@lintsure/core 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Lintsure
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -1,3 +1,12 @@
-# Temporary Holding Version
+# @lintsure/core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The Lintsure engine: rules, framework knowledge, scanning and report writers. Used by the [`lintsure`](https://www.npmjs.com/package/lintsure) CLI and [`@lintsure/mcp`](https://www.npmjs.com/package/@lintsure/mcp). No network code.
+
+> **Lintsure is a readiness tool, not an audit, a certification or legal advice.** Results cover code only; a qualified person should review them.
+
+```js
+import { scan, toMarkdown, toAssessmentHtml } from "@lintsure/core";
+const report = await scan("./my-app", ["gdpr", "soc2"]);
+```
+
+Docs: https://lintsure.com/docs · Source: https://github.com/lintsure/lintsure · Apache-2.0

package/dist/src/assessment.d.ts

@@ -0,0 +1,8 @@
+import type { Report } from "./types.js";
+export interface AssessmentOptions {
+    /** Shown on the cover. Defaults to "Your project". */
+    project?: string;
+    /** Date the report was produced, as YYYY-MM-DD. Passed in so the same input gives the same file. */
+    date: string;
+}
+export declare function toAssessmentHtml(r: Report, opts: AssessmentOptions): string;

package/dist/src/assessment.js

@@ -0,0 +1,116 @@
+// The assessment report: one self-contained HTML file, laid out in print pages, so a person can
+// read it, annotate it, print it or save it as a PDF from any browser. It is a draft until a
+// qualified person reviews it and fills in the sign-off page.
+import { DISCLAIMER, NOT_A_VERDICT, nextSteps } from "./index.js";
+import { knowledge } from "./knowledge/index.js";
+const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+const NAME = { "eu-ai-act": "EU AI Act", gdpr: "GDPR", soc2: "SOC 2", "iso-27001": "ISO/IEC 27001" };
+const STATUS = { gap: "Gap", partial: "Partial", met: "Met", outside: "Outside code" };
+const SEV = ["high", "medium", "low"];
+const SKIPPED = "node_modules, .git, dist, build, out, .output, .next, .nuxt, .svelte-kit, .astro, .vercel, .netlify, .wrangler, .turbo, .cache, venv, .venv, __pycache__, coverage";
+function page(title, body, n, total, project) {
+    return `<section class="page"><header><span>Lintsure readiness assessment · ${esc(project)}</span><span>Draft until reviewed by a person</span></header>
+<h2>${esc(title)}</h2>${body}<footer><span>Not an audit, a certification or legal advice.</span><span>Section ${n} of ${total}</span></footer></section>`;
+}
+function findingCard(f, i) {
+    return `<article class="finding ${f.status}">
+  <p class="meta"><b class="st">${STATUS[f.status]}</b> · ${f.severity} severity · <code>${esc(f.ruleId)}</code></p>
+  <h3>${i}. ${esc(f.title)}</h3>
+  <p class="where"><code>${esc(f.file)}:${f.line}</code></p>
+  <dl>
+    <dt>Rules it may affect</dt><dd>${f.controls.map((c) => `${NAME[c.framework]} ${esc(c.id)} (${esc(c.title)})`).join("<br>")}</dd>
+    <dt>Why it matters</dt><dd>${esc(f.note)}</dd>
+    <dt>Possible fix</dt><dd>${esc(f.fix)} Review the change before it is made.</dd>
+  </dl>
