compromising-position 1.0.0

package/dist/input/secure-prompt.js

@@ -0,0 +1,105 @@
+import { SecureBuffer } from "../core/secure-buffer.js";
+/**
+ * Read a secret from stdin.
+ *
+ * - If stdin is a pipe: reads all data from the pipe.
+ * - If stdin is a TTY: prompts interactively with hidden input.
+ *
+ * Always returns a SecureBuffer (Buffer-backed, not String).
+ */
+export async function readSecret() {
+    if (!process.stdin.isTTY) {
+        return readFromPipe();
+    }
+    return readFromTTY();
+}
+async function readFromPipe() {
+    const chunks = [];
+    return new Promise((resolve, reject) => {
+        process.stdin.on("data", (chunk) => {
+            chunks.push(chunk);
+        });
+        process.stdin.on("end", () => {
+            const combined = Buffer.concat(chunks);
+            // Strip trailing newline that shells typically add.
+            // Note: combined.subarray() returns a view, not a copy.
+            // SecureBuffer.fromBuffer() copies the data before we zero combined.
+            let end = combined.length;
+            while (end > 0 && (combined[end - 1] === 0x0a || combined[end - 1] === 0x0d)) {
+                end--;
+            }
+            const trimmed = combined.subarray(0, end);
+            const secret = SecureBuffer.fromBuffer(trimmed);
+            // Zero the intermediate buffers
+            for (const chunk of chunks) {
+                chunk.fill(0);
+            }
+            combined.fill(0);
+            resolve(secret);
+        });
+        process.stdin.on("error", (err) => {
+            // Zero any accumulated data before rejecting
+            for (const chunk of chunks) {
+                chunk.fill(0);
+            }
+            reject(err);
+        });
+    });
+}
+/** Max input length for TTY (4 KiB should be sufficient for any API key). */
+const TTY_BUFFER_SIZE = 4096;
+async function readFromTTY() {
+    process.stderr.write("Enter secret (input hidden): ");
+    return new Promise((resolve, reject) => {
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        // Accumulate input directly into a Buffer (not strings) so we can zero it.
+        const buf = Buffer.alloc(TTY_BUFFER_SIZE);
+        let pos = 0;
+        stdin.setRawMode(true);
+        stdin.resume();
+        const cleanup = () => {
+            stdin.setRawMode(wasRaw ?? false);
+            stdin.pause();
+            stdin.removeListener("data", onData);
+        };
+        const onData = (data) => {
+            // data is a Buffer in raw mode when encoding is not set
+            for (let i = 0; i < data.length; i++) {
+                const byte = data[i];
+                // Ctrl+C (0x03)
+                if (byte === 0x03) {
+                    cleanup();
+                    process.stderr.write("\n");
+                    buf.fill(0);
+                    reject(new Error("Aborted"));
+                    return;
+                }
+                // Enter (CR=0x0d or LF=0x0a)
+                if (byte === 0x0d || byte === 0x0a) {
+                    cleanup();
+                    process.stderr.write("\n");
+                    const secret = SecureBuffer.fromBuffer(buf.subarray(0, pos));
+                    buf.fill(0);
+                    resolve(secret);
+                    return;
+                }
+                // Backspace (0x7f) or BS (0x08)
+                if (byte === 0x7f || byte === 0x08) {
+                    if (pos > 0) {
+                        pos--;
+                        buf[pos] = 0; // Zero the removed byte
+                    }
+                    continue;
+                }
+                // Regular byte — don't echo. Silently discard if buffer full.
+                if (pos < TTY_BUFFER_SIZE) {
+                    buf[pos] = byte;
+                    pos++;
+                }
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+//# sourceMappingURL=secure-prompt.js.map

package/dist/input/secure-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-prompt.js","sourceRoot":"","sources":["../../src/input/secure-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,oDAAoD;YACpD,wDAAwD;YACxD,qEAAqE;YACrE,IAAI,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC1B,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7E,GAAG,EAAE,CAAC;YACR,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAChD,gCAAgC;YAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAChC,6CAA6C;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,KAAK,UAAU,WAAW;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAE3B,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YAClC,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;YAC9B,wDAAwD;YACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;gBAEtB,gBAAgB;gBAChB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBAED,6BAA6B;gBAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnC,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC7D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,OAAO,CAAC,MAAM,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;gBAED,gCAAgC;gBAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;wBACZ,GAAG,EAAE,CAAC;wBACN,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB;oBACxC,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,8DAA8D;gBAC9D,IAAI,GAAG,GAAG,eAAe,EAAE,CAAC;oBAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAChB,GAAG,EAAE,CAAC;gBACR,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/output/audit-log.d.ts

