@ash-technologia/fathom 0.1.0

package/dist/cli/commands.js

@@ -0,0 +1,277 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import ora from 'ora';
+import { runAnalysis, createDefaultRegistry } from '../core/orchestrator.js';
+import { TerminalReporter } from '../reporters/terminal.js';
+import { JsonReporter } from '../reporters/json.js';
+import { HtmlReporter } from '../reporters/html.js';
+import { SarifReporter } from '../reporters/sarif.js';
+import { loadConfig } from './options.js';
+import { FathomConfigError, FathomRepositoryError, FathomBaselineMissingError, FathomBaselineCorruptError, FathomGitDiffError, } from '../core/errors.js';
+import { saveBaseline, loadBaseline } from '../baseline/baseline.js';
+import { compareWithBaseline } from '../baseline/compare.js';
+import { analyzePR } from '../diff/analyzer.js';
+import { buildRepositoryContext } from '../core/context.js';
+import { generatePRMarkdownSummary } from '../reporters/markdown.js';
+import { detectGitHubContext, publishStepSummary, publishPRComment, } from '../integrations/github/context.js';
+import { reactPlugin } from '../plugins/examples/react.js';
+/**
+ * Exit codes:
+ * 0 = success
+ * 1 = analysis completed but threshold / high-severity findings triggered
+ * 2 = invalid usage / config error
+ * 3 = unexpected failure
+ */
+/**
+ * The main analyze command.
+ */
+export async function analyzeCommand(targetPath, options) {
+    const isJsonMode = options.json === true;
+    const isSarifMode = options.sarif === true;
+    const isCIMode = options.ci === true;
+    const isVerbose = options.verbose === true;
+    // Validate repository path
+    const resolvedPath = path.resolve(targetPath);
+    try {
+        const stat = await fs.stat(resolvedPath);
+        if (!stat.isDirectory()) {
+            process.stderr.write(`Error: "${resolvedPath}" is not a directory.\n`);
+            process.exit(2);
+        }
+    }
+    catch {
+        process.stderr.write(`Error: "${resolvedPath}" does not exist.\n`);
+        process.exit(2);
+    }
+    // Load configuration
+    let config;
+    try {
+        config = await loadConfig(resolvedPath);
+    }
+    catch (err) {
+        if (err instanceof FathomConfigError) {
+            process.stderr.write(`Configuration error: ${err.message}\n`);
+            process.exit(2);
+        }
+        throw err;
+    }
+    // Warn explicitly about any disabled security checks
+    if (config.disabledSecurityRules && config.disabledSecurityRules.length > 0) {
+        for (const secRule of config.disabledSecurityRules) {
+            process.stderr.write(`[Fathom] Warning: Security check ${secRule} has been explicitly disabled via configuration.\n`);
+        }
+    }
+    // Pre-load baseline if comparison requested
+    let baseline = null;
+    if (options.compare) {
+        try {
+            baseline = await loadBaseline(resolvedPath);
+        }
+        catch (err) {
+            if (err instanceof FathomBaselineMissingError || err instanceof FathomBaselineCorruptError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+                process.exit(2);
+            }
+            throw err;
+        }
+    }
+    // Spinner (not in JSON, SARIF, or CI mode)
+    let spinner = null;
+    if (!isJsonMode && !isSarifMode && !isCIMode) {
+        spinner = ora({
+            text: `Scanning ${path.basename(resolvedPath)}...`,
+            color: 'cyan',
+        }).start();
+    }
+    else if (isCIMode) {
+        process.stderr.write(`Scanning ${resolvedPath}...\n`);
+    }
+    let result;
+    try {
+        const pluginsToLoad = [];
+        if (config.plugins && config.plugins.length > 0) {
+            for (const pName of config.plugins) {
+                if (pName === '@fathom/plugin-react' || pName === 'react') {
+                    pluginsToLoad.push(reactPlugin);
+                }
+            }
+        }
+        const registry = createDefaultRegistry();
+        result = await runAnalysis(registry, {
+            repositoryPath: resolvedPath,
+            ignorePatterns: config.ignore ?? [],
+            ruleOverrides: config.rules ?? {},
+            online: Boolean(options.online),
+            plugins: pluginsToLoad,
+        });
+    }
+    catch (err) {
+        spinner?.fail('Analysis failed.');
+        if (err instanceof FathomRepositoryError) {
+            process.stderr.write(`Repository error: ${err.message}\n`);
+            process.exit(3);
+        }
+        process.stderr.write(`Unexpected error: ${String(err)}\n`);
+        process.exit(3);
+    }
+    spinner?.stop();
+    // Attach comparison if baseline was loaded
+    if (options.compare && baseline) {
+        result.comparison = compareWithBaseline(result, baseline);
+    }
+    // Attach PR diff analysis if requested
+    if (options.diff !== undefined) {
+        try {
+            const currentContext = await buildRepositoryContext(resolvedPath, config.ignore ?? []);
+            const githubContext = await detectGitHubContext();
+            // If diff baseRef was not explicitly specified and GITHUB_BASE_REF is set, use it
+            const effectiveBaseRef = (options.diff === true || options.diff === '') && githubContext.baseRef
+                ? githubContext.baseRef
