@sponsio/sdk 0.1.0-alpha.3 → 0.2.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (243) hide show
  1. package/bin/sponsio.cjs +11 -0
  2. package/contracts/benchmark/agentdojo.yaml +551 -0
  3. package/contracts/benchmark/odcv_bench.yaml +393 -0
  4. package/contracts/benchmark/redcode_exec.yaml +488 -0
  5. package/contracts/benchmark/swebench.yaml +176 -0
  6. package/contracts/benchmark/tau2_bench.yaml +984 -0
  7. package/contracts/capability/credentials.yaml +8 -8
  8. package/contracts/capability/database.yaml +6 -6
  9. package/contracts/capability/destructive.yaml +213 -0
  10. package/contracts/capability/factual-claims.yaml +79 -0
  11. package/contracts/capability/filesystem-strict.yaml +4 -4
  12. package/contracts/capability/filesystem.yaml +9 -9
  13. package/contracts/capability/host-config-integrity.yaml +318 -0
  14. package/contracts/capability/self-modify.yaml +260 -9
  15. package/contracts/capability/shell.yaml +43 -41
  16. package/contracts/capability/subagent.yaml +5 -5
  17. package/contracts/incident/claude-code-secret-bypass.yaml +57 -26
  18. package/contracts/incident/cursor-railway-wipe.yaml +63 -7
  19. package/contracts/incident/mcp-composition.yaml +12 -12
  20. package/contracts/incident/openclaw.yaml +47 -92
  21. package/contracts/incident/subagent-escape.yaml +4 -4
  22. package/contracts/premium/.gitkeep +5 -6
  23. package/dist/cli/check.d.ts +2 -0
  24. package/dist/cli/check.d.ts.map +1 -0
  25. package/dist/cli/check.js +283 -0
  26. package/dist/cli/check.js.map +1 -0
  27. package/dist/cli/cli.d.ts +25 -0
  28. package/dist/cli/cli.d.ts.map +1 -0
  29. package/dist/cli/cli.js +491 -0
  30. package/dist/cli/cli.js.map +1 -0
  31. package/dist/cli/config.d.ts +88 -0
  32. package/dist/cli/config.d.ts.map +1 -0
  33. package/dist/cli/config.js +243 -0
  34. package/dist/cli/config.js.map +1 -0
  35. package/dist/cli/demo.d.ts +12 -0
  36. package/dist/cli/demo.d.ts.map +1 -0
  37. package/dist/cli/demo.js +350 -0
  38. package/dist/cli/demo.js.map +1 -0
  39. package/dist/cli/doctor.d.ts +11 -0
  40. package/dist/cli/doctor.d.ts.map +1 -0
  41. package/dist/cli/doctor.js +201 -0
  42. package/dist/cli/doctor.js.map +1 -0
  43. package/dist/cli/eval.d.ts +2 -0
  44. package/dist/cli/eval.d.ts.map +1 -0
  45. package/dist/cli/eval.js +361 -0
  46. package/dist/cli/eval.js.map +1 -0
  47. package/dist/cli/explain.d.ts +2 -0
  48. package/dist/cli/explain.d.ts.map +1 -0
  49. package/dist/cli/explain.js +266 -0
  50. package/dist/cli/explain.js.map +1 -0
  51. package/dist/cli/export-sessions.d.ts +2 -0
  52. package/dist/cli/export-sessions.d.ts.map +1 -0
  53. package/dist/cli/export-sessions.js +182 -0
  54. package/dist/cli/export-sessions.js.map +1 -0
  55. package/dist/cli/export.d.ts +2 -0
  56. package/dist/cli/export.d.ts.map +1 -0
  57. package/dist/cli/export.js +222 -0
  58. package/dist/cli/export.js.map +1 -0
  59. package/dist/cli/extractors/common.d.ts +27 -0
  60. package/dist/cli/extractors/common.d.ts.map +1 -0
  61. package/dist/cli/extractors/common.js +107 -0
  62. package/dist/cli/extractors/common.js.map +1 -0
  63. package/dist/cli/extractors/generic.d.ts +37 -0
  64. package/dist/cli/extractors/generic.d.ts.map +1 -0
  65. package/dist/cli/extractors/generic.js +185 -0
  66. package/dist/cli/extractors/generic.js.map +1 -0
  67. package/dist/cli/extractors/langchain.d.ts +18 -0
  68. package/dist/cli/extractors/langchain.d.ts.map +1 -0
  69. package/dist/cli/extractors/langchain.js +86 -0
  70. package/dist/cli/extractors/langchain.js.map +1 -0
  71. package/dist/cli/extractors/vercel.d.ts +17 -0
  72. package/dist/cli/extractors/vercel.d.ts.map +1 -0
  73. package/dist/cli/extractors/vercel.js +46 -0
  74. package/dist/cli/extractors/vercel.js.map +1 -0
  75. package/dist/cli/index.d.ts +38 -0
  76. package/dist/cli/index.d.ts.map +1 -0
  77. package/dist/cli/index.js +146 -0
  78. package/dist/cli/index.js.map +1 -0
  79. package/dist/cli/init.d.ts +2 -0
  80. package/dist/cli/init.d.ts.map +1 -0
  81. package/dist/cli/init.js +177 -0
  82. package/dist/cli/init.js.map +1 -0
  83. package/dist/cli/mode.d.ts +2 -0
