@oops-catcher/core 0.1.0

package/dist/config/loader.d.ts

@@ -0,0 +1,5 @@
+import { ParsedConfig } from './schema.js';
+export declare const DEFAULT_CONFIG_PATH = "oops.yml";
+export declare function loadConfig(cwd: string, explicitPath?: string): ParsedConfig;
+export declare function getDefaultConfigYaml(): string;
+//# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CAY3E;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAmB7C"}

package/dist/config/loader.js

@@ -0,0 +1,37 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import yaml from 'js-yaml';
+import { ConfigSchema } from './schema.js';
+export const DEFAULT_CONFIG_PATH = 'oops.yml';
+export function loadConfig(cwd, explicitPath) {
+    const configPath = explicitPath
+        ? path.resolve(cwd, explicitPath)
+        : path.resolve(cwd, DEFAULT_CONFIG_PATH);
+    if (!fs.existsSync(configPath)) {
+        return ConfigSchema.parse({});
+    }
+    const raw = fs.readFileSync(configPath, 'utf8');
+    const data = yaml.load(raw) ?? {};
+    return ConfigSchema.parse(data);
+}
+export function getDefaultConfigYaml() {
+    return `version: 1
+include: ["**/*"]
+exclude: [".git/**","node_modules/**","dist/**","build/**",".next/**","coverage/**"]
+rulesets: ["secrets_v1","containers_v1","ai_artifacts_v1"]
+rules:
+  disable: []
+  severity_overrides: {}
+output:
+  format: text
+  failOn: critical
+  redact: { showPrefix: 4, showSuffix: 4 }
+baseline:
+  mode: off
+  file: ".oops-baseline.json"
+allowlist:
+  paths: []
+  rules: {}
+`;
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,YAAqB;IAC3D,MAAM,UAAU,GAAG,YAAY;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAE3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;;;;;;;;;;;;;;;;;CAiBR,CAAC;AACF,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,117 @@
+import { z } from 'zod';
+export declare const ConfigSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodLiteral<1>>;
+    include: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    exclude: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    rulesets: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    rules: z.ZodDefault<z.ZodObject<{
+        disable: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        severity_overrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<["critical", "warning", "info"]>>>;
+    }, "strip", z.ZodTypeAny, {
+        disable: string[];
+        severity_overrides: Record<string, "critical" | "warning" | "info">;
+    }, {
+        disable?: string[] | undefined;
+        severity_overrides?: Record<string, "critical" | "warning" | "info"> | undefined;
+    }>>;
+    output: z.ZodDefault<z.ZodObject<{
+        format: z.ZodDefault<z.ZodEnum<["text", "json"]>>;
+        failOn: z.ZodDefault<z.ZodEnum<["critical", "warning", "info"]>>;
+        redact: z.ZodDefault<z.ZodObject<{
+            showPrefix: z.ZodDefault<z.ZodNumber>;
+            showSuffix: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            showPrefix: number;
+            showSuffix: number;
+        }, {
+            showPrefix?: number | undefined;
+            showSuffix?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        format: "text" | "json";
+        failOn: "critical" | "warning" | "info";
+        redact: {
+            showPrefix: number;
+            showSuffix: number;
+        };
+    }, {
+        format?: "text" | "json" | undefined;
+        failOn?: "critical" | "warning" | "info" | undefined;
+        redact?: {
+            showPrefix?: number | undefined;
+            showSuffix?: number | undefined;
+        } | undefined;
+    }>>;
+    baseline: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<["off", "use", "update"]>>;
+        file: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        mode: "off" | "use" | "update";
+        file: string;
+    }, {
+        mode?: "off" | "use" | "update" | undefined;
+        file?: string | undefined;
+    }>>;
+    allowlist: z.ZodDefault<z.ZodObject<{
+        paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+    }, "strip", z.ZodTypeAny, {
+        rules: Record<string, string[]>;
+        paths: string[];
+    }, {
+        rules?: Record<string, string[]> | undefined;
+        paths?: string[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: 1;
+    include: string[];
+    exclude: string[];
+    rulesets: string[];
+    rules: {
+        disable: string[];
+        severity_overrides: Record<string, "critical" | "warning" | "info">;
+    };
+    output: {
+        format: "text" | "json";
+        failOn: "critical" | "warning" | "info";
+        redact: {
+            showPrefix: number;
+            showSuffix: number;
+        };
+    };
+    baseline: {
+        mode: "off" | "use" | "update";
+        file: string;
+    };
+    allowlist: {
+        rules: Record<string, string[]>;
+        paths: string[];
+    };
+}, {
+    version?: 1 | undefined;
+    include?: string[] | undefined;
+    exclude?: string[] | undefined;
+    rulesets?: string[] | undefined;
+    rules?: {
+        disable?: string[] | undefined;
+        severity_overrides?: Record<string, "critical" | "warning" | "info"> | undefined;
+    } | undefined;
+    output?: {
+        format?: "text" | "json" | undefined;
+        failOn?: "critical" | "warning" | "info" | undefined;
+        redact?: {
+            showPrefix?: number | undefined;
+            showSuffix?: number | undefined;
+        } | undefined;
+    } | undefined;
+    baseline?: {
+        mode?: "off" | "use" | "update" | undefined;
+        file?: string | undefined;
+    } | undefined;
+    allowlist?: {
+        rules?: Record<string, string[]> | undefined;
+        paths?: string[] | undefined;
+    } | undefined;
+}>;
+export type ParsedConfig = z.infer<typeof ConfigSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkDvB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/config/schema.js

