@runa-ai/runa-cli 0.5.26

package/dist/internal/machines/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CLI Machine Utilities
+ *
+ * Purpose:
+ * - Provide a single, shared runner for CLI XState machines.
+ * - Keep command handlers thin and consistent.
+ */
+export { runMachine } from './machine-runner.js';
+export type { StateE2EMeta } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/internal/machines/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/machines/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/internal/machines/machine-runner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared CLI Machine Runner
+ *
+ * Purpose:
+ * - Standardize XState machine execution for CLI commands.
+ * - Provide consistent logging hooks and timeouts.
+ *
+ * Design:
+ * - Machines should expose:
+ *   - getStateName(snapshot)
+ *   - isComplete(snapshot)
+ *   - getError(snapshot)
+ * - Machines should define `output:` so this runner can return a typed output.
+ */
+import { type AnyStateMachine, type OutputFrom } from 'xstate';
+import type { RunMachineParams } from './types.js';
+export declare function runMachine<TMachine extends AnyStateMachine>(params: RunMachineParams<TMachine>): Promise<OutputFrom<TMachine>>;
+//# sourceMappingURL=machine-runner.d.ts.map

package/dist/internal/machines/machine-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-runner.d.ts","sourceRoot":"","sources":["../../../src/internal/machines/machine-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAe,KAAK,UAAU,EAAqB,MAAM,QAAQ,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAcnD,wBAAsB,UAAU,CAAC,QAAQ,SAAS,eAAe,EAC/D,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GACjC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAsD/B"}

package/dist/internal/machines/types.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared Types for CLI XState Machines
+ *
+ * Notes:
+ * - These types are used in machine `meta.e2e` blocks to keep E2E mapping explicit.
+ * - Keep this file minimal and stable (consumed by many machines).
+ */
+import type { AnyStateMachine, InputFrom, SnapshotFrom } from 'xstate';
+type StateSeverity = 'blocking' | 'non-critical' | 'final';
+type StateObservables = Record<string, string | number | boolean | null>;
+/**
+ * E2E meta attached to states via `meta: { e2e: ... }`.
+ *
+ * Rule of thumb:
+ * - Only describe observables that can be asserted (E2E Rule).
+ */
+export interface StateE2EMeta {
+    description: string;
+    severity: StateSeverity;
+    observables: StateObservables;
+    assertions: string[];
+    nextStates: string[];
+}
+/** @internal - Used by machine-runner.ts */
+interface MachineRunnerHelpers<TSnapshot> {
+    getStateName: (snapshot: TSnapshot) => string;
+    isComplete: (snapshot: TSnapshot) => boolean;
+    getError: (snapshot: TSnapshot) => unknown;
+}
+/** @internal - Used by machine-runner.ts */
+export interface RunMachineParams<TMachine extends AnyStateMachine> {
+    machine: TMachine;
+    input: InputFrom<TMachine>;
+    helpers: MachineRunnerHelpers<SnapshotFrom<TMachine>>;
+    /**
+     * Snapshot callback (called on every transition).
+     * Use this when you need full context for logging.
+     */
+    onSnapshot?: (snapshot: SnapshotFrom<TMachine>) => void;
+    /**
+     * State-name callback (called on every transition).
+     * Use this when you only need state string for mapping to steps/sections.
+     */
+    onTransition?: (stateName: string) => void;
+    timeoutMs?: number;
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/internal/machines/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/internal/machines/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEvE,KAAK,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,OAAO,CAAC;AAE3D,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4CAA4C;AAC5C,UAAU,oBAAoB,CAAC,SAAS;IACtC,YAAY,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7C,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC;CAC5C;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB,CAAC,QAAQ,SAAS,eAAe;IAChE,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,EAAE,oBAAoB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IACxD;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/internal/vuln-checker/analyzers/dependency-analyzer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * AI HINT: Dependency vulnerability analyzer
+ *
+ * Purpose: Check npm dependencies for known vulnerabilities
+ * Philosophy: Leverage npm audit for CVE detection
+ *
+ * Checks:
+ * - Known CVEs via npm audit
+ * - Outdated packages (major versions behind)
+ * - Potentially malicious packages (typosquatting)
+ */
+import type { Analyzer, AnalyzerOptions, Category, Finding } from '../types.js';
+/**
+ * Dependency vulnerability analyzer
+ */
+export declare class DependencyAnalyzer implements Analyzer {
+    name: string;
+    categories: Category[];
+    analyze(options: AnalyzerOptions): Promise<Finding[]>;
+    private runNpmAudit;
+    private executeNpmAudit;
+    private checkTyposquatting;
+}
+//# sourceMappingURL=dependency-analyzer.d.ts.map