  84. package/dist/cli/mode.d.ts.map +1 -0
  85. package/dist/cli/mode.js +71 -0
  86. package/dist/cli/mode.js.map +1 -0
  87. package/dist/cli/onboard.d.ts +88 -0
  88. package/dist/cli/onboard.d.ts.map +1 -0
  89. package/dist/cli/onboard.js +758 -0
  90. package/dist/cli/onboard.js.map +1 -0
  91. package/dist/cli/otlp.d.ts +27 -0
  92. package/dist/cli/otlp.d.ts.map +1 -0
  93. package/dist/cli/otlp.js +79 -0
  94. package/dist/cli/otlp.js.map +1 -0
  95. package/dist/cli/package.json +1 -0
  96. package/dist/cli/packs.d.ts +16 -0
  97. package/dist/cli/packs.d.ts.map +1 -0
  98. package/dist/cli/packs.js +190 -0
  99. package/dist/cli/packs.js.map +1 -0
  100. package/dist/cli/patterns.d.ts +16 -0
  101. package/dist/cli/patterns.d.ts.map +1 -0
  102. package/dist/cli/patterns.js +136 -0
  103. package/dist/cli/patterns.js.map +1 -0
  104. package/dist/cli/prompt.d.ts +2 -0
  105. package/dist/cli/prompt.d.ts.map +1 -0
  106. package/dist/cli/prompt.js +54 -0
  107. package/dist/cli/prompt.js.map +1 -0
  108. package/dist/cli/replay.d.ts +2 -0
  109. package/dist/cli/replay.d.ts.map +1 -0
  110. package/dist/cli/replay.js +196 -0
  111. package/dist/cli/replay.js.map +1 -0
  112. package/dist/cli/report.d.ts +57 -0
  113. package/dist/cli/report.d.ts.map +1 -0
  114. package/dist/cli/report.js +298 -0
  115. package/dist/cli/report.js.map +1 -0
  116. package/dist/cli/scan.d.ts +2 -0
  117. package/dist/cli/scan.d.ts.map +1 -0
  118. package/dist/cli/scan.js +172 -0
  119. package/dist/cli/scan.js.map +1 -0
  120. package/dist/cli/skill.d.ts +15 -0
  121. package/dist/cli/skill.d.ts.map +1 -0
  122. package/dist/cli/skill.js +131 -0
  123. package/dist/cli/skill.js.map +1 -0
  124. package/dist/cli/tokens.d.ts +31 -0
  125. package/dist/cli/tokens.d.ts.map +1 -0
  126. package/dist/cli/tokens.js +73 -0
  127. package/dist/cli/tokens.js.map +1 -0
  128. package/dist/cli/types.d.ts +46 -0
  129. package/dist/cli/types.d.ts.map +1 -0
  130. package/dist/cli/types.js +3 -0
  131. package/dist/cli/types.js.map +1 -0
  132. package/dist/cli/validate.d.ts +19 -0
  133. package/dist/cli/validate.d.ts.map +1 -0
  134. package/dist/cli/validate.js +205 -0
  135. package/dist/cli/validate.js.map +1 -0
  136. package/dist/cli/zod.d.ts +36 -0
  137. package/dist/cli/zod.d.ts.map +1 -0
  138. package/dist/cli/zod.js +226 -0
  139. package/dist/cli/zod.js.map +1 -0
  140. package/dist/cloud/client.d.ts +76 -0
  141. package/dist/cloud/client.d.ts.map +1 -0
  142. package/dist/cloud/client.js +204 -0
  143. package/dist/cloud/client.js.map +1 -0
  144. package/dist/cloud/evidence.d.ts +108 -0
  145. package/dist/cloud/evidence.d.ts.map +1 -0
  146. package/dist/cloud/evidence.js +184 -0
  147. package/dist/cloud/evidence.js.map +1 -0
  148. package/dist/cloud/privacy.d.ts +67 -0
  149. package/dist/cloud/privacy.d.ts.map +1 -0
  150. package/dist/cloud/privacy.js +170 -0
  151. package/dist/cloud/privacy.js.map +1 -0
  152. package/dist/cloud/view-model.d.ts +49 -0
  153. package/dist/cloud/view-model.d.ts.map +1 -0
  154. package/dist/cloud/view-model.js +172 -0
  155. package/dist/cloud/view-model.js.map +1 -0
  156. package/dist/contract.d.ts +13 -13
  157. package/dist/contract.d.ts.map +1 -1
  158. package/dist/contract.js +21 -21
  159. package/dist/contract.js.map +1 -1
  160. package/dist/core/config-loader.d.ts +1 -1
  161. package/dist/core/config-loader.d.ts.map +1 -1
  162. package/dist/core/config-loader.js +116 -26
  163. package/dist/core/config-loader.js.map +1 -1
  164. package/dist/core/evaluator.d.ts +11 -1
  165. package/dist/core/evaluator.d.ts.map +1 -1
  166. package/dist/core/evaluator.js +275 -13
  167. package/dist/core/evaluator.js.map +1 -1
  168. package/dist/core/formula.d.ts +76 -17
  169. package/dist/core/formula.d.ts.map +1 -1
  170. package/dist/core/formula.js +95 -1
  171. package/dist/core/formula.js.map +1 -1
  172. package/dist/core/grounding.d.ts +86 -3
  173. package/dist/core/grounding.d.ts.map +1 -1
  174. package/dist/core/grounding.js +485 -143
  175. package/dist/core/grounding.js.map +1 -1
  176. package/dist/core/nl-parser.d.ts +2 -2
  177. package/dist/core/nl-parser.d.ts.map +1 -1
