cleartoship 0.4.0

package/dist/data/popular.js

@@ -0,0 +1,103 @@
+/**
+ * Frequently-installed packages, used as typosquat bait references. A candidate
+ * that sits one edit away from one of these — and has almost no downloads of its
+ * own — is very likely a squat or an LLM misremembering the real name.
+ */
+export const POPULAR_NPM = [
+    'react', 'react-dom', 'next', 'vue', 'svelte', 'angular', 'express', 'fastify',
+    'koa', 'nest', 'axios', 'lodash', 'underscore', 'moment', 'dayjs', 'date-fns',
+    'chalk', 'commander', 'yargs', 'inquirer', 'dotenv', 'zod', 'yup', 'joi',
+    'valibot', 'typescript', 'eslint', 'prettier', 'jest', 'vitest', 'mocha',
+    'chai', 'sinon', 'webpack', 'rollup', 'vite', 'esbuild', 'babel', 'postcss',
+    'tailwindcss', 'autoprefixer', 'sass', 'less', 'styled-components', 'emotion',
+    'redux', 'zustand', 'jotai', 'recoil', 'mobx', 'rxjs', 'graphql', 'apollo',
+    'prisma', 'sequelize', 'typeorm', 'mongoose', 'knex', 'drizzle-orm', 'pg',
+    'mysql2', 'sqlite3', 'redis', 'ioredis', 'bcrypt', 'bcryptjs', 'jsonwebtoken',
+    'passport', 'cors', 'helmet', 'morgan', 'winston', 'pino', 'debug', 'uuid',
+    'nanoid', 'cuid', 'classnames', 'clsx', 'ramda', 'immer', 'formik',
+    'react-hook-form', 'react-router', 'react-router-dom', 'react-query',
+    'swr', 'socket.io', 'ws', 'node-fetch', 'got', 'undici', 'cheerio',
+    'puppeteer', 'playwright', 'selenium-webdriver', 'sharp', 'jimp', 'multer',
+    'formidable', 'busboy', 'archiver', 'tar', 'glob', 'fast-glob', 'globby',
+    'rimraf', 'fs-extra', 'chokidar', 'nodemon', 'concurrently', 'cross-env',
+    'husky', 'lint-staged', 'semantic-release', 'stripe', 'twilio', 'nodemailer',
+    'resend', 'openai', 'langchain', 'framer-motion', 'three', 'd3', 'chart.js',
+    'recharts', 'plotly.js', 'leaflet', 'mapbox-gl', 'marked', 'markdown-it',
+    'remark', 'rehype', 'gray-matter', 'slugify', 'validator', 'sanitize-html',
+    'dompurify', 'he', 'qs', 'query-string', 'form-data', 'body-parser',
+    'cookie-parser', 'express-session', 'connect-redis', 'compression',
+    'http-proxy-middleware', 'async', 'bluebird', 'p-limit',
+    'p-queue', 'ora', 'boxen', 'figlet', 'cli-table3', 'enquirer', 'prompts',
+    'minimist', 'meow', 'execa', 'shelljs', 'zx', 'tslib', 'core-js',
+    'regenerator-runtime', 'whatwg-fetch', 'abort-controller',
+    'jsdom', 'happy-dom', 'cypress', 'supertest', 'msw',
+    'faker', 'chance', 'nock', 'ts-node', 'tsx', 'tsup', 'unbuild',
+    'microbundle', 'parcel', 'turbo', 'nx', 'lerna',
+];
+export const POPULAR_PYPI = [
+    'requests', 'urllib3', 'numpy', 'pandas', 'scipy', 'matplotlib', 'seaborn',
+    'scikit-learn', 'tensorflow', 'torch', 'transformers', 'flask', 'django',
+    'fastapi', 'starlette', 'uvicorn', 'gunicorn', 'celery', 'redis', 'sqlalchemy',
+    'alembic', 'psycopg2', 'pymongo', 'boto3', 'botocore', 'click', 'typer',
