E;QAC5E,+CAA+C;QAC/C,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAI,MAAiC,EAAE,QAAQ,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,sCAAsC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,CAAC,SAAS,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACnE,MAAM,CAAC,qEAAqE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;YAC5B,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACjF,OAAO,WAAW,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/review/scope.js

@@ -0,0 +1,27 @@
+import { minimatch } from "./glob.js";
+import { resolveProfile } from "../render/profile.js";
+export function resolveScope(manifest, profile, files) {
+    const resolved = resolveProfile(manifest, profile);
+    const matched = new Set();
+    const uncovered = [];
+    for (const file of files) {
+        let any = false;
+        for (const id of resolved.stacks) {
+            const globs = manifest.stacks[id]?.globs ?? [];
+            if (globs.some((glob) => minimatch(file, glob))) {
+                matched.add(id);
+                any = true;
+            }
+        }
+        if (!any)
+            uncovered.push(file);
+    }
+    // The profile's own order, not insertion order: a stack that extends another
+    // must come after it, and the manifest already encodes that ordering.
+    return {
+        profile: resolved.profile,
+        stacks: resolved.stacks.filter((id) => matched.has(id)),
+        uncovered,
+    };
+}
+//# sourceMappingURL=scope.js.map

package/dist/review/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../cli/review/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAqBtD,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,OAAe,EAAE,KAAe;IAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/sarif/map.js

@@ -0,0 +1,58 @@
+import { SEVERITY_RANK, isSeverity } from "../core/severity.js";
+// SARIF 2.1.0's own `level` vocabulary, plus the ones the common producers
+// actually emit in `properties.security-severity` bands and vendor fields.
+export const DEFAULT_SEVERITY_MAP = {
+    // SARIF levels
+    error: 'BLOCKER',
+    warning: 'HIGH',
+    note: 'SUGGESTION',
+    none: 'SUGGESTION',
+    // Common vendor words
+    critical: 'BLOCKER',
+    high: 'BLOCKER',
+    medium: 'HIGH',
+    moderate: 'HIGH',
+    low: 'SUGGESTION',
+    info: 'SUGGESTION',
+    informational: 'SUGGESTION',
+};
+export const FALLBACK_SEVERITY = 'SUGGESTION';
+export function mapSeverity(native, map) {
+    const word = (native ?? '').trim();
+    const key = word.toLowerCase();
+    const mapped = map[key];
+    if (mapped)
+        return { severity: mapped, native: word, matched: true };
+    return { severity: FALLBACK_SEVERITY, native: word, matched: false };
+}
+/**
+ * A repository's override, merged over the defaults.
+ *
+ * Overrides are validated rather than trusted: `.redline.json` is a file a
+ * repository edits, and a typo like `"error": "CRITICAL"` must be refused at the
+ * boundary with a message naming it — not silently ignored, which would leave a
+ * repository believing it had raised a severity it had not.
+ */
+export function resolveSeverityMap(override) {
+    const problems = [];
+    const map = { ...DEFAULT_SEVERITY_MAP };
+    if (override === undefined || override === null)
+        return { map, problems };
+    if (typeof override !== 'object' || Array.isArray(override)) {
+        problems.push('severityMap must be an object of {"<their word>": "BLOCKER|HIGH|SUGGESTION"}');
+        return { map, problems };
+    }
+    for (const [word, value] of Object.entries(override)) {
+        if (!isSeverity(value)) {
+            problems.push(`severityMap["${word}"] is ${JSON.stringify(value)} — it must be one of BLOCKER, HIGH or SUGGESTION`);
+            continue;
+        }
+        map[word.toLowerCase()] = value;
+    }
+    return { map, problems };
+}
+/** The most severe of a set. Never an average — an average severity is not a thing. */
+export function mostSevere(severities) {
+    return severities.reduce((worst, s) => (worst === null || SEVERITY_RANK[s] > SEVERITY_RANK[worst] ? s : worst), null);
+}
+//# sourceMappingURL=map.js.map

package/dist/sarif/map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.js","sourceRoot":"","sources":["../../cli/sarif/map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAiB,MAAM,qBAAqB,CAAC;AAe/E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,eAAe;IACf,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,MAAM;IACf,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,sBAAsB;IACtB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,YAAY;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAa,YAAY,CAAC;AAYxD,MAAM,UAAU,WAAW,CAAC,MAA0B,EAAE,GAAgB;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAgB,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAErD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC9F,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kDAAkD,CACrG,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,UAAsB;IAC/C,OAAO,UAAU,CAAC,MAAM,CACtB,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EACrF,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/sarif/parse.js