  178. package/dist/core/nl-parser.js +690 -42
  179. package/dist/core/nl-parser.js.map +1 -1
  180. package/dist/core/pack-loader.d.ts.map +1 -1
  181. package/dist/core/pack-loader.js +14 -2
  182. package/dist/core/pack-loader.js.map +1 -1
  183. package/dist/core/parser.d.ts.map +1 -1
  184. package/dist/core/parser.js +30 -1
  185. package/dist/core/parser.js.map +1 -1
  186. package/dist/core/pattern-factory.d.ts +4 -4
  187. package/dist/core/pattern-factory.d.ts.map +1 -1
  188. package/dist/core/pattern-factory.js +59 -4
  189. package/dist/core/pattern-factory.js.map +1 -1
  190. package/dist/core/patterns.d.ts +196 -5
  191. package/dist/core/patterns.d.ts.map +1 -1
  192. package/dist/core/patterns.js +400 -13
  193. package/dist/core/patterns.js.map +1 -1
  194. package/dist/core/session-log.d.ts.map +1 -1
  195. package/dist/core/session-log.js +20 -1
  196. package/dist/core/session-log.js.map +1 -1
  197. package/dist/core/spans.d.ts +1 -1
  198. package/dist/core/spans.d.ts.map +1 -1
  199. package/dist/core/spans.js.map +1 -1
  200. package/dist/core/sto.d.ts +30 -66
  201. package/dist/core/sto.d.ts.map +1 -1
  202. package/dist/core/sto.js +39 -100
  203. package/dist/core/sto.js.map +1 -1
  204. package/dist/core/tool-names.d.ts +59 -0
  205. package/dist/core/tool-names.d.ts.map +1 -0
  206. package/dist/core/tool-names.js +128 -0
  207. package/dist/core/tool-names.js.map +1 -0
  208. package/dist/index.d.ts +227 -33
  209. package/dist/index.d.ts.map +1 -1
  210. package/dist/index.js +539 -152
  211. package/dist/index.js.map +1 -1
  212. package/dist/integrations/claude-agent.d.ts +5 -0
  213. package/dist/integrations/claude-agent.d.ts.map +1 -1
  214. package/dist/integrations/claude-agent.js +42 -13
  215. package/dist/integrations/claude-agent.js.map +1 -1
  216. package/dist/integrations/google-adk.d.ts +5 -3
  217. package/dist/integrations/google-adk.d.ts.map +1 -1
  218. package/dist/integrations/google-adk.js +9 -5
  219. package/dist/integrations/google-adk.js.map +1 -1
  220. package/dist/integrations/langchain.d.ts +7 -0
  221. package/dist/integrations/langchain.d.ts.map +1 -1
  222. package/dist/integrations/langchain.js +21 -3
  223. package/dist/integrations/langchain.js.map +1 -1
  224. package/dist/integrations/openai-agents.d.ts +22 -10
  225. package/dist/integrations/openai-agents.d.ts.map +1 -1
  226. package/dist/integrations/openai-agents.js +57 -16
  227. package/dist/integrations/openai-agents.js.map +1 -1
  228. package/dist/integrations/openai.d.ts +11 -0
  229. package/dist/integrations/openai.d.ts.map +1 -1
  230. package/dist/integrations/openai.js +130 -48
  231. package/dist/integrations/openai.js.map +1 -1
  232. package/dist/integrations/vercel-ai.d.ts +20 -9
  233. package/dist/integrations/vercel-ai.d.ts.map +1 -1
  234. package/dist/integrations/vercel-ai.js +131 -32
  235. package/dist/integrations/vercel-ai.js.map +1 -1
  236. package/dist/render/tokens.d.ts.map +1 -1
  237. package/dist/render/tokens.js +1 -0
  238. package/dist/render/tokens.js.map +1 -1
  239. package/package.json +41 -9
  240. package/prompts/onboard.md +259 -0
  241. package/prompts/scan.md +123 -0
  242. package/skills/SKILL.md +432 -0
  243. package/contracts/core/llm_safety.yaml +0 -130
@@ -0,0 +1,491 @@
1
+ #!/usr/bin/env node
2
+ "use strict";
3
+ /**
4
+ * ``sponsio`` — CLI frontend for ``@sponsio/sdk``.
5
+ *
6
+ * Usage:
7
+ *
8
+ * npx @sponsio/sdk ./src
9
+ * npx @sponsio/sdk "src/**\/*.ts" --out tools.json
10
+ * npx @sponsio/sdk --config sponsio.yaml
11
+ * npx @sponsio/sdk ./src --pretty
12
+ *
13
+ * Writes the OpenAI function-calling JSON inventory to stdout (or to
14
+ * ``--out <file>``) so you can pipe into ``sponsio scan`` on the
15
+ * Python side:
16
+ *
17
+ * npx @sponsio/sdk ./src > tools.json
18
+ * sponsio scan tools.json --out sponsio.yaml
19
+ *
20
+ * When ``--config sponsio.yaml`` is passed, the CLI also reads the
21
+ * ``scan:`` section (for defaults) and ``extractor:`` (for LLM
22
+ * passthrough in the output JSON, so the Python-side scan doesn't
23
+ * need ``--config`` a second time). CLI flags always win over YAML.