+    'rich', 'pydantic', 'attrs', 'marshmallow', 'jinja2', 'pyyaml', 'toml',
+    'python-dotenv', 'httpx', 'aiohttp', 'beautifulsoup4', 'lxml', 'selenium',
+    'pillow', 'opencv-python', 'pytest', 'tox', 'black', 'flake8', 'mypy',
+    'pylint', 'ruff', 'isort', 'setuptools', 'wheel', 'pip', 'poetry', 'openai',
+    'anthropic', 'langchain', 'cryptography', 'pyjwt', 'passlib', 'bcrypt',
+    'python-multipart', 'supabase', 'stripe', 'twilio', 'sendgrid',
+];
+/** Damerau-Levenshtein distance, capped: returns `max + 1` once it exceeds `max`. */
+export function editDistance(a, b, max = 2) {
+    if (a === b)
+        return 0;
+    if (Math.abs(a.length - b.length) > max)
+        return max + 1;
+    let prev2 = [];
+    let prev = [];
+    let curr = [];
+    for (let j = 0; j <= b.length; j++)
+        prev[j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        curr = [i];
+        let rowMin = i;
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            let value = Math.min((curr[j - 1] ?? Infinity) + 1, (prev[j] ?? Infinity) + 1, (prev[j - 1] ?? Infinity) + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                value = Math.min(value, (prev2[j - 2] ?? Infinity) + 1);
+            }
+            curr[j] = value;
+            if (value < rowMin)
+                rowMin = value;
+        }
+        if (rowMin > max)
+            return max + 1;
+        prev2 = prev;
+        prev = curr;
+    }
+    return prev[b.length] ?? max + 1;
+}
+/**
+ * Closest popular package within `max` edits, or null.
+ *
+ * A name that *is* one of the popular packages is never its own lookalike, and
+ * names shorter than five characters are skipped: at that length almost every
+ * real package has a one-edit neighbour, so the signal is noise.
+ */
+export function nearestPopular(name, list, max = 1) {
+    const bare = name.replace(/^@[^/]+\//, '').toLowerCase();
+    if (bare.length < 5)
+        return null;
+    if (list.includes(bare))
+        return null;
+    let best = null;
+    let bestScore = max + 1;
+    for (const candidate of list) {
+        const d = editDistance(bare, candidate, max);
+        if (d > 0 && d < bestScore) {
+            bestScore = d;
+            best = candidate;
+        }
+    }
+    return best;
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { scan } from './scan.js';
+export type { ScanOptions, FullScan } from './scan.js';
+export { renderTerminal, renderJson, renderSarif, renderFixPrompt, renderBadge, renderMarkdown, } from './report.js';
+export { SCANNERS } from './scanners/index.js';
+export * from './types.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export { scan } from './scan.js';
+export { renderTerminal, renderJson, renderSarif, renderFixPrompt, renderBadge, renderMarkdown, } from './report.js';
+export { SCANNERS } from './scanners/index.js';
+export * from './types.js';