+                : options.diff;
+            result.prAnalysis = await analyzePR(resolvedPath, {
+                baseRef: effectiveBaseRef,
+                ignorePatterns: config.ignore ?? [],
+                currentResult: result,
+                currentContext,
+            });
+            // Handle Markdown PR summary if requested or running in GitHub Actions
+            const shouldWriteSummary = options.summary !== undefined || githubContext.isGitHubActions;
+            if (shouldWriteSummary && result.prAnalysis) {
+                const markdown = generatePRMarkdownSummary(result.prAnalysis);
+                // If specific file requested via --summary <file>, write directly
+                if (typeof options.summary === 'string' && options.summary.length > 0) {
+                    await fs.writeFile(options.summary, markdown, 'utf8');
+                    if (!isJsonMode && !isSarifMode) {
+                        process.stderr.write(`PR summary written to: ${options.summary}\n`);
+                    }
+                }
+                // In GitHub Actions, publish to GITHUB_STEP_SUMMARY
+                if (githubContext.isGitHubActions || options.summary === true) {
+                    await publishStepSummary(markdown);
+                }
+                // Optional PR comment posting
+                if (options.prComment) {
+                    if (githubContext.repository && githubContext.prNumber && githubContext.token) {
+                        const commentRes = await publishPRComment({
+                            repository: githubContext.repository,
+                            prNumber: githubContext.prNumber,
+                            token: githubContext.token,
+                            body: markdown,
+                        });
+                        if (commentRes.success) {
+                            process.stderr.write('✓ Published PR summary comment to GitHub.\n');
+                        }
+                        else {
+                            process.stderr.write(`[Fathom] Warning: Failed to post PR comment: ${commentRes.error}\n`);
+                        }
+                    }
+                    else {
+                        process.stderr.write('[Fathom] Warning: --pr-comment requested, but GITHUB_TOKEN, repository, or PR number could not be detected.\n');
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof FathomGitDiffError) {
+                process.stderr.write(`Error: ${err.message}\n`);
+                process.exit(2);
+            }
+            throw err;
+        }
+    }
+    // Save baseline if requested
+    if (options.baseline) {
+        try {
+            const savedPath = await saveBaseline(resolvedPath, result);
+            if (!isJsonMode && !isSarifMode) {
+                const rel = path.relative(resolvedPath, savedPath) || savedPath;
+                process.stdout.write(`\n✓ Baseline saved to: ${rel}\n`);
+            }
+            else {
+                const rel = path.relative(resolvedPath, savedPath) || savedPath;
+                process.stderr.write(`✓ Baseline saved to: ${rel}\n`);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`Error: Failed to save baseline: ${String(err)}\n`);
+            process.exit(3);
+        }
+    }
+    // Report
+    if (isSarifMode) {
+        const reporter = new SarifReporter();
+        if (options.output) {
+            const sarif = reporter.generateSarif(result);
+            await fs.writeFile(options.output, sarif, 'utf8');
+            process.stderr.write(`SARIF report written to: ${options.output}\n`);
+        }
+        else {
+            await reporter.report(result);
+        }
+    }
+    else if (isJsonMode) {
+        const reporter = new JsonReporter();
+        if (options.output) {
+            // Write JSON to file
+            const json = JSON.stringify(result, null, 2);
+            await fs.writeFile(options.output, json, 'utf8');
+            process.stderr.write(`JSON report written to: ${options.output}\n`);
+        }
+        else {
+            await reporter.report(result);
+        }
+    }
+    else if (options.html !== undefined) {
+        const htmlPath = typeof options.html === 'string' && options.html !== '' ? options.html : 'fathom-report.html';
+        const termReporter = new TerminalReporter();
+        await termReporter.report(result, isCIMode, isVerbose);
+        const htmlReporter = new HtmlReporter();
+        await htmlReporter.report(result, htmlPath);
+        process.stdout.write(`HTML report written to: ${htmlPath}\n`);
+    }
+    else {
+        const termReporter = new TerminalReporter();
+        if (options.architecture) {
+            termReporter.printArchitectureReport(result);
+        }
+        else if (options.deps) {
+            termReporter.printDependencyReport(result);
+        }
+        else {
+            await termReporter.report(result, isCIMode, isVerbose);
+        }
+    }
+    // fail-under threshold check (CLI flag takes precedence over .fathom.json)
+    const threshold = options.failUnder ?? config.failUnder;
+    if (typeof threshold === 'number') {
+        if (result.score.overall < threshold) {
+            if (!isJsonMode && !isSarifMode) {
