@safegres/test 0.0.1 → 1.30.7

package/cli/commands.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commands = void 0;
+const logger_1 = require("@pgpmjs/logger");
+const inquirerer_1 = require("inquirerer");
+const audit_1 = __importDefault(require("./audit"));
+const baseline_1 = __importDefault(require("./baseline"));
+const doctor_1 = __importDefault(require("./doctor"));
+const eval_1 = __importDefault(require("./eval"));
+const print_config_1 = __importDefault(require("./print-config"));
+const log = new logger_1.Logger('safegres');
+const usage = `
+safegres — Postgres security and performance auditor
+
+Usage:
+  safegres <command> [OPTIONS]
+
+Commands:
+  audit           Audit grants, RLS flags, policy coverage, and anti-patterns
+  lint            Alias for audit, for a package.json script
+  perf            Audit index hygiene and policy cost (audit --perf)
+  baseline        Choose the report a delta is measured against (CI)
+  doctor          Diagnose environment, connection, and configuration
+  eval            Grade the auditor against a corpus with known answers
+  print-config    Show the resolved effective configuration
+  help            Show this help message
+
+Run \`safegres <command> --help\` for command-specific options.
+`;
+const commandMap = {
+    audit: audit_1.default,
+    lint: audit_1.default,
+    perf: (argv, prompter, options) => (0, audit_1.default)({ ...argv, perf: true }, prompter, options),
+    baseline: baseline_1.default,
+    doctor: doctor_1.default,
+    eval: eval_1.default,
+    'print-config': print_config_1.default
+};
+const commands = async (argv, prompter, options) => {
+    const { first: command, newArgv } = (0, inquirerer_1.extractFirst)(argv);
+    if (!command && (argv.help || argv.h)) {
+        process.stdout.write(usage);
+        return;
+    }
+    if (!command || command === 'help') {
+        process.stdout.write(usage);
+        return;
+    }
+    const handler = commandMap[command];
+    if (!handler) {
+        log.error(`Unknown command: ${command}`);
+        process.stdout.write(usage);
+        process.exit(2);
+    }
+    await handler(newArgv, prompter, options);
+};
+exports.commands = commands;

package/cli/doctor.d.ts

@@ -0,0 +1,3 @@
+import { CLIOptions, Inquirerer, ParsedArgs } from 'inquirerer';
+declare const _default: (argv: ParsedArgs, _prompter: Inquirerer, _options: CLIOptions) => Promise<void>;
+export default _default;

package/cli/doctor.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const yanse_1 = __importDefault(require("yanse"));
+const doctor_1 = require("../commands/doctor");
+const shared_1 = require("./shared");
+const usage = `
+safegres doctor — diagnose the environment, connection, and configuration
+
+  safegres doctor [OPTIONS]
+
+Connection (same flags as \`safegres audit\`):
+  --connection <url>       Full PostgreSQL connection string
+  --host / --port / --user / --password / --database
+
+Configuration:
+  --config <path>          Explicit config file
+  --preset <name>          Apply a built-in preset
+  --rule <CODE=SETTING>    Retune a rule (repeatable)
+
+Options:
+  --no-color               Disable ANSI colors
+  --help, -h               Show this help message
+
+Checks: config discovery & rule validation, pgsql-parser availability,
+connection, catalog access (pg_policy), audit blind spots (BYPASSRLS),
+and whether any tables actually have RLS enabled.
+`;
+const STATUS_LABEL = {
+    ok: 'OK  ',
+    warn: 'WARN',
+    fail: 'FAIL'
+};
+exports.default = async (argv, _prompter, _options) => {
+    if (argv.help || argv.h) {
+        process.stdout.write(usage);
+        return;
+    }
+    const colorEnabled = argv.color !== false;
+    const paint = (status, s) => {
+        if (!colorEnabled)
+            return s;
+        if (status === 'ok')
+            return yanse_1.default.green(s);
+        if (status === 'warn')
+            return yanse_1.default.yellow(s);
+        return yanse_1.default.bold(yanse_1.default.red(s));
+    };
+    let client = (0, shared_1.buildClient)(argv);
+    try {
+        await client.connect();
+    }
+    catch {
+        client = null;
+    }
+    try {
+        const report = await (0, doctor_1.doctor)(client, (0, shared_1.configParamsFromArgv)(argv));
+        for (const check of report.checks) {
+            process.stdout.write(`[${paint(check.status, STATUS_LABEL[check.status])}] ${check.name.padEnd(12)} ${check.detail}\n`);
+        }
+        process.stdout.write('\n');
+        process.stdout.write(report.ok ? 'doctor: all checks passed\n' : 'doctor: some checks failed\n');
+        if (!report.ok)
+            process.exit(1);
+    }
+    finally {
+        if (client)
+            await client.end();
+    }
+};