+  <p class="decide"><b>Reviewer decision:</b> ☐ Fix &nbsp; ☐ Accept the risk (record why) &nbsp; ☐ Not applicable (record why) &nbsp; Initials ______ &nbsp; Date ______</p>
+</article>`;
+}
+export function toAssessmentHtml(r, opts) {
+    const project = opts.project?.trim() || "Your project";
+    const n = (s) => r.findings.filter((f) => f.status === s).length;
+    const fws = r.frameworks;
+    const sorted = [...r.findings].sort((a, b) => SEV.indexOf(a.severity) - SEV.indexOf(b.severity));
+    const cover = `<section class="page cover">
+  <p class="brand">Lintsure</p>
+  <h1>Readiness assessment</h1>
+  <p class="sub">${esc(project)}</p>
+  <table class="facts">
+    <tr><th>Date produced</th><td>${esc(opts.date)}</td></tr>
+    <tr><th>Frameworks checked</th><td>${fws.map((f) => NAME[f]).join(", ") || "None"}</td></tr>
+    <tr><th>Files checked</th><td>${r.filesChecked}</td></tr>
+    <tr><th>Rules version</th><td>${esc(r.rulesVersion)}</td></tr>
+    <tr><th>Status of this report</th><td><b>Draft.</b> Not complete until a qualified person reviews it and signs the review page.</td></tr>
+  </table>
+  <div class="callout"><b>Read this first.</b> ${esc(DISCLAIMER)}</div>
+</section>`;
+    const summary = `<p>This report shows where your code may not meet the code-related parts of the frameworks above, what could be done about it, and what still has to happen outside code. It is a starting point for a person to review, not a conclusion.</p>
+<table class="counts"><tr><th>Gap</th><th>Partial</th><th>Rules with no finding (Met)</th><th>Outside code</th></tr>
+<tr><td>${n("gap")}</td><td>${n("partial")}</td><td>${r.met.length}</td><td>${r.outside.length}</td></tr></table>
+<h3>By framework</h3>
+<table><tr><th>Framework</th><th>Gaps</th><th>Partial</th><th>Rules with no finding</th><th>Outside-code items</th></tr>
+${fws.map((f) => `<tr><td>${NAME[f]}</td><td>${r.findings.filter((x) => x.status === "gap" && x.controls.some((c) => c.framework === f)).length}</td><td>${r.findings.filter((x) => x.status === "partial" && x.controls.some((c) => c.framework === f)).length}</td><td>${r.met.filter((m) => m.controls.some((c) => c.framework === f)).length}</td><td>${r.outside.filter((o) => o.framework === f).length}</td></tr>`).join("")}</table>
+<div class="callout"><b>What this summary does not mean.</b> ${esc(NOT_A_VERDICT)}</div>`;
+    const method = `<h3>What was checked</h3>
+<p>Lintsure read ${r.filesChecked} files in the project folder on the computer or CI runner where it ran. Nothing was uploaded. It skipped these folders: ${SKIPPED}, any paths listed under ignore in lintsure.config.yaml, minified files, and any file over 1 MB or binary.</p>
+<h3>How results are produced</h3>
+<ul><li>A fixed set of rules (version ${esc(r.rulesVersion)}) looks for known patterns, line by line or file by file. It does not use a language model to decide results, so the same code gives the same findings.</li>
+<li><b>Gap</b>: a rule found code that may break a control. <b>Partial</b>: a likely problem that depends on context only you can confirm. <b>Met</b>: the rule ran and found nothing in the files it read. <b>Outside code</b>: work that code cannot show.</li>
+<li>Rules reflect our reading of the publicly available text of each framework. They are in Beta: their mappings to framework controls await review by a qualified compliance professional.</li></ul>
