skannr 0.2.0 → 0.2.2

package/dist/guard/review-runner.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Review runner — orchestrates the full guard pipeline:
+ * build symbol diffs → enrich with call context → batch → call LLM → validate.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGuardReview = runGuardReview;
+const rules_loader_1 = require("./rules-loader");
+const symbol_diff_1 = require("./symbol-diff");
+const call_context_1 = require("./call-context");
+const provider_1 = require("./provider");
+/** Maximum symbols to include in a single LLM call. */
+const BATCH_SIZE = 15;
+/**
+ * Run the full guard review pipeline.
+ * Returns a GuardResult with violations, or throws with exit code 2 errors.
+ */
+async function runGuardReview(options) {
+    const { root, diffContent, diffOnly = false } = options;
+    const started = Date.now();
+    // 1. Load rules
+    const rules = (0, rules_loader_1.loadRules)(root);
+    // 2. Load provider config
+    const config = (0, rules_loader_1.loadGuardConfig)(root);
+    // 3. Build symbol-level diffs
+    let units;
+    if (diffContent) {
+        units = (0, symbol_diff_1.buildSymbolDiffsFromDiff)(root, diffContent);
+    }
+    else {
+        units = (0, symbol_diff_1.buildSymbolDiffs)(root);
+    }
+    if (units.length === 0) {
+        return {
+            response: {
+                violations: [],
+                status: 'pass',
+                summary: 'No staged changes with identifiable symbols to review.',
+            },
+            rulesUsed: rules,
+            symbolsReviewed: 0,
+            durationMs: Date.now() - started,
+        };
+    }
+    // 4. Enrich with call context (unless --diff-only)
+    if (!diffOnly) {
+        units = (0, call_context_1.enrichWithCallContext)(units, root);
+    }
+    // 5. Batch and review
+    const allViolations = [];
+    const batches = batchUnits(units, BATCH_SIZE);
+    // Run batches concurrently (up to 3 in parallel)
+    const CONCURRENCY = 3;
+    for (let i = 0; i < batches.length; i += CONCURRENCY) {
+        const chunk = batches.slice(i, i + CONCURRENCY);
+        const results = await Promise.all(chunk.map((batch) => (0, provider_1.runLlmReview)(config, rules, batch)));
+        for (const result of results) {
+            allViolations.push(...result.violations);
+        }
+    }
+    // 6. Determine status
+    const hasHighConfidenceFail = allViolations.some((v) => v.confidence >= 0.7 && (v.severity === 'high' || v.severity === 'critical'));
+    const response = {
+        violations: allViolations,
+        status: hasHighConfidenceFail ? 'fail' : 'pass',
+        summary: allViolations.length === 0
+            ? `All ${units.length} symbol(s) pass review.`
+            : `${allViolations.length} violation(s) found across ${units.length} symbol(s).`,
+    };
+    return {
+        response,
+        rulesUsed: rules,
+        symbolsReviewed: units.length,
+        durationMs: Date.now() - started,
+    };
+}
+/** Split units into batches of the given size. */
+function batchUnits(units, size) {
+    const batches = [];
+    for (let i = 0; i < units.length; i += size) {
+        batches.push(units.slice(i, i + size));
+    }
+    return batches;
+}
+//# sourceMappingURL=review-runner.js.map

package/dist/guard/review-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-runner.js","sourceRoot":"","sources":["../../src/guard/review-runner.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA0BH,wCAuEC;AA/FD,iDAA4D;AAC5D,+CAA2E;AAC3E,iDAAuD;AACvD,yCAA0C;AAG1C,uDAAuD;AACvD,MAAM,UAAU,GAAG,EAAE,CAAC;AAatB;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,OAAmB;IACtD,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,gBAAgB;IAChB,MAAM,KAAK,GAAG,IAAA,wBAAS,EAAC,IAAI,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAA,8BAAe,EAAC,IAAI,CAAC,CAAC;IAErC,8BAA8B;IAC9B,IAAI,KAAuB,CAAC;IAC5B,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,GAAG,IAAA,sCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE;gBACR,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wDAAwD;aAClE;YACD,SAAS,EAAE,KAAK;YAChB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,GAAG,IAAA,oCAAqB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAiC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAE9C,iDAAiD;IACjD,MAAM,WAAW,GAAG,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,uBAAY,EAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACnF,CAAC;IAEF,MAAM,QAAQ,GAAmB;QAC/B,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC/C,OAAO,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,yBAAyB;YAC9C,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,8BAA8B,KAAK,CAAC,MAAM,aAAa;KACnF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE,KAAK,CAAC,MAAM;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KACjC,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,SAAS,UAAU,CAAC,KAAuB,EAAE,IAAY;IACvD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/guard/rules-loader.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Load and validate the rules file (.skannr/rules.json or .skannr/rules.yaml).
+ * Returns validated rules or throws with a clear error message.
+ */
+import type { GuardRule, GuardConfig } from './types';
+/** Load and validate rules from the project root. Falls back to defaults if no file exists. */
+export declare function loadRules(root: string): GuardRule[];
+/** Load guard provider configuration from .skannr/guard.json or env vars. */
+export declare function loadGuardConfig(root: string): GuardConfig;
+//# sourceMappingURL=rules-loader.d.ts.map