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+const SeveritySchema = z.enum(['critical', 'warning', 'info']);
+export const ConfigSchema = z.object({
+    version: z.literal(1).default(1),
+    include: z.array(z.string()).default(['**/*']),
+    exclude: z
+        .array(z.string())
+        .default([
+        '.git/**',
+        'node_modules/**',
+        'dist/**',
+        'build/**',
+        '.next/**',
+        'coverage/**',
+    ]),
+    rulesets: z
+        .array(z.string())
+        .default(['secrets_v1', 'containers_v1', 'ai_artifacts_v1']),
+    rules: z
+        .object({
+        disable: z.array(z.string()).default([]),
+        severity_overrides: z.record(SeveritySchema).default({}),
+    })
+        .default({ disable: [], severity_overrides: {} }),
+    output: z
+        .object({
+        format: z.enum(['text', 'json']).default('text'),
+        failOn: SeveritySchema.default('critical'),
+        redact: z
+            .object({
+            showPrefix: z.number().int().min(0).default(4),
+            showSuffix: z.number().int().min(0).default(4),
+        })
+            .default({ showPrefix: 4, showSuffix: 4 }),
+    })
+        .default({
+        format: 'text',
+        failOn: 'critical',
+        redact: { showPrefix: 4, showSuffix: 4 },
+    }),
+    baseline: z
+        .object({
+        mode: z.enum(['off', 'use', 'update']).default('off'),
+        file: z.string().default('.oops-baseline.json'),
+    })
+        .default({ mode: 'off', file: '.oops-baseline.json' }),
+    allowlist: z
+        .object({
+        paths: z.array(z.string()).default([]),
+        rules: z.record(z.array(z.string())).default({}),
+    })
+        .default({ paths: [], rules: {} }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC;QACP,SAAS;QACT,iBAAiB;QACjB,SAAS;QACT,UAAU;QACV,UAAU;QACV,aAAa;KACd,CAAC;IACJ,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC9D,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzD,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAChD,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1C,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SAC/C,CAAC;aACD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;KAC7C,CAAC;SACD,OAAO,CAAC;QACP,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KACzC,CAAC;IACJ,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;KAChD,CAAC;SACD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACjD,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;CACrC,CAAC,CAAC"}

package/dist/engine/fingerprint.d.ts

@@ -0,0 +1,2 @@
+export declare function stableFingerprint(input: string): string;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/engine/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/engine/fingerprint.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/engine/fingerprint.js

@@ -0,0 +1,5 @@
+import crypto from 'node:crypto';
+export function stableFingerprint(input) {
+    return crypto.createHash('sha256').update(input).digest('hex');
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/engine/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/engine/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/engine/line.d.ts