+<h3>Known limits</h3>
+<ul><li>Rules can miss real problems and can flag code that is fine.</li><li>They do not follow data across files or functions.</li><li>They mainly cover JavaScript, TypeScript and Python.</li><li>They cannot see infrastructure, cloud settings, or anything outside the folder that was scanned.</li></ul>`;
+    const findingsBody = sorted.length
+        ? `<p>${sorted.length} possible issue${sorted.length === 1 ? "" : "s"}, most severe first. For each one, a reviewer records a decision.</p>${sorted.map((f, i) => findingCard(f, i + 1)).join("")}`
+        : `<p>The current rules found no possible issues in the files they read. That is not the same as having none: rules have limits (see "Scope and method"), and the outside-code work still applies.</p>`;
+    const byFramework = fws.map((f) => {
+        const k = knowledge.find((x) => x.id === f);
+        const hits = r.findings.filter((x) => x.controls.some((c) => c.framework === f));
+        const rows = (k?.obligations ?? []).map((o) => {
+            const related = hits.filter((h) => o.rules?.includes(h.ruleId));
+            const result = o.inCode === "no" ? "Outside code: needs evidence" : related.length ? `${related.length} finding${related.length === 1 ? "" : "s"} to review` : o.inCode === "partly" ? "No finding from the rules; code shows only part of this" : "No finding from the rules";
+            return `<tr><td><code>${esc(o.ref)}</code></td><td><b>${esc(o.title)}.</b> ${esc(o.plain)}</td><td>${result}</td></tr>`;
+        }).join("");
+        return `<h3>${NAME[f]}</h3>${k ? `<p>${esc(k.summary)}</p>` : ""}<table><tr><th>Ref</th><th>What it asks</th><th>What Lintsure saw</th></tr>${rows}</table>`;
+    }).join("");
+    const outside = r.outside.length
+        ? `<p>Code cannot show these. They still need to be done before a full review. Assign an owner to each.</p><table><tr><th>Framework</th><th>Item</th><th>Evidence an auditor may ask for</th><th>Owner</th><th>Done</th></tr>
+${r.outside.map((o) => `<tr><td>${NAME[o.framework]} <code>${esc(o.control)}</code></td><td>${esc(o.title)}</td><td>${esc(o.evidence)}</td><td></td><td>☐</td></tr>`).join("")}</table>`
+        : `<p>No outside-code items for the frameworks checked.</p>`;
+    const next = `<ol>${nextSteps(r).map((s) => `<li>${esc(s)}</li>`).join("")}</ol>
+<p>Lintsure suggests; people decide. Re-run Lintsure after changes, and keep each signed report with the rules version it was produced with.</p>`;
+    const signoff = `<div class="callout"><b>Human review is required.</b> This report is a draft produced by software. It must be reviewed by a qualified person, such as a compliance professional, before anyone relies on it for an audit, a certification, a customer answer or a business decision.</div>
+<table class="sign">
+<tr><th>Reviewer name</th><td></td></tr><tr><th>Role and qualification</th><td></td></tr><tr><th>Date of review</th><td></td></tr>
+<tr><th>Scope reviewed</th><td>☐ All findings &nbsp; ☐ Outside-code items &nbsp; ☐ Framework applicability</td></tr>
+<tr><th>Overall notes</th><td class="tall"></td></tr><tr><th>Signature</th><td class="tall"></td></tr></table>
