@runa-ai/runa-cli 0.5.71 → 0.6.0

package/dist/validators/risk-detector-content-risks.d.ts

@@ -0,0 +1,13 @@
+import type { SchemaRisk } from './risk-detector-types.js';
+/**
+ * Normalize SQL content for pattern matching.
+ *
+ * - Removes SQL comments (-- and /* *\/)
+ * - Preserves content length to keep line offsets stable
+ */
+export declare function stripSqlForPatternMatching(content: string): string;
+/**
+ * Detect risks using content-based pattern matching.
+ */
+export declare function detectRisksFromContent(normalizedContent: string, originalContent: string, lineStarts: number[]): SchemaRisk[];
+//# sourceMappingURL=risk-detector-content-risks.d.ts.map

package/dist/validators/risk-detector-core.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: Schema risk detection
+ *
+ * Purpose: Detect risky schema changes before they cause problems
+ * Features: Risk categorization, mitigation suggestions
+ *
+ * Design:
+ * - Uses normalized content (whitespace-collapsed) for multi-line SQL detection
+ * - Detects dangerous DDL operations that may cause data loss
+ * - Provides actionable mitigation suggestions
+ */
+import type { SchemaRisk } from './risk-detector-types.js';
+export type { RiskConfidence, RiskLevel, SchemaRisk, } from './risk-detector-types.js';
+/**
+ * Detect risks in a schema file
+ *
+ * Uses two strategies:
+ * 1. Content-based: For multi-line SQL statements (DROP TABLE, ALTER COLUMN, etc.)
+ * 2. Line-based: For patterns that benefit from line-level detection (REFERENCES)
+ *
+ * Note: Wrapper function definitions (runa_auth_*) are masked to avoid false positives
+ * when detecting auth.uid() / auth.jwt() usage.
+ */
+export declare function detectSchemaRisks(filePath: string): Promise<SchemaRisk[]>;
+//# sourceMappingURL=risk-detector-core.d.ts.map

package/dist/validators/risk-detector-patterns.d.ts

@@ -0,0 +1,15 @@
+import type { RiskConfidence, RiskLevel } from './risk-detector-types.js';
+export type { RiskConfidence, RiskLevel } from './risk-detector-types.js';
+export interface RiskPattern {
+    pattern: RegExp;
+    level: RiskLevel;
+    description: string;
+    mitigation: string;
+    reasonCode: string;
+    confidence: RiskConfidence;
+}
+export declare const IDENTIFIER_PATTERN = "[A-Za-z_][A-Za-z0-9_]*";
+export declare const QUALIFIED_IDENTIFIER = "(?:[A-Za-z_][A-Za-z0-9_]*|\"(?:[^\"]|\"\")*\")(?:\\s*\\.\\s*(?:[A-Za-z_][A-Za-z0-9_]*|\"(?:[^\"]|\"\")*\"))?";
+export declare const RUNA_AUTH_FUNCTION_NAME: RegExp;
+export declare const RISK_PATTERNS: RiskPattern[];
+//# sourceMappingURL=risk-detector-patterns.d.ts.map

package/dist/validators/risk-detector-plpgsql-expression-resolver.d.ts

@@ -0,0 +1,22 @@
+/**
+ * AI HINT: PL/pgSQL expression resolver helpers.
+ *
+ * Purpose: Reconstruct static SQL strings from PL/pgSQL expressions when possible.
+ */
+export declare function skipWhitespace(content: string, index: number): number;
+export declare function skipIdentifier(content: string, index: number): number;
+export type StaticSqlExtractionResult = {
+    kind: 'static';
+    sql: string;
+} | {
+    kind: 'unresolved';
+    reason: string;
+};
+export declare function parseTopLevelAssignment(statement: string): {
+    target: string;
+    expression: string;
+    isConditionalContext: boolean;
+} | undefined;
+export declare function mergeStringEnvValue(env: Map<string, string>, target: string, nextValue: string): void;
+export declare function extractStaticSqlFromExpression(expression: string, stringEnv?: Map<string, string>): StaticSqlExtractionResult;
+//# sourceMappingURL=risk-detector-plpgsql-expression-resolver.d.ts.map

package/dist/validators/risk-detector-plpgsql-parser.d.ts

@@ -0,0 +1,5 @@
+export type { PlpgsqlExecuteInfo, PlpgsqlStatementRange, } from './risk-detector-plpgsql-tokenizer.js';
+export type { StaticSqlExtractionResult } from './risk-detector-plpgsql-expression-resolver.js';
+export { extractExecuteExpressions, splitPlpgsqlStatementsWithOffsets, } from './risk-detector-plpgsql-tokenizer.js';
+export { extractStaticSqlFromExpression, mergeStringEnvValue, parseTopLevelAssignment, skipIdentifier, skipWhitespace, } from './risk-detector-plpgsql-expression-resolver.js';
+//# sourceMappingURL=risk-detector-plpgsql-parser.d.ts.map

