"use strict";
/**
 * Centralized Context-Based Severity Adjustments
 *
 * Consolidates the duplicate filter logic from:
 * - layer2/index.ts applyFileContextAdjustments() — per-file with full FileContext
 * - index.ts applyGlobalContextAdjustments() — post-layers with tooling-dir only
 *
 * Both functions are replaced by a single applyContextAdjustments() that handles
 * all context-based severity downgrades in one place.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.applyContextAdjustments = applyContextAdjustments;
/** Categories that are expected and not risky in tooling directories */
const TOOLING_DOWNGRADABLE_CATEGORIES = [
    'dangerous_function', // exec, spawn, etc. are expected in scripts
    'command_injection', // child_process usage is expected in build scripts
    'weak_crypto', // Math.random() for seeding is fine in scripts
    'data_exposure', // Logging is expected in tooling
    'ai_pattern', // AI patterns in scripts are typically fine
];
/** Categories that are expected and not risky in test files */
const TEST_DOWNGRADABLE_CATEGORIES = [
    'ai_pattern',
    'dangerous_function',
    'sensitive_variable',
    'data_exposure',
];
/**
 * Apply context-based severity adjustments to findings.
 *
 * When called with a FileContext (from Layer 2 per-file processing), applies
 * full context-aware rules: test files, tooling dirs, server-only files.
 *
 * When called without a FileContext (from the orchestrator for Layer 1 findings),
 * applies only tooling-directory downgrades based on file path.
 */
function applyContextAdjustments(findings, fileContext) {
    return findings.map(finding => {
        // Never downgrade critical findings
        if (finding.severity === 'critical') {
            return finding;
        }
        if (fileContext) {
            // Full per-file context available (Layer 2 path)
            // Test files: Downgrade specific categories
            if (fileContext.isTestFile) {
                if (TEST_DOWNGRADABLE_CATEGORIES.includes(finding.category)) {
                    return {
                        ...finding,
                        severity: 'info',
                        validationNotes: 'Downgraded: test/fixture file',
                    };
                }
            }
            // Tooling directories: Downgrade expected patterns
            if (fileContext.isToolingDir) {
                if (TOOLING_DOWNGRADABLE_CATEGORIES.includes(finding.category)) {
                    return {
                        ...finding,
                        severity: 'info',
                        validationNotes: 'Downgraded: tooling/scripts directory',
                    };
                }
            }
            // Server-only files: Client-exposure concerns don't apply
            if (fileContext.isServerOnly) {
                if (finding.category === 'hardcoded_secret' &&
                    finding.title.toLowerCase().includes('service role')) {
                    return {
                        ...finding,
                        severity: 'info',
                        validationNotes: 'Downgraded: server-only file (service role key expected)',
                    };
                }
            }
        }
        else {
            // No file context — apply path-based adjustments only (orchestrator path)
            // This catches Layer 1 findings that didn't go through Layer 2's per-file adjustments
            const inToolingDir = isToolingPath(finding.filePath);
            if (inToolingDir && TOOLING_DOWNGRADABLE_CATEGORIES.includes(finding.category)) {
                return {
                    ...finding,
                    severity: 'info',
                    validationNotes: `${finding.validationNotes || ''} Downgraded: tooling/scripts directory`.trim(),
                };
            }
        }
        return finding;
    });
}
/**
 * Tooling-path check for findings without FileContext.
 * Uses the same regex as utils/context-helpers.ts isToolingDirectory().
 */
function isToolingPath(filePath) {
    return /\/(scripts?|cli|tools?|bin|devtools|build|tasks)\//i.test(filePath);
}
//# sourceMappingURL=context-adjustments.js.map