package/dist/internal/vuln-checker/analyzers/dependency-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/dependency-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAyclG;;GAEG;AACH,qBAAa,kBAAmB,YAAW,QAAQ;IACjD,IAAI,SAAwB;IAC5B,UAAU,EAAE,QAAQ,EAAE,CAAkB;IAElC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAe7C,WAAW;YAcX,eAAe;YAcf,kBAAkB;CA0BjC"}

package/dist/internal/vuln-checker/analyzers/rls-analyzer.d.ts

@@ -0,0 +1,28 @@
+/**
+ * AI HINT: RLS (Row Level Security) policy analyzer
+ *
+ * Purpose: Detect missing or weak RLS policies in PostgreSQL schemas
+ * Philosophy: AST-driven analysis of Drizzle schema files (ts-morph)
+ *
+ * Detects:
+ * - Tables without RLS enabled
+ * - Missing tenant isolation in policies
+ * - Overly permissive policies
+ * - Missing policies for CRUD operations
+ *
+ * Implementation:
+ * - TypeScript schema parsing: ts-morph (AST) - eliminates regex false positives
+ * - SQL policy parsing: regex (acceptable for SQL files)
+ *
+ * @module rls-analyzer
+ */
+import type { Analyzer, AnalyzerOptions, Category, Finding } from '../types.js';
+/**
+ * RLS analyzer using AST-based TypeScript parsing
+ */
+export declare class RLSAnalyzer implements Analyzer {
+    name: string;
+    categories: Category[];
+    analyze(options: AnalyzerOptions): Promise<Finding[]>;
+}
+//# sourceMappingURL=rls-analyzer.d.ts.map

package/dist/internal/vuln-checker/analyzers/rls-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/rls-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAU,MAAM,aAAa,CAAC;AAwiBxF;;GAEG;AACH,qBAAa,WAAY,YAAW,QAAQ;IAC1C,IAAI,SAAiB;IACrB,UAAU,EAAE,QAAQ,EAAE,CAAW;IAE3B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAgB5D"}

package/dist/internal/vuln-checker/analyzers/secret-analyzer.d.ts

@@ -0,0 +1,26 @@
+/**
+ * AI HINT: Secret detection analyzer
+ *
+ * Purpose: Detect hardcoded secrets, API keys, tokens, and credentials
+ * Philosophy: Pattern-based detection with entropy analysis
+ *
+ * Detects:
+ * - API keys (AWS, Google, Stripe, GitHub, etc.)
+ * - Private keys (RSA, SSH)
+ * - Passwords and credentials
+ * - Connection strings
+ * - JWT tokens
+ * - OAuth tokens
+ */
+import type { Analyzer, AnalyzerOptions, Category, Finding } from '../types.js';
+/**
+ * Secret detection analyzer
+ */
+export declare class SecretAnalyzer implements Analyzer {
+    name: string;
+    categories: Category[];
+    analyze(options: AnalyzerOptions): Promise<Finding[]>;
+    private getFilesToScan;
+    private isExcluded;
+}
+//# sourceMappingURL=secret-analyzer.d.ts.map

package/dist/internal/vuln-checker/analyzers/secret-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/secret-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAu9BlG;;GAEG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,IAAI,SAAoB;IACxB,UAAU,EAAE,QAAQ,EAAE,CAAc;IAE9B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB7C,cAAc;IAY5B,OAAO,CAAC,UAAU;CAGnB"}