+<p class="small">By signing, the reviewer confirms they reviewed this report. Signing does not turn it into an audit or certification.</p>`;
+    const pages = [
+        ["Summary", summary], ["Scope and method", method], ["Possible issues and fixes", findingsBody],
+        ["Framework by framework", byFramework || "<p>No frameworks were checked.</p>"], ["Work outside code", outside],
+        ["What to do next", next], ["Human review and sign-off", signoff], ["Disclaimer", `<p>${esc(DISCLAIMER)}</p><p>${esc(NOT_A_VERDICT)}</p><p>Lintsure does not decide whether a framework applies to you or whether you meet it. A person makes the final call. Full disclaimer: https://lintsure.com/disclaimer</p>`],
+    ];
+    const total = pages.length + 1;
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Lintsure readiness assessment · ${esc(project)} · ${esc(opts.date)}</title>
+<style>
+:root{--ink:#141413;--muted:#5E5D59;--line:#E4E2DD;--sunken:#F5F4F1;--gap:#B42318;--partial:#8A5A00;--met:#0B6E4F}
+*{box-sizing:border-box}body{margin:0;background:#ECEAE5;color:var(--ink);font:14px/1.55 -apple-system,"Segoe UI",Helvetica,Arial,sans-serif}
+.page{background:#fff;width:210mm;min-height:297mm;margin:16px auto;padding:18mm 18mm 22mm;position:relative;box-shadow:0 2px 12px #0002}
+header,footer{display:flex;justify-content:space-between;font-size:10px;color:var(--muted)}header{border-bottom:1px solid var(--line);padding-bottom:6px;margin-bottom:18px}
+footer{position:absolute;left:18mm;right:18mm;bottom:10mm;border-top:1px solid var(--line);padding-top:6px}
+h1{font-size:40px;letter-spacing:-.03em;margin:40mm 0 4px}h2{font-size:24px;letter-spacing:-.02em;margin:0 0 12px}h3{font-size:16px;margin:20px 0 6px}
+.brand{font-weight:700;letter-spacing:-.02em;font-size:18px}.sub{font-size:18px;color:var(--muted);margin:0 0 24px}
+table{width:100%;border-collapse:collapse;margin:8px 0 12px;font-size:12.5px}th,td{border:1px solid var(--line);padding:6px 8px;text-align:left;vertical-align:top}th{background:var(--sunken);font-weight:600}
+.counts td{font-size:22px;font-weight:600;text-align:center}.facts th{width:38%}
+.callout{border:1px solid var(--ink);border-radius:8px;padding:10px 12px;margin:14px 0;font-size:13px}
+code{font:12px ui-monospace,Menlo,Consolas,monospace;background:var(--sunken);padding:1px 4px;border-radius:4px}
+.finding{border:1px solid var(--line);border-radius:8px;padding:10px 12px;margin:10px 0;break-inside:avoid}.finding h3{margin:4px 0 2px}
+.finding .meta{margin:0;font-size:12px;color:var(--muted)}.gap .st{color:var(--gap)}.partial .st{color:var(--partial)}
+.where{margin:0 0 6px}dl{margin:0;display:grid;grid-template-columns:150px 1fr;gap:4px 10px;font-size:12.5px}dt{color:var(--muted)}dd{margin:0}
+.decide{font-size:12px;margin:8px 0 0;padding-top:6px;border-top:1px dashed var(--line)}
+.sign td{height:28px}.sign .tall{height:70px}.small{font-size:11.5px;color:var(--muted)}
+@page{size:A4;margin:0}@media print{body{background:#fff}.page{margin:0;box-shadow:none;break-after:page}}
+</style></head><body>
+${cover}
+${pages.map(([t, b], i) => page(t, b, i + 2, total, project)).join("\n")}
+</body></html>`;
+}

