verification-layer 0.27.13 → 0.28.0

package/dist/delivery/policy.d.ts

@@ -0,0 +1,13 @@
+import type { Finding, Severity } from '../types.js';
+import type { DeliveryPolicy, FindingDelta, PolicyDecision, SeverityBudget } from './types.js';
+export declare const DEFAULT_DELIVERY_POLICY: Required<Pick<DeliveryPolicy, 'changedFilesOnly' | 'minimumScore' | 'requireBaseline' | 'failOnExpiredAcknowledgments'>> & {
+    blockOn: Severity[];
+    maxNew: SeverityBudget;
+};
+export declare function resolveDeliveryPolicy(policy?: DeliveryPolicy): PolicyDecision['policy'];
+/**
+ * Decide whether a software change is allowed to ship. The policy deliberately
+ * evaluates new active risk instead of the repository's historical debt.
+ */
+export declare function evaluateDeliveryPolicy(delta: FindingDelta, allFindings: Finding[], complianceScore: number | undefined, baselineLoaded: boolean, gitAvailable: boolean, policy?: DeliveryPolicy, expiredAcknowledgmentCount?: number): PolicyDecision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/delivery/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/delivery/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EAEd,cAAc,EACf,MAAM,YAAY,CAAC;AAIpB,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,IAAI,CACjD,cAAc,EACd,kBAAkB,GAAG,cAAc,GAAG,iBAAiB,GAAG,8BAA8B,CACzF,CAAC,GAAG;IACH,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;CAQxB,CAAC;AAYF,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,cAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAU3F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,OAAO,EAAE,EACtB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,cAAc,EAAE,OAAO,EACvB,YAAY,EAAE,OAAO,EACrB,MAAM,GAAE,cAAmB,EAC3B,0BAA0B,SAAI,GAC7B,cAAc,CAuEhB"}