package/dist/guard/rules-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-loader.d.ts","sourceRoot":"","sources":["../../src/guard/rules-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAwDtD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAwBnD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CA2BzD"}

package/dist/guard/rules-loader.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Load and validate the rules file (.skannr/rules.json or .skannr/rules.yaml).
+ * Returns validated rules or throws with a clear error message.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadRules = loadRules;
+exports.loadGuardConfig = loadGuardConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const schema_1 = require("./schema");
+const schema_2 = require("./schema");
+/** Default locations to search for the rules file. */
+const RULES_PATHS = [
+    '.skannr/rules.json',
+    '.skannr/rules.yaml',
+    '.skannr/rules.yml',
+];
+/** Built-in default rules used when no .skannr/rules.json exists. */
+const DEFAULT_RULES = [
+    {
+        id: 'no-any-type',
+        description: 'Do not use the `any` type in TypeScript; use explicit types or `unknown`.',
+        severity: 'high',
+        fixable: true,
+        category: 'type-safety',
+    },
+    {
+        id: 'no-console-log',
+        description: 'Remove console.log statements before committing; use a proper logger in production code.',
+        severity: 'medium',
+        fixable: true,
+        category: 'code-quality',
+    },
+    {
+        id: 'error-handling',
+        description: 'Async functions that can throw should have error handling (try/catch or .catch()).',
+        severity: 'high',
+        fixable: false,
+        category: 'reliability',
+    },
+    {
+        id: 'no-hardcoded-secrets',
+        description: 'Do not hardcode API keys, passwords, tokens, or connection strings. Use environment variables.',
+        severity: 'critical',
+        fixable: false,
+        category: 'security',
+    },
+    {
+        id: 'function-complexity',
+        description: 'Functions should not exceed ~40 lines. Extract helper functions for complex logic.',
+        severity: 'medium',
+        fixable: false,
+        category: 'maintainability',
+    },
+    {
+        id: 'unused-imports',
+        description: 'Remove unused imports.',
+        severity: 'low',
+        fixable: true,
+        category: 'code-quality',
+    },
+];
+/** Load and validate rules from the project root. Falls back to defaults if no file exists. */
+function loadRules(root) {
+    const rulesPath = findRulesFile(root);
+    if (!rulesPath) {
+        return DEFAULT_RULES;
+    }
+    const raw = fs.readFileSync(rulesPath, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Failed to parse rules file as JSON: ${rulesPath}`);
+    }
+    const result = schema_1.RulesFileSchema.safeParse(parsed);
+    if (!result.success) {
+        const errors = result.error.issues
+            .map((i) => `  - ${i.path.join('.')}: ${i.message}`)
+            .join('\n');
+        throw new Error(`Invalid rules file (${rulesPath}):\n${errors}`);
+    }
+    return result.data.rules;
+}
+/** Load guard provider configuration from .skannr/guard.json or env vars. */
+function loadGuardConfig(root) {
+    const configPath = path.join(root, '.skannr', 'guard.json');
+    let rawConfig = {};
+    if (fs.existsSync(configPath)) {
+        try {
+            rawConfig = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        }
+        catch {
+            // Fall through to defaults + env
+        }
+    }
+    // Env vars override file config
+    const provider = (process.env.SKANNR_GUARD_PROVIDER || rawConfig.provider || 'gemini');
+    const model = (process.env.SKANNR_GUARD_MODEL || rawConfig.model || 'gemini-2.0-flash-exp');
+    const apiKey = process.env.SKANNR_GUARD_API_KEY
+        || process.env.GEMINI_API_KEY
+        || process.env.OPENAI_API_KEY
+        || rawConfig.apiKey;
+    const baseUrl = process.env.OPENAI_BASE_URL || rawConfig.baseUrl;
+    const result = schema_2.GuardConfigSchema.safeParse({ provider, model, apiKey, baseUrl });
+    if (!result.success) {
+        throw new Error(`Invalid guard config: ${result.error.issues.map((i) => i.message).join(', ')}`);
+    }
+    return result.data;
+}
+/** Find the first existing rules file in the project. */
+function findRulesFile(root) {
+    for (const rel of RULES_PATHS) {
+        const full = path.join(root, rel);
+        if (fs.existsSync(full)) {
+            return full;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=rules-loader.js.map