24
+ */
25
+ Object.defineProperty(exports, "__esModule", { value: true });
26
+ const fs_1 = require("fs");
27
+ const config_1 = require("./config");
28
+ const onboard_1 = require("./onboard");
29
+ const report_1 = require("./report");
30
+ const validate_1 = require("./validate");
31
+ const patterns_1 = require("./patterns");
32
+ const doctor_1 = require("./doctor");
33
+ const packs_1 = require("./packs");
34
+ const skill_1 = require("./skill");
35
+ const mode_1 = require("./mode");
36
+ const init_1 = require("./init");
37
+ const scan_1 = require("./scan");
38
+ const prompt_1 = require("./prompt");
39
+ const explain_1 = require("./explain");
40
+ const replay_1 = require("./replay");
41
+ const check_1 = require("./check");
42
+ const eval_1 = require("./eval");
43
+ const export_1 = require("./export");
44
+ const export_sessions_1 = require("./export-sessions");
45
+ const demo_1 = require("./demo");
46
+ const index_1 = require("./index");
47
+ // Authored as a plain-string array (not a template literal) because
48
+ // the help text contains literal ``${VAR}`` tokens that describe the
49
+ // env-var interpolation syntax. Inside a template literal those
50
+ // would try to evaluate as JS expressions (and ``\$`` escapes are
51
+ // inconsistently handled across TS-target combos). Joining plain
52
+ // strings is dull but unambiguous.
53
+ const HELP = [
54
+ "sponsio — scan TypeScript/JavaScript for agent tool definitions",
55
+ "",
56
+ "USAGE:",
57
+ " sponsio <patterns...> [options]",
58
+ "",
59
+ "ARGUMENTS:",
60
+ ' <patterns...> Files or glob patterns to scan (default: "src/**/*.{ts,tsx,js,jsx}")',
61
+ "",
62
+ "COMMANDS:",
63
+ " init | onboard Write a sponsio.yaml for this project",
64
+ " scan | validate Mine contracts from code; check a config parses",
65
+ " mode | packs Flip observe/enforce; list the shipped contract packs",
66
+ " check | eval Judge one trace; judge a directory of them",
67
+ " report | replay What would have been blocked; re-run a recorded session",
68
+ " patterns | explain The pattern catalog; why one contract exists",
69
+ " doctor | skill Environment check; install the agent skill",
70
+ " prompt | export Authoring prompts; export a config or sessions",
71
+ " demo Run a packaged scenario",
72
+ "",
73
+ "OPTIONS:",
74
+ " -o, --out <file> Write output to <file> instead of stdout",
75
+ " -c, --config <yaml> Read defaults from sponsio.yaml's ``scan:`` section and",
76
+ " embed ``extractor:`` config into the output for Python.",
77
+ " --pretty Pretty-print the emitted JSON",
78
+ " --provenance Include per-tool source-file provenance in output",
79
+ " -h, --help Show this help",
80
+ " -v, --version Show version",
81
+ "",
82
+ "EXAMPLES:",
83
+ " sponsio ./src",
84
+ ' sponsio "src/tools/**/*.ts" --out tools.json',
85
+ " sponsio --config sponsio.yaml --pretty",
86
+ " sponsio ./src --out /tmp/inv.json && sponsio scan /tmp/inv.json -o sponsio.yaml",
87
+ " sponsio onboard .",
88
+ " sponsio init --mode observe",
89
+ " sponsio scan ./src --append",
90
+ " sponsio mode enforce",
91
+ " sponsio check -t trace.json --config sponsio.yaml",
92
+ " sponsio eval traces/ --config sponsio.yaml --json",
93
+ " sponsio explain C1",
94
+ " sponsio prompt onboard",
95
+ " sponsio replay --list",
96
+ " sponsio export run.json --to traces/ --label safe",
97
+ " sponsio export-sessions --to audit.jsonl",
98
+ " sponsio demo --scenario wire",
99
+ " sponsio report --since 24h",
100
+ " sponsio validate ./sponsio.yaml",
101
+ " sponsio patterns",
102
+ " sponsio doctor",
103
+ " sponsio skill install",
104
+ "",
105
+ "SUBCOMMANDS:",
106
+ " onboard [.] Generate sponsio.yaml + print integration snippet",
107
+ " init [target] Skeleton sponsio.yaml (no scan)",
108
+ " scan <patterns…> AST-scan source -> sponsio.yaml with contracts",
109
+ " mode <observe|enforce> Flip the mode line in sponsio.yaml",
110
+ " check -t <trace> … Replay a trace file, report contract pass/fail",
111
+ " eval <traces/> … Replay labelled corpus, report FPR/FNR + diff",
112
+ " explain <Cn|substr> Explain a contract: source, last violation",
113
+ " prompt <onboard|scan|…> Print agent-facing contract-authoring template",
114
+ " replay [session|--list] Pretty-print a session log",
115
+ " export <src> --to <dir> Sponsio-native trace -> OTLP/JSON",
116
+ " export-sessions --to <f> Session log -> OTLP-JSONL",
117
+ " report [--since 24h …] Summarize ~/.sponsio/sessions/ into markdown/json",
118
+ " validate [path] Parse sponsio.yaml + report contract counts (sto contracts flagged as Cloud-only)",
119
+ " patterns [--category …] List deterministic pattern templates available in TS",
120
+ " packs List the built-in pack library (Python-executed)",
121
+ " doctor Env + config health check",
122
+ " demo [--scenario wire] Terminal demo of unsafe agent + Sponsio block",
123
+ " skill install Drop SKILL.md into Cursor/Claude/Codex skill dirs",
124
+ "",
125
+ "CONFIG FILE SHAPE:",
126
+ " # sponsio.yaml",
127
+ " scan:",
128
+ ' patterns: ["src/**/*.ts", "packages/*/src/**/*.ts"]',
129
+ ' ignore: ["**/generated/**"]',
130
+ ' out: "tools.json"',
131
+ " provenance: true",
132
+ " extractor:",
133
+ " provider: openai",
134
+ " model: gpt-4o",
135
+ " api_key: ${OPENAI_API_KEY} # ${VAR} / ${VAR:-default} supported",
136
+ ].join("\n") + "\n";
137
+ function parseArgs(argv) {
138
+ const args = {
139
+ patterns: [],
140
+ pretty: false,
141
+ help: false,
142
+ version: false,
143
+ includeProvenance: false,