package/dist/report.d.ts

@@ -0,0 +1,15 @@
+import type { FullScan } from './scan.js';
+export declare function renderTerminal(scan: FullScan, opts?: {
+    showPassed: boolean;
+}): string;
+export declare function renderJson(scan: FullScan): string;
+export declare function renderSarif(scan: FullScan, version: string): string;
+export declare function renderFixPrompt(scan: FullScan): string;
+/**
+ * Markdown for a GitHub pull-request comment or an Actions job summary. Kept
+ * compact: the verdict and counts up top, findings grouped by severity in a
+ * collapsible block, so a passing PR shows one green line and a failing one puts
+ * the blocking issues first without burying the diff.
+ */
+export declare function renderMarkdown(scan: FullScan): string;
+export declare function renderBadge(scan: FullScan): string;

package/dist/report.js

@@ -0,0 +1,317 @@
+import pc from 'picocolors';
+import { SEVERITY_ORDER } from './types.js';
+const RULE = '─'.repeat(74);
+const SEVERITY_STYLE = {
+    critical: { label: 'CRITICAL', paint: (s) => pc.bold(pc.red(s)) },
+    high: { label: 'HIGH    ', paint: pc.red },
+    medium: { label: 'MEDIUM  ', paint: pc.yellow },
+    low: { label: 'LOW     ', paint: pc.blue },
+    info: { label: 'INFO    ', paint: pc.dim },
+};
+function indent(text, prefix) {
+    return text
+        .split('\n')
+        .map((l) => prefix + l)
+        .join('\n');
+}
+function wrap(text, width) {
+    const words = text.split(/\s+/);
+    const lines = [];
+    let line = '';
+    for (const word of words) {
+        if (line.length + word.length + 1 > width && line) {
+            lines.push(line);
+            line = word;
+        }
+        else {
+            line = line ? `${line} ${word}` : word;
+        }
+    }
+    if (line)
+        lines.push(line);
+    return lines.join('\n');
+}
+/**
+ * Wraps the prose lines of a fix while leaving indented lines — SQL and code
+ * snippets — exactly as written, since reflowing those would break them.
+ */
+function renderFix(fix) {
+    return fix
+        .split('\n')
+        .map((line, i) => {
+        if (/^\s/.test(line))
+            return line;
+        const prefixed = i === 0 ? `\u2192 ${line}` : line;
+        return wrap(prefixed, 68);
+    })
+        .join('\n');
+}
+export function renderTerminal(scan, opts = { showPassed: true }) {
+    const out = [];
+    const total = scan.findings.length;
+    if (total > 0) {
+        out.push('');
+        out.push(pc.dim(RULE));
+        const summary = ['critical', 'high', 'medium', 'low', 'info']
+            .filter((s) => scan.counts[s] > 0)
+            .map((s) => SEVERITY_STYLE[s].paint(`${scan.counts[s]} ${s}`))
+            .join(pc.dim(' · '));
+        out.push(`  ${pc.bold('SCAN FINDINGS')}  ${pc.dim('(')}${summary}${pc.dim(')')}`);
+        out.push(pc.dim(RULE));
+        out.push('');
+        for (const f of scan.findings) {
+            const style = SEVERITY_STYLE[f.severity];
+            const location = f.file ? `${f.file}${f.line ? `:${f.line}` : ''}` : scan.root;
+            out.push(`  ${style.paint('✖ ' + style.label)}  ${pc.bold(f.title)}  ${pc.dim(f.id)}`);
+            out.push(`    ${pc.dim('at')} ${pc.cyan(location)}`);
+            if (f.snippet)
+                out.push(`    ${pc.dim('│')} ${pc.dim(f.snippet)}`);
+            out.push(indent(wrap(f.detail, 68), '    '));
+            out.push(indent(pc.green(renderFix(f.fix)), '    '));
+            if (f.owasp)
+                out.push(`    ${pc.dim(f.owasp)}${f.cwe ? pc.dim(' · ' + f.cwe) : ''}`);
+            out.push('');
+        }
+    }
+    if (opts.showPassed) {
+        const passed = scan.checks.filter((c) => c.passed);
+        if (passed.length) {
+            for (const c of passed) {
+                out.push(`  ${pc.green('✔ PASS')}      ${c.label}${c.note ? pc.dim(` — ${c.note}`) : ''}`);
+            }
+            out.push('');
+        }
+    }
+    if (scan.warnings.length) {
+        for (const w of scan.warnings)
+            out.push(`  ${pc.yellow('! WARN')}      ${w}`);
+        out.push('');
+    }
+    out.push(pc.dim(RULE));
+    const blocking = scan.counts.critical + scan.counts.high;
+    if (scan.counts.critical > 0) {
+        out.push(`  ${pc.bold(pc.red('VERDICT: 🔴 HOLD — resolve the critical findings before deploying'))}`);
+    }