package/dist/guard/rules-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-loader.js","sourceRoot":"","sources":["../../src/guard/rules-loader.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DH,8BAwBC;AAGD,0CA2BC;AAlHD,uCAAyB;AACzB,2CAA6B;AAC7B,qCAA2C;AAE3C,qCAA6C;AAE7C,sDAAsD;AACtD,MAAM,WAAW,GAAG;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;CACpB,CAAC;AAEF,qEAAqE;AACrE,MAAM,aAAa,GAAgB;IACjC;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,2EAA2E;QACxF,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,0FAA0F;QACvG,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,cAAc;KACzB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,gGAAgG;QAC7G,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,wBAAwB;QACrC,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,cAAc;KACzB;CACF,CAAC;AAEF,+FAA+F;AAC/F,SAAgB,SAAS,CAAC,IAAY;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,wBAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,OAAO,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,SAAS,GAA4B,EAAE,CAAC;IAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAW,CAAC;IACjG,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC,KAAK,IAAI,sBAAsB,CAAW,CAAC;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;WAC1C,OAAO,CAAC,GAAG,CAAC,cAAc;WAC1B,OAAO,CAAC,GAAG,CAAC,cAAc;WACzB,SAAS,CAAC,MAA6B,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAK,SAAS,CAAC,OAA8B,CAAC;IAEzF,MAAM,MAAM,GAAG,0BAAiB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,OAAO,MAAM,CAAC,IAAmB,CAAC;AACpC,CAAC;AAED,yDAAyD;AACzD,SAAS,aAAa,CAAC,IAAY;IACjC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/guard/schema.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Zod schemas for rules file validation and LLM response contract enforcement.
+ * These ensure we never parse free text — all LLM output is validated against
+ * a strict schema before being used.
+ */
+import { z } from 'zod';
+export declare const SeveritySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+export declare const RuleSchema: z.ZodObject<{
+    id: z.ZodString;
+    description: z.ZodString;
+    severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    fixable: z.ZodBoolean;
+    category: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    description: string;
+    severity: "low" | "high" | "critical" | "medium";
+    fixable: boolean;
+    category: string;
+}, {
+    id: string;
+    description: string;
+    severity: "low" | "high" | "critical" | "medium";
+    fixable: boolean;
+    category: string;
+}>;
+export declare const RulesFileSchema: z.ZodObject<{
+    rules: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        description: z.ZodString;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        fixable: z.ZodBoolean;
+        category: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        description: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        category: string;
+    }, {
+        id: string;
+        description: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        category: string;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    rules: {
+        id: string;
+        description: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        category: string;
+    }[];
+}, {
+    rules: {
+        id: string;
+        description: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        category: string;
+    }[];
+}>;
+export declare const ViolationSchema: z.ZodObject<{
+    rule_id: z.ZodString;
+    file: z.ZodString;
+    symbol: z.ZodString;
+    line_start: z.ZodNumber;
+    line_end: z.ZodNumber;
+    severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    confidence: z.ZodNumber;
+    fixable: z.ZodBoolean;
+    message: z.ZodString;
+    suggested_fix: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    symbol: string;
+    message: string;
+    file: string;
+    severity: "low" | "high" | "critical" | "medium";
+    fixable: boolean;
+    rule_id: string;
+    line_start: number;
+    line_end: number;
+    confidence: number;
+    suggested_fix?: string | undefined;
+}, {
+    symbol: string;
+    message: string;
+    file: string;
+    severity: "low" | "high" | "critical" | "medium";
+    fixable: boolean;
+    rule_id: string;
+    line_start: number;
+    line_end: number;
+    confidence: number;
+    suggested_fix?: string | undefined;
+}>;
+export declare const ReviewResponseSchema: z.ZodObject<{
+    violations: z.ZodArray<z.ZodObject<{
+        rule_id: z.ZodString;
+        file: z.ZodString;
+        symbol: z.ZodString;
+        line_start: z.ZodNumber;
+        line_end: z.ZodNumber;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        confidence: z.ZodNumber;
+        fixable: z.ZodBoolean;
+        message: z.ZodString;
+        suggested_fix: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        symbol: string;
+        message: string;
+        file: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        rule_id: string;
+        line_start: number;
+        line_end: number;
+        confidence: number;
+        suggested_fix?: string | undefined;
+    }, {
+        symbol: string;
+        message: string;
+        file: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        rule_id: string;
+        line_start: number;
+        line_end: number;
+        confidence: number;
+        suggested_fix?: string | undefined;
+    }>, "many">;
+    status: z.ZodEnum<["pass", "fail"]>;
+    summary: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status: "pass" | "fail";
+    violations: {
+        symbol: string;
+        message: string;
+        file: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        rule_id: string;
+        line_start: number;
+        line_end: number;
+        confidence: number;
+        suggested_fix?: string | undefined;
+    }[];
+    summary: string;
+}, {
+    status: "pass" | "fail";
+    violations: {
+        symbol: string;
+        message: string;
+        file: string;
+        severity: "low" | "high" | "critical" | "medium";
+        fixable: boolean;
+        rule_id: string;
+        line_start: number;
+        line_end: number;
+        confidence: number;
+        suggested_fix?: string | undefined;
+    }[];
+    summary: string;
+}>;
+export declare const GuardConfigSchema: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodEnum<["gemini", "openai"]>>;
+    model: z.ZodDefault<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    model: string;
+    provider: "gemini" | "openai";
+    apiKey?: string | undefined;
+    baseUrl?: string | undefined;
+}, {
+    apiKey?: string | undefined;
+    model?: string | undefined;
+    provider?: "gemini" | "openai" | undefined;
+    baseUrl?: string | undefined;
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/guard/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/guard/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,cAAc,kDAAgD,CAAC;AAE5E,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;EAMrB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE1B,CAAC;AAMH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW1B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI/B,CAAC;AAMH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAK5B,CAAC"}