+                process.stderr.write(`\nScore ${result.score.overall} is below threshold ${threshold}. Exiting with code 1.\n`);
+            }
+            process.exit(1);
+        }
+    }
+    // CI mode regression check
+    if (isCIMode && options.compare && result.comparison?.isRegression) {
+        process.stderr.write(`\nRegression detected compared to baseline. Exiting with code 1.\n`);
+        process.exit(1);
+    }
+    // CI mode PR diff check: fail build if changes introduce new findings or regression
+    if (isCIMode && options.diff !== undefined && result.prAnalysis) {
+        if (!result.prAnalysis.verdict.passed) {
+            process.stderr.write(`\nPR analysis check failed: ${result.prAnalysis.verdict.summary}. Exiting with code 1.\n`);
+            process.exit(1);
+        }
+    }
+    // CI mode: exit 1 on any critical or high finding (no score threshold —
+    // a single leaked key must fail CI even if overall score is 90).
+    if (isCIMode && typeof threshold !== 'number') {
+        const blocking = result.findings.filter((f) => f.severity === 'critical' || f.severity === 'high');
+        if (blocking.length > 0) {
+            process.stderr.write(`\n${blocking.length} critical/high finding${blocking.length > 1 ? 's' : ''} detected. Exiting with code 1.\n`);
+            process.exit(1);
+        }
+    }
+    process.exit(0);
+}
+//# sourceMappingURL=commands.js.map

package/dist/cli/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA8B3D;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,OAAuB;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;IAE3C,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,YAAY,yBAAyB,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,YAAY,qBAAqB,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,OAAO,oDAAoD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,0BAA0B,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,OAAO,GAAkC,IAAI,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7C,OAAO,GAAG,GAAG,CAAC;YACZ,IAAI,EAAE,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;YAClD,KAAK,EAAE,MAAM;SACd,CAAC,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,YAAY,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,aAAa,GAAmB,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,KAAK,KAAK,sBAAsB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;YACnC,cAAc,EAAE,YAAY;YAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACnC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClC,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;IAEhB,2CAA2C;IAC3C,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,aAAa,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAElD,kFAAkF;YAClF,MAAM,gBAAgB,GACpB,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO;gBACrE,CAAC,CAAC,aAAa,CAAC,OAAO;gBACvB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAEnB,MAAM,CAAC,UAAU,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE;gBAChD,OAAO,EAAE,gBAAgB;gBACzB,cAAc,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBACnC,aAAa,EAAE,MAAM;gBACrB,cAAc;aACf,CAAC,CAAC;YAEH,uEAAuE;YACvE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC;YAE1F,IAAI,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAE9D,kEAAkE;gBAClE,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACtD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;wBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;oBACtE,CAAC;gBACH,CAAC;gBAED,oDAAoD;gBACpD,IAAI,aAAa,CAAC,eAAe,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC9D,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBACrC,CAAC;gBAED,8BAA8B;gBAC9B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtB,IAAI,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;wBAC9E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;4BACxC,UAAU,EAAE,aAAa,CAAC,UAAU;4BACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,KAAK,EAAE,aAAa,CAAC,KAAK;4BAC1B,IAAI,EAAE,QAAQ;yBACf,CAAC,CAAC;wBACH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;4BACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;wBACtE,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,UAAU,CAAC,KAAK,IAAI,CACrE,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+GAA+G,CAChH,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;gBAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;gBAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,SAAS;IACT,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,qBAAqB;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAEhG,MAAM,YAAY,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEvD,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,QAAQ,IAAI,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,YAAY,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,uBAAuB,SAAS,0BAA0B,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oFAAoF;IACpF,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,0BAA0B,CAC3F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAC1D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,QAAQ,CAAC,MAAM,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mCAAmC,CAC/G,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { analyzeCommand } from './commands.js';
+const program = new Command();
+program
+    .name('fathom')
+    .description("Know what's beneath the surface. Local-first repository intelligence.")