144
+ };
145
+ for (let i = 0; i < argv.length; i++) {
146
+ const a = argv[i];
147
+ if (a === "-h" || a === "--help")
148
+ args.help = true;
149
+ else if (a === "-v" || a === "--version")
150
+ args.version = true;
151
+ else if (a === "--pretty")
152
+ args.pretty = true;
153
+ else if (a === "--provenance")
154
+ args.includeProvenance = true;
155
+ else if (a === "-o" || a === "--out") {
156
+ args.out = argv[++i];
157
+ }
158
+ else if (a === "-c" || a === "--config") {
159
+ args.configPath = argv[++i];
160
+ }
161
+ else if (a.startsWith("-")) {
162
+ process.stderr.write(`unknown flag: ${a}\n`);
163
+ process.exit(2);
164
+ }
165
+ else {
166
+ args.patterns.push(a);
167
+ }
168
+ }
169
+ return args;
170
+ }
171
+ async function main() {
172
+ const raw = process.argv.slice(2);
173
+ if (raw[0] === "onboard") {
174
+ try {
175
+ await (0, onboard_1.runOnboardCli)(raw.slice(1));
176
+ }
177
+ catch (err) {
178
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
179
+ process.exit(1);
180
+ }
181
+ return;
182
+ }
183
+ if (raw[0] === "report") {
184
+ try {
185
+ await (0, report_1.runReportCli)(raw.slice(1));
186
+ }
187
+ catch (err) {
188
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
189
+ process.exit(1);
190
+ }
191
+ return;
192
+ }
193
+ if (raw[0] === "validate") {
194
+ try {
195
+ await (0, validate_1.runValidateCli)(raw.slice(1));
196
+ }
197
+ catch (err) {
198
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
199
+ process.exit(1);
200
+ }
201
+ return;
202
+ }
203
+ if (raw[0] === "patterns") {
204
+ try {
205
+ await (0, patterns_1.runPatternsCli)(raw.slice(1));
206
+ }
207
+ catch (err) {
208
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
209
+ process.exit(1);
210
+ }
211
+ return;
212
+ }
213
+ if (raw[0] === "packs") {
214
+ try {
215
+ await (0, packs_1.runPacksCli)(raw.slice(1));
216
+ }
217
+ catch (err) {
218
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
219
+ process.exit(1);
220
+ }
221
+ return;
222
+ }
223
+ if (raw[0] === "doctor") {
224
+ try {
225
+ await (0, doctor_1.runDoctorCli)(raw.slice(1));
226
+ }
227
+ catch (err) {
228
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
229
+ process.exit(1);
230
+ }
231
+ return;
232
+ }
233
+ if (raw[0] === "skill") {
234
+ try {
235
+ await (0, skill_1.runSkillCli)(raw.slice(1));
236
+ }
237
+ catch (err) {
238
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
239
+ process.exit(1);
240
+ }
241
+ return;
242
+ }
243
+ if (raw[0] === "mode") {
244
+ try {
245
+ await (0, mode_1.runModeCli)(raw.slice(1));
246
+ }
247
+ catch (err) {
248
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
249
+ process.exit(1);
250
+ }
251
+ return;
252
+ }
253
+ if (raw[0] === "init") {
254
+ try {
255
+ await (0, init_1.runInitCli)(raw.slice(1));
256
+ }
257
+ catch (err) {
258
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
259
+ process.exit(1);
260
+ }
261
+ return;
262
+ }
263
+ if (raw[0] === "scan") {
264
+ try {
265
+ await (0, scan_1.runScanCli)(raw.slice(1));
266
+ }
267
+ catch (err) {
268
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
269
+ process.exit(1);
270
+ }
271
+ return;
272
+ }
273
+ if (raw[0] === "prompt") {
274
+ try {
275
+ await (0, prompt_1.runPromptCli)(raw.slice(1));
276
+ }
277
+ catch (err) {
278
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
279
+ process.exit(1);
280
+ }
281
+ return;
282
+ }
283
+ if (raw[0] === "explain") {
284
+ try {
285
+ await (0, explain_1.runExplainCli)(raw.slice(1));
286
+ }
287
+ catch (err) {
288
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
289
+ process.exit(1);
290
+ }
291
+ return;
292
+ }
293
+ if (raw[0] === "replay") {
294
+ try {
295
+ await (0, replay_1.runReplayCli)(raw.slice(1));
296
+ }
297
+ catch (err) {
298
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
299
+ process.exit(1);
300
+ }
301
+ return;
302
+ }
303
+ if (raw[0] === "check") {
304
+ try {
305
+ await (0, check_1.runCheckCli)(raw.slice(1));
306
+ }
307
+ catch (err) {
308
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
309
+ process.exit(1);
310
+ }
311
+ return;
312
+ }
313
+ if (raw[0] === "eval") {
314
+ try {
315
+ await (0, eval_1.runEvalCli)(raw.slice(1));
316
+ }
317
+ catch (err) {
318
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
319
+ process.exit(1);
320
+ }
321
+ return;
322
+ }
323
+ if (raw[0] === "export") {
324
+ try {
325
+ await (0, export_1.runExportCli)(raw.slice(1));
326
+ }
327
+ catch (err) {
328
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
329
+ process.exit(1);
330
+ }
331
+ return;
332
+ }
333
+ if (raw[0] === "export-sessions") {
334
+ try {
335
+ await (0, export_sessions_1.runExportSessionsCli)(raw.slice(1));
336
+ }
337
+ catch (err) {
338
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
339
+ process.exit(1);
340
+ }
341
+ return;
342
+ }
343
+ if (raw[0] === "demo") {
344
+ try {
345
+ await (0, demo_1.runDemoCli)(raw.slice(1));
346
+ }
347
+ catch (err) {
348
+ process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : err}\n`);
349
+ process.exit(1);
350
+ }
351
+ return;
352
+ }
353
+ // Anything above returned. A first argument that is plainly meant as a
354
+ // command and matched none of them used to fall through to the scanner,
355
+ // which found no files, printed `{"tools":[]}` and exited 0. A typo
356
+ // therefore looked like a success — and the onboarding prompt tells
357
+ // coding agents to run these commands, so the agent reads the zero exit
358
+ // and moves on.