package/dist/src/guidance.d.ts

@@ -0,0 +1,3 @@
+export declare const AGENT_GUIDANCE = "You are using Lintsure, a readiness tool that checks code against compliance frameworks.\n\nWhen you report Lintsure results:\n- Never say or imply the user is compliant, certified, approved, audit-ready, \"good to go\", or that they passed. Lintsure cannot decide that.\n- Never make a decision for the user. Present findings and options; the user chooses what to do.\n- Always ask for confirmation before changing any file, and before treating a framework as applicable.\n- Say that results cover code only, against Lintsure's reading of the publicly available text of each framework.\n- Always mention the items outside code (policies, training, contracts, evidence) that still need to be done before a full review.\n- Recommend that a qualified person review the results before any audit, certification or business decision.\n- A control marked Met only means Lintsure's rules found no problem in the files they read. Say so if you mention Met.";
+/** Phrases that read as a verdict. Lintsure's own output must never claim these. */
+export declare const FORBIDDEN_CLAIMS: RegExp[];

package/dist/src/guidance.js

@@ -0,0 +1,18 @@
+// How any agent should talk about Lintsure results. Sent to MCP clients as server instructions
+// and tested: the report text must never contain the phrases in FORBIDDEN_CLAIMS.
+export const AGENT_GUIDANCE = `You are using Lintsure, a readiness tool that checks code against compliance frameworks.
+
+When you report Lintsure results:
+- Never say or imply the user is compliant, certified, approved, audit-ready, "good to go", or that they passed. Lintsure cannot decide that.
+- Never make a decision for the user. Present findings and options; the user chooses what to do.
+- Always ask for confirmation before changing any file, and before treating a framework as applicable.
+- Say that results cover code only, against Lintsure's reading of the publicly available text of each framework.
+- Always mention the items outside code (policies, training, contracts, evidence) that still need to be done before a full review.
+- Recommend that a qualified person review the results before any audit, certification or business decision.
+- A control marked Met only means Lintsure's rules found no problem in the files they read. Say so if you mention Met.`;
+/** Phrases that read as a verdict. Lintsure's own output must never claim these. */
+export const FORBIDDEN_CLAIMS = [
+    /\byou(?:'re| are) (?:now )?(?:fully )?(?:compliant|certified|audit[- ]ready|ready for (?:an |the )?audit)\b/i,
+    /\b(?:good to go|all clear|you passed|passed the audit|guaranteed?)\b/i,
+    /\bis (?:now )?(?:fully )?(?:compliant|certified)\b/i,
+];

package/dist/src/index.d.ts

@@ -0,0 +1,31 @@
+import { rules } from "./rules/index.js";
+import type { FrameworkId, Report } from "./types.js";
+export * from "./types.js";
+export { rules };
+export * from "./guidance.js";
+export { toAssessmentHtml } from "./assessment.js";
+export * from "./knowledge/index.js";
+export declare const RULES_VERSION = "0.1.1";
+/** Shown with every result, in every interface. Lintsure prepares; people decide. */
+export declare const DISCLAIMER: string;
+/** What a report must never be read as. Used in the report and by the MCP server. */
+export declare const NOT_A_VERDICT: string;
+/** Plain next steps, so a report always ends with what a person still needs to do. */
+export declare function nextSteps(r: Report): string[];
+export declare const ALL_FRAMEWORKS: FrameworkId[];
+/** Reads the frameworks list from lintsure.config.yaml in the repo root, if there is one.
+ *  Only the simple list form is supported:
+ *    frameworks:
+ *      - gdpr
+ *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`.
+ *  An `ignore:` list of paths (relative to the root, for example tests/ or fixtures/) is skipped by scan(). */
+export declare function readConfig(root: string): Promise<{
+    frameworks: FrameworkId[] | null;
+    skipped: string[];
+    ignore: string[];
+}>;
+export declare const SKIP_DIRS: string[];
+/** Scout: list files to check, sorted so output order never depends on the file system. */
+export declare function listFiles(root: string, ignore?: string[]): Promise<string[]>;
+export declare function scan(root: string, frameworks?: FrameworkId[]): Promise<Report>;
+export declare function toMarkdown(r: Report): string;