+    .version('0.1.0', '-v, --version', 'Output the current version')
+    .argument('[path]', 'Path to the repository to analyze', '.')
+    .option('--json', 'Output results as JSON (to stdout)')
+    .option('--sarif', 'Output results in SARIF 2.1.0 format (to stdout or file with -o)')
+    .option('--html [file]', 'Generate an HTML report (default: fathom-report.html)')
+    .option('--ci', 'CI mode: compact output, exit 1 on critical findings')
+    .option('--fail-under <number>', 'Exit 1 if the health score is below this value', parseFloat)
+    .option('-o, --output <file>', 'Write JSON or SARIF report directly to a file')
+    .option('--verbose', 'Show all findings in terminal output without truncation')
+    .option('--baseline', 'Save the current analysis as baseline in .fathom/baseline.json')
+    .option('--compare', 'Compare current analysis against .fathom/baseline.json and report regressions')
+    .option('--diff [ref]', 'Analyze changes introduced by Git diff against base ref (default: auto-detect)')
+    .option('--summary [file]', 'Generate Markdown PR summary (writes to GITHUB_STEP_SUMMARY or specified file)')
+    .option('--pr-comment', 'Post PR summary comment to GitHub pull request (requires GITHUB_TOKEN)')
+    .option('--architecture', 'Display architecture model, layers, and boundary checks')
+    .option('--deps', 'Display dependency intelligence, duplicates, and configuration hygiene')
+    .option('--online', 'Enable online dependency vulnerability and freshness queries (opt-in)')
+    .action(async (targetPath, options) => {
+    await analyzeCommand(targetPath, options);
+});
+program.parse(process.argv);
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,uEAAuE,CAAC;KACpF,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;KAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,EAAE,GAAG,CAAC;KAC5D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,SAAS,EAAE,kEAAkE,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,uDAAuD,CAAC;KAChF,MAAM,CAAC,MAAM,EAAE,sDAAsD,CAAC;KACtE,MAAM,CAAC,uBAAuB,EAAE,gDAAgD,EAAE,UAAU,CAAC;KAC7F,MAAM,CAAC,qBAAqB,EAAE,+CAA+C,CAAC;KAC9E,MAAM,CAAC,WAAW,EAAE,yDAAyD,CAAC;KAC9E,MAAM,CAAC,YAAY,EAAE,gEAAgE,CAAC;KACtF,MAAM,CACL,WAAW,EACX,+EAA+E,CAChF;KACA,MAAM,CACL,cAAc,EACd,gFAAgF,CACjF;KACA,MAAM,CACL,kBAAkB,EAClB,gFAAgF,CACjF;KACA,MAAM,CAAC,cAAc,EAAE,wEAAwE,CAAC;KAChG,MAAM,CAAC,gBAAgB,EAAE,yDAAyD,CAAC;KACnF,MAAM,CAAC,QAAQ,EAAE,wEAAwE,CAAC;KAC1F,MAAM,CAAC,UAAU,EAAE,uEAAuE,CAAC;KAC3F,MAAM,CACL,KAAK,EACH,UAAkB,EAClB,OAgBC,EACD,EAAE;IACF,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC;AAEJ,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/cli/options.d.ts

@@ -0,0 +1,55 @@
+import type { RuleConfigValue } from '../rules/registry.js';
+/**
+ * Valid string states for rules.
+ */
+export type RuleState = 'off' | 'warning' | 'error';
+/**
+ * Fathom configuration file schema (.fathom.json).
