oauthlint 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Maurice Anney
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# oauthlint
+
+> Catch the OAuth/OIDC/JWT anti-patterns AI coding tools systematically produce.
+
+CLI wrapper around [`oauthlint-rules`](../oauthlint-rules) — a Semgrep
+rule pack curated by an IAM engineer.
+
+## Quick start
+
+```bash
+npx oauthlint scan ./src
+```
+
+You need [Semgrep](https://semgrep.dev/docs/getting-started/) installed
+(`pipx install semgrep` or `brew install semgrep`). The CLI invokes it
+under the hood and normalises the output for humans and CI.
+
+## Commands
+
+```
+oauthlint scan [path]           Scan a directory (default: current dir)
+oauthlint scan --json           Emit machine-readable JSON
+oauthlint scan --severity HIGH  Only show findings ≥ HIGH
+oauthlint scan --fail-on off    Never fail the build (CI dry-run)
+oauthlint list                  List every shipped rule
+oauthlint list --json           Same, as JSON
+oauthlint init                  Generate .oauthlintrc.yml at cwd
+oauthlint init --force          Overwrite an existing config
+```
+
+## Exit codes
+
+| Code | When |
+|------|------|
+| 0 | No findings ≥ `failOn` threshold |
+| 1 | At least one HIGH finding |
+| 2 | At least one CRITICAL finding |
+| 127 | Semgrep is not installed |
+
+## Configuration
+
+Create a `.oauthlintrc.yml` at your repo root with `oauthlint init`. The
+file follows the schema in [`src/core/config.ts`](./src/core/config.ts).
+
+```yaml
+version: 1
+include:
+  - "src/**/*.{ts,tsx,js,jsx}"
+exclude:
+  - "**/*.test.ts"
+rules:
+  auth.cookie.no-samesite: warn
+  auth.session.id-in-url: off
+failOn: HIGH
+```
+
+## License
+
+MIT — see [LICENSE](../../LICENSE).

package/bin/oauthlint.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { buildProgram } from '../dist/cli.js';
+
+const program = await buildProgram();
+await program.parseAsync(process.argv);

package/dist/adapters/semgrep.d.ts

@@ -0,0 +1,36 @@
+import { type ScanResult } from '../types.js';
+export declare class SemgrepNotInstalledError extends Error {
+    constructor();
+}
+export interface SemgrepAdapterOptions {
+    /** Override path to the semgrep binary (defaults to `semgrep` on PATH). */
+    binary?: string;
+    /** Override the rule config — usually a directory of YAML rules. */
+    configPath: string;
+    /** Working directory to run semgrep from (the target to scan). */
+    cwd?: string;
+}
+export declare class SemgrepAdapter {
+    private readonly binary;
+    private readonly configPath;
+    private readonly cwd?;
+    constructor(opts: SemgrepAdapterOptions);
+    /**
+     * Run semgrep against `targetPath`, returning a normalised scan result.
+     * When `applyFixes` is true, Semgrep rewrites the source files in place
+     * using each rule's `fix:` template. The returned report reflects what
+     * was matched BEFORE the rewrite — callers should re-scan if they want
+     * a clean post-fix report.
+     *
+     * @throws SemgrepNotInstalledError if the binary cannot be found.
+     */
+    scan(targetPath: string, options?: {
+        applyFixes?: boolean;
+    }): Promise<ScanResult>;
+    /**
+     * Check whether Semgrep is callable at all. Used by `oauthlint doctor`.
+     */
+    getVersion(): Promise<string | null>;
+}
+export declare function normaliseRuleId(rawId: string): string;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/adapters/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/adapters/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BlF,qBAAa,wBAAyB,SAAQ,KAAK;;CASlD;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAS;gBAElB,IAAI,EAAE,qBAAqB;IAMvC;;;;;;;;OAQG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA2D3F;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAS3C;AAwCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGrD"}