+    else if (blocking > 0) {
+        out.push(`  ${pc.bold(pc.yellow('VERDICT: 🟡 CONDITIONAL — no criticals, but high-severity gaps remain'))}`);
+    }
+    else if (total > 0) {
+        out.push(`  ${pc.bold(pc.green('VERDICT: 🟢 CLEAR TO SHIP'))} ${pc.dim(`— ${total} low-priority note${total === 1 ? '' : 's'}`)}`);
+    }
+    else {
+        out.push(`  ${pc.bold(pc.green('VERDICT: 🟢 CLEAR TO SHIP — all checks passed'))}`);
+    }
+    out.push(pc.dim(RULE));
+    out.push(pc.dim(`  ${scan.fileCount} files · ${(scan.durationMs / 1000).toFixed(1)}s`));
+    if (total > 0) {
+        out.push('');
+        out.push(`  ${pc.dim('Hand the fixes to your AI editor:')}  ${pc.cyan('npx cleartoship --fix-prompt')}`);
+    }
+    out.push('');
+    return out.join('\n');
+}
+export function renderJson(scan) {
+    return JSON.stringify({
+        version: 1,
+        tool: 'cleartoship',
+        root: scan.root,
+        framework: scan.framework,
+        fileCount: scan.fileCount,
+        durationMs: scan.durationMs,
+        verdict: scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear',
+        counts: scan.counts,
+        findings: scan.findings,
+        checks: scan.checks,
+        warnings: scan.warnings,
+    }, null, 2);
+}
+const SARIF_LEVEL = {
+    critical: 'error',
+    high: 'error',
+    medium: 'warning',
+    low: 'note',
+    info: 'note',
+};
+export function renderSarif(scan, version) {
+    const rules = new Map();
+    for (const f of scan.findings) {
+        if (rules.has(f.id))
+            continue;
+        rules.set(f.id, {
+            id: f.id,
+            name: f.title.replace(/\s+/g, ''),
+            shortDescription: { text: f.title },
+            fullDescription: { text: f.detail },
+            help: { text: f.fix },
+            defaultConfiguration: { level: SARIF_LEVEL[f.severity] },
+            properties: {
+                tags: [f.owasp, f.cwe].filter(Boolean),
+                'security-severity': String(SEVERITY_ORDER[f.severity] * 2.4),
+            },
+        });
+    }
+    return JSON.stringify({
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'ClearToShip',
+                        version,
+                        informationUri: 'https://cleartoship.app',
+                        rules: [...rules.values()],
+                    },
+                },
+                results: scan.findings.map((f) => ({
+                    ruleId: f.id,
+                    level: SARIF_LEVEL[f.severity],
+                    message: { text: `${f.title}. ${f.detail}` },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: f.file ?? '.' },
+                                region: { startLine: Math.max(1, f.line ?? 1) },
+                            },
+                        },
+                    ],
+                })),
+            },
+        ],
+    }, null, 2);
+}
+export function renderFixPrompt(scan) {
+    if (scan.findings.length === 0) {
+        return 'ClearToShip found no issues to fix.\n';
+    }
+    const lines = [];
+    lines.push('# ClearToShip — security fixes to apply');
+    lines.push('');
+    lines.push('You are fixing security findings in this repository. Apply every fix below. ' +
+        'Do not change unrelated behaviour, do not weaken any existing check, and keep the ' +
+        'project’s existing conventions and helper functions. After each fix, briefly state ' +
+        'what you changed.');
+    lines.push('');
+    lines.push(`Project: ${scan.framework}`);
+    lines.push('');
+    const bySeverity = ['critical', 'high', 'medium', 'low'];
+    for (const sev of bySeverity) {
+        const group = scan.findings.filter((f) => f.severity === sev);
+        if (!group.length)
+            continue;
+        lines.push(`## ${sev.toUpperCase()} (${group.length})`);
+        lines.push('');
+        group.forEach((f, i) => {
+            lines.push(`### ${i + 1}. ${f.title} \`${f.id}\``);
+            lines.push('');
+            if (f.file)
+                lines.push(`**Location:** \`${f.file}${f.line ? `:${f.line}` : ''}\``);
+            if (f.snippet)
+                lines.push(`**Offending line:** \`${f.snippet}\``);
+            lines.push('');
+            lines.push(`**Problem:** ${f.detail}`);
+            lines.push('');
+            lines.push('**Required fix:**');
+            lines.push('');