package/dist/guard/schema.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Zod schemas for rules file validation and LLM response contract enforcement.
+ * These ensure we never parse free text — all LLM output is validated against
+ * a strict schema before being used.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardConfigSchema = exports.ReviewResponseSchema = exports.ViolationSchema = exports.RulesFileSchema = exports.RuleSchema = exports.SeveritySchema = void 0;
+const zod_1 = require("zod");
+// ---------------------------------------------------------------------------
+// Rules file schema
+// ---------------------------------------------------------------------------
+exports.SeveritySchema = zod_1.z.enum(['low', 'medium', 'high', 'critical']);
+exports.RuleSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    description: zod_1.z.string().min(1),
+    severity: exports.SeveritySchema,
+    fixable: zod_1.z.boolean(),
+    category: zod_1.z.string().min(1),
+});
+exports.RulesFileSchema = zod_1.z.object({
+    rules: zod_1.z.array(exports.RuleSchema).min(1),
+});
+// ---------------------------------------------------------------------------
+// Violation / LLM response schema
+// ---------------------------------------------------------------------------
+exports.ViolationSchema = zod_1.z.object({
+    rule_id: zod_1.z.string().min(1),
+    file: zod_1.z.string().min(1),
+    symbol: zod_1.z.string(),
+    line_start: zod_1.z.number().int().nonnegative(),
+    line_end: zod_1.z.number().int().nonnegative(),
+    severity: exports.SeveritySchema,
+    confidence: zod_1.z.number().min(0).max(1),
+    fixable: zod_1.z.boolean(),
+    message: zod_1.z.string().min(1),
+    suggested_fix: zod_1.z.string().optional(),
+});
+exports.ReviewResponseSchema = zod_1.z.object({
+    violations: zod_1.z.array(exports.ViolationSchema),
+    status: zod_1.z.enum(['pass', 'fail']),
+    summary: zod_1.z.string().min(1),
+});
+// ---------------------------------------------------------------------------
+// Guard config schema (optional .skannr/guard.json)
+// ---------------------------------------------------------------------------
+exports.GuardConfigSchema = zod_1.z.object({
+    provider: zod_1.z.enum(['gemini', 'openai']).default('gemini'),
+    model: zod_1.z.string().default('gemini-2.0-flash-exp'),
+    apiKey: zod_1.z.string().optional(),
+    baseUrl: zod_1.z.string().optional(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/guard/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/guard/schema.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,6BAAwB;AAExB,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAEjE,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D,QAAA,UAAU,GAAG,OAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,sBAAc;IACxB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEU,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,kBAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAEjE,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,QAAQ,EAAE,sBAAc;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC;IACpC,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAEjE,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACjD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC"}

package/dist/guard/symbol-diff.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Build symbol-level diff units from staged git changes.
+ * Uses Skannr's existing parser to identify which symbols changed,
+ * instead of working with raw file diffs.
+ */
+import type { SymbolDiffUnit } from './types';
+/** Get the list of staged files (paths relative to root). */
+export declare function getStagedFiles(root: string): string[];
+/**
+ * Build symbol-level diff units for all staged files in the project.
+ * This is the primary input to the review runner.
+ */
+export declare function buildSymbolDiffs(root: string): SymbolDiffUnit[];
+/**
+ * Build symbol diffs from a PR diff string (for --pr-mode).
+ */
+export declare function buildSymbolDiffsFromDiff(root: string, diffContent: string): SymbolDiffUnit[];
+//# sourceMappingURL=symbol-diff.d.ts.map

package/dist/guard/symbol-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbol-diff.d.ts","sourceRoot":"","sources":["../../src/guard/symbol-diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUrD;AAmFD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAgE/D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,EAAE,CA6C5F"}