package/dist/adapters/semgrep.js

@@ -0,0 +1,156 @@
+import { ExecaError, execa } from 'execa';
+import { SEMGREP_SEVERITY_MAP } from '../types.js';
+export class SemgrepNotInstalledError extends Error {
+    constructor() {
+        super('Semgrep is not installed.\n' +
+            'Install it with: pipx install semgrep   (or)   brew install semgrep\n' +
+            'See https://semgrep.dev/docs/getting-started/ for more options.');
+        this.name = 'SemgrepNotInstalledError';
+    }
+}
+export class SemgrepAdapter {
+    binary;
+    configPath;
+    cwd;
+    constructor(opts) {
+        this.binary = opts.binary ?? 'semgrep';
+        this.configPath = opts.configPath;
+        this.cwd = opts.cwd;
+    }
+    /**
+     * Run semgrep against `targetPath`, returning a normalised scan result.
+     * When `applyFixes` is true, Semgrep rewrites the source files in place
+     * using each rule's `fix:` template. The returned report reflects what
+     * was matched BEFORE the rewrite — callers should re-scan if they want
+     * a clean post-fix report.
+     *
+     * @throws SemgrepNotInstalledError if the binary cannot be found.
+     */
+    async scan(targetPath, options = {}) {
+        const start = Date.now();
+        const args = [
+            'scan',
+            '--config',
+            this.configPath,
+            '--json',
+            '--quiet',
+            '--no-git-ignore',
+            '--metrics=off',
+        ];
+        if (options.applyFixes)
+            args.push('--autofix');
+        args.push(targetPath);
+        let result;
+        try {
+            result = await execa(this.binary, args, {
+                cwd: this.cwd,
+                reject: false,
+                // Semgrep exits non-zero when findings are present; we don't want that to throw.
+                stdout: 'pipe',
+                stderr: 'pipe',
+            });
+        }
+        catch (err) {
+            if (isSpawnFailure(err)) {
+                throw new SemgrepNotInstalledError();
+            }
+            throw err;
+        }
+        // Even with reject:false, execa surfaces spawn failures via the result object.
+        if (isSpawnFailure(result)) {
+            throw new SemgrepNotInstalledError();
+        }
+        let parsed;
+        try {
+            const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+            parsed = JSON.parse(stdout || '{}');
+        }
+        catch {
+            return {
+                findings: [],
+                scannedFiles: 0,
+                durationMs: Date.now() - start,
+                semgrepVersion: null,
+                errors: ['semgrep output was not valid JSON'],
+            };
+        }
+        const findings = (parsed.results ?? []).map(toFinding);
+        return {
+            findings,
+            scannedFiles: parsed.paths?.scanned?.length ?? 0,
+            durationMs: Date.now() - start,
+            semgrepVersion: parsed.version ?? null,
+            errors: (parsed.errors ?? []).map((e) => e.long_msg ?? e.message ?? 'unknown semgrep error'),
+        };
+    }
+    /**
+     * Check whether Semgrep is callable at all. Used by `oauthlint doctor`.
+     */
+    async getVersion() {
+        try {
+            const { stdout } = await execa(this.binary, ['--version'], { reject: false });
+            return stdout.trim() || null;
+        }
+        catch (err) {
+            if (isSpawnFailure(err))
+                return null;
+            throw err;
+        }
+    }
+}
+function toFinding(r) {
+    const rawSeverity = (r.extra.severity ?? 'INFO').toUpperCase();
+    const severity = SEMGREP_SEVERITY_MAP[rawSeverity] ?? 'MEDIUM';
+    return {
+        ruleId: normaliseRuleId(r.check_id),
+        oauthlintRuleId: r.extra.metadata?.['oauthlint-rule-id'],
+        severity,
+        filePath: r.path,
+        startLine: r.start.line,
+        endLine: r.end.line,
+        message: (r.extra.message ?? '').trim(),