package/cli/eval.d.ts

@@ -0,0 +1,3 @@
+import { CLIOptions, Inquirerer, ParsedArgs } from 'inquirerer';
+declare const _default: (argv: ParsedArgs, _prompter: Inquirerer, _options: CLIOptions) => Promise<void>;
+export default _default;

package/cli/eval.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const yanse_1 = __importDefault(require("yanse"));
+const eval_1 = require("../commands/eval");
+const loader_1 = require("../config/loader");
+const corpus_1 = require("../corpus");
+const shared_1 = require("./shared");
+const usage = `
+safegres eval — grade the auditor against a corpus with known answers
+
+  safegres eval [OPTIONS]
+
+Deploys each corpus case into the connected database, audits it under a sealed
+preset, and grades the report against the case's answer key: every expected
+finding present (recall), nothing the case forbids (precision). Exits non-zero
+if any case fails. Each case's schemas are dropped afterwards.
+
+Connection (same flags as \`safegres audit\`):
+  --connection <url>       Full PostgreSQL connection string
+  --host / --port / --user / --password / --database
+
+Options:
+  --preset <name>          Preset every case is graded under (default: recommended)
+  --corpus <dir>           Corpus directory of <id>/{case.json,schema.sql}
+  --case <id>              Run only these cases; id or id prefix, comma-separated
+  --list                   List the corpus without connecting to a database
+  --keep                   Leave the case schemas in the database
+  --json                   Emit the machine-readable result instead of a table
+  --no-color               Disable ANSI colors
+  --help, -h               Show this help message
+
+Config: a discovered safegres config may set \`eval.corpus\`, \`eval.preset\` and
+\`eval.cases\` — what to run. It cannot retune the rules: cases are always
+graded by the named preset alone, or the corpus would be measuring itself.
+`;
+/**
+ * Discovery is used for *selection only* (which corpus, which preset, which
+ * cases). Grading always loads the preset sealed, so nothing in the working
+ * tree can change the answers.
+ */
+function evalDefaults(configFile) {
+    try {
+        const loaded = (0, loader_1.loadConfig)({ configFile });
+        const config = loaded.config.eval ?? {};
+        if (config.corpus === undefined)
+            return config;
+        // Like every other configured path: relative to the file that declared it,
+        // so a corpus committed next to the config is found from any cwd.
+        return { ...config, corpus: path.resolve((0, loader_1.configPathBase)(loaded).dirFor('eval.corpus'), config.corpus) };
+    }
+    catch {
+        return {};
+    }
+}
+function line(r, color) {
+    const paint = (s) => (!color ? s : r.passed ? yanse_1.default.green(s) : yanse_1.default.bold(yanse_1.default.red(s)));
+    const detail = r.passed
+        ? r.found.map((e) => e.code).join(' ')
+        : [
+            ...r.missed.map((e) => `missed ${e.code}${e.relation ? `@${e.relation}` : ''}`),
+            ...r.falsePositives.map((code) => `false positive ${code}`)
+        ].join(', ');
+    return `  ${paint(r.passed ? 'PASS' : 'FAIL')}  ${r.id.padEnd(32)} ${r.dimension.padEnd(8)} `
+        + `${String(r.score).padStart(3)} (${r.grade.padEnd(2)})  ${detail}\n`;
+}
+function summary(report, color) {
+    const pct = (n) => `${Math.round(n * 100)}%`;
+    const ok = report.passed === report.total;
+    const headline = `${report.passed}/${report.total} cases passed`;
+    return `\n${color ? (ok ? yanse_1.default.green(headline) : yanse_1.default.bold(yanse_1.default.red(headline))) : headline}`
+        + ` · recall ${pct(report.recall)} · precision ${pct(report.precision)}\n`;
+}
+exports.default = async (argv, _prompter, _options) => {
+    if (argv.help || argv.h) {
+        process.stdout.write(usage);
+        return;
+    }
+    const defaults = evalDefaults(typeof argv.config === 'string' ? argv.config : undefined);
+    const corpus = typeof argv.corpus === 'string' ? argv.corpus : defaults.corpus;
+    const preset = typeof argv.preset === 'string' ? argv.preset : (defaults.preset ?? 'recommended');
+    const cases = (0, shared_1.csvList)(argv.case) ?? defaults.cases;
+    const color = argv.color !== false && argv.json !== true;
+    if (argv.list === true) {
+        for (const c of (0, corpus_1.loadCorpus)(corpus)) {
+            process.stdout.write(`${c.id.padEnd(32)} ${c.dimension.padEnd(8)} ${c.title}\n`);
+        }
+        return;
+    }
+    const { config } = (0, loader_1.loadConfig)({ sealed: true, preset });
+    const client = (0, shared_1.buildClient)(argv);
+    await client.connect();
+    try {
+        const report = await (0, eval_1.runEval)(client, {
+            config,
+            preset,
+            corpus,
+            cases,
+            keep: argv.keep === true,
+            onResult: argv.json === true ? undefined : (r) => process.stdout.write(line(r, color))
+        });
+        if (argv.json === true) {
+            process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(summary(report, color));
+            for (const r of report.results.filter((x) => !x.passed)) {
+                process.stdout.write(`\n${r.id}: ${r.title}\n  fix: ${r.fix}\n`);
+            }
+        }
+        if (report.passed !== report.total)
+            process.exit(1);
+    }
+    finally {
+        await client.end();
+    }
+};