package/dist/src/index.js

@@ -0,0 +1,168 @@
+// Scout (file walk) + Checker (rules) + Auditor (dedupe, sort) + Officer (outside code).
+// No network calls anywhere in this package: a test enforces it.
+import { readdir, readFile } from "node:fs/promises";
+import { extname, join, relative, sep } from "node:path";
+import { outsideFor } from "./knowledge/index.js";
+import { rules } from "./rules/index.js";
+export * from "./types.js";
+export { rules };
+export * from "./guidance.js";
+export { toAssessmentHtml } from "./assessment.js";
+export * from "./knowledge/index.js";
+export const RULES_VERSION = "0.1.1";
+/** Shown with every result, in every interface. Lintsure prepares; people decide. */
+export const DISCLAIMER = "Lintsure is a readiness tool, not an audit, a certification or legal advice. " +
+    "Its rules reflect our reading of the publicly available text of each framework, and they check code only. " +
+    "Work outside code, such as policies, training, contracts and evidence, still has to be done. " +
+    "Have a qualified person review the results before any audit, certification or decision.";
+/** What a report must never be read as. Used in the report and by the MCP server. */
+export const NOT_A_VERDICT = "These results do not mean you are compliant, certified or ready for an audit. A control marked Met means only that " +
+    "Lintsure's rules found no problem in the files they read.";
+/** Plain next steps, so a report always ends with what a person still needs to do. */
+export function nextSteps(r) {
+    const gaps = r.findings.filter((f) => f.status === "gap").length;
+    const partial = r.findings.filter((f) => f.status === "partial").length;
+    return [
+        gaps ? `Review the ${gaps} gap${gaps === 1 ? "" : "s"} and decide how to fix each one. Approve any change before it is made.` : "No gaps were found by the current rules. Keep checking as the code changes.",
+        partial ? `Check the ${partial} partial finding${partial === 1 ? "" : "s"}: each depends on context only you can confirm.` : "",
+        `Work through the ${r.outside.length} item${r.outside.length === 1 ? "" : "s"} that live outside code. Code checks alone are not enough for a full review.`,
+        "Ask a qualified compliance professional to review the results before you rely on them.",
+    ].filter(Boolean);
+}
+export const ALL_FRAMEWORKS = ["gdpr", "soc2", "iso-27001", "eu-ai-act"];
+/** Reads the frameworks list from lintsure.config.yaml in the repo root, if there is one.
+ *  Only the simple list form is supported:
+ *    frameworks:
+ *      - gdpr
+ *  Ids Lintsure doesn't check yet (for example "hipaa") are returned in `skipped`.
+ *  An `ignore:` list of paths (relative to the root, for example tests/ or fixtures/) is skipped by scan(). */
+export async function readConfig(root) {
+    let text;
+    try {
+        text = await readFile(join(root, "lintsure.config.yaml"), "utf8");
+    }
+    catch {
+        return { frameworks: null, skipped: [], ignore: [] };
+    }
+    const lists = { frameworks: [], ignore: [] };
+    let key = "";
+    let emptyFw = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/#.*$/, "").trimEnd();
+        if (/^frameworks\s*:\s*\[\s*\]\s*$/.test(line)) {
+            emptyFw = true;
+            key = "";
+            continue;
+        }
+        const head = line.match(/^(frameworks|ignore)\s*:\s*$/);
+        if (head) {
+            key = head[1];
+            continue;
+        }
+        if (key) {
+            const m = line.match(/^\s+-\s*["']?([^"'\s]+)["']?\s*$/);
+            if (m)
+                lists[key].push(m[1]);
+            else if (line.trim())
+                key = "";
+        }
+    }
+    const ignore = lists.ignore.map((p) => p.replace(/\\/g, "/").replace(/^\.?\//, "").replace(/\/+$/, ""));
+    if (emptyFw)
+        return { frameworks: [], skipped: [], ignore };
+    const ids = lists.frameworks;
+    if (!ids.length)
+        return { frameworks: null, skipped: [], ignore };
+    const known = ids.filter((i) => ALL_FRAMEWORKS.includes(i));
+    return { frameworks: known, skipped: ids.filter((i) => !known.includes(i)), ignore };
+}
+// Dependencies, build output and caches: generated code, not code you wrote.
+export const SKIP_DIRS = ["node_modules", ".git", "dist", "build", "out", ".output", ".next", ".nuxt", ".svelte-kit", ".astro", ".vercel", ".netlify", ".wrangler", ".turbo", ".cache", "venv", ".venv", "__pycache__", "coverage"];
+const SKIP = new Set(SKIP_DIRS);
+const MAX_LINE = 1000; // a line this long means minified or generated code