package/dist/delivery/policy.js

@@ -0,0 +1,100 @@
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+export const DEFAULT_DELIVERY_POLICY = {
+    blockOn: ['critical', 'high'],
+    maxNew: {},
+    changedFilesOnly: true,
+    minimumScore: 0,
+    requireBaseline: false,
+    failOnExpiredAcknowledgments: true,
+};
+function countsFor(findings) {
+    return {
+        critical: findings.filter(f => f.severity === 'critical').length,
+        high: findings.filter(f => f.severity === 'high').length,
+        medium: findings.filter(f => f.severity === 'medium').length,
+        low: findings.filter(f => f.severity === 'low').length,
+        info: findings.filter(f => f.severity === 'info').length,
+    };
+}
+export function resolveDeliveryPolicy(policy = {}) {
+    return {
+        blockOn: policy.blockOn ?? DEFAULT_DELIVERY_POLICY.blockOn,
+        maxNew: policy.maxNew ?? DEFAULT_DELIVERY_POLICY.maxNew,
+        changedFilesOnly: policy.changedFilesOnly ?? DEFAULT_DELIVERY_POLICY.changedFilesOnly,
+        minimumScore: policy.minimumScore ?? DEFAULT_DELIVERY_POLICY.minimumScore,
+        requireBaseline: policy.requireBaseline ?? DEFAULT_DELIVERY_POLICY.requireBaseline,
+        failOnExpiredAcknowledgments: policy.failOnExpiredAcknowledgments ?? DEFAULT_DELIVERY_POLICY.failOnExpiredAcknowledgments,
+    };
+}
+/**
+ * Decide whether a software change is allowed to ship. The policy deliberately
+ * evaluates new active risk instead of the repository's historical debt.
+ */
+export function evaluateDeliveryPolicy(delta, allFindings, complianceScore, baselineLoaded, gitAvailable, policy = {}, expiredAcknowledgmentCount = 0) {
+    const resolved = resolveDeliveryPolicy(policy);
+    const useChangedFiles = resolved.changedFilesOnly && gitAvailable;
+    const considered = useChangedFiles
+        ? delta.newFindingsInChangedFiles
+        : delta.newFindings;
+    const counts = countsFor(considered);
+    const reasons = [];
+    for (const severity of resolved.blockOn) {
+        const count = counts[severity];
+        if (count > 0) {
+            reasons.push({
+                code: 'BLOCKING_SEVERITY',
+                severity,
+                count,
+                message: `${count} new ${severity} finding${count === 1 ? '' : 's'} in the evaluated change`,
+            });
+        }
+    }
+    for (const severity of SEVERITIES) {
+        const limit = resolved.maxNew[severity];
+        if (limit === undefined)
+            continue;
+        const count = counts[severity];
+        if (count > limit) {
+            reasons.push({
+                code: 'SEVERITY_BUDGET_EXCEEDED',
+                severity,
+                count,
+                limit,
+                message: `${severity} budget exceeded: ${count} new finding${count === 1 ? '' : 's'} (limit ${limit})`,
+            });
+        }
+    }
+    if (resolved.minimumScore > 0 && (complianceScore ?? 0) < resolved.minimumScore) {
+        reasons.push({
+            code: 'MINIMUM_SCORE',
+            message: `Compliance score ${complianceScore ?? 0} is below required minimum ${resolved.minimumScore}`,
+        });
+    }
+    if (resolved.requireBaseline && !baselineLoaded) {
+        reasons.push({
+            code: 'BASELINE_REQUIRED',
+            message: 'A committed baseline is required by delivery policy',
+        });
+    }
+    const expiredInFindings = allFindings.filter(f => f.acknowledgment?.expired === true).length;
+    const expired = Math.max(expiredAcknowledgmentCount, expiredInFindings);
+    if (resolved.failOnExpiredAcknowledgments && expired > 0) {
+        reasons.push({
+            code: 'EXPIRED_ACKNOWLEDGMENT',
+            count: expired,
+            message: `${expired} acknowledgment${expired === 1 ? '' : 's'} expired and require re-review`,
+        });
+    }
+    const deployAllowed = reasons.length === 0;
+    return {
+        status: deployAllowed ? 'pass' : 'fail',
+        deployAllowed,
+        evaluatedAt: new Date().toISOString(),
+        consideredScope: useChangedFiles ? 'changed-files' : 'all-files',
+        counts,
+        totalConsidered: considered.length,
+        reasons,
+        policy: resolved,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/delivery/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/delivery/policy.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,uBAAuB,GAMhC;IACF,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,EAAE;IACV,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,KAAK;IACtB,4BAA4B,EAAE,IAAI;CACnC,CAAC;AAEF,SAAS,SAAS,CAAC,QAAmB;IACpC,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAChE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC5D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;QACtD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAyB,EAAE;IAC/D,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,uBAAuB,CAAC,OAAO;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAAC,MAAM;QACvD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,gBAAgB;QACrF,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,uBAAuB,CAAC,YAAY;QACzE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,eAAe;QAClF,4BAA4B,EAC1B,MAAM,CAAC,4BAA4B,IAAI,uBAAuB,CAAC,4BAA4B;KAC9F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,WAAsB,EACtB,eAAmC,EACnC,cAAuB,EACvB,YAAqB,EACrB,SAAyB,EAAE,EAC3B,0BAA0B,GAAG,CAAC;IAE9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,IAAI,YAAY,CAAC;IAClE,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAC,KAAK,CAAC,yBAAyB;QACjC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,QAAQ;gBACR,KAAK;gBACL,OAAO,EAAE,GAAG,KAAK,QAAQ,QAAQ,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,0BAA0B;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,0BAA0B;gBAChC,QAAQ;gBACR,KAAK;gBACL,KAAK;gBACL,OAAO,EAAE,GAAG,QAAQ,qBAAqB,KAAK,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,GAAG;aACvG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,oBAAoB,eAAe,IAAI,CAAC,8BAA8B,QAAQ,CAAC,YAAY,EAAE;SACvG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,iBAAiB,CAAC,CAAC;IACxE,IAAI,QAAQ,CAAC,4BAA4B,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gCAAgC;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACvC,aAAa;QACb,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW;QAChE,MAAM;QACN,eAAe,EAAE,UAAU,CAAC,MAAM;QAClC,OAAO;QACP,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC"}