package/dist/validators/risk-detector-plpgsql-tokenizer.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AI HINT: PL/pgSQL tokenizer/scanner helpers.
+ *
+ * Purpose: Statement splitting and EXECUTE expression extraction.
+ */
+export type PlpgsqlExecuteInfo = {
+    expression: string;
+    statementStartOffset: number;
+    hasUsingClause: boolean;
+    hasIntoClause: boolean;
+};
+export type PlpgsqlStatementRange = {
+    statement: string;
+    startOffset: number;
+};
+export declare function splitPlpgsqlStatementsWithOffsets(content: string): PlpgsqlStatementRange[];
+export declare function extractExecuteExpressions(body: string): PlpgsqlExecuteInfo[];
+//# sourceMappingURL=risk-detector-plpgsql-tokenizer.d.ts.map

package/dist/validators/risk-detector-plpgsql.d.ts

@@ -0,0 +1,9 @@
+/**
+ * AI HINT: PL/pgSQL dynamic SQL risk analyzer
+ *
+ * Purpose: Detect unresolved or high-risk dynamic SQL usage in DO/FUNCTION bodies.
+ * Design: Keep heavy PL/pgSQL parsing logic isolated from risk-detector-core import path.
+ */
+import type { SchemaRisk } from './risk-detector-types.js';
+export declare function detectPlpgsqlDynamicExecutionRisks(content: string): SchemaRisk[];
+//# sourceMappingURL=risk-detector-plpgsql.d.ts.map

package/dist/validators/risk-detector-text-utils.d.ts

@@ -0,0 +1,6 @@
+export declare function stripSqlCommentsPreserveLines(content: string): string;
+export declare function stripSqlStringsPreserveLines(content: string): string;
+export declare function maskWrapperFunctions(content: string): string;
+export declare function buildLineStarts(content: string): number[];
+export declare function lineNumberFromIndex(content: string, index: number, lineStarts?: number[]): number;
+//# sourceMappingURL=risk-detector-text-utils.d.ts.map

package/dist/validators/risk-detector-types.d.ts

@@ -0,0 +1,16 @@
+export type RiskLevel = 'low' | 'medium' | 'high';
+export type RiskConfidence = 'low' | 'medium' | 'high';
+export interface SchemaRisk {
+    level: RiskLevel;
+    description: string;
+    mitigation?: string;
+    line?: number;
+    reasonCode?: string;
+    confidence?: RiskConfidence;
+    evidence?: {
+        source: string;
+        snippet?: string;
+        detail?: string;
+    };
+}
+//# sourceMappingURL=risk-detector-types.d.ts.map

package/dist/validators/risk-detector.d.ts

@@ -1,34 +1,15 @@
+import type { SchemaRisk } from './risk-detector-types.js';
 /**
- * AI HINT: Schema risk detection
+ * AI HINT: Schema risk detection façade
  *
- * Purpose: Detect risky schema changes before they cause problems
- * Features: Risk categorization, mitigation suggestions
- *
- * Design:
- * - Uses normalized content (whitespace-collapsed) for multi-line SQL detection
- * - Detects dangerous DDL operations that may cause data loss
- * - Provides actionable mitigation suggestions
- */
-export type RiskLevel = 'low' | 'medium' | 'high';
-export interface SchemaRisk {
-    level: RiskLevel;
-    description: string;
-    mitigation?: string;
-    line?: number;
-}
-/**
- * Detect risks in a schema file
- *
- * Uses two strategies:
- * 1. Content-based: For multi-line SQL statements (DROP TABLE, ALTER COLUMN, etc.)
- * 2. Line-based: For patterns that benefit from line-level detection (REFERENCES)
- *
- * Note: Wrapper function definitions (runa_auth_*) are masked to avoid false positives
- * when detecting auth.uid() / auth.jwt() usage.
+ * Purpose: Keep module import light and load the heavy analysis engine lazily.
  */
+export type { RiskLevel, RiskConfidence, SchemaRisk, } from './risk-detector-types.js';
 export declare function detectSchemaRisks(filePath: string): Promise<SchemaRisk[]>;
 /**
- * Categorize risks by level
+ * Categorize risks by level.
+ * Kept in façade to avoid eager loading the full engine module for callers that only need
+ * lightweight risk grouping.
  */
 export declare function categorizeRisks(risks: SchemaRisk[]): {
     high: SchemaRisk[];