package/cli/print-config.d.ts

@@ -0,0 +1,3 @@
+import { CLIOptions, Inquirerer, ParsedArgs } from 'inquirerer';
+declare const _default: (argv: ParsedArgs, _prompter: Inquirerer, _options: CLIOptions) => Promise<void>;
+export default _default;

package/cli/print-config.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const loader_1 = require("../config/loader");
+const resolve_1 = require("../config/resolve");
+const schema_1 = require("../config/schema");
+const registry_1 = require("../rules/registry");
+const shared_1 = require("./shared");
+const usage = `
+safegres print-config — show the resolved effective configuration
+
+  safegres print-config [OPTIONS]
+
+Options:
+  --config <path>          Explicit config file
+  --preset <name>          Apply a built-in preset
+  --rule <CODE=SETTING>    Retune a rule (repeatable)
+  --explain                Show per-key provenance (which layer set each value)
+  --schema                 Print the config JSON Schema instead, for an editor
+  --help, -h               Show this help message
+`;
+exports.default = async (argv, _prompter, _options) => {
+    if (argv.help || argv.h) {
+        process.stdout.write(usage);
+        return;
+    }
+    if (argv.schema === true) {
+        process.stdout.write(`${JSON.stringify((0, schema_1.toJsonSchema)(), null, 2)}\n`);
+        return;
+    }
+    const params = (0, shared_1.configParamsFromArgv)(argv);
+    if (argv.explain === true) {
+        const loader = (0, loader_1.safegresConfigLoader)();
+        const explained = loader.explainSync({
+            configFile: params.configFile,
+            overrides: params.overrides
+        });
+        for (const e of explained) {
+            process.stdout.write(`${e.path} = ${JSON.stringify(e.value)}  (${e.source}: ${e.origin})\n`);
+        }
+        return;
+    }
+    const { config, filepath, isEmpty } = (0, loader_1.loadConfig)(params);
+    const resolved = (0, resolve_1.resolveRules)(config);
+    const effectiveRules = {};
+    for (const rule of registry_1.RULES) {
+        const r = resolved.rules.get(rule.code);
+        effectiveRules[rule.code] = r.enabled ? r.severity : 'off';
+    }
+    process.stdout.write(`${JSON.stringify({
+        source: filepath ?? (isEmpty ? '(no config file — defaults)' : undefined),
+        config,
+        effectiveRules
+    }, null, 2)}\n`);
+};