@@ -0,0 +1,11 @@
+import type { AuditEntry, CheckResult } from "../types/index.js";
+/** Convert a CheckResult to an audit entry (no secrets, only fingerprint). */
+export declare function toAuditEntry(result: CheckResult): AuditEntry;
+/**
+ * Validate an audit log path to prevent path traversal and device file writes.
+ * Returns the resolved absolute path, or throws on invalid paths.
+ */
+export declare function validateAuditLogPath(path: string): Promise<string>;
+/** Append an audit entry to a JSONL file. */
+export declare function writeAuditLog(path: string, result: CheckResult): Promise<void>;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/output/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/output/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEjE,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,CAS5D;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBxE;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/output/audit-log.js

@@ -0,0 +1,50 @@
+import { appendFile, lstat } from "node:fs/promises";
+import { resolve } from "node:path";
+/** Convert a CheckResult to an audit entry (no secrets, only fingerprint). */
+export function toAuditEntry(result) {
+    return {
+        timestamp: result.timestamp,
+        fingerprint: result.fingerprint,
+        provider: result.local.identification.provider,
+        riskLevel: result.riskLevel,
+        hibpFound: result.hibpPassword?.found ?? null,
+        summary: result.summary,
+    };
+}
+/**
+ * Validate an audit log path to prevent path traversal and device file writes.
+ * Returns the resolved absolute path, or throws on invalid paths.
+ */
+export async function validateAuditLogPath(path) {
+    const resolved = resolve(path);
+    // Refuse device files
+    if (resolved.startsWith("/dev/") || resolved.startsWith("/proc/") || resolved.startsWith("/sys/")) {
+        throw new Error(`Refusing to write audit log to device path: ${resolved}`);
+    }
+    // Check if path is a symlink (could point to unexpected location)
+    try {
+        const stats = await lstat(resolved);
+        if (stats.isSymbolicLink()) {
+            throw new Error(`Refusing to write audit log to symlink: ${resolved}`);
+        }
+    }
+    catch (err) {
+        // File doesn't exist yet — that's fine, appendFile will create it
+        if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+            // OK
+        }
+        else if (err instanceof Error && err.message.includes("Refusing")) {
+            throw err;
+        }
+        // Other stat errors — let appendFile handle them
+    }
+    return resolved;
+}
+/** Append an audit entry to a JSONL file. */
+export async function writeAuditLog(path, result) {
+    const validatedPath = await validateAuditLogPath(path);
+    const entry = toAuditEntry(result);
+    const line = JSON.stringify(entry) + "\n";
+    await appendFile(validatedPath, line, "utf-8");
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/output/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/output/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ;QAC9C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,IAAI,IAAI;QAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/B,sBAAsB;IACtB,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,KAAK;QACP,CAAC;aAAM,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,iDAAiD;IACnD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,MAAmB;IAEnB,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,MAAM,UAAU,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/output/csv.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from "../types/index.js";
+/**
+ * Format check results as CSV.
+ */
+export declare function formatCsv(results: CheckResult[]): string;
+//# sourceMappingURL=csv.d.ts.map

package/dist/output/csv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.d.ts","sourceRoot":"","sources":["../../src/output/csv.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUrD;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAiBxD"}

package/dist/output/csv.js

@@ -0,0 +1,28 @@
+/** Escape a value for CSV (RFC 4180). */
+function csvEscape(value) {
+    if (value.includes(",") || value.includes('"') || value.includes("\n")) {
+        return `"${value.replace(/"/g, '""')}"`;
+    }
+    return value;
+}
+/**
+ * Format check results as CSV.
+ */
+export function formatCsv(results) {
+    const header = "fingerprint,provider,confidence,risk_level,hibp_found,hibp_occurrences,entropy,summary,timestamp";
+    const rows = results.map((r) => {
+        return [
+            r.fingerprint,
+            csvEscape(r.local.identification.provider),
+            r.local.identification.confidence,
+            r.riskLevel,
+            r.hibpPassword?.found ?? "",
+            r.hibpPassword?.occurrences ?? "",
+            r.local.entropy.shannonEntropy,
+            csvEscape(r.summary),
+            r.timestamp,
+        ].join(",");
+    });
+    return [header, ...rows].join("\n");
+}
+//# sourceMappingURL=csv.js.map