package/dist/delivery/remediation.d.ts

@@ -0,0 +1,9 @@
+import type { GuardResult, RemediationPlan } from './types.js';
+/**
+ * Convert a policy decision into a developer-facing remediation plan. The plan
+ * never mutates source; it only advertises a safe-fix command when the scanner
+ * has a registered fix type for the finding.
+ */
+export declare function buildRemediationPlan(projectPath: string, guard: GuardResult): RemediationPlan;
+export declare function remediationToMarkdown(plan: RemediationPlan): string;
+//# sourceMappingURL=remediation.d.ts.map

package/dist/delivery/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/delivery/remediation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAQhF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,WAAW,GACjB,eAAe,CAoCjB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CA2BnE"}

package/dist/delivery/remediation.js

@@ -0,0 +1,60 @@
+import { generateFindingHash, normalizeFindingFile } from '../baseline.js';
+function consideredNewFindings(guard) {
+    return guard.decision.consideredScope === 'changed-files'
+        ? guard.delta.newFindingsInChangedFiles
+        : guard.delta.newFindings;
+}
+/**
+ * Convert a policy decision into a developer-facing remediation plan. The plan
+ * never mutates source; it only advertises a safe-fix command when the scanner
+ * has a registered fix type for the finding.
+ */
+export function buildRemediationPlan(projectPath, guard) {
+    const blockingSeverities = new Set(guard.decision.reasons
+        .filter(reason => reason.code === 'BLOCKING_SEVERITY' && reason.severity)
+        .map(reason => reason.severity));
+    const budgetSeverities = new Set(guard.decision.reasons
+        .filter(reason => reason.code === 'SEVERITY_BUDGET_EXCEEDED' && reason.severity)
+        .map(reason => reason.severity));
+    const considered = consideredNewFindings(guard);
+    const relevant = considered.filter(finding => blockingSeverities.has(finding.severity) || budgetSeverities.has(finding.severity));
+    const items = relevant.map(finding => {
+        const autoFixAvailable = Boolean(finding.fixType);
+        return {
+            fingerprint: generateFindingHash(finding, projectPath),
+            severity: finding.severity,
+            title: finding.title,
+            file: normalizeFindingFile(finding, projectPath),
+            line: finding.line,
+            recommendation: finding.recommendation,
+            autoFixAvailable,
+            command: autoFixAvailable ? `vlayer scan ${JSON.stringify(projectPath)} --fix` : undefined,
+        };
+    });
+    return {
+        deployAllowed: guard.decision.deployAllowed,
+        blockingCount: items.length,
+        items,
+    };
+}
+export function remediationToMarkdown(plan) {
+    const lines = [
+        plan.deployAllowed ? '# Deployment approved' : '# Deployment blocked',
+        '',
+    ];
+    if (plan.items.length === 0) {
+        lines.push(plan.deployAllowed
+            ? 'No blocking remediation is required.'
+            : 'The policy failed for a non-finding condition. Review the policy reasons.');
+        return lines.join('\n');
+    }
+    lines.push(`Blocking findings: ${plan.items.length}`, '');
+    for (const item of plan.items) {
+        lines.push(`## ${item.severity.toUpperCase()} — ${item.title}`, '', `- Location: \`${item.file}${item.line ? `:${item.line}` : ''}\``, `- Recommendation: ${item.recommendation}`, `- Auto-fix registered: ${item.autoFixAvailable ? 'yes' : 'no'}`);
+        if (item.command)
+            lines.push(`- Safe-fix command: \`${item.command}\``);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=remediation.js.map