+const MAX_BYTES = 1_000_000;
+/** Scout: list files to check, sorted so output order never depends on the file system. */
+export async function listFiles(root, ignore = []) {
+    const out = [];
+    const ignored = (p) => { const r = relative(root, p).split(sep).join("/"); return ignore.some((i) => r === i || r.startsWith(i + "/")); };
+    async function walk(dir) {
+        for (const e of await readdir(dir, { withFileTypes: true })) {
+            if (SKIP.has(e.name) || /\.min\.(js|css)$/.test(e.name))
+                continue;
+            const p = join(dir, e.name);
+            if (ignored(p))
+                continue;
+            if (e.isDirectory())
+                await walk(p);
+            else if (e.isFile())
+                out.push(p);
+        }
+    }
+    await walk(root);
+    return out.sort();
+}
+export async function scan(root, frameworks = ALL_FRAMEWORKS) {
+    const active = rules.filter((r) => r.controls.some((c) => frameworks.includes(c.framework)));
+    const findings = [];
+    let filesChecked = 0;
+    for (const abs of await listFiles(root, (await readConfig(root)).ignore)) {
+        const ext = extname(abs) || (abs.endsWith(".env") ? ".env" : "");
+        const relevant = active.filter((r) => r.extensions.includes(ext));
+        if (!relevant.length)
+            continue;
+        const buf = await readFile(abs);
+        if (buf.length > MAX_BYTES || buf.includes(0))
+            continue; // skip big or binary files
+        const file = relative(root, abs).split(sep).join("/");
+        const lines = buf.toString("utf8").split(/\r?\n/);
+        if (lines.some((l) => l.length > MAX_LINE))
+            continue; // minified or generated
+        filesChecked++;
+        const add = (r, line) => findings.push({
+            ruleId: r.id, file, line, status: r.status, severity: r.severity, title: r.title,
+            controls: r.controls.filter((c) => frameworks.includes(c.framework)), fix: r.fix, note: r.note,
+        });
+        for (const r of relevant) {
+            if (r.test)
+                lines.forEach((text, i) => { if (r.test(text))
+                    add(r, i + 1); });
+            if (r.fileTest)
+                for (const n of r.fileTest(lines))
+                    add(r, n);
+        }
+    }
+    // Auditor: one finding per rule per line; stable order.
+    const seen = new Set();
+    const deduped = findings.filter((f) => { const k = `${f.ruleId}|${f.file}|${f.line}`; return seen.has(k) ? false : (seen.add(k), true); })
+        .sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+    const hit = new Set(deduped.map((f) => f.ruleId));
+    return {
+        rulesVersion: RULES_VERSION,
+        frameworks: [...frameworks].sort(),
+        findings: deduped,
+        // Only the Checker sets Met: a rule that ran and found nothing.
+        met: active.filter((r) => !hit.has(r.id)).map((r) => ({ ruleId: r.id, title: r.title, controls: r.controls.filter((c) => frameworks.includes(c.framework)) })),
+        outside: outsideFor(frameworks),
+        filesChecked,
+        disclaimer: DISCLAIMER,
+    };
+}
+const LABEL = { gap: "Gap", partial: "Partial", met: "Met", outside: "Outside code" };
+const ctl = (c) => c.map((x) => `${x.framework.toUpperCase()} ${x.id}`).join(" · ");
+export function toMarkdown(r) {
+    const lines = [
+        "# Lintsure report", "",
+        `Frameworks: ${r.frameworks.join(", ")} · Rules v${r.rulesVersion}`, "",
+        `> ${DISCLAIMER}`, "",
+        `## Findings (${r.findings.length})`, "",
+    ];
+    if (!r.findings.length)
+        lines.push("No issues found by the current rules.", "");
+    for (const f of r.findings)
+        lines.push(`### ${LABEL[f.status]} · \`${f.file}:${f.line}\``, `**${f.title}** (${f.severity})`, "", `- Rules: ${ctl(f.controls)}`, `- Fix: ${f.fix}`, `- Auditor note: ${f.note}`, "");
+    lines.push(`## Met (${r.met.length})`, "", ...r.met.map((m) => `- ${m.title} · ${ctl(m.controls)}`), "");
+    lines.push(`## Outside code (${r.outside.length})`, "", "Code can't prove these. They still need to be done before a full review.", "", ...r.outside.map((o) => `- ${o.framework.toUpperCase()} ${o.control} · ${o.title}: ${o.evidence}`), "");
+    lines.push("## What to do next", "", ...nextSteps(r).map((s, i) => `${i + 1}. ${s}`), "");
+    lines.push("## What this report is not", "", NOT_A_VERDICT, "");
+    return lines.join("\n");
+}

package/dist/src/knowledge/eu-ai-act.d.ts

@@ -0,0 +1,2 @@
+import type { FrameworkKnowledge } from "./types.js";
+export declare const euAiAct: FrameworkKnowledge;