package/dist/output/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../../src/output/csv.ts"],"names":[],"mappings":"AAEA,yCAAyC;AACzC,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAsB;IAC9C,MAAM,MAAM,GAAG,kGAAkG,CAAC;IAClH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,OAAO;YACL,CAAC,CAAC,WAAW;YACb,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC1C,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU;YACjC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YAC3B,CAAC,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE;YACjC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc;YAC9B,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,SAAS;SACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/output/formatter.d.ts

@@ -0,0 +1,12 @@
+import type { CheckResult } from "../types/index.js";
+/** Format a full check result as a colored terminal report. Writes to stderr. */
+export declare function formatReport(result: CheckResult): string;
+/** Format a result as JSON for piping. */
+export declare function formatJson(result: CheckResult): string;
+/** Format a privacy summary for all plugins. */
+export declare function formatPrivacySummary(plugins: readonly {
+    id: string;
+    name: string;
+    privacySummary: string;
+}[]): string;
+//# sourceMappingURL=formatter.d.ts.map

package/dist/output/formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,mBAAmB,CAAC;AA2BhE,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CA2IxD;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEtD;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAAE,GACvE,MAAM,CASR"}

package/dist/output/formatter.js

@@ -0,0 +1,154 @@
+import chalk from "chalk";
+import { sanitizeForTerminal } from "../core/sanitize.js";
+const RISK_COLORS = {
+    critical: chalk.bgRed.white.bold,
+    high: chalk.red.bold,
+    medium: chalk.yellow.bold,
+    low: chalk.green.bold,
+    info: chalk.blue,
+};
+const RISK_LABELS = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+function riskBadge(level) {
+    return RISK_COLORS[level](`[${RISK_LABELS[level]}]`);
+}
+/** Sanitize a value from an external API before terminal output. */
+function s(val) {
+    return sanitizeForTerminal(val ?? "");
+}
+/** Format a full check result as a colored terminal report. Writes to stderr. */
+export function formatReport(result) {
+    const lines = [];
+    lines.push("");
+    lines.push(chalk.bold("--- Credential Exposure Report ---"));
+    lines.push("");
+    // Risk level
+    lines.push(`  Risk Level:  ${riskBadge(result.riskLevel)}`);
+    lines.push(`  Summary:     ${s(result.summary)}`);
+    lines.push(`  Fingerprint: ${chalk.dim(result.fingerprint)}`);
+    lines.push("");
+    // Local analysis
+    const local = result.local;
+    lines.push(chalk.bold.underline("Local Analysis"));
+    lines.push(`  Provider:    ${local.identification.provider} (${local.identification.confidence} confidence)`);
+    lines.push(`  Description: ${local.identification.description}`);
+    lines.push(`  Entropy:     ${local.entropy.shannonEntropy} bits/char (${local.entropy.normalizedEntropy} normalized)`);
+    lines.push(`  Encoding:    ${local.entropy.encoding} | Length: ${local.entropy.length}`);
+    if (local.warnings.length > 0) {
+        lines.push("");
+        lines.push(chalk.yellow("  Warnings:"));
+        for (const w of local.warnings) {
+            lines.push(chalk.yellow(`    ! ${w}`));
+        }
+    }
+    // HIBP password check
+    if (result.hibpPassword) {
+        lines.push("");
+        lines.push(chalk.bold.underline("HIBP Password Check (k-Anonymity)"));
+        const hp = result.hibpPassword;
+        if (hp.error) {
+            lines.push(chalk.red(`  Error: ${s(hp.error)}`));
+        }
+        else if (hp.found) {
+            lines.push(chalk.red.bold(`  FOUND in breach data — ${hp.occurrences.toLocaleString()} occurrence(s)`));
+        }
+        else {
+            lines.push(chalk.green("  Not found in breach data"));
+        }
+        lines.push(chalk.dim(`  Hash prefix sent: ${hp.hashPrefix}`));
+    }
+    // HIBP email check
+    if (result.hibpEmail) {
+        lines.push("");
+        lines.push(chalk.bold.underline("HIBP Email Breach Check"));
+        const he = result.hibpEmail;
+        if (he.error) {
+            lines.push(chalk.red(`  Error: ${s(he.error)}`));
+        }
+        else {
+            if (he.breaches.length > 0) {
+                lines.push(chalk.red(`  Found in ${he.breaches.length} breach(es):`));
+                for (const b of he.breaches.slice(0, 10)) {
+                    lines.push(`    - ${s(b.Name)} (${s(b.BreachDate)})`);
+                }
+                if (he.breaches.length > 10) {
+                    lines.push(chalk.dim(`    ... and ${he.breaches.length - 10} more`));
+                }
+            }
+            else {
+                lines.push(chalk.green("  No breaches found"));