+        docUrl: r.extra.metadata?.['oauthlint-doc-url'],
+        cwe: r.extra.metadata?.cwe,
+        llmPrevalence: r.extra.metadata?.['llm-prevalence'],
+    };
+}
+/**
+ * Strip the file-path prefix Semgrep adds when loading rules from a
+ * directory. Semgrep encodes the relative path into `check_id`, so a
+ * rule defined as `auth.jwt.alg-none` in
+ * `packages/oauthlint-rules/rules/jwt/alg-none.yml` is reported as
+ * `packages.oauthlint-rules.rules.jwt.auth.jwt.alg-none`.
+ *
+ * OAuthLint rule ids always have the shape `auth.<category>.<name>`, so we
+ * pull out the trailing match. The regex is deliberately strict: it has to
+ * land at the END of the string so we don't accidentally truncate
+ * `auth.oauth.hardcoded-secret` into `auth.hardcoded-secret` when the
+ * path itself contains the substring `auth.` more than once (e.g.
+ * `rules.oauth.auth.oauth.hardcoded-secret`, where `oauth` ends with
+ * "auth" before the dot).
+ *
+ * Custom (non-OAuthLint) rule ids that don't fit the shape are returned
+ * unchanged.
+ */
+const OAUTHLINT_ID_RE = /auth\.[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$/;
+export function normaliseRuleId(rawId) {
+    const match = rawId.match(OAUTHLINT_ID_RE);
+    return match ? match[0] : rawId;
+}
+function isSpawnFailure(err) {
+    // Direct throw path (when execa is configured to reject).
+    if (err instanceof ExecaError) {
+        return err.code === 'ENOENT';
+    }
+    // reject:false path — execa returns a result object that exposes `failed`
+    // plus `code` / `cause` indicating ENOENT when the binary is missing.
+    if (typeof err === 'object' && err !== null) {
+        const r = err;
+        if (r.code === 'ENOENT')
+            return true;
+        if (r.cause?.code === 'ENOENT')
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/adapters/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/adapters/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAgB,oBAAoB,EAAmB,MAAM,aAAa,CAAC;AA6BlF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CACH,6BAA6B;YAC3B,uEAAuE;YACvE,iEAAiE,CACpE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAWD,MAAM,OAAO,cAAc;IACR,MAAM,CAAS;IACf,UAAU,CAAS;IACnB,GAAG,CAAU;IAE9B,YAAY,IAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,UAAoC,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG;YACX,MAAM;YACN,UAAU;YACV,IAAI,CAAC,UAAU;YACf,QAAQ;YACR,SAAS;YACT,iBAAiB;YACjB,eAAe;SAChB,CAAC;QACF,IAAI,OAAO,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtB,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;gBACtC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,KAAK;gBACb,iFAAiF;gBACjF,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,wBAAwB,EAAE,CAAC;YACvC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,+EAA+E;QAC/E,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAgB,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,cAAc,EAAE,IAAI;gBACpB,MAAM,EAAE,CAAC,mCAAmC,CAAC;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,cAAc,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YACtC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,uBAAuB,CAAC;SAC7F,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,CAAgB;IACjC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC;IAE/D,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC;QACxD,QAAQ;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;QACvB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;QACnB,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG;QAC1B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAElE,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,0DAA0D;IAC1D,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,OAAQ,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAC;IACtD,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,GAAqE,CAAC;QAChF,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function buildProgram(): Promise<Command>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BpC,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAgErD"}