359
+ //
360
+ // A scan target is a path or a glob. A bare word that is neither, with
361
+ // no extension and no glob metacharacter and nothing on disk by that
362
+ // name, is a mistyped command.
363
+ const first = raw[0];
364
+ if (first !== undefined &&
365
+ !first.startsWith("-") &&
366
+ !/[*?[\]{}]/.test(first) &&
367
+ !first.includes("/") &&
368
+ !first.includes(".") &&
369
+ !(0, fs_1.existsSync)(first)) {
370
+ process.stderr.write(`sponsio: unknown command '${first}'\n` +
371
+ `Run 'sponsio --help' for the list, or pass a path or glob to scan.\n`);
372
+ process.exit(2);
373
+ }
374
+ const args = parseArgs(raw);
375
+ if (args.help) {
376
+ process.stdout.write(HELP);
377
+ return;
378
+ }
379
+ if (args.version) {
380
+ // eslint-disable-next-line @typescript-eslint/no-var-requires
381
+ const pkg = require("../package.json");
382
+ process.stdout.write(`${pkg.version}\n`);
383
+ return;
384
+ }
385
+ // ---------------------------------------------------------------
386
+ // Resolve config (if any). Precedence: CLI flag > YAML > default.
387
+ // We load the YAML *first* so CLI flags can overwrite whatever we
388
+ // parsed; the opposite order (CLI then YAML) would silently undo
389
+ // ``--out foo.json`` when the YAML also set ``scan.out``.
390
+ // ---------------------------------------------------------------
391
+ let config;
392
+ if (args.configPath) {
393
+ try {
394
+ config = (0, config_1.loadConfig)(args.configPath);
395
+ }
396
+ catch (err) {
397
+ if (err instanceof config_1.ConfigError) {
398
+ process.stderr.write(`[config] ${err.message}\n`);
399
+ process.exit(2);
400
+ }
401
+ throw err;
402
+ }
403
+ // Warn about unset env-var references. We don't fail on these
404
+ // — shell semantics says a missing var expands to empty, and
405
+ // aborting a pure AST scan because an ``OPENAI_API_KEY`` env
406
+ // isn't exported would be actively unhelpful (the scanner
407
+ // itself doesn't use that key; only the downstream Python
408
+ // extractor does). But a warning means users find out before
409
+ // the Python side yells about ``api_key: ""``.
410
+ if (config.missingEnvVars.length) {
411
+ process.stderr.write(`[config] warning: ${config.missingEnvVars.length} ` +
412
+ `env var(s) referenced in ${config.sourcePath} are unset ` +
413
+ `and have no default, expanded to empty string: ` +
414
+ config.missingEnvVars.join(", ") +
415
+ `\n`);
416
+ }
417
+ }
418
+ // ---------------------------------------------------------------
419
+ // Apply precedence for each knob.
420
+ // ---------------------------------------------------------------
421
+ const effectivePatterns = args.patterns.length > 0
422
+ ? args.patterns
423
+ : config?.scan.patterns && config.scan.patterns.length > 0
424
+ ? config.scan.patterns
425
+ : ["src/**/*.{ts,tsx,js,jsx}"];
426
+ const effectiveOut = args.out ?? config?.scan.out;
427
+ // Provenance is a boolean flag so we can't use ``??`` to mean
428
+ // "CLI not provided" — but since CLI parsing only sets
429
+ // includeProvenance to ``true`` on --provenance (never back to
430
+ // false from a flag), the YAML value only matters when the flag
431
+ // wasn't passed. Keep this explicit so future additions (e.g. a
432
+ // ``--no-provenance`` flag) don't accidentally tangle precedence.
433
+ const effectiveProvenance = args.includeProvenance
434
+ ? true
435
+ : config?.scan.provenance === true;
436
+ // ---------------------------------------------------------------
437
+ // If a bare directory was passed, expand it to a glob. Kept here
438
+ // (not in the config loader) because ``scan.patterns`` in YAML is
439
+ // authored with globs already — only CLI args get the fast-path
440
+ // directory expansion.
441
+ // ---------------------------------------------------------------
442
+ const expanded = await Promise.all(effectivePatterns.map(async (p) => {
443
+ try {
444
+ const stat = await fs_1.promises.stat(p);
445
+ if (stat.isDirectory()) {
446
+ return `${p.replace(/\/$/, "")}/**/*.{ts,tsx,js,jsx}`;
447
+ }
448
+ }
449
+ catch {
450
+ // not a real path — treat as a glob
451
+ }
452
+ return p;
453
+ }));
454
+ const scanOptions = config?.scan.ignore ? { ignore: config.scan.ignore } : {};
455
+ const result = await (0, index_1.scan)(expanded, scanOptions);
456
+ // ---------------------------------------------------------------
457
+ // Build the output payload. The extractor passthrough goes on a
458
+ // ``_extractor`` key with a leading underscore so Python's tool
459
+ // inventory loader (which accepts any top-level dict with a
460
+ // ``tools:`` key) ignores it as metadata rather than trying to
461
+ // interpret it as a tool. The Python ``sponsio scan`` side will
462
+ // read ``_extractor`` in a follow-up PR.