package/dist/internal/vuln-checker/analyzers/typescript-analyzer.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: TypeScript AST-based vulnerability analyzer
+ *
+ * Purpose: Detect security vulnerabilities using AST analysis
+ * Philosophy: Structure-driven detection, not regex pattern matching
+ *
+ * Detects:
+ * - SQL injection (raw SQL strings)
+ * - XSS vulnerabilities (dangerouslySetInnerHTML)
+ * - Command injection (child_process.exec)
+ * - Path traversal (user input in file paths)
+ * - Insecure eval usage
+ * - Missing authentication checks
+ * - Hardcoded credentials
+ */
+import type { Analyzer, AnalyzerOptions, Category, Finding } from '../types.js';
+/**
+ * TypeScript AST-based vulnerability analyzer
+ */
+export declare class TypeScriptAnalyzer implements Analyzer {
+    name: string;
+    categories: Category[];
+    analyze(options: AnalyzerOptions): Promise<Finding[]>;
+}
+//# sourceMappingURL=typescript-analyzer.d.ts.map

package/dist/internal/vuln-checker/analyzers/typescript-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/typescript-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAU,MAAM,aAAa,CAAC;AAunBxF;;GAEG;AACH,qBAAa,kBAAmB,YAAW,QAAQ;IACjD,IAAI,SAAwB;IAC5B,UAAU,EAAE,QAAQ,EAAE,CAA6C;IAE7D,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CA8C5D"}

package/dist/internal/vuln-checker/config/loader.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AI HINT: Configuration loader for vulnerability checker
+ *
+ * Purpose: Load and parse configuration files
+ * Supports: YAML and JSON formats
+ */
+import type { IgnoreRule, VulnCheckerConfig } from '../types.js';
+/**
+ * Load configuration file
+ */
+export declare function loadConfig(configPath: string, rootDir: string): Promise<VulnCheckerConfig>;
+/**
+ * Load ignore file
+ */
+export declare function loadIgnores(ignorePath: string, rootDir: string): Promise<IgnoreRule[]>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/internal/vuln-checker/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkBhG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA6B5F"}

package/dist/internal/vuln-checker/constants.d.ts

@@ -0,0 +1,75 @@
+/**
+ * AI HINT: Security standards constants
+ *
+ * Purpose: Centralized definitions for OWASP Top 10 and CWE identifiers
+ * Philosophy: Single source of truth for security categorization
+ */
+/**
+ * OWASP Top 10 2021 Categories
+ * @see https://owasp.org/Top10/
+ */
+export declare const OWASP_2021: {
+    /** A01:2021 - Broken Access Control */
+    readonly BROKEN_ACCESS_CONTROL: "A01:2021";
+    /** A02:2021 - Cryptographic Failures */
+    readonly CRYPTO_FAILURES: "A02:2021";
+    /** A03:2021 - Injection */
+    readonly INJECTION: "A03:2021";
+    /** A04:2021 - Insecure Design */
+    readonly INSECURE_DESIGN: "A04:2021";
+    /** A05:2021 - Security Misconfiguration */
+    readonly SECURITY_MISCONFIG: "A05:2021";
+    /** A06:2021 - Vulnerable and Outdated Components */
+    readonly VULNERABLE_COMPONENTS: "A06:2021";
+    /** A07:2021 - Identification and Authentication Failures */
+    readonly AUTH_FAILURES: "A07:2021";
+    /** A08:2021 - Software and Data Integrity Failures */
+    readonly INTEGRITY_FAILURES: "A08:2021";
+    /** A09:2021 - Security Logging and Monitoring Failures */
+    readonly LOGGING_FAILURES: "A09:2021";
+    /** A10:2021 - Server-Side Request Forgery */
+    readonly SSRF: "A10:2021";
+};
+/**
+ * Common Weakness Enumeration (CWE) identifiers
+ * @see https://cwe.mitre.org/
+ */
+export declare const CWE: {
+    /** CWE-78: OS Command Injection */
+    readonly COMMAND_INJECTION: "CWE-78";
+    /** CWE-79: Cross-site Scripting (XSS) */
+    readonly XSS: "CWE-79";
+    /** CWE-89: SQL Injection */
+    readonly SQL_INJECTION: "CWE-89";
+    /** CWE-95: Eval Injection */
+    readonly EVAL_INJECTION: "CWE-95";
+    /** CWE-284: Improper Access Control */
+    readonly IMPROPER_ACCESS_CONTROL: "CWE-284";
+    /** CWE-306: Missing Authentication */
+    readonly MISSING_AUTH: "CWE-306";
+    /** CWE-321: Use of Hard-coded Cryptographic Key */
+    readonly HARDCODED_CRYPTO_KEY: "CWE-321";
+    /** CWE-330: Use of Insufficiently Random Values */
+    readonly WEAK_RANDOM: "CWE-330";
+    /** CWE-532: Insertion of Sensitive Information into Log File */
+    readonly SENSITIVE_LOG: "CWE-532";
+    /** CWE-798: Use of Hard-coded Credentials */
+    readonly HARDCODED_CREDENTIALS: "CWE-798";
+    /** CWE-1104: Use of Unmaintained Third Party Components */
+    readonly UNMAINTAINED_COMPONENTS: "CWE-1104";
+    /** CWE-494: Download of Code Without Integrity Check */
+    readonly UNTRUSTED_DOWNLOAD: "CWE-494";
+};
+/**
+ * Severity numeric scores (for SARIF and sorting)
+ */
+export declare const SEVERITY_SCORE: Record<string, number>;
+/**
+ * Tool metadata
+ */
+export declare const TOOL: {
+    readonly NAME: "runa-vuln-checker";
+    readonly VERSION: string;
+    readonly REPO_URL: "https://github.com/r06-dev/runa";
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/internal/vuln-checker/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/internal/vuln-checker/constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB,uCAAuC;;IAEvC,wCAAwC;;IAExC,2BAA2B;;IAE3B,iCAAiC;;IAEjC,2CAA2C;;IAE3C,oDAAoD;;IAEpD,4DAA4D;;IAE5D,sDAAsD;;IAEtD,0DAA0D;;IAE1D,6CAA6C;;CAErC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,GAAG;IACd,mCAAmC;;IAEnC,yCAAyC;;IAEzC,4BAA4B;;IAE5B,6BAA6B;;IAE7B,uCAAuC;;IAEvC,sCAAsC;;IAEtC,mDAAmD;;IAEnD,mDAAmD;;IAEnD,gEAAgE;;IAEhE,6CAA6C;;IAE7C,2DAA2D;;IAE3D,wDAAwD;;CAEhD,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMjD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,IAAI;;;;CAIP,CAAC"}