package/dist/cli.js

@@ -0,0 +1,103 @@
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Command } from 'commander';
+import pc from 'picocolors';
+import { runDoctor } from './commands/doctor.js';
+import { runInit } from './commands/init.js';
+import { runList } from './commands/list.js';
+import { runScan } from './commands/scan.js';
+import { SEVERITIES } from './types.js';
+async function readPackageVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    // dist/cli.js → ../package.json (when published)
+    // src/cli.ts  → ../package.json (when running via tsx/vitest)
+    for (const candidate of [
+        resolve(here, '..', 'package.json'),
+        resolve(here, '..', '..', 'package.json'),
+    ]) {
+        try {
+            const pkg = JSON.parse(await readFile(candidate, 'utf8'));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return '0.0.0';
+}
+export async function buildProgram() {
+    const program = new Command();
+    const version = await readPackageVersion();
+    program
+        .name('oauthlint')
+        .description('OAuthLint — catch the OAuth/OIDC/JWT anti-patterns AI coding tools systematically produce.')
+        .version(version, '-v, --version');
+    program
+        .command('scan')
+        .argument('[path]', 'Path to scan', '.')
+        .description('Scan a directory for auth misconfigurations')
+        .option('--json', 'Emit JSON (shortcut for --format json)')
+        .option('--format <fmt>', 'Output format: pretty | json | sarif', parseFormat)
+        .option('--severity <level>', 'Only emit findings ≥ this severity', parseSeverity)
+        .option('--fail-on <level>', 'Process exits non-zero if any finding ≥ this severity', parseFailOn)
+        .option('--rules-dir <path>', 'Override the bundled rules directory')
+        .option('--fix', 'Apply auto-fixes (rewrites source in place where possible)')
+        .action(async (path, opts) => {
+        const code = await runScan({
+            path,
+            json: opts.json,
+            format: opts.format,
+            severity: opts.severity,
+            failOn: opts.failOn,
+            rulesDir: opts.rulesDir,
+            fix: opts.fix,
+        });
+        process.exit(code);
+    });
+    program
+        .command('list')
+        .description('List every rule the current install ships with')
+        .option('--json', 'Emit JSON instead of pretty output')
+        .action(async (opts) => {
+        process.exit(await runList({ json: opts.json }));
+    });
+    program
+        .command('init')
+        .description('Generate a .oauthlintrc.yml at the current directory')
+        .option('-f, --force', 'Overwrite an existing config file')
+        .action(async (opts) => {
+        process.exit(await runInit({ cwd: process.cwd(), force: opts.force }));
+    });
+    program
+        .command('doctor')
+        .description('Diagnose your OAuthLint install (Node, Semgrep, rule pack)')
+        .option('--json', 'Emit JSON instead of pretty output')
+        .action(async (opts) => {
+        process.exit(await runDoctor({ json: opts.json }));
+    });
+    program.showHelpAfterError(pc.dim('(run `oauthlint --help` for available commands)'));
+    return program;
+}
+function parseSeverity(v) {
+    const upper = v.toUpperCase();
+    if (!SEVERITIES.includes(upper)) {
+        throw new Error(`Unknown severity "${v}". Expected one of: ${SEVERITIES.join(', ')}`);
+    }
+    return upper;
+}
+function parseFailOn(v) {
+    if (v === 'off')
+        return 'off';
+    return parseSeverity(v);
+}
+const FORMATS = ['pretty', 'json', 'sarif'];
+function parseFormat(v) {
+    const lower = v.toLowerCase();
+    if (!FORMATS.includes(lower)) {
+        throw new Error(`Unknown format "${v}". Expected one of: ${FORMATS.join(', ')}`);
+    }
+    return lower;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAM3D,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,iDAAiD;IACjD,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;SACJ,IAAI,CAAC,WAAW,CAAC;SACjB,WAAW,CACV,4FAA4F,CAC7F;SACA,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAErC,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC;SACvC,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,WAAW,CAAC;SAC7E,MAAM,CAAC,oBAAoB,EAAE,oCAAoC,EAAE,aAAa,CAAC;SACjF,MAAM,CACL,mBAAmB,EACnB,uDAAuD,EACvD,WAAW,CACZ;SACA,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,4DAA4D,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAoB,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAkB,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AACrD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAgB,CAAC;IAC5C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,8 @@
+export interface DoctorOptions {
+    binary?: string;
+    stream?: NodeJS.WritableStream;
+    /** When true, emit JSON instead of pretty output. */
+    json?: boolean;
+}
+export declare function runDoctor(opts?: DoctorOptions): Promise<number>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAQD,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoDzE"}