package/cli/shared.d.ts

@@ -0,0 +1,43 @@
+import type { ParsedArgs } from 'inquirerer';
+import { Client } from 'pg';
+import type { ConfigPathBase, LoadConfigParams } from '../config/loader';
+import type { ExtensionsConfig, RulesConfig, SafegresConfig } from '../config/types';
+export declare function csvList(value: unknown): string[] | undefined;
+/**
+ * Merge `--ignore-extensions` / `--audit-extension-owned` over the config's
+ * `extensions` block. Returns `undefined` when neither side says anything, so
+ * the introspection defaults apply.
+ */
+export declare function extensionScopeFromArgv(argv: ParsedArgs, config: SafegresConfig): ExtensionsConfig | undefined;
+export declare function buildClient(argv: ParsedArgs): Client;
+/**
+ * Parse repeatable `--rule CODE=SETTING` flags into a RulesConfig, e.g.
+ * `--rule A3=off --rule A5=high --rule 'P*'=off`.
+ */
+export declare function parseRuleFlags(value: unknown): RulesConfig | undefined;
+/** Every file a run reads or writes, after flags and config have been merged. */
+export interface RunPaths {
+    /** The pgpm workspace to deploy, when `usePgpm`. Undefined means "nearest". */
+    pgpm?: string;
+    usePgpm: boolean;
+    perfBaseline?: string;
+    callGraphBaseline?: string;
+    outputs: {
+        json?: string;
+        markdown?: string;
+        sarif?: string;
+        sarifSources?: string;
+        snapshot?: string;
+        githubComment?: string;
+    };
+}
+/**
+ * Flags win over the config file. A path from a config file is resolved
+ * against *the file that declared it* — which is not always the discovered
+ * one, since a file can extend another — so a CI job can run from any
+ * directory; a path on the command line stays relative to cwd, like every
+ * other command's arguments.
+ */
+export declare function resolveRunPaths(argv: ParsedArgs, config: SafegresConfig, base: ConfigPathBase | string): RunPaths;
+/** Build config-loading params from shared CLI flags. */
+export declare function configParamsFromArgv(argv: ParsedArgs): LoadConfigParams;

package/cli/shared.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csvList = csvList;
+exports.extensionScopeFromArgv = extensionScopeFromArgv;
+exports.buildClient = buildClient;
+exports.parseRuleFlags = parseRuleFlags;
+exports.resolveRunPaths = resolveRunPaths;
+exports.configParamsFromArgv = configParamsFromArgv;
+const path = __importStar(require("path"));
+const pg_1 = require("pg");
+const pg_env_1 = require("pg-env");
+function csvList(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return undefined;
+    return value
+        .split(',')
+        .map((p) => p.trim())
+        .filter(Boolean);
+}
+/**
+ * Merge `--ignore-extensions` / `--audit-extension-owned` over the config's
+ * `extensions` block. Returns `undefined` when neither side says anything, so
+ * the introspection defaults apply.
+ */
+function extensionScopeFromArgv(argv, config) {
+    const ignore = csvList(argv['ignore-extensions']) ?? config.extensions?.ignore;
+    const skipOwned = argv['audit-extension-owned'] === true ? false : config.extensions?.skipOwned;
+    if (ignore === undefined && skipOwned === undefined)
+        return undefined;
+    return { ...(ignore !== undefined && { ignore }), ...(skipOwned !== undefined && { skipOwned }) };
+}
+function buildClient(argv) {
+    if (typeof argv.connection === 'string' && argv.connection.length > 0) {
+        return new pg_1.Client({ connectionString: argv.connection });
+    }
+    const overrides = {};
+    if (typeof argv.host === 'string')
+        overrides.host = argv.host;
+    if (typeof argv.port === 'number')
+        overrides.port = argv.port;
+    if (typeof argv.user === 'string')
+        overrides.user = argv.user;
+    if (typeof argv.password === 'string')
+        overrides.password = argv.password;
+    if (typeof argv.database === 'string')
+        overrides.database = argv.database;
+    return new pg_1.Client((0, pg_env_1.getPgEnvOptions)(overrides));
+}
+/**
+ * Parse repeatable `--rule CODE=SETTING` flags into a RulesConfig, e.g.
+ * `--rule A3=off --rule A5=high --rule 'P*'=off`.
+ */
+function parseRuleFlags(value) {
+    if (value == null)
+        return undefined;
+    const entries = Array.isArray(value) ? value : [value];
+    const rules = {};
+    for (const entry of entries) {
+        if (typeof entry !== 'string')
+            continue;
+        const eq = entry.indexOf('=');
+        if (eq <= 0) {
+            throw new Error(`Invalid --rule "${entry}": expected CODE=off|<severity>.`);
+        }
+        const code = entry.slice(0, eq).trim();
+        const setting = entry.slice(eq + 1).trim();
+        rules[code] = setting;
+    }
+    return Object.keys(rules).length > 0 ? rules : undefined;
+}
+/** Did the caller name a database on the command line, rather than in the environment? */
+function hasConnectionFlag(argv) {
+    return ['connection', 'database', 'host', 'port'].some((flag) => typeof argv[flag] === 'string' || typeof argv[flag] === 'number');
+}
+/**
+ * Flags win over the config file. A path from a config file is resolved
+ * against *the file that declared it* — which is not always the discovered
+ * one, since a file can extend another — so a CI job can run from any
+ * directory; a path on the command line stays relative to cwd, like every
+ * other command's arguments.
+ */
+function resolveRunPaths(argv, config, base) {
+    const dirFor = typeof base === 'string' ? () => base : (key) => base.dirFor(key);
+    const pick = (flag, key, configured) => typeof flag === 'string' ? flag : configured && path.resolve(dirFor(key), configured);
+    // A directory is the common case: one path, conventional names, no remembering
+    // which extension goes with which renderer. A named file still wins.
+    const dir = pick(argv.out, 'outputs.dir', config.outputs?.dir);
+    const inDir = (name) => dir && path.join(dir, name);
+    return {
+        pgpm: pick(argv.pgpm, 'source.pgpm', config.source?.pgpm),
+        // An explicit connection on the command line beats a configured source:
+        // pointing the same config at a database you already have is the whole
+        // reason to type one, and deploying a throwaway copy instead would ignore it.
+        usePgpm: argv.pgpm !== undefined || (config.source?.pgpm !== undefined && !hasConnectionFlag(argv)),
+        perfBaseline: pick(argv['perf-baseline'], 'perf.baseline', config.perf?.baseline),
+        callGraphBaseline: pick(argv.baseline, 'callGraph.baseline', config.callGraph?.baseline),
+        outputs: {
+            json: pick(argv['write-json'], 'outputs.json', config.outputs?.json) ?? inDir('safegres.json'),
+            markdown: pick(argv['write-markdown'], 'outputs.markdown', config.outputs?.markdown)
+                ?? inDir('safegres.md'),
+            sarif: pick(argv['write-sarif'], 'outputs.sarif', config.outputs?.sarif) ?? inDir('safegres.sarif'),
+            sarifSources: pick(argv['sarif-sources'], 'outputs.sarifSources', config.outputs?.sarifSources),
+            snapshot: pick(argv['write-snapshot'], 'outputs.snapshot', config.outputs?.snapshot),
+            githubComment: pick(argv['write-github-comment'], 'outputs.githubComment', config.outputs?.githubComment)
+        }
+    };
+}
+/** Build config-loading params from shared CLI flags. */
+function configParamsFromArgv(argv) {
+    const cliRules = parseRuleFlags(argv.rule);
+    const overrides = {};
+    if (cliRules)
+        overrides.rules = cliRules;
+    return {
+        configFile: typeof argv.config === 'string' ? argv.config : undefined,
+        preset: typeof argv.preset === 'string' ? argv.preset : undefined,
+        overrides: Object.keys(overrides).length > 0 ? overrides : undefined,
+        sealed: argv.sealed === true
+    };
+}