+ */
+export interface FathomConfig {
+    /** Configuration schema version (currently 1) */
+    version?: number | undefined;
+    /** Glob patterns to ignore during analysis */
+    ignore: string[];
+    /** Minimum overall health score before CI exit 1 */
+    failUnder?: number | undefined;
+    /** Explicit opt-in flag required to disable critical security checks */
+    allowDisableSecurity?: boolean | undefined;
+    /** Thresholds for various checks */
+    thresholds: {
+        /** Large file size threshold in MB (default: 10) */
+        largeFileMB: number;
+        /** Large file line threshold (default: 500) */
+        largeFileLines: number;
+    };
+    /** Per-rule overrides */
+    rules: Record<string, RuleConfigValue>;
+    /** Explicit list of security rules that were intentionally disabled */
+    disabledSecurityRules?: string[] | undefined;
+    /** Optional list of enabled plugins (e.g. ["@fathom/plugin-react"]) */
+    plugins?: string[] | undefined;
+}
+/**
+ * Default configuration.
+ */
+export declare const DEFAULT_CONFIG: FathomConfig;
+/**
+ * Expands an ignore pattern into fast-glob compatible patterns.
+ * Supports directory patterns, root-anchored paths, and file extensions.
+ */
+export declare function expandIgnorePattern(pattern: string): string[];
+/**
+ * Parses the contents of a .fathomignore file.
+ * Ignores comments (lines starting with #) and blank lines.
+ */
+export declare function parseFathomIgnore(content: string): string[];
+/**
+ * Reads and parses .fathomignore if present in the repository root.
+ */
+export declare function loadFathomIgnore(repositoryRoot: string): Promise<string[]>;
+/**
+ * Load and validate configuration from .fathom.json and .fathomignore.
+ * Returns default config merged with .fathomignore if no .fathom.json exists.
+ */
+export declare function loadConfig(repositoryRoot: string): Promise<FathomConfig>;
+//# sourceMappingURL=options.d.ts.map

package/dist/cli/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/cli/options.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,oCAAoC;IACpC,UAAU,EAAE;QACV,oDAAoD;QACpD,WAAW,EAAE,MAAM,CAAC;QACpB,+CAA+C;QAC/C,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,YAQ5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA+B7D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAa3D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQhF;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAgP9E"}

package/dist/cli/options.js

@@ -0,0 +1,258 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { FathomConfigError } from '../core/errors.js';
+import { RULE_DEFINITIONS } from '../rules/definitions.js';
+/**
+ * Default configuration.
+ */
+export const DEFAULT_CONFIG = {
+    version: 1,
+    ignore: [],
+    thresholds: {
+        largeFileMB: 10,
+        largeFileLines: 500,
+    },
+    rules: {},
+};
+/**
+ * Expands an ignore pattern into fast-glob compatible patterns.
+ * Supports directory patterns, root-anchored paths, and file extensions.
+ */
+export function expandIgnorePattern(pattern) {
+    let p = pattern.trim().replace(/\\/g, '/');
+    if (!p)
+        return [];
+    const isRootAnchored = p.startsWith('/');
+    if (isRootAnchored) {
+        p = p.slice(1);
+    }
+    const isDir = p.endsWith('/');
+    if (isDir) {
+        p = p.slice(0, -1);
+    }
+    const results = [];
+    if (isDir) {
+        results.push(`${p}/**`);
+        if (!isRootAnchored) {
+            results.push(`**/${p}/**`);
+        }
+    }
+    else {
+        results.push(p);
+        results.push(`${p}/**`);
+        if (!isRootAnchored) {
+            results.push(`**/${p}`);
+            results.push(`**/${p}/**`);
+        }
+    }
+    return [...new Set(results)];
+}
+/**
+ * Parses the contents of a .fathomignore file.
+ * Ignores comments (lines starting with #) and blank lines.
+ */
+export function parseFathomIgnore(content) {
+    const patterns = [];
+    const lines = content.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        patterns.push(...expandIgnorePattern(trimmed));
+    }
+    return [...new Set(patterns)];
+}
+/**
+ * Reads and parses .fathomignore if present in the repository root.
+ */
+export async function loadFathomIgnore(repositoryRoot) {
+    const ignorePath = path.join(repositoryRoot, '.fathomignore');
+    try {
+        const content = await fs.readFile(ignorePath, 'utf8');
+        return parseFathomIgnore(content);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Load and validate configuration from .fathom.json and .fathomignore.