+            }
+            if (he.stealerLogs.length > 0) {
+                lines.push(chalk.red(`  Found in ${he.stealerLogs.length} stealer log(s):`));
+                for (const sl of he.stealerLogs.slice(0, 5)) {
+                    lines.push(`    - ${s(sl.Name)} (${s(sl.Date)})`);
+                }
+            }
+            if (he.pastes.length > 0) {
+                lines.push(chalk.yellow(`  Found in ${he.pastes.length} paste(s):`));
+                for (const p of he.pastes.slice(0, 5)) {
+                    lines.push(`    - ${s(p.Source)}: ${s(p.Title ?? p.Id)}`);
+                }
+            }
+        }
+    }
+    // Plugin results
+    if (result.pluginResults.length > 0) {
+        lines.push("");
+        lines.push(chalk.bold.underline("Plugin Results"));
+        for (const pr of result.pluginResults) {
+            const badge = riskBadge(pr.severity);
+            if (pr.error) {
+                lines.push(`  ${s(pr.pluginName)}: ${chalk.red(`Error: ${s(pr.error)}`)}`);
+            }
+            else if (pr.found) {
+                lines.push(`  ${s(pr.pluginName)}: ${badge} ${s(pr.details)}`);
+            }
+            else {
+                lines.push(`  ${s(pr.pluginName)}: ${chalk.green(s(pr.details))}`);
+            }
+        }
+    }
+    // Verification result
+    if (result.verification) {
+        lines.push("");
+        lines.push(chalk.bold.underline("Active Key Verification"));
+        const v = result.verification;
+        if (v.error) {
+            lines.push(chalk.red(`  Error: ${s(v.error)}`));
+        }
+        else if (v.active) {
+            lines.push(chalk.bgRed.white.bold("  KEY IS ACTIVE — rotate immediately!"));
+            lines.push(`  ${s(v.details)}`);
+        }
+        else {
+            lines.push(chalk.green(`  Key is inactive/revoked: ${s(v.details)}`));
+        }
+        lines.push(chalk.dim(`  Endpoint checked: ${s(v.endpoint)}`));
+    }
+    lines.push("");
+    lines.push(chalk.dim(`  Timestamp: ${result.timestamp}`));
+    lines.push("");
+    return lines.join("\n");
+}
+/** Format a result as JSON for piping. */
+export function formatJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+/** Format a privacy summary for all plugins. */
+export function formatPrivacySummary(plugins) {
+    const lines = [];
+    lines.push("");
+    lines.push(chalk.bold("Privacy summary:"));
+    for (const p of plugins) {
+        lines.push(`  ${chalk.cyan(p.id.padEnd(24))} ${p.privacySummary}`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+//# sourceMappingURL=formatter.js.map

package/dist/output/formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,WAAW,GAAgD;IAC/D,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;IAChC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;IACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;IACzB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;IACrB,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,CAAC;AAEF,MAAM,WAAW,GAA8B;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,SAAS,CAAC,KAAgB;IACjC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,SAAS,CAAC,CAAC,GAA8B;IACvC,OAAO,mBAAmB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,aAAa;IACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,iBAAiB;IACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CACR,kBAAkB,KAAK,CAAC,cAAc,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,CAAC,UAAU,cAAc,CAClG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CACR,kBAAkB,KAAK,CAAC,OAAO,CAAC,cAAc,eAAe,KAAK,CAAC,OAAO,CAAC,iBAAiB,cAAc,CAC3G,CAAC;IACF,KAAK,CAAC,IAAI,CACR,kBAAkB,KAAK,CAAC,OAAO,CAAC,QAAQ,cAAc,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAC7E,CAAC;IAEF,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CAAC,IAAI,CACZ,4BAA4B,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,gBAAgB,CAC5E,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAC1D,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACzC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC5B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CACP,cAAc,EAAE,CAAC,WAAW,CAAC,MAAM,kBAAkB,CACtD,CACF,CAAC;gBACF,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,CACzD,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QAC9B,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAChE,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAClC,OAAwE;IAExE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/output/sarif.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from "../types/index.js";
+/**
+ * Format check results as SARIF for GitHub Advanced Security.
+ */
+export declare function formatSarif(results: CheckResult[]): string;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/output/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/output/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,mBAAmB,CAAC;AAgDhE;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAsC1D"}