@@ -0,0 +1,2 @@
+export declare function lineForIndex(content: string, index: number): number;
+//# sourceMappingURL=line.d.ts.map

package/dist/engine/line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"line.d.ts","sourceRoot":"","sources":["../../src/engine/line.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnE"}

package/dist/engine/line.js

@@ -0,0 +1,11 @@
+export function lineForIndex(content, index) {
+    if (index <= 0)
+        return 1;
+    let line = 1;
+    for (let i = 0; i < content.length && i < index; i += 1) {
+        if (content[i] === '\n')
+            line += 1;
+    }
+    return line;
+}
+//# sourceMappingURL=line.js.map

package/dist/engine/line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"line.js","sourceRoot":"","sources":["../../src/engine/line.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/scan.d.ts

@@ -0,0 +1,13 @@
+import { OopsConfig, Finding, Severity } from '../types.js';
+import { Rule } from '../rules/types.js';
+export declare function applyRules(rules: Rule[], config: OopsConfig, cwd: string, pathValue: string, content: string): Finding[];
+export type ScanResult = {
+    findings: Finding[];
+};
+export declare function scanRepo(cwd: string, config: OopsConfig): Promise<ScanResult>;
+export declare function scanEntries(cwd: string, config: OopsConfig, entries: {
+    path: string;
+    content: string;
+}[]): ScanResult;
+export declare function hasFindingsAtOrAbove(findings: Finding[], failOn: Severity): boolean;
+//# sourceMappingURL=scan.d.ts.map

package/dist/engine/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/engine/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAoBzC,wBAAgB,UAAU,CACxB,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,EAAE,CAaX;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB,CAAC;AAEF,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAMnF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,GAC3C,UAAU,CAYZ;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAGnF"}

package/dist/engine/scan.js

@@ -0,0 +1,57 @@
+import { listFiles, readFileSafely } from './walker.js';
+import { getRulesets } from '../rules/registry.js';
+const SEVERITY_ORDER = ['info', 'warning', 'critical'];
+function applySeverityOverride(ruleId, severity, config) {
+    return config.rules.severity_overrides[ruleId] ?? severity;
+}
+function isAllowed(pathValue, ruleId, config) {
+    if (config.allowlist.paths.some((p) => pathValue.includes(p)))
+        return true;
+    const ruleAllows = config.allowlist.rules[ruleId] ?? [];
+    return ruleAllows.some((p) => pathValue.includes(p));
+}
+function shouldIncludeFinding(finding, config) {
+    if (config.rules.disable.includes(finding.ruleId))
+        return false;
+    if (isAllowed(finding.path, finding.ruleId, config))
+        return false;
+    return true;
+}
+export function applyRules(rules, config, cwd, pathValue, content) {
+    const findings = [];
+    for (const rule of rules) {
+        if (!rule.appliesTo(pathValue))
+            continue;
+        const ruleFindings = rule.run({ cwd, path: pathValue, content, config });
+        for (const f of ruleFindings) {
+            findings.push({
+                ...f,
+                severity: applySeverityOverride(rule.id, f.severity, config),
+            });
+        }
+    }
+    return findings;
+}
+export async function scanRepo(cwd, config) {
+    const files = await listFiles(cwd, config.include, config.exclude);
+    const entries = files
+        .map((filePath) => readFileSafely(cwd, filePath))
+        .filter((entry) => Boolean(entry));
+    return scanEntries(cwd, config, entries);
+}
+export function scanEntries(cwd, config, entries) {
+    const rulesets = getRulesets(config.rulesets);
+    const rules = rulesets.flatMap((set) => set.rules);
+    const findings = [];
+    for (const entry of entries) {
+        const fileFindings = applyRules(rules, config, cwd, entry.path, entry.content)
+            .filter((f) => shouldIncludeFinding(f, config));
+        findings.push(...fileFindings);
+    }
+    return { findings };
+}
+export function hasFindingsAtOrAbove(findings, failOn) {
+    const failIndex = SEVERITY_ORDER.indexOf(failOn);
+    return findings.some((f) => SEVERITY_ORDER.indexOf(f.severity) >= failIndex);
+}
+//# sourceMappingURL=scan.js.map