+ * Returns default config merged with .fathomignore if no .fathom.json exists.
+ */
+export async function loadConfig(repositoryRoot) {
+    const fathomIgnorePatterns = await loadFathomIgnore(repositoryRoot);
+    const configPath = path.join(repositoryRoot, '.fathom.json');
+    let raw;
+    try {
+        raw = await fs.readFile(configPath, 'utf8');
+    }
+    catch {
+        // No .fathom.json file — use defaults merged with .fathomignore
+        return {
+            ...DEFAULT_CONFIG,
+            ignore: fathomIgnorePatterns,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new FathomConfigError(`.fathom.json is not valid JSON. Please fix the syntax.`, configPath);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new FathomConfigError(`.fathom.json must be a JSON object.`, configPath);
+    }
+    const config = parsed;
+    // Validate allowed top-level keys
+    const allowedKeys = new Set([
+        'version',
+        'ignore',
+        'failUnder',
+        'allowDisableSecurity',
+        'thresholds',
+        'rules',
+    ]);
+    for (const key of Object.keys(config)) {
+        if (!allowedKeys.has(key)) {
+            throw new FathomConfigError(`Unknown configuration property: "${key}". Allowed properties: ${[...allowedKeys].join(', ')}.`, configPath);
+        }
+    }
+    // Validate version (if present, must be 1)
+    if (config['version'] !== undefined) {
+        if (typeof config['version'] !== 'number' || config['version'] !== 1) {
+            throw new FathomConfigError(`Unsupported configuration version: ${JSON.stringify(config['version'])}. Supported versions: 1.`, configPath);
+        }
+    }
+    // Validate failUnder (0–100 number)
+    if (config['failUnder'] !== undefined) {
+        if (typeof config['failUnder'] !== 'number' ||
+            config['failUnder'] < 0 ||
+            config['failUnder'] > 100 ||
+            Number.isNaN(config['failUnder'])) {
+            throw new FathomConfigError(`"failUnder" must be a number between 0 and 100.`, configPath);
+        }
+    }
+    // Validate allowDisableSecurity (boolean)
+    if (config['allowDisableSecurity'] !== undefined &&
+        typeof config['allowDisableSecurity'] !== 'boolean') {
+        throw new FathomConfigError(`"allowDisableSecurity" must be a boolean.`, configPath);
+    }
+    // Validate ignore array
+    const jsonIgnorePatterns = [];
+    if (config['ignore'] !== undefined) {
+        if (!Array.isArray(config['ignore']) || !config['ignore'].every((x) => typeof x === 'string')) {
+            throw new FathomConfigError(`"ignore" in .fathom.json must be an array of strings.`, configPath);
+        }
+        for (const pat of config['ignore']) {
+            jsonIgnorePatterns.push(...expandIgnorePattern(pat));
+        }
+    }
+    // Combine ignore patterns from .fathomignore and .fathom.json
+    const combinedIgnore = [...new Set([...fathomIgnorePatterns, ...jsonIgnorePatterns])].sort();
+    // Validate thresholds
+    const thresholds = { ...DEFAULT_CONFIG.thresholds };
+    if (config['thresholds'] !== undefined) {
+        if (typeof config['thresholds'] !== 'object' ||
+            config['thresholds'] === null ||
+            Array.isArray(config['thresholds'])) {
+            throw new FathomConfigError(`"thresholds" in .fathom.json must be an object.`, configPath);
+        }
+        const t = config['thresholds'];
+        if (t['largeFileMB'] !== undefined) {
+            if (typeof t['largeFileMB'] !== 'number' || t['largeFileMB'] <= 0) {
+                throw new FathomConfigError(`"thresholds.largeFileMB" must be a positive number.`, configPath);
+            }
+            thresholds.largeFileMB = t['largeFileMB'];
+        }
+        if (t['largeFileLines'] !== undefined) {
+            if (typeof t['largeFileLines'] !== 'number' || t['largeFileLines'] <= 0) {
+                throw new FathomConfigError(`"thresholds.largeFileLines" must be a positive number.`, configPath);
+            }
+            thresholds.largeFileLines = t['largeFileLines'];
+        }
+    }
+    // Validate rules
+    const rules = {};
+    const disabledSecurityRules = [];
+    const allowDisableSecurity = config['allowDisableSecurity'] === true;
+    if (config['rules'] !== undefined) {
+        if (typeof config['rules'] !== 'object' ||