+            lines.push('```');
+            lines.push(f.fix);
+            lines.push('```');
+            lines.push('');
+        });
+    }
+    lines.push('---');
+    lines.push('');
+    lines.push('When you are done, re-run `npx cleartoship` and confirm the findings above are gone ' +
+        'and no new ones appeared.');
+    lines.push('');
+    return lines.join('\n');
+}
+const MD_SEVERITY = {
+    critical: '🔴 Critical',
+    high: '🟠 High',
+    medium: '🟡 Medium',
+    low: '🔵 Low',
+    info: '⚪ Info',
+};
+/**
+ * Markdown for a GitHub pull-request comment or an Actions job summary. Kept
+ * compact: the verdict and counts up top, findings grouped by severity in a
+ * collapsible block, so a passing PR shows one green line and a failing one puts
+ * the blocking issues first without burying the diff.
+ */
+export function renderMarkdown(scan) {
+    const out = [];
+    const total = scan.findings.length;
+    const verdict = scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear';
+    const heading = verdict === 'hold'
+        ? '## 🔴 ClearToShip — hold before shipping'
+        : verdict === 'conditional'
+            ? '## 🟡 ClearToShip — clear, with high-severity gaps'
+            : total > 0
+                ? '## 🟢 ClearToShip — clear to ship'
+                : '## 🟢 ClearToShip — clear to ship, all checks passed';
+    out.push(heading);
+    out.push('');
+    const counts = ['critical', 'high', 'medium', 'low']
+        .filter((sev) => scan.counts[sev] > 0)
+        .map((sev) => `**${scan.counts[sev]}** ${sev}`)
+        .join(' · ');
+    out.push(`\`${scan.framework}\` · ${scan.fileCount} files · ${(scan.durationMs / 1000).toFixed(1)}s` +
+        (counts ? ` · ${counts}` : ''));
+    out.push('');
+    if (total === 0) {
+        out.push('No security findings. ✅');
+        out.push('');
+        out.push('<sub>Static pre-flight for AI-built apps · [cleartoship.app](https://cleartoship.app)</sub>');
+        return out.join('\n');
+    }
+    const bySeverity = ['critical', 'high', 'medium', 'low'];
+    const blocking = scan.findings.filter((f) => f.severity === 'critical' || f.severity === 'high');
+    const rest = scan.findings.filter((f) => f.severity === 'medium' || f.severity === 'low');
+    const table = (findings) => {
+        const rows = ['| Severity | Rule | Finding | Location |', '| --- | --- | --- | --- |'];
+        for (const f of findings) {
+            const loc = f.file ? `\`${f.file}${f.line ? `:${f.line}` : ''}\`` : '—';
+            const title = f.title.replace(/\|/g, '\\|');
+            rows.push(`| ${MD_SEVERITY[f.severity]} | \`${f.id}\` | ${title} | ${loc} |`);
+        }
+        return rows.join('\n');
+    };
+    if (blocking.length > 0) {
+        out.push(table(blocking));
+        out.push('');
+    }
+    if (rest.length > 0) {
+        out.push('<details><summary>' + `${rest.length} lower-severity finding${rest.length === 1 ? '' : 's'}` + '</summary>');
+        out.push('');
+        out.push(table(rest));
+        out.push('');
+        out.push('</details>');
+        out.push('');
+    }
+    // The single most severe finding gets its fix shown inline; the rest are a
+    // command away, so the comment stays scannable.
+    const worst = scan.findings[0];
+    if (worst) {
+        out.push(`<details><summary>How to fix <code>${worst.id}</code> — ${worst.title}</summary>`);
+        out.push('');
+        out.push(worst.detail);
+        out.push('');
+        out.push('```');
+        out.push(worst.fix);
+        out.push('```');
+        out.push('');
+        out.push('</details>');
+        out.push('');
+    }
+    out.push('Run `npx cleartoship --fix-prompt` for a prompt that fixes all of these in Cursor or Claude Code.');
+    out.push('');
+    out.push('<sub>Static pre-flight for AI-built apps · [cleartoship.app](https://cleartoship.app)</sub>');
+    return out.join('\n');
+}
+export function renderBadge(scan) {
+    const verdict = scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear';
+    const colour = verdict === 'clear' ? '10b981' : verdict === 'conditional' ? 'f59e0b' : 'ef4444';
+    const label = verdict === 'clear' ? 'clear%20to%20ship' : verdict;
+    return `[![ClearToShip](https://img.shields.io/badge/ClearToShip-${label}-${colour}?style=flat-square)](https://cleartoship.app)`;
+}