package/dist/delivery/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../src/delivery/remediation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3E,SAAS,qBAAqB,CAAC,KAAkB;IAC/C,OAAO,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,eAAe;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB;QACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,KAAkB;IAElB,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,QAAQ,CAAC,OAAO;SACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,CAAC,QAAQ,CAAC;SACxE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAS,CAAC,CACnC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,KAAK,CAAC,QAAQ,CAAC,OAAO;SACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,0BAA0B,IAAI,MAAM,CAAC,QAAQ,CAAC;SAC/E,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAS,CAAC,CACnC,CAAC;IAEF,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAC3C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAsB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC;YACtD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC;YAChD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,gBAAgB;YAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC3F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC3C,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,sBAAsB;QACrE,EAAE;KACH,CAAC;IAEF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAC3B,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,2EAA2E,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EACnD,EAAE,EACF,iBAAiB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EACjE,qBAAqB,IAAI,CAAC,cAAc,EAAE,EAC1C,0BAA0B,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CACjE,CAAC;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/delivery/runner.d.ts

@@ -0,0 +1,26 @@
+import type { Confidence } from '../types.js';
+import { getAcknowledgmentLifecycle } from './governance.js';
+import type { DeliveryPolicy, GuardResult } from './types.js';
+export interface RunGuardOptions {
+    path: string;
+    baselineFile?: string;
+    configFile?: string;
+    policyFile?: string;
+    baseRef?: string;
+    headRef?: string;
+    changedFilesOnly?: boolean;
+    enableAI?: boolean;
+    minConfidence?: Confidence;
+    policy?: DeliveryPolicy;
+}
+export interface GuardExecution extends GuardResult {
+    policySource?: string;
+    acknowledgmentLifecycle: Awaited<ReturnType<typeof getAcknowledgmentLifecycle>>;
+    baselinePath?: string;
+}
+/**
+ * Execute a deterministic compliance delivery gate. AI triage is disabled by
+ * default so CI decisions are reproducible unless the caller explicitly opts in.
+ */
+export declare function runComplianceGuard(options: RunGuardOptions): Promise<GuardExecution>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/delivery/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/delivery/runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAI3D,OAAO,EAAE,0BAA0B,EAAsB,MAAM,iBAAiB,CAAC;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA6BD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAkD1F"}

package/dist/delivery/runner.js

@@ -0,0 +1,79 @@
+import { isAbsolute, resolve } from 'path';
+import { access } from 'fs/promises';
+import { scan } from '../scan.js';
+import { loadBaseline } from '../baseline.js';
+import { getGitContext } from './git.js';
+import { buildFindingDelta } from './diff.js';
+import { evaluateDeliveryPolicy } from './policy.js';
+import { getAcknowledgmentLifecycle, loadDeliveryPolicy } from './governance.js';
+async function existingFile(path) {
+    try {
+        await access(path);
+        return path;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveBaselinePath(root, explicit) {
+    if (explicit) {
+        const candidate = isAbsolute(explicit) ? explicit : resolve(root, explicit);
+        return existingFile(candidate);
+    }
+    return existingFile(resolve(root, '.vlayer-baseline.json'));
+}
+function mergePolicy(base, override) {
+    if (!override)
+        return base;
+    return {
+        ...base,
+        ...override,
+        maxNew: override.maxNew ?? base.maxNew,
+        blockOn: override.blockOn ?? base.blockOn,
+    };
+}
+/**
+ * Execute a deterministic compliance delivery gate. AI triage is disabled by
+ * default so CI decisions are reproducible unless the caller explicitly opts in.
+ */
+export async function runComplianceGuard(options) {
+    const projectPath = resolve(options.path);
+    const git = await getGitContext(projectPath, options.baseRef, options.headRef ?? 'HEAD');
+    const scanRoot = git.available ? git.root : projectPath;
+    const baselinePath = await resolveBaselinePath(scanRoot, options.baselineFile);
+    const configPath = options.configFile
+        ? (isAbsolute(options.configFile) ? options.configFile : resolve(scanRoot, options.configFile))
+        : undefined;
+    let baseline = null;
+    if (baselinePath)
+        baseline = await loadBaseline(baselinePath);
+    const scanOptions = {
+        path: scanRoot,
+        configFile: configPath,
+        baselineFile: baselinePath,
+        enableAI: options.enableAI === true,
+        minConfidence: options.minConfidence,
+    };
+    const result = await scan(scanOptions);
+    const delta = buildFindingDelta(result.findings, scanRoot, git.changedFiles, baseline);
+    const loadedPolicy = await loadDeliveryPolicy(scanRoot, options.policyFile, configPath);
+    const acknowledgmentLifecycle = await getAcknowledgmentLifecycle(scanRoot, configPath);
+    let policy = mergePolicy(loadedPolicy.policy, options.policy);
+    if (options.changedFilesOnly !== undefined) {
+        policy = { ...policy, changedFilesOnly: options.changedFilesOnly };
+    }
+    const decision = evaluateDeliveryPolicy(delta, result.findings, result.complianceScore?.score, baseline !== null, git.available, policy, acknowledgmentLifecycle.expired.length);
+    return {
+        git,
+        delta,
+        decision,
+        findings: result.findings,
+        scannedFiles: result.scannedFiles,
+        complianceScore: result.complianceScore?.score,
+        baselineLoaded: baseline !== null,
+        baselinePath,
+        policySource: loadedPolicy.source,
+        acknowledgmentLifecycle,
+    };
+}
+//# sourceMappingURL=runner.js.map