package/dist/internal/vuln-checker/ignore/matcher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * AI HINT: Ignore rule matching and inline annotation parsing
+ *
+ * Purpose: Determine if a finding should be ignored based on:
+ * - Global ignore rules (.vuln-ignore.yml)
+ * - Inline annotations (@vuln-ignore)
+ *
+ * Cross-platform: Paths are normalized to forward slashes for consistent matching
+ */
+import type { Finding, IgnoreRule, InlineAnnotation } from '../types.js';
+/**
+ * Check if a finding matches an ignore rule
+ */
+export declare function matchIgnoreRule(rule: IgnoreRule, finding: Finding): boolean;
+/**
+ * Parse inline annotations from a file
+ */
+export declare function parseInlineAnnotations(filePath: string): Promise<InlineAnnotation[]>;
+/**
+ * Check if a finding should be ignored based on inline annotation
+ */
+export declare function shouldIgnoreByAnnotation(finding: Finding, annotations: InlineAnnotation[]): boolean;
+//# sourceMappingURL=matcher.d.ts.map

package/dist/internal/vuln-checker/ignore/matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/ignore/matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAU,MAAM,aAAa,CAAC;AAwBjF;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAoB3E;AAoDD;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoD1F;AA6BD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,gBAAgB,EAAE,GAC9B,OAAO,CAKT"}