@@ -0,0 +1,88 @@
+import { mapSeverity } from "./map.js";
+// CodeQL and several others carry a 0-10 CVSS-ish band here rather than a word.
+// Read as a band, not a number: the point is which of three buckets it lands in,
+// and inventing precision the producer did not have would be worse than the
+// coarse answer.
+function securitySeverityBand(properties) {
+    const raw = properties?.['security-severity'];
+    const value = typeof raw === 'string' ? Number.parseFloat(raw) : typeof raw === 'number' ? raw : NaN;
+    if (Number.isNaN(value))
+        return undefined;
+    if (value >= 9)
+        return 'critical';
+    if (value >= 7)
+        return 'high';
+    if (value >= 4)
+        return 'medium';
+    return 'low';
+}
+export function parseSarif(raw, map, where = 'sarif') {
+    const findings = [];
+    const problems = [];
+    let log;
+    try {
+        log = JSON.parse(raw);
+    }
+    catch (error) {
+        return {
+            findings,
+            problems: [`${where}: not valid JSON (${error instanceof Error ? error.message : String(error)})`],
+        };
+    }
+    if (typeof log !== 'object' || log === null || !Array.isArray(log.runs)) {
+        return { findings, problems: [`${where}: not a SARIF log — no "runs" array`] };
+    }
+    log.runs.forEach((run, runIndex) => {
+        const tool = run.tool?.driver?.name?.trim() || 'unknown';
+        const ruleTable = new Map();
+        for (const rule of run.tool?.driver?.rules ?? []) {
+            if (rule.id)
+                ruleTable.set(rule.id, rule);
+        }
+        const results = run.results;
+        if (!Array.isArray(results)) {
+            // A run with no results is a scanner that found nothing — a fact worth
+            // ingesting as silence, not a malformed file.
+            return;
+        }
+        results.forEach((result, i) => {
+            const ruleId = result.ruleId?.trim();
+            if (!ruleId) {
+                problems.push(`${where}: run ${runIndex} result ${i} has no ruleId — skipped`);
+                return;
+            }
+            const rule = ruleTable.get(ruleId);
+            // Precedence: the result's own level, then the rule's default, then the
+            // security-severity band. The result is most specific and the band is the
+            // least, which is the order a reader would expect.
+            const native = result.level ??
+                rule?.defaultConfiguration?.level ??
+                securitySeverityBand(result.properties) ??
+                securitySeverityBand(rule?.properties);
+            const mapped = mapSeverity(native, map);
+            if (!mapped.matched && native) {
+                problems.push(`${where}: ${tool} severity "${native}" is not in the severity map — ${ruleId} ingested as ${mapped.severity}`);
+            }
+            const location = result.locations?.[0]?.physicalLocation;
+            findings.push({
+                source: 'sarif',
+                tool,
+                ruleId,
+                severity: mapped.severity,
+                nativeSeverity: mapped.native,
+                message: result.message?.text?.trim() ?? '',
+                file: location?.artifactLocation?.uri ?? null,
+                line: location?.region?.startLine ?? null,
+            });
+        });
+    });
+    return { findings, problems };
+}
+/** Per-tool counts, for a view that must never merge two rule catalogues. */
+export function byTool(findings) {
+    const counts = {};
+    for (const finding of findings)
+        counts[finding.tool] = (counts[finding.tool] ?? 0) + 1;
+    return counts;
+}
+//# sourceMappingURL=parse.js.map

package/dist/sarif/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../cli/sarif/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAoB,MAAM,UAAU,CAAC;AA8CzD,gFAAgF;AAChF,iFAAiF;AACjF,4EAA4E;AAC5E,iBAAiB;AACjB,SAAS,oBAAoB,CAAC,UAA+C;IAC3E,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACrG,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAgB,EAAE,KAAK,GAAG,OAAO;IACvE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,CAAC,GAAG,KAAK,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;SACnG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,qCAAqC,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,EAAE;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,uEAAuE;YACvE,8CAA8C;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,QAAQ,WAAW,CAAC,0BAA0B,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,wEAAwE;YACxE,0EAA0E;YAC1E,mDAAmD;YACnD,MAAM,MAAM,GACV,MAAM,CAAC,KAAK;gBACZ,IAAI,EAAE,oBAAoB,EAAE,KAAK;gBACjC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvC,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAEzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,IAAI,cAAc,MAAM,kCAAkC,MAAM,gBAAgB,MAAM,CAAC,QAAQ,EAAE,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO;gBACf,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,MAAM,CAAC,MAAM;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,IAAI;gBAC7C,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,QAA6B;IAClD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sarif/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/sarif/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../cli/sarif/types.ts"],"names":[],"mappings":""}