463
+ // ---------------------------------------------------------------
464
+ const basePayload = effectiveProvenance
465
+ ? result
466
+ : { tools: result.tools };
467
+ const payload = { ...basePayload };
468
+ if (config && Object.keys(config.extractor).length > 0) {
469
+ payload._extractor = config.extractor;
470
+ }
471
+ const json = args.pretty
472
+ ? JSON.stringify(payload, null, 2)
473
+ : JSON.stringify(payload);
474
+ if (effectiveOut) {
475
+ await fs_1.promises.writeFile(effectiveOut, json + "\n", "utf8");
476
+ process.stderr.write(`wrote ${result.tools.length} tools to ${effectiveOut}\n`);
477
+ }
478
+ else {
479
+ process.stdout.write(json + "\n");
480
+ }
481
+ if (result.diagnostics.length) {
482
+ for (const d of result.diagnostics) {
483
+ process.stderr.write(`[${d.level}] ${d.filepath}:${d.line} ${d.message}\n`);
484
+ }
485
+ }
486
+ }
487
+ main().catch((err) => {
488
+ process.stderr.write(`${err.stack ?? err.message ?? err}\n`);
489
+ process.exit(1);
490
+ });
491
+ //# sourceMappingURL=cli.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli/cli.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAEH,2BAAgD;AAChD,qCAAuE;AACvE,uCAA0C;AAC1C,qCAAwC;AACxC,yCAA4C;AAC5C,yCAA4C;AAC5C,qCAAwC;AACxC,mCAAsC;AACtC,mCAAsC;AACtC,iCAAoC;AACpC,iCAAoC;AACpC,iCAAoC;AACpC,qCAAwC;AACxC,uCAA0C;AAC1C,qCAAwC;AACxC,mCAAsC;AACtC,iCAAoC;AACpC,qCAAwC;AACxC,uDAAyD;AACzD,iCAAoC;AACpC,mCAA+B;AAY/B,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,mCAAmC;AACnC,MAAM,IAAI,GACR;IACE,iEAAiE;IACjE,EAAE;IACF,QAAQ;IACR,mCAAmC;IACnC,EAAE;IACF,YAAY;IACZ,4FAA4F;IAC5F,EAAE;IACF,WAAW;IACX,6DAA6D;IAC7D,uEAAuE;IACvE,6EAA6E;IAC7E,kEAAkE;IAClE,+EAA+E;IAC/E,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,+CAA+C;IAC/C,EAAE;IACF,UAAU;IACV,gEAAgE;IAChE,+EAA+E;IAC/E,+EAA+E;IAC/E,qDAAqD;IACrD,yEAAyE;IACzE,sCAAsC;IACtC,oCAAoC;IACpC,EAAE;IACF,WAAW;IACX,iBAAiB;IACjB,gDAAgD;IAClD,0CAA0C;IAC1C,mFAAmF;IACnF,qBAAqB;IACrB,+BAA+B;IAC/B,+BAA+B;IAC/B,wBAAwB;IACxB,qDAAqD;IACrD,qDAAqD;IACrD,sBAAsB;IACtB,0BAA0B;IAC1B,yBAAyB;IACzB,qDAAqD;IACrD,4CAA4C;IAC5C,gCAAgC;IAChC,8BAA8B;IAC9B,mCAAmC;IACnC,oBAAoB;IACpB,kBAAkB;IAClB,yBAAyB;IACvB,EAAE;IACF,cAAc;IACd,gFAAgF;IAChF,8DAA8D;IAC9D,6EAA6E;IAC7E,iEAAiE;IACjE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,yDAAyD;IACzD,gEAAgE;IAChE,wDAAwD;IACxD,gFAAgF;IAChF,gHAAgH;IAChH,mFAAmF;IACnF,+EAA+E;IAC/E,wDAAwD;IACxD,4EAA4E;IAC5E,gFAAgF;IAChF,EAAE;IACF,oBAAoB;IACpB,kBAAkB;IAClB,SAAS;IACT,0DAA0D;IAC1D,oCAAoC;IACpC,6BAA6B;IAC7B,sBAAsB;IACtB,cAAc;IACd,sBAAsB;IACtB,sBAAsB;IACtB,2EAA2E;CAC5E,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEtB,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY;QACpB,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,KAAK;QACd,iBAAiB,EAAE,KAAK;KACzB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;aAC9C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;aACzD,IAAI,CAAC,KAAK,UAAU;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;aACzC,IAAI,CAAC,KAAK,cAAc;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAA,uBAAa,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAA,qBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAA,yBAAc,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAA,yBAAc,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAA,mBAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAA,qBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAA,mBAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAA,qBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAA,uBAAa,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAA,qBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAA,mBAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAA,qBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAA,sCAAoB,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,wEAAwE;IACxE,gBAAgB;IAChB,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,+BAA+B;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACxB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,IAAA,eAAU,EAAC,KAAK,CAAC,EAClB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,KAAK,KAAK;YACrC,sEAAsE,CACzE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,8DAA8D;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,0DAA0D;IAC1D,kEAAkE;IAClE,IAAI,MAAiC,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAW,EAAE,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,0DAA0D;QAC1D,0DAA0D;QAC1D,8DAA8D;QAC9D,+CAA+C;QAC/C,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG;gBAClD,4BAA4B,MAAM,CAAC,UAAU,aAAa;gBAC1D,iDAAiD;gBACjD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChC,IAAI,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,kCAAkC;IAClC,kEAAkE;IAClE,MAAM,iBAAiB,GACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;YACtB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;IAElD,8DAA8D;IAC9D,uDAAuD;IACvD,+DAA+D;IAC/D,gEAAgE;IAChE,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB;QAChD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAErC,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,uBAAuB;IACvB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAA,YAAI,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAEjD,kEAAkE;IAClE,iEAAiE;IACjE,gEAAgE;IAChE,4DAA4D;IAC5D,+DAA+D;IAC/D,iEAAiE;IACjE,yCAAyC;IACzC,kEAAkE;IAClE,MAAM,WAAW,GAAG,mBAAmB;QACrC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAE5B,MAAM,OAAO,GAA4B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;QACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAE5B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,aAAa,YAAY,IAAI,CAC1D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
@@ -0,0 +1,88 @@
1
+ /**
2
+ * ``sponsio.yaml`` loader for ``@sponsio/sdk``.