package/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/cli.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = require("@pgpmjs/logger");
+const inquirerer_1 = require("inquirerer");
+const commands_1 = require("./cli/commands");
+const log = new logger_1.Logger('safegres');
+if (process.argv.includes('--version') || process.argv.includes('-v')) {
+    const pkg = (0, inquirerer_1.getPackageJson)(__dirname);
+    process.stdout.write(`${pkg.version}\n`);
+    process.exit(0);
+}
+const options = {
+    minimistOpts: {
+        alias: { v: 'version', h: 'help', q: 'summary' },
+        boolean: [
+            'skip-ast',
+            'color',
+            'help',
+            'version',
+            'summary',
+            'verbose',
+            'call-graph',
+            'fail-on-new-boundaries',
+            'keep',
+            'list',
+            'json'
+        ],
+        string: [
+            'baseline',
+            'write-baseline',
+            'compare',
+            'compare-ref',
+            'compare-sha',
+            'compare-run-id',
+            'compare-run-url',
+            'compare-age',
+            'compare-skipped',
+            'write-snapshot',
+            'connection',
+            'host',
+            'user',
+            'password',
+            'database',
+            'schemas',
+            'exclude-schemas',
+            'ignore-extensions',
+            'roles',
+            'exclude-roles',
+            'format',
+            'fail-on',
+            'out',
+            'preset',
+            'corpus',
+            'case',
+            'provider',
+            'repo',
+            'base',
+            'head',
+            'workflow',
+            'artifact',
+            'dir'
+        ]
+    }
+};
+new inquirerer_1.CLI(commands_1.commands, options).run().catch((error) => {
+    log.error(error);
+    process.exit(1);
+});