package/dist/delivery/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/delivery/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,YAAY,EAAiB,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAsBjF,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IAChE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5E,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,IAAoB,EAAE,QAAyB;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QACtC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAwB;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;QACnC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,YAAY;QAAE,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAgB;QAC/B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,uBAAuB,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEvF,IAAI,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,EACL,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,eAAe,EAAE,KAAK,EAC7B,QAAQ,KAAK,IAAI,EACjB,GAAG,CAAC,SAAS,EACb,MAAM,EACN,uBAAuB,CAAC,OAAO,CAAC,MAAM,CACvC,CAAC;IAEF,OAAO;QACL,GAAG;QACH,KAAK;QACL,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK;QAC9C,cAAc,EAAE,QAAQ,KAAK,IAAI;QACjC,YAAY;QACZ,YAAY,EAAE,YAAY,CAAC,MAAM;QACjC,uBAAuB;KACxB,CAAC;AACJ,CAAC"}

package/dist/delivery/types.d.ts

@@ -0,0 +1,156 @@
+import type { Finding, Severity } from '../types.js';
+import type { BaselineEntry } from '../baseline.js';
+export interface GitContext {
+    available: boolean;
+    root: string;
+    branch?: string;
+    headSha?: string;
+    baseSha?: string;
+    author?: string;
+    changedFiles: string[];
+    repository?: string;
+    commitUrl?: string;
+}
+export interface FindingDelta {
+    newFindings: Finding[];
+    newFindingsInChangedFiles: Finding[];
+    baselineFindings: Finding[];
+    resolvedFindings: BaselineEntry[];
+    changedFiles: string[];
+}
+export interface SeverityBudget {
+    critical?: number;
+    high?: number;
+    medium?: number;
+    low?: number;
+    info?: number;
+}
+export interface DeliveryPolicy {
+    /** Severities that always block when a new active finding is considered. */
+    blockOn?: Severity[];
+    /** Maximum number of new findings allowed by severity. */
+    maxNew?: SeverityBudget;
+    /** Evaluate only findings in files changed by the git comparison. Default true when git is available. */
+    changedFilesOnly?: boolean;
+    /** Optional minimum overall compliance score. */
+    minimumScore?: number;
+    /** Require a baseline file before the gate can pass. */
+    requireBaseline?: boolean;
+    /** Expired acknowledgments are governance failures even when the underlying finding is low severity. */
+    failOnExpiredAcknowledgments?: boolean;
+}
+export interface PolicyReason {
+    code: 'BLOCKING_SEVERITY' | 'SEVERITY_BUDGET_EXCEEDED' | 'MINIMUM_SCORE' | 'BASELINE_REQUIRED' | 'EXPIRED_ACKNOWLEDGMENT';
+    message: string;
+    severity?: Severity;
+    count?: number;
+    limit?: number;
+}
+export interface PolicyDecision {
+    status: 'pass' | 'fail';
+    deployAllowed: boolean;
+    evaluatedAt: string;
+    consideredScope: 'changed-files' | 'all-files';
+    counts: Record<Severity, number>;
+    totalConsidered: number;
+    reasons: PolicyReason[];
+    policy: Required<Pick<DeliveryPolicy, 'changedFilesOnly' | 'minimumScore' | 'requireBaseline' | 'failOnExpiredAcknowledgments'>> & {
+        blockOn: Severity[];
+        maxNew: SeverityBudget;
+    };
+}