package/dist/vuln-check-TYQNEFS7.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { emitJsonSuccess } from './chunk-UU55OH7P.js';
+import './chunk-RRGQCUKT.js';
+import './chunk-JT5SUTWE.js';
+import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { createCLILogger } from '@runa-ai/runa';
+import chalk from 'chalk';
+import { Command } from 'commander';
+import { z } from 'zod';
+
+createRequire(import.meta.url);
+
+// src/commands/vuln-check.ts
+init_esm_shims();
+var VulnCheckOutputSchema = z.object({
+  timestamp: z.string(),
+  summary: z.object({
+    total: z.number(),
+    critical: z.number(),
+    high: z.number(),
+    medium: z.number(),
+    low: z.number(),
+    info: z.number(),
+    ignored: z.number()
+  }),
+  findings: z.array(
+    z.object({
+      ruleId: z.string(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]),
+      title: z.string(),
+      description: z.string(),
+      location: z.object({
+        file: z.string(),
+        line: z.number(),
+        column: z.number().optional(),
+        endLine: z.number().optional(),
+        endColumn: z.number().optional()
+      }),
+      snippet: z.object({ text: z.string() }).optional(),
+      fix: z.object({
+        description: z.string(),
+        replacement: z.string().optional()
+      }).optional(),
+      cweId: z.string().optional(),
+      owaspCategory: z.string().optional(),
+      confidence: z.number().optional()
+    })
+  ),
+  metadata: z.object({
+    duration: z.number(),
+    filesScanned: z.number(),
+    rulesEvaluated: z.number(),
+    rootDir: z.string()
+  }),
+  ignoredFindings: z.array(z.any()).optional()
+});
+var vulnCheckCommand = new Command("vuln-check").description("Run comprehensive vulnerability scan").option(
+  "-c, --category <categories>",
+  "Categories to scan (comma-separated: code,deps,rls,secrets)",
+  "code,deps,rls,secrets"
+).option(
+  "-s, --min-severity <severity>",
+  "Minimum severity to report (critical,high,medium,low,info)",
+  "low"
+).option("-f, --format <format>", "Output format (console,json,sarif,markdown)", "console").option("--show-ignored", "Show ignored findings", false).option("--ci", "CI mode (exit code based on findings)", false).option(
+  "--fail-on <severity>",
+  "Severity threshold for CI failure (critical,high,medium,low)",
+  "high"
+).option("--include <patterns>", "File patterns to include", "**/*.ts,**/*.tsx,**/*.sql").option("--exclude <patterns>", "File patterns to exclude", "**/node_modules/**,**/dist/**").action(async function(options) {
+  const logger = createCLILogger("vuln-check");
+  const isJsonMode = getOutputFormatFromEnv() === "json" || options.format === "json";
+  try {
+    const { VulnChecker } = await import('./vuln-checker-2QXGN5YT.js');
+    const categoryMap = {
+      code: ["injection", "auth", "crypto"],
+      deps: ["dependency"],
+      rls: ["rls"],
+      secrets: ["secret"]
+    };
+    const categories = options.category?.split(",").flatMap((c) => categoryMap[c.trim()] || [c.trim()]);
+    const checker = new VulnChecker({
+      rootDir: process.cwd(),
+      categories,
+      minSeverity: options.minSeverity,
+      format: options.format,
+      showIgnored: options.showIgnored,
+      include: options.include?.split(","),
+      exclude: options.exclude?.split(",")
+    });
+    if (!isJsonMode) {
+      logger.step("Running vulnerability scan...", 1);
+    }
+    const result = await checker.scan();
+    const output = checker.format(result);
+    if (isJsonMode || options.format === "json" || options.format === "sarif") {
+      console.log(output);
+      if (options.format === "json") {
+        emitJsonSuccess(this, VulnCheckOutputSchema, result);
+      }
+    } else {
+      console.log(output);
+    }
+    if (options.ci) {
+      const exitCode = checker.getExitCode(result, options.failOn);
+      if (exitCode !== 0) {
+        process.exit(exitCode);
+      }
+    }
+  } catch (error) {
+    if (isJsonMode) {
+      console.error(JSON.stringify({ error: String(error) }));
+    } else {
+      logger.error(`Vulnerability scan failed: ${error}`);
+      console.error(chalk.red("Error:"), error);
+    }
+    process.exit(1);
+  }
+});
+
+export { vulnCheckCommand };