package/dist/scan.d.ts

@@ -0,0 +1,24 @@
+import type { CheckSummary, Finding, Severity } from './types.js';
+export interface ScanOptions {
+    root: string;
+    paths?: string[];
+    offline?: boolean;
+    ignore?: string[];
+    only?: string[];
+    minSeverity?: Severity;
+    /** Skip the vendored community ruleset, leaving only ClearToShip's own checks. */
+    noCommunity?: boolean;
+    verbose?: boolean;
+    onProgress?: (step: number, total: number, name: string) => void;
+}
+export interface FullScan {
+    root: string;
+    framework: string;
+    fileCount: number;
+    findings: Finding[];
+    checks: CheckSummary[];
+    warnings: string[];
+    counts: Record<Severity, number>;
+    durationMs: number;
+}
+export declare function scan(options: ScanOptions): Promise<FullScan>;

package/dist/scan.js

@@ -0,0 +1,81 @@
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { walk } from './utils/files.js';
+import { detectFramework } from './utils/detect.js';
+import { SCANNERS, communityScanner } from './scanners/index.js';
+import { GUARDVIBE_CVE_RULE_IDS } from './vendor/guardvibe/index.js';
+import { SEVERITY_ORDER } from './types.js';
+export async function scan(options) {
+    const started = Date.now();
+    const root = resolve(options.root);
+    const roots = options.paths?.length ? options.paths.map((p) => resolve(root, p)) : [root];
+    const files = [...new Set(roots.flatMap((r) => walk(r)))];
+    const framework = detectFramework(root, files);
+    const ctx = {
+        root,
+        files,
+        framework,
+        offline: Boolean(options.offline),
+        cacheDir: process.env.CLEARTOSHIP_CACHE ?? join(homedir(), '.cache', 'cleartoship'),
+        verbose: Boolean(options.verbose),
+    };
+    const active = SCANNERS.filter((s) => s.applies(ctx) && !(options.noCommunity && s === communityScanner));
+    const findings = [];
+    const checks = [];
+    const warnings = [];
+    for (let i = 0; i < active.length; i++) {
+        const scanner = active[i];
+        options.onProgress?.(i + 1, active.length, scanner.name);
+        try {
+            const result = await scanner.run(ctx);
+            findings.push(...result.findings);
+            checks.push(...result.checks);
+            warnings.push(...result.warnings);
+        }
+        catch (err) {
+            warnings.push(`${scanner.name} failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // OSV.dev is authoritative and current; the vendored CVE-version regexes are
+    // neither. If OSV answered for this project, stand them down rather than
+    // report the same advisory twice from two sources of differing freshness.
+    const osvAnswered = checks.some((c) => c.label.startsWith('Known vulnerabilities'));
+    let filtered = osvAnswered
+        ? findings.filter((f) => !GUARDVIBE_CVE_RULE_IDS.has(f.id))
+        : findings;
+    if (options.ignore?.length) {
+        const ignored = new Set(options.ignore.map((s) => s.toUpperCase()));
+        filtered = filtered.filter((f) => !ignored.has(f.id.toUpperCase()));
+    }
+    if (options.only?.length) {
+        const only = new Set(options.only.map((s) => s.toUpperCase()));
+        filtered = filtered.filter((f) => only.has(f.id.toUpperCase()));
+    }
+    if (options.minSeverity) {
+        const floor = SEVERITY_ORDER[options.minSeverity];
+        filtered = filtered.filter((f) => SEVERITY_ORDER[f.severity] >= floor);
+    }
+    filtered.sort((a, b) => {
+        const bySeverity = SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity];
+        if (bySeverity !== 0)
+            return bySeverity;
+        const byFile = (a.file ?? '').localeCompare(b.file ?? '');
+        if (byFile !== 0)
+            return byFile;
+        return (a.line ?? 0) - (b.line ?? 0);
+    });
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of filtered)
+        counts[f.severity]++;
+    return {
+        root,
+        framework: framework.describe(),
+        fileCount: files.length,
+        findings: filtered,
+        checks,
+        warnings,
+        counts,
+        durationMs: Date.now() - started,
+    };
+}

package/dist/scanners/community.d.ts

@@ -0,0 +1,2 @@
+import type { Scanner } from '../types.js';
+export declare const communityScanner: Scanner;