package/dist/internal/vuln-checker/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * AI HINT: runa Vulnerability Checker
+ *
+ * Purpose: Comprehensive security scanning for TypeScript/PostgreSQL projects
+ * Philosophy: AST-based analysis + pattern matching + false positive management
+ */
+import type { Category, ScanResult, Severity } from './types.js';
+export * from './types.js';
+export interface VulnCheckerOptions {
+    rootDir: string;
+    configFile?: string;
+    ignoreFile?: string;
+    categories?: Category[];
+    minSeverity?: Severity;
+    format?: 'json' | 'sarif' | 'markdown' | 'console';
+    showIgnored?: boolean;
+    include?: string[];
+    exclude?: string[];
+}
+export declare class VulnChecker {
+    private options;
+    private config;
+    private ignores;
+    private analyzers;
+    private reporters;
+    private errors;
+    constructor(options: VulnCheckerOptions);
+    init(): Promise<void>;
+    scan(): Promise<ScanResult>;
+    private getFiles;
+    private runAnalyzers;
+    private shouldRunAnalyzer;
+    private classifyFindings;
+    private meetsMinSeverity;
+    private isFindingIgnored;
+    format(result: ScanResult): string;
+    run(): Promise<string>;
+    getExitCode(result: ScanResult, failOn?: Severity): number;
+    /** Get errors that occurred during scanning */
+    getErrors(): Array<{
+        analyzer: string;
+        error: unknown;
+    }>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/internal/vuln-checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/vuln-checker/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,KAAK,EAGV,QAAQ,EAKR,UAAU,EACV,QAAQ,EAET,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AA6ED,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,MAAM,CAAmD;gBAErD,OAAO,EAAE,kBAAkB;IA6CjC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IASrB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;YA6BnB,QAAQ;YAQR,YAAY;IA2B1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IAQxB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ5B,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAK5B,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,GAAE,QAAiB,GAAG,MAAM;IAWlE,+CAA+C;IAC/C,SAAS,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAGzD"}

package/dist/internal/vuln-checker/reporters/console-reporter.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Console reporter for terminal output
+ */
+import type { Reporter, ScanResult } from '../types.js';
+export declare class ConsoleReporter implements Reporter {
+    name: string;
+    format(result: ScanResult): string;
+}
+//# sourceMappingURL=console-reporter.d.ts.map

package/dist/internal/vuln-checker/reporters/console-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/console-reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AA0F3E,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,IAAI,SAAa;IAEjB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAuEnC"}

package/dist/internal/vuln-checker/reporters/json-reporter.d.ts

@@ -0,0 +1,9 @@
+/**
+ * JSON reporter for vulnerability scan results
+ */
+import type { Reporter, ScanResult } from '../types.js';
+export declare class JsonReporter implements Reporter {
+    name: string;
+    format(result: ScanResult): string;
+}
+//# sourceMappingURL=json-reporter.d.ts.map

package/dist/internal/vuln-checker/reporters/json-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/json-reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,YAAa,YAAW,QAAQ;IAC3C,IAAI,SAAU;IAEd,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAGnC"}

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Markdown reporter for human-readable vulnerability reports
+ */
+import type { Reporter, ScanResult } from '../types.js';
+export declare class MarkdownReporter implements Reporter {
+    name: string;
+    format(result: ScanResult): string;
+}
+//# sourceMappingURL=markdown-reporter.d.ts.map

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/markdown-reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AAgH3E,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,IAAI,SAAc;IAElB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAqDnC"}

package/dist/internal/vuln-checker/reporters/sarif-reporter.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SARIF reporter for GitHub Code Scanning integration
+ *
+ * SARIF = Static Analysis Results Interchange Format
+ * https://sarifweb.azurewebsites.net/
+ */
+import type { Reporter, ScanResult } from '../types.js';
+export declare class SarifReporter implements Reporter {
+    name: string;
+    format(result: ScanResult): string;
+}
+//# sourceMappingURL=sarif-reporter.d.ts.map

package/dist/internal/vuln-checker/reporters/sarif-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/sarif-reporter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AA2H3E,qBAAa,aAAc,YAAW,QAAQ;IAC5C,IAAI,SAAW;IAEf,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAoCnC"}

