vigiles 8.0.0 → 9.0.0

package/dist/audit-report.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The `AuditReport` — the versioned JSON contract that IS the audit's product
+ * boundary. Everything renders FROM it: the local self-contained HTML report,
+ * `audit --json` for CI, and (later) an upload to a hosted dashboard. Because it's
+ * the wire format between the CLI and anything downstream, it is VERSIONED
+ * (`meta.schemaVersion`) and stable — additive changes only within a version.
+ *
+ * Pure: `buildAuditReport` assembles the report from the same deterministic pieces
+ * the terminal output uses (`auditScore` + `optimize` + the scan inventory) — no
+ * re-detection (one-detector-no-drift), no model, no clock (a `generatedAt`
+ * timestamp is attached by the CLI at write time, never by this pure builder, so
+ * the embedded-in-HTML form stays deterministic).
+ */
+import { type AuditScore } from "./audit-score.js";
+import { type Recommendation } from "./optimize.js";
+import type { AdoptabilityResult } from "./adoptability.js";
+import type { ScanReport } from "./scan.js";
+/** The current schema version. Bump only on a BREAKING change to the shape. */
+export declare const AUDIT_SCHEMA_VERSION = 1;
+export interface AuditReportMeta {
+    /** Wire-format version — consumers gate on this. */
+    readonly schemaVersion: typeof AUDIT_SCHEMA_VERSION;
+    readonly tool: "vigiles";
+    /** The vigiles version that produced the report. */
+    readonly vigilesVersion: string;
+    /** The detected/selected harness (`claude-code`, `codex`, …). */
+    readonly harness: string;
+    /** The audited directory. */
+    readonly dir: string;
+    /** ISO-8601 produced-at stamp — set by the CLI at write time (NOT the pure builder). */
+    readonly generatedAt?: string;
+}
+/** What the harness ships — the "inventory" surface counts. */
+export interface AuditInventory {
+    readonly skills: number;
+    readonly agents: number;
+    readonly hooks: number;
+    readonly commands: number;
+    readonly mcp: boolean;
+    readonly untested: number;
+}
+/**
+ * The full audit, as the dashboard / CI / HTML all consume it. Self-describing
+ * and versioned; additive-only within a `schemaVersion`.
+ */
+export interface AuditReport {
+    readonly meta: AuditReportMeta;
+    /** The four deterministic category rings + the weighted overall + grade. */
+    readonly score: AuditScore;
+    /** The deterministic, ranked fixes (the inline recommendations). */
+    readonly recommendations: readonly Recommendation[];
+    readonly inventory: AuditInventory;
+    /**
+     * The adoption preview — "what would vigiles catch in your repo?" Present only
+     * when the model-gated tier ran (behind consent); a deterministic read omits it.
+     * Additive/optional, so the schema version is unchanged.
+     */
+    readonly adoptability?: AdoptabilityResult;
+}
+export interface BuildAuditReportOptions {
+    readonly harness: string;
+    readonly vigilesVersion: string;
+}
+/**
+ * Assemble the versioned {@link AuditReport} from a scan report — pure, no clock.
+ * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
+ * HTML-embedded form omits it so the rendered file stays deterministic.
+ */
+export declare function buildAuditReport(report: ScanReport, opts: BuildAuditReportOptions): AuditReport;
+//# sourceMappingURL=audit-report.d.ts.map

package/dist/audit-report.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_SCHEMA_VERSION = void 0;
+exports.buildAuditReport = buildAuditReport;
+/**
+ * The `AuditReport` — the versioned JSON contract that IS the audit's product
+ * boundary. Everything renders FROM it: the local self-contained HTML report,
+ * `audit --json` for CI, and (later) an upload to a hosted dashboard. Because it's
+ * the wire format between the CLI and anything downstream, it is VERSIONED
+ * (`meta.schemaVersion`) and stable — additive changes only within a version.
+ *
+ * Pure: `buildAuditReport` assembles the report from the same deterministic pieces
+ * the terminal output uses (`auditScore` + `optimize` + the scan inventory) — no
+ * re-detection (one-detector-no-drift), no model, no clock (a `generatedAt`
+ * timestamp is attached by the CLI at write time, never by this pure builder, so
+ * the embedded-in-HTML form stays deterministic).
+ */
+const audit_score_js_1 = require("./audit-score.js");
+const optimize_js_1 = require("./optimize.js");
+/** The current schema version. Bump only on a BREAKING change to the shape. */
+exports.AUDIT_SCHEMA_VERSION = 1;
+/**
+ * Assemble the versioned {@link AuditReport} from a scan report — pure, no clock.
+ * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
+ * HTML-embedded form omits it so the rendered file stays deterministic.
+ */
+function buildAuditReport(report, opts) {
+    return {
+        meta: {
+            schemaVersion: exports.AUDIT_SCHEMA_VERSION,
+            tool: "vigiles",
+            vigilesVersion: opts.vigilesVersion,
+            harness: opts.harness,
+            dir: report.dir,
+        },
+        score: (0, audit_score_js_1.auditScore)(report),
+        recommendations: (0, optimize_js_1.optimize)(report).recommendations,
+        inventory: {
+            skills: report.skills.length,
+            agents: report.agents.length,
+            // All hooks, file-backed + inline — matches formatScanReport and the
+            // emptiness/scoring count, so a JSON/HTML "What it ships" never reports 0
+            // hooks for an inline-hook-only harness.
+            hooks: report.hooks.length + report.inlineHooks,
+            commands: report.commands,
+            mcp: report.mcp,
+            untested: report.untested,
+        },
+    };
+}
+//# sourceMappingURL=audit-report.js.map