+export type ComplianceGraphNodeType = 'code' | 'finding' | 'control' | 'policy' | 'owner' | 'evidence';
+export interface ComplianceGraphNode {
+    id: string;
+    type: ComplianceGraphNodeType;
+    label: string;
+    metadata?: Record<string, string | number | boolean | null>;
+}
+export interface ComplianceGraphEdge {
+    from: string;
+    to: string;
+    relation: 'contains' | 'violates' | 'governed-by' | 'owned-by' | 'supports';
+}
+export interface ComplianceGraph {
+    schemaVersion: '1.0';
+    generatedAt: string;
+    nodes: ComplianceGraphNode[];
+    edges: ComplianceGraphEdge[];
+}
+export interface EvidenceFinding {
+    fingerprint: string;
+    ruleId: string;
+    id: string;
+    severity: Severity;
+    category: string;
+    title: string;
+    file: string;
+    line?: number;
+    hipaaReference?: string;
+    recommendation: string;
+    acknowledged: boolean;
+    acknowledgment?: {
+        reason: string;
+        acknowledgedBy: string;
+        acknowledgedAt: string;
+        ticketUrl?: string;
+        expired?: boolean;
+    };
+    baseline: boolean;
+    suppressed: boolean;
+}
+export interface EvidencePackage {
+    schemaVersion: '1.0';
+    generatedAt: string;
+    project: {
+        name: string;
+    };
+    source: {
+        repository?: string;
+        branch?: string;
+        headSha?: string;
+        baseSha?: string;
+        author?: string;
+        commitUrl?: string;
+        changedFiles: string[];
+    };
+    decision: PolicyDecision;
+    summary: {
+        scannedFiles: number;
+        totalFindings: number;
+        newFindings: number;
+        resolvedFindings: number;
+        acknowledged: number;
+        suppressed: number;
+        complianceScore?: number;
+    };
+    controls: string[];
+    findings: EvidenceFinding[];
+    graph: ComplianceGraph;
+    packageHash: string;
+}
+export interface RemediationItem {
+    fingerprint: string;
+    severity: Severity;
+    title: string;
+    file: string;
+    line?: number;
+    recommendation: string;
+    autoFixAvailable: boolean;
+    command?: string;
+}
+export interface RemediationPlan {
+    deployAllowed: boolean;
+    blockingCount: number;
+    items: RemediationItem[];
+}
+export interface GuardResult {
+    git: GitContext;
+    delta: FindingDelta;
+    decision: PolicyDecision;
+    findings: Finding[];
+    scannedFiles: number;
+    complianceScore?: number;
+    baselineLoaded: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/delivery/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/delivery/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,yBAAyB,EAAE,OAAO,EAAE,CAAC;IACrC,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wGAAwG;IACxG,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EACA,mBAAmB,GACnB,0BAA0B,GAC1B,eAAe,GACf,mBAAmB,GACnB,wBAAwB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,eAAe,GAAG,WAAW,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,cAAc,GAAG,iBAAiB,GAAG,8BAA8B,CAAC,CAAC,GAAG;QACjI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,MAAM,EAAE,cAAc,CAAC;KACxB,CAAC;CACH;AAED,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,SAAS,GACT,SAAS,GACT,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,CAAC;CAC7E;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,MAAM,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,EAAE,eAAe,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,UAAU,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;CACzB"}