package/dist/internal/vuln-checker/types.d.ts

@@ -0,0 +1,149 @@
+/**
+ * AI HINT: Core types for vulnerability checker
+ *
+ * Purpose: Define shared types for analyzers, rules, and reporters
+ * Design: Minimal, extensible, SARIF-compatible
+ */
+/**
+ * Severity levels (SARIF-compatible)
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+/**
+ * Finding categories
+ */
+export type Category = 'injection' | 'auth' | 'crypto' | 'secret' | 'config' | 'rls' | 'dependency' | 'design';
+/**
+ * Rule ID format: <category>/<subcategory>[-<variant>]
+ */
+export type RuleId = `${Category}/${string}`;
+/**
+ * Location in source code
+ */
+export interface Location {
+    file: string;
+    line: number;
+    column: number;
+    endLine?: number;
+    endColumn?: number;
+}
+/**
+ * Code snippet for context
+ */
+export interface CodeSnippet {
+    text: string;
+    highlightStart?: number;
+    highlightEnd?: number;
+}
+/**
+ * A single vulnerability finding
+ */
+export interface Finding {
+    ruleId: RuleId;
+    severity: Severity;
+    title: string;
+    description: string;
+    location: Location;
+    snippet?: CodeSnippet;
+    fix?: {
+        description: string;
+        replacement?: string;
+    };
+    metadata?: Record<string, unknown>;
+    cweId?: string;
+    owaspCategory?: string;
+    confidence?: number;
+}
+/**
+ * Rule definition
+ */
+export interface Rule {
+    id: RuleId;
+    name: string;
+    description: string;
+    severity: Severity;
+    category: Category;
+    cweId?: string;
+    owaspCategory?: string;
+    include?: string[];
+    exclude?: string[];
+    enabled?: boolean;
+}
+/**
+ * Ignore configuration
+ */
+export interface IgnoreRule {
+    rule: RuleId | '*';
+    path?: string;
+    reason: string;
+    expires?: string;
+    issue?: string;
+}
+/**
+ * Configuration file format
+ */
+export interface VulnCheckerConfig {
+    version: number;
+    categories?: Category[];
+    minSeverity?: Severity;
+    ignores?: IgnoreRule[];
+    patternsFile?: string;
+    format?: 'json' | 'sarif' | 'markdown' | 'console';
+}
+/**
+ * Scan result
+ */
+export interface ScanResult {
+    timestamp: string;
+    summary: {
+        total: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+        ignored: number;
+    };
+    findings: Finding[];
+    ignoredFindings?: Finding[];
+    metadata: {
+        duration: number;
+        filesScanned: number;
+        rulesEvaluated: number;
+        rootDir: string;
+    };
+}
+/**
+ * Analyzer interface
+ */
+export interface Analyzer {
+    name: string;
+    categories: Category[];
+    analyze(options: AnalyzerOptions): Promise<Finding[]>;
+}
+/**
+ * Analyzer options
+ */
+export interface AnalyzerOptions {
+    rootDir: string;
+    include?: string[];
+    exclude?: string[];
+    rules?: Rule[];
+    ignores?: IgnoreRule[];
+}
+/**
+ * Reporter interface
+ */
+export interface Reporter {
+    name: string;
+    format(result: ScanResult): string;
+}
+/**
+ * Inline annotation format
+ */
+export interface InlineAnnotation {
+    ruleId: RuleId | '*';
+    reason?: string;
+    scope: 'line' | 'next-line' | 'file';
+    line: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/internal/vuln-checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/internal/vuln-checker/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE;;GAEG;AACH,MAAM,MAAM,QAAQ,GAChB,WAAW,GACX,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,YAAY,GACZ,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,GAAG,CAAC,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IAC5B,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvB,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/notifiers/desktop-notifier.d.ts

@@ -0,0 +1,34 @@
+/**
+ * AI HINT: Desktop notification system
+ *
+ * Purpose: Send desktop notifications for important events
+ * Features: Cross-platform support, notification types, non-blocking
+ */
+export interface NotificationOptions {
+    title: string;
+    message: string;
+    type?: 'info' | 'success' | 'warning' | 'error';
+    sound?: boolean;
+    timeout?: number;
+}
+/**
+ * Send desktop notification
+ */
+export declare function notifyDesktop(options: NotificationOptions): Promise<void>;
+/**
+ * Send success notification
+ */
+export declare function notifySuccess(title: string, message: string): Promise<void>;
+/**
+ * Send error notification
+ */
+export declare function notifyError(title: string, message: string): Promise<void>;
+/**
+ * Send warning notification
+ */
+export declare function notifyWarning(title: string, message: string): Promise<void>;
+/**
+ * Check if notifications are supported
+ */
+export declare function isNotificationSupported(): boolean;
+//# sourceMappingURL=desktop-notifier.d.ts.map

package/dist/notifiers/desktop-notifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-notifier.d.ts","sourceRoot":"","sources":["../../src/notifiers/desktop-notifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD"}