package/dist/engine/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/engine/scan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,MAAM,cAAc,GAAe,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAEnE,SAAS,qBAAqB,CAAC,MAAc,EAAE,QAAkB,EAAE,MAAkB;IACnF,OAAO,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAkB;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,MAAkB;IAChE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,MAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,OAAe;IAEf,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,SAAS;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,CAAC;gBACJ,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAkB;IAC5D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAAsC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,MAAkB,EAClB,OAA4C;IAE5C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;aAC3E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,MAAgB;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC;AAC/E,CAAC"}

package/dist/engine/walker.d.ts

@@ -0,0 +1,8 @@
+export type FileEntry = {
+    path: string;
+    content: string;
+};
+export declare function listFiles(cwd: string, include: string[], exclude: string[]): Promise<string[]>;
+export declare function isBinary(buffer: Buffer): boolean;
+export declare function readFileSafely(cwd: string, relativePath: string): FileEntry | null;
+//# sourceMappingURL=walker.d.ts.map

package/dist/engine/walker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.d.ts","sourceRoot":"","sources":["../../src/engine/walker.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQpG;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKhD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAiBlF"}

package/dist/engine/walker.js

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+const MAX_FILE_SIZE_BYTES = 1024 * 1024; // 1MB
+const BINARY_SAMPLE_BYTES = 8192;
+export async function listFiles(cwd, include, exclude) {
+    return fg(include, {
+        cwd,
+        ignore: exclude,
+        dot: true,
+        onlyFiles: true,
+        followSymbolicLinks: false,
+    });
+}
+export function isBinary(buffer) {
+    for (let i = 0; i < buffer.length; i += 1) {
+        if (buffer[i] === 0)
+            return true;
+    }
+    return false;
+}
+export function readFileSafely(cwd, relativePath) {
+    const fullPath = path.resolve(cwd, relativePath);
+    const stat = fs.statSync(fullPath, { throwIfNoEntry: false });
+    if (!stat || !stat.isFile())
+        return null;
+    if (stat.size > MAX_FILE_SIZE_BYTES)
+        return null;
+    const fd = fs.openSync(fullPath, 'r');
+    try {
+        const sample = Buffer.alloc(Math.min(BINARY_SAMPLE_BYTES, stat.size));
+        fs.readSync(fd, sample, 0, sample.length, 0);
+        if (isBinary(sample))
+            return null;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const content = fs.readFileSync(fullPath, 'utf8');
+    return { path: relativePath, content };
+}
+//# sourceMappingURL=walker.js.map

package/dist/engine/walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.js","sourceRoot":"","sources":["../../src/engine/walker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,WAAW,CAAC;AAE3B,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;AAC/C,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAOjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,OAAiB,EAAE,OAAiB;IAC/E,OAAO,EAAE,CAAC,OAAO,EAAE;QACjB,GAAG;QACH,MAAM,EAAE,OAAO;QACf,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,YAAoB;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { loadConfig, getDefaultConfigYaml } from './config/loader.js';
+export { scanRepo, scanEntries, hasFindingsAtOrAbove, applyRules } from './engine/scan.js';
+export { formatText, formatJson } from './output/formatters.js';
+export type { OopsConfig, Finding, Severity } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { loadConfig, getDefaultConfigYaml } from './config/loader.js';
+export { scanRepo, scanEntries, hasFindingsAtOrAbove, applyRules } from './engine/scan.js';
+export { formatText, formatJson } from './output/formatters.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/output/formatters.d.ts

@@ -0,0 +1,4 @@
+import { Finding } from '../types.js';
+export declare function formatText(findings: Finding[]): string;
+export declare function formatJson(findings: Finding[]): string;
+//# sourceMappingURL=formatters.d.ts.map

package/dist/output/formatters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatters.d.ts","sourceRoot":"","sources":["../../src/output/formatters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,MAAM,aAAa,CAAC;AAYhD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAsBtD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAEtD"}