package/dist/delivery/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/delivery/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/delivery/types.ts"],"names":[],"mappings":""}

package/dist/delivery/upload.d.ts

@@ -0,0 +1,20 @@
+import type { EvidencePackage } from './types.js';
+export interface UploadEvidenceOptions {
+    url?: string;
+    token?: string;
+    timeoutMs?: number;
+}
+export interface UploadEvidenceResult {
+    ok: boolean;
+    status: number;
+    scanId?: string;
+    projectId?: string;
+    message?: string;
+}
+/**
+ * Upload an already-verified evidence package. Tokens are accepted only in the
+ * Authorization header and are never included in the result or thrown errors.
+ */
+export declare function uploadEvidencePackage(evidence: EvidencePackage, options?: UploadEvidenceOptions): Promise<UploadEvidenceResult>;
+export declare function uploadEvidenceFile(path: string, options?: UploadEvidenceOptions): Promise<UploadEvidenceResult>;
+//# sourceMappingURL=upload.d.ts.map

package/dist/delivery/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/delivery/upload.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAeD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAmD/B;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAG/B"}

package/dist/delivery/upload.js

@@ -0,0 +1,72 @@
+import { readFile } from 'fs/promises';
+import { resolve } from 'path';
+import { verifyEvidencePackage } from './evidence.js';
+function resolveIngestUrl(value) {
+    const raw = value || process.env.VLAYER_INGEST_URL || 'https://vlayer.app/api/ingest';
+    const url = new URL(raw);
+    const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (url.protocol !== 'https:' && !(local && url.protocol === 'http:')) {
+        throw new Error('Evidence uploads require HTTPS (except localhost development)');
+    }
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error('Ingest URL must not contain credentials, query parameters, or fragments');
+    }
+    return url;
+}
+/**
+ * Upload an already-verified evidence package. Tokens are accepted only in the
+ * Authorization header and are never included in the result or thrown errors.
+ */
+export async function uploadEvidencePackage(evidence, options = {}) {
+    if (!verifyEvidencePackage(evidence)) {
+        throw new Error('Evidence package integrity check failed; refusing upload');
+    }
+    const token = options.token || process.env.VLAYER_TOKEN;
+    if (!token)
+        throw new Error('VLAYER_TOKEN is required to upload evidence');
+    const url = resolveIngestUrl(options.url);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 15_000);
+    try {
+        const response = await fetch(url, {
+            method: 'POST',
+            redirect: 'error',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+                'User-Agent': 'verification-layer',
+            },
+            body: JSON.stringify(evidence),
+            signal: controller.signal,
+        });
+        let payload;
+        try {
+            payload = await response.json();
+        }
+        catch {
+            payload = undefined;
+        }
+        const record = payload && typeof payload === 'object'
+            ? payload
+            : {};
+        if (!response.ok) {
+            throw new Error(`Workspace upload failed with HTTP ${response.status}`);
+        }
+        const safeValue = (value) => typeof value === 'string' && !value.includes(token) ? value : undefined;
+        return {
+            ok: true,
+            status: response.status,
+            scanId: safeValue(record.scanId),
+            projectId: safeValue(record.projectId),
+            message: safeValue(record.message),
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function uploadEvidenceFile(path, options = {}) {
+    const evidence = JSON.parse(await readFile(resolve(path), 'utf-8'));
+    return uploadEvidencePackage(evidence, options);
+}
+//# sourceMappingURL=upload.js.map

package/dist/delivery/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../src/delivery/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAiBtD,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,+BAA+B,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAyB,EACzB,UAAiC,EAAE;IAEnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAElF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,oBAAoB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YACnD,CAAC,CAAC,OAAkC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;YACtC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;SACnC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAoB,CAAC;IACvF,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC"}

package/dist/delivery-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=delivery-cli.d.ts.map

package/dist/delivery-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-cli.d.ts","sourceRoot":"","sources":["../src/delivery-cli.ts"],"names":[],"mappings":""}