package/dist/output/sarif.js

@@ -0,0 +1,52 @@
+/**
+ * SARIF severity mapping.
+ * See: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ */
+const SARIF_SEVERITY = {
+    critical: "error",
+    high: "error",
+    medium: "warning",
+    low: "note",
+    info: "none",
+};
+/**
+ * Format check results as SARIF for GitHub Advanced Security.
+ */
+export function formatSarif(results) {
+    const sarifResults = results.map((r) => ({
+        ruleId: `credential-exposure/${r.local.identification.provider.toLowerCase().replace(/\s+/g, "-")}`,
+        level: SARIF_SEVERITY[r.riskLevel],
+        message: { text: r.summary },
+        fingerprints: { primaryLocationHash: r.fingerprint },
+        properties: {
+            riskLevel: r.riskLevel,
+            provider: r.local.identification.provider,
+            timestamp: r.timestamp,
+        },
+    }));
+    const report = {
+        version: "2.1.0",
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "compromising-position",
+                        version: "1.0.0",
+                        informationUri: "https://github.com/your-org/compromising-position",
+                        rules: [
+                            {
+                                id: "credential-exposure",
+                                shortDescription: { text: "Credential found in breach database or identified as weak" },
+                                defaultConfiguration: { level: "error" },
+                            },
+                        ],
+                    },
+                },
+                results: sarifResults,
+            },
+        ],
+    };
+    return JSON.stringify(report, null, 2);
+}
+//# sourceMappingURL=sarif.js.map