package/dist/output/formatters.js

@@ -0,0 +1,35 @@
+const ORDER = ['critical', 'warning', 'info'];
+function groupBySeverity(findings) {
+    return {
+        critical: findings.filter((f) => f.severity === 'critical'),
+        warning: findings.filter((f) => f.severity === 'warning'),
+        info: findings.filter((f) => f.severity === 'info'),
+    };
+}
+export function formatText(findings) {
+    if (findings.length === 0)
+        return 'No findings.\n';
+    const grouped = groupBySeverity(findings);
+    const lines = [];
+    for (const severity of ORDER) {
+        const bucket = grouped[severity];
+        if (bucket.length === 0)
+            continue;
+        lines.push(`${severity.toUpperCase()} (${bucket.length})`);
+        for (const f of bucket) {
+            const location = f.line ? `${f.path}:${f.line}` : f.path;
+            lines.push(`- ${f.ruleId} ${location}: ${f.message}`);
+            lines.push(`  Why: ${f.why}`);
+            lines.push(`  Fix: ${f.fix}`);
+            if (f.redactedExcerpt) {
+                lines.push(`  Excerpt: ${f.redactedExcerpt}`);
+            }
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+export function formatJson(findings) {
+    return JSON.stringify({ findings }, null, 2) + '\n';
+}
+//# sourceMappingURL=formatters.js.map

package/dist/output/formatters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/output/formatters.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAe,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAE1D,SAAS,eAAe,CAAC,QAAmB;IAC1C,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC3D,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;QACzD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAmB;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAmB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACtD,CAAC"}

package/dist/output/redact.d.ts

@@ -0,0 +1,4 @@
+import { RedactConfig } from '../types.js';
+export declare function redact(value: string, config: RedactConfig): string;
+export declare function redactExcerpt(value: string, config: RedactConfig, maxLen?: number): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/output/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/output/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAQlE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAM,GAAG,MAAM,CAGvF"}

package/dist/output/redact.js

@@ -0,0 +1,14 @@
+export function redact(value, config) {
+    const { showPrefix, showSuffix } = config;
+    if (value.length <= showPrefix + showSuffix) {
+        return `${value.slice(0, showPrefix)}…${value.slice(-showSuffix)}`;
+    }
+    const prefix = value.slice(0, showPrefix);
+    const suffix = value.slice(-showSuffix);
+    return `${prefix}…${suffix}`;
+}
+export function redactExcerpt(value, config, maxLen = 120) {
+    const clipped = value.length > maxLen ? value.slice(0, maxLen) : value;
+    return redact(clipped, config);
+}
+//# sourceMappingURL=redact.js.map

package/dist/output/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/output/redact.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAoB;IACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,GAAG,UAAU,EAAE,CAAC;QAC5C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAoB,EAAE,MAAM,GAAG,GAAG;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC"}

package/dist/rules/ai_artifacts_v1.d.ts

@@ -0,0 +1,3 @@
+import { Rule } from './types.js';
+export declare const aiArtifactsV1Rules: Rule[];
+//# sourceMappingURL=ai_artifacts_v1.d.ts.map

package/dist/rules/ai_artifacts_v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai_artifacts_v1.d.ts","sourceRoot":"","sources":["../../src/rules/ai_artifacts_v1.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAwClC,eAAO,MAAM,kBAAkB,EAAE,IAAI,EAqDpC,CAAC"}