3
+ *
4
+ * Parity feature with the Python side's ``sponsio/config.py``. The
5
+ * goal is *semantic* parity — same YAML file works for both
6
+ * scanners, same env-var interpolation rules, same precedence
7
+ * (CLI flag > YAML > built-in default) — not byte-level parity of
8
+ * the parsed dataclasses (the TS scanner only needs a narrow slice
9
+ * of the schema).
10
+ *
11
+ * The three things we read:
12
+ *
13
+ * 1. ``scan:`` — optional section for TS-scanner-specific
14
+ * knobs: patterns, ignore list, output path, provenance
15
+ * inclusion. Lets a repo put all scanner config in one
16
+ * file instead of sprinkling CLI flags across workflows.
17
+ * 2. ``extractor:`` — *passthrough* (not interpreted here).
18
+ * We embed it in the output JSON as ``_extractor`` metadata
19
+ * so a downstream ``sponsio scan tools.json`` picks up the
20
+ * same LLM config without needing ``--config`` a second
21
+ * time. Mirrors the Python ``ExtractorSection``.
22
+ * 3. ``${ENV_VAR}`` / ``${ENV_VAR:-default}`` — interpolated
23
+ * on load with EXACTLY the same regex and semantics as
24
+ * Python (see ``_ENV_VAR_RE`` in ``sponsio/config.py``).
25
+ *
26
+ * Sections we *don't* parse: contracts, agents, judge, defaults.
27
+ * Those are Python-runtime concerns; touching them here would
28
+ * duplicate the Python schema and invite drift.
29
+ */
30
+ /**
31
+ * Parse-time LLM config — passed through to the output JSON for
32
+ * Python-side consumption. All fields optional because partial
33
+ * configs are common (e.g. ``provider`` + ``model`` with the
34
+ * api_key coming from an env var later).
35
+ */
36
+ export interface ExtractorSection {
37
+ provider?: string;
38
+ model?: string;
39
+ api_key?: string;
40
+ base_url?: string;
41
+ }
42
+ /**
43
+ * TS-scanner-specific config knobs. Everything optional; CLI flags
44
+ * still override whatever we find here.
45
+ */
46
+ export interface ScanSection {
47
+ patterns?: string[];
48
+ ignore?: string[];
49
+ out?: string;
50
+ provenance?: boolean;
51
+ }
52
+ export interface SponsioConfig {
53
+ /** Raw extractor section — unvalidated, emitted verbatim so any
54
+ * future field the Python side adds flows through without a
55
+ * TS-side schema change. */
56
+ extractor: ExtractorSection;
57
+ scan: ScanSection;
58
+ /** Env-var references that appeared in the file but were unset
59
+ * AND had no default. The loader keeps going (shell-like
60
+ * semantics: the var expands to empty) but surfaces these for
61
+ * CLI-time warnings — silent empty strings are a classic
62
+ * "api_key: " source of head-scratching. */
63
+ missingEnvVars: string[];
64
+ /** Absolute path the file was loaded from — used in error
65
+ * messages and tests. */
66
+ sourcePath: string;
67
+ }
68
+ export declare class ConfigError extends Error {
69
+ readonly sourcePath?: string | undefined;
70
+ constructor(message: string, sourcePath?: string | undefined);
71
+ }
72
+ /**
73
+ * Load and parse ``sponsio.yaml``.
74
+ *
75
+ * Design notes:
76
+ * * We *don't* validate the full Python schema — only the two
77
+ * sections we care about. Everything else (``contracts``,
78
+ * ``agents``, ``judge``) sails through untouched so a
79
+ * single file can be authoritative for both Python and TS.
80
+ * * Missing file → ``ConfigError`` (not silently-empty config),
81
+ * because the user explicitly passed ``--config <path>`` and
82
+ * typos are the #1 failure mode.
83
+ * * Malformed YAML → ``ConfigError`` with the parser's line/col
84
+ * where available (js-yaml's default YAMLException already
85
+ * includes this in its ``reason`` field).
86
+ */
87
+ export declare function loadConfig(configPath: string): SponsioConfig;
88
+ //# sourceMappingURL=config.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B;;iCAE6B;IAC7B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB;;;;iDAI6C;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;8BAC0B;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAY,SAAQ,KAAK;aACS,UAAU,CAAC,EAAE,MAAM;gBAApD,OAAO,EAAE,MAAM,EAAkB,UAAU,CAAC,EAAE,MAAM,YAAA;CAIjE;AA6CD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CA4D5D"}