package/dist/commands/doctor.js

@@ -0,0 +1,69 @@
+import { buildManifest } from 'oauthlint-rules';
+import pc from 'picocolors';
+import { SemgrepAdapter } from '../adapters/semgrep.js';
+export async function runDoctor(opts = {}) {
+    const out = opts.stream ?? process.stdout;
+    const checks = [];
+    checks.push({
+        name: 'Node.js runtime',
+        status: nodeOk() ? 'ok' : 'warn',
+        details: `${process.version} (≥ v20 required)`,
+    });
+    const adapter = new SemgrepAdapter({ configPath: 'unused', binary: opts.binary });
+    const semgrepVersion = await adapter.getVersion();
+    if (semgrepVersion) {
+        checks.push({
+            name: 'Semgrep CLI',
+            status: 'ok',
+            details: semgrepVersion,
+        });
+    }
+    else {
+        checks.push({
+            name: 'Semgrep CLI',
+            status: 'fail',
+            details: 'not found on PATH — install with `pipx install semgrep` or `brew install semgrep`',
+        });
+    }
+    try {
+        const manifest = await buildManifest();
+        checks.push({
+            name: 'OAuthLint rule pack',
+            status: manifest.length >= 20 ? 'ok' : 'warn',
+            details: `${manifest.length} rules loaded`,
+        });
+    }
+    catch (err) {
+        checks.push({
+            name: 'OAuthLint rule pack',
+            status: 'fail',
+            details: `failed to load: ${err.message}`,
+        });
+    }
+    if (opts.json) {
+        out.write(`${JSON.stringify({ checks }, null, 2)}\n`);
+    }
+    else {
+        out.write(pc.bold('OAuthLint — environment check\n'));
+        out.write(`${pc.dim('─'.repeat(60))}\n`);
+        for (const c of checks) {
+            out.write(`${badge(c.status)} ${c.name.padEnd(20, ' ')} ${pc.dim(c.details)}\n`);
+        }
+    }
+    return checks.some((c) => c.status === 'fail') ? 1 : 0;
+}
+function nodeOk() {
+    const major = Number.parseInt(process.versions.node.split('.')[0] ?? '0', 10);
+    return major >= 20;
+}
+function badge(status) {
+    switch (status) {
+        case 'ok':
+            return pc.green(' ✓ ');
+        case 'warn':
+            return pc.yellow(' ! ');
+        case 'fail':
+            return pc.red(' ✗ ');
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAexD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAChC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,mBAAmB;KAC/C,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAClD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mFAAmF;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC7C,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,eAAe;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,MAAM;IACb,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,KAAK,CAAC,MAAuB;IACpC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,IAAI;YACP,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,9 @@
+export interface InitOptions {
+    cwd: string;
+    force?: boolean;
+    stream?: NodeJS.WritableStream;
+}
+export declare function runInit(opts: InitOptions): Promise<number>;
+export declare const __TEMPLATE = "# OAuthLint config\n# Documentation: https://oauthlint.dev/docs/config\nversion: 1\n\n# Files to scan\ninclude:\n  - \"src/**/*.{ts,tsx,js,jsx,mjs,cjs}\"\nexclude:\n  - \"**/*.test.{ts,tsx,js,jsx}\"\n  - \"**/*.spec.{ts,tsx,js,jsx}\"\n  - \"node_modules/**\"\n  - \"dist/**\"\n  - \"build/**\"\n\n# Per-rule overrides:\n#   off    \u2192 disable the rule\n#   warn   \u2192 emit but don't affect exit code\n#   <SEV>  \u2192 override severity (INFO | LOW | MEDIUM | HIGH | CRITICAL)\n# rules:\n#   auth.cookie.no-samesite: warn\n#   auth.session.