package/dist/sync/host.js

@@ -0,0 +1,21 @@
+import { RedlineError } from "../core/errors.js";
+import { createGitHubClient } from "../platforms/github/client.js";
+import { readRemoteConfig, readRemoteFile } from "../platforms/github/remote.js";
+import { openOrUpdatePullRequest, pushRemoteFiles } from "../platforms/github/push.js";
+// The estate spans both hosts, so one sync run needs a client per host rather
+// than the single resolved platform every other command works with — those all
+// act on one repository, which has exactly one host.
+export function createSyncHost(clients = {}) {
+    const github = clients.github ?? createGitHubClient();
+    const unsupported = (host) => {
+        throw new RedlineError('host', `sync does not support ${host} yet`, 'Azure DevOps discovery and sync are outstanding — see the roadmap Phase 0');
+    };
+    const forHost = (ref) => ref.host === 'github' ? github : unsupported(ref.host);
+    return {
+        readRemoteConfig: (ref) => readRemoteConfig(forHost(ref), ref),
+        readRemoteFile: (ref, path) => readRemoteFile(forHost(ref), ref, path),
+        pushFiles: (ref, push) => pushRemoteFiles(forHost(ref), ref, push),
+        openPullRequest: (ref, pr) => openOrUpdatePullRequest(forHost(ref), ref, pr),
+    };
+}
+//# sourceMappingURL=host.js.map

package/dist/sync/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../cli/sync/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGvF,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,MAAM,UAAU,cAAc,CAAC,UAAmD,EAAE;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;IAEtD,MAAM,WAAW,GAAG,CAAC,IAAU,EAAS,EAAE;QACxC,MAAM,IAAI,YAAY,CACpB,MAAM,EACN,yBAAyB,IAAI,MAAM,EACnC,2EAA2E,CAC5E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAY,EAA8B,EAAE,CAC3D,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;QAC9D,cAAc,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC;QAClE,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/dist/sync/plan.js

@@ -0,0 +1,47 @@
+// Compare two dotted versions numerically. A string compare would rank 0.0.10
+// below 0.0.9 and quietly stop syncing an estate on the tenth patch.
+function isBehind(recorded, current) {
+    const parse = (v) => v.split('.').map((p) => Number.parseInt(p, 10));
+    const a = parse(recorded);
+    const b = parse(current);
+    const length = Math.max(a.length, b.length);
+    for (let i = 0; i < length; i += 1) {
+        const left = a[i] ?? 0;
+        const right = b[i] ?? 0;
+        // A recorded version that is not a number at all — hand-edited, or written
+        // by a version of the CLI that did not exist yet — is treated as behind.
+        // Syncing it proposes a correction; skipping it would strand the repository.
+        if (Number.isNaN(left))
+            return true;
+        if (Number.isNaN(right))
+            return false;
+        if (left !== right)
+            return left < right;
+    }
+    return false;
+}
+// Which registered repositories need a pull request, and why each other one
+// does not. Pure: no host, no filesystem. Every skip carries its reason so a
+// dry run explains the whole estate rather than only the part it would touch.
+export function planSync(registry, standardsVersion, opts = {}) {
+    const targets = [];
+    const skipped = [];
+    for (const entry of registry.entries) {
+        const name = `${entry.org}/${entry.repo}`;
+        if (opts.repo && name !== opts.repo) {
+            skipped.push({ entry, reason: `not ${opts.repo}` });
+            continue;
+        }
+        if (opts.force) {
+            targets.push({ entry, from: entry.standardsVersion });
+            continue;
+        }
+        if (isBehind(entry.standardsVersion, standardsVersion)) {
+            targets.push({ entry, from: entry.standardsVersion });
+            continue;
+        }
+        skipped.push({ entry, reason: `already at standards v${entry.standardsVersion}` });
+    }
+    return { standardsVersion, targets, skipped };
+}
+//# sourceMappingURL=plan.js.map

package/dist/sync/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../cli/sync/plan.ts"],"names":[],"mappings":"AA2BA,8EAA8E;AAC9E,qEAAqE;AACrE,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAe;IACjD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,GAAG,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CACtB,QAAkB,EAClB,gBAAwB,EACxB,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}