+            config['rules'] === null ||
+            Array.isArray(config['rules'])) {
+            throw new FathomConfigError(`"rules" in .fathom.json must be an object.`, configPath);
+        }
+        const rawRules = config['rules'];
+        const validStates = new Set(['off', 'warning', 'error']);
+        const validSeverities = new Set(['critical', 'high', 'medium', 'low', 'info']);
+        for (const [ruleId, val] of Object.entries(rawRules)) {
+            if (typeof val === 'string') {
+                if (!validStates.has(val)) {
+                    throw new FathomConfigError(`Invalid rule state "${val}" for rule "${ruleId}". Expected "off", "warning", or "error".`, configPath);
+                }
+                rules[ruleId] = val;
+            }
+            else if (typeof val === 'object' && val !== null && !Array.isArray(val)) {
+                const obj = val;
+                if (obj['enabled'] !== undefined && typeof obj['enabled'] !== 'boolean') {
+                    throw new FathomConfigError(`"enabled" for rule "${ruleId}" must be a boolean.`, configPath);
+                }
+                if (obj['severity'] !== undefined &&
+                    (typeof obj['severity'] !== 'string' || !validSeverities.has(obj['severity']))) {
+                    throw new FathomConfigError(`Invalid severity ${JSON.stringify(obj['severity'])} for rule "${ruleId}". Expected one of: ${[...validSeverities].join(', ')}.`, configPath);
+                }
+                if (obj['reason'] !== undefined && typeof obj['reason'] !== 'string') {
+                    throw new FathomConfigError(`"reason" for rule "${ruleId}" must be a string.`, configPath);
+                }
+                rules[ruleId] = {
+                    enabled: typeof obj['enabled'] === 'boolean' ? obj['enabled'] : undefined,
+                    severity: typeof obj['severity'] === 'string' ? obj['severity'] : undefined,
+                    reason: typeof obj['reason'] === 'string' ? obj['reason'] : undefined,
+                };
+            }
+            else {
+                throw new FathomConfigError(`Invalid configuration for rule "${ruleId}". Expected "off", "warning", "error", or an object.`, configPath);
+            }
+            // Check if this rule is a security check and is being disabled
+            const isSecurityRule = ruleId.startsWith('SEC-') || RULE_DEFINITIONS[ruleId]?.category === 'security';
+            const isDisabled = rules[ruleId] === 'off' ||
+                (typeof rules[ruleId] === 'object' &&
+                    rules[ruleId].enabled === false);
+            if (isSecurityRule && isDisabled) {
+                const hasExplicitReason = typeof rules[ruleId] === 'object' &&
+                    typeof rules[ruleId].reason === 'string' &&
+                    rules[ruleId].reason.trim().length > 0;
+                if (!allowDisableSecurity && !hasExplicitReason) {
+                    throw new FathomConfigError(`Cannot silently disable security check "${ruleId}". Disabling security checks requires explicit confirmation: set "allowDisableSecurity": true or provide a non-empty "reason" (e.g. "${ruleId}": { "enabled": false, "reason": "Justification..." }).`, configPath);
+                }
+                disabledSecurityRules.push(ruleId);
+            }
+        }
+    }
+    // Validate plugins if declared
+    let pluginsList;
+    if (config['plugins'] !== undefined) {
+        if (!Array.isArray(config['plugins'])) {
+            throw new FathomConfigError(`"plugins" in .fathom.json must be an array of plugin names.`, configPath);
+        }
+        pluginsList = [];
+        for (const p of config['plugins']) {
+            if (typeof p !== 'string' || !p.trim()) {
+                throw new FathomConfigError(`Each entry in "plugins" must be a non-empty string.`, configPath);
+            }
+            pluginsList.push(p.trim());
+        }
+    }
+    return {
+        version: typeof config['version'] === 'number' ? config['version'] : 1,
+        ignore: combinedIgnore,
+        failUnder: typeof config['failUnder'] === 'number' ? config['failUnder'] : undefined,
+        allowDisableSecurity,
+        thresholds,
+        rules,
+        disabledSecurityRules,
+        plugins: pluginsList,
+    };
+}
+//# sourceMappingURL=options.js.map