package/dist/rules/ai_artifacts_v1.js

@@ -0,0 +1,76 @@
+import { lineForIndex } from '../engine/line.js';
+import { redactExcerpt } from '../output/redact.js';
+import { stableFingerprint } from '../engine/fingerprint.js';
+import { PRIVATE_KEY_BLOCK, GITHUB_TOKEN, AWS_ACCESS_KEY, STRIPE_LIVE_KEY, SLACK_TOKEN, } from './secrets_v1.js';
+const AI_ARTIFACT_PATTERNS = [
+    /\bchat\b/i,
+    /\bprompt\b/i,
+    /\btranscript\b/i,
+    /\.prompt_history$/,
+    /\bgpt\b/i,
+    /\bclaude\b/i,
+    /\bllm[-_]?output\b/i,
+];
+function isAiArtifact(filePath) {
+    const base = filePath.split('/').pop() ?? filePath;
+    return AI_ARTIFACT_PATTERNS.some((p) => p.test(base));
+}
+const SECRET_PATTERNS = [
+    { regex: PRIVATE_KEY_BLOCK, label: 'Private key block' },
+    { regex: GITHUB_TOKEN, label: 'GitHub token' },
+    { regex: AWS_ACCESS_KEY, label: 'AWS access key' },
+    { regex: STRIPE_LIVE_KEY, label: 'Stripe live key' },
+    { regex: SLACK_TOKEN, label: 'Slack token' },
+];
+export const aiArtifactsV1Rules = [
+    // AI001 — AI transcript/prompt artifacts tracked
+    {
+        id: 'AI001',
+        title: 'AI artifact file tracked',
+        defaultSeverity: 'info',
+        appliesTo: (path) => isAiArtifact(path),
+        run: (ctx) => [
+            {
+                ruleId: 'AI001',
+                severity: 'info',
+                path: ctx.path,
+                message: `AI artifact file tracked in repository: ${ctx.path.split('/').pop()}`,
+                why: 'AI transcripts and prompt logs may contain sensitive context or secrets.',
+                fix: 'Remove the file or add it to .gitignore.',
+                fingerprint: stableFingerprint(`AI001:${ctx.path}`),
+            },
+        ],
+    },
+    // AI002 — Secrets in AI artifacts
+    {
+        id: 'AI002',
+        title: 'Secret detected in AI artifact',
+        defaultSeverity: 'critical',
+        appliesTo: (path) => isAiArtifact(path),
+        run: (ctx) => {
+            const findings = [];
+            for (const { regex, label } of SECRET_PATTERNS) {
+                // Reset lastIndex since these are exported compiled regexes
+                const re = new RegExp(regex.source, regex.flags);
+                for (const match of ctx.content.matchAll(re)) {
+                    const index = match.index ?? 0;
+                    const line = lineForIndex(ctx.content, index);
+                    const matched = match[0];
+                    findings.push({
+                        ruleId: 'AI002',
+                        severity: 'critical',
+                        path: ctx.path,
+                        line,
+                        message: `${label} found in AI artifact`,
+                        why: 'Secrets in AI artifacts should be removed and rotated immediately.',
+                        fix: 'Remove the file, rotate the secret, and add the file to .gitignore.',
+                        redactedExcerpt: redactExcerpt(matched, ctx.config.output.redact),
+                        fingerprint: stableFingerprint(`AI002:${ctx.path}:${line}:${matched.slice(0, 8)}`),
+                    });
+                }
+            }
+            return findings;
+        },
+    },
+];
+//# sourceMappingURL=ai_artifacts_v1.js.map

package/dist/rules/ai_artifacts_v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai_artifacts_v1.js","sourceRoot":"","sources":["../../src/rules/ai_artifacts_v1.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAEzB,MAAM,oBAAoB,GAAG;IAC3B,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,mBAAmB;IACnB,UAAU;IACV,aAAa;IACb,qBAAqB;CACtB,CAAC;AAEF,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACnD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAOD,MAAM,eAAe,GAAoB;IACvC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACxD,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE;IAC9C,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAClD,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACpD,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAW;IACxC,iDAAiD;IACjD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,0BAA0B;QACjC,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;YACZ;gBACE,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,2CAA2C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC/E,GAAG,EAAE,0EAA0E;gBAC/E,GAAG,EAAE,0CAA0C;gBAC/C,WAAW,EAAE,iBAAiB,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC;aACpD;SACF;KACF;IAED,kCAAkC;IAClC;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,gCAAgC;QACvC,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAc,EAAE,CAAC;YAE/B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;gBAC/C,4DAA4D;gBAC5D,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;oBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,OAAO;wBACf,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,IAAI;wBACJ,OAAO,EAAE,GAAG,KAAK,uBAAuB;wBACxC,GAAG,EAAE,oEAAoE;wBACzE,GAAG,EAAE,qEAAqE;wBAC1E,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBACjE,WAAW,EAAE,iBAAiB,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;CACF,CAAC"}

package/dist/rules/containers_v1.d.ts

@@ -0,0 +1,3 @@
+import { Rule } from './types.js';
+export declare const containersV1Rules: Rule[];
+//# sourceMappingURL=containers_v1.d.ts.map

package/dist/rules/containers_v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containers_v1.d.ts","sourceRoot":"","sources":["../../src/rules/containers_v1.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA8FlC,eAAO,MAAM,iBAAiB,EAAE,IAAI,EAkTnC,CAAC"}