package/dist/output/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/output/sarif.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,cAAc,GAA8B;IAChD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,MAAM;CACb,CAAC;AAoCF;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAsB;IAChD,MAAM,YAAY,GAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,uBAAuB,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACnG,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QAClC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,UAAU,EAAE;YACV,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,sGAAsG;QAC/G,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,mDAAmD;wBACnE,KAAK,EAAE;4BACL;gCACE,EAAE,EAAE,qBAAqB;gCACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,2DAA2D,EAAE;gCACvF,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;6BACzC;yBACF;qBACF;iBACF;gBACD,OAAO,EAAE,YAAY;aACtB;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,141 @@
+export declare enum KeyProvider {
+    OpenAI = "OpenAI",
+    OpenAIService = "OpenAI Service Account",
+    Anthropic = "Anthropic",
+    AWS = "AWS",
+    GitHubPAT = "GitHub PAT",
+    GitHubFineGrained = "GitHub Fine-Grained",
+    StripeLive = "Stripe Live",
+    StripeTest = "Stripe Test",
+    GoogleAPI = "Google API",
+    SlackBot = "Slack Bot",
+    SlackUser = "Slack User",
+    SendGrid = "SendGrid",
+    Twilio = "Twilio",
+    Mailgun = "Mailgun",
+    DiscordBot = "Discord Bot",
+    TelegramBot = "Telegram Bot",
+    GitLabPAT = "GitLab PAT",
+    GitLabPipeline = "GitLab Pipeline",
+    NpmToken = "npm Token",
+    PyPIToken = "PyPI Token",
+    ShopifyPrivate = "Shopify Private",
+    ShopifyAccess = "Shopify Access",
+    DigitalOceanPAT = "DigitalOcean PAT",
+    DigitalOceanOAuth = "DigitalOcean OAuth",
+    Supabase = "Supabase",
+    HashiCorpVault = "HashiCorp Vault",
+    TerraformCloud = "Terraform Cloud",
+    PlanetScale = "PlanetScale",
+    Postman = "Postman",
+    GrafanaService = "Grafana Service",
+    Linear = "Linear",
+    Netlify = "Netlify",
+    DopplerServiceToken = "Doppler Service Token",
+    DopplerServiceAccount = "Doppler Service Account",
+    Buildkite = "Buildkite",
+    Atlassian = "Atlassian",
+    Figma = "Figma",
+    CircleCI = "CircleCI",
+    Notion = "Notion",
+    Unknown = "Unknown"
+}
+export type Encoding = "base64" | "hex" | "base62" | "alphanumeric" | "mixed";
+export interface EntropyResult {
+    shannonEntropy: number;
+    maxPossibleEntropy: number;
+    normalizedEntropy: number;
+    encoding: Encoding;
+    length: number;
+    warning: string | null;
+}
+export interface KeyIdentification {
+    provider: KeyProvider;
+    confidence: "high" | "medium" | "low";
+    description: string;
+}
+export interface LocalCheckResult {
+    identification: KeyIdentification;
+    entropy: EntropyResult;
+    warnings: string[];
+    looksLikeSecret: boolean;
+}
+export interface HibpPasswordResult {
+    checked: boolean;
+    found: boolean;
+    occurrences: number;
+    hashPrefix: string;
+    error: string | null;
+}
+export interface BreachEntry {
+    Name: string;
+    BreachDate: string;
+    DataClasses: string[];
+}
+export interface PasteEntry {
+    Source: string;
+    Id: string;
+    Title: string | null;
+    Date: string | null;
+}
+export interface StealerLogEntry {
+    Name: string;
+    Date: string;
+}
+export interface HibpEmailResult {
+    checked: boolean;
+    breaches: BreachEntry[];
+    stealerLogs: StealerLogEntry[];
+    pastes: PasteEntry[];
+    error: string | null;
+}
+export type RiskLevel = "critical" | "high" | "medium" | "low" | "info";
+export type PluginInputKind = "secret" | "email" | "both";
+export interface PluginCheckResult {
+    pluginId: string;
+    pluginName: string;
+    found: boolean;
+    details: string;
+    severity: RiskLevel;
+    error: string | null;
+    metadata?: Record<string, unknown>;
+}
+export interface VerificationResult {
+    provider: KeyProvider;
+    active: boolean;
+    details: string;
+    error: string | null;
+    endpoint: string;
+}
+export interface CheckResult {
+    local: LocalCheckResult;
+    hibpPassword: HibpPasswordResult | null;
+    hibpEmail: HibpEmailResult | null;
+    pluginResults: PluginCheckResult[];
+    verification: VerificationResult | null;
+    riskLevel: RiskLevel;
+    summary: string;
+    fingerprint: string;
+    timestamp: string;
+}
+export interface AuditEntry {
+    timestamp: string;
+    fingerprint: string;
+    provider: KeyProvider;
+    riskLevel: RiskLevel;
+    hibpFound: boolean | null;
+    summary: string;
+}
+export interface AppConfig {
+    hibpApiKey: string | null;
+    auditLogPath: string | null;
+    envFile?: string;
+    offline: boolean;
+    json: boolean;
+    verbose: boolean;
+    verify: boolean;
+    enabledPlugins: string[];
+    disabledPlugins: string[];
+    pluginApiKeys: Record<string, string>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,oBAAY,WAAW;IACrB,MAAM,WAAW;IACjB,aAAa,2BAA2B;IACxC,SAAS,cAAc;IACvB,GAAG,QAAQ;IACX,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,UAAU,gBAAgB;IAC1B,UAAU,gBAAgB;IAC1B,SAAS,eAAe;IACxB,QAAQ,cAAc;IACtB,SAAS,eAAe;IACxB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,UAAU,gBAAgB;IAC1B,WAAW,iBAAiB;IAE5B,SAAS,eAAe;IACxB,cAAc,oBAAoB;IAClC,QAAQ,cAAc;IACtB,SAAS,eAAe;IACxB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,eAAe,qBAAqB;IACpC,iBAAiB,uBAAuB;IACxC,QAAQ,aAAa;IACrB,cAAc,oBAAoB;IAClC,cAAc,oBAAoB;IAClC,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,cAAc,oBAAoB;IAClC,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,mBAAmB,0BAA0B;IAC7C,qBAAqB,4BAA4B;IACjD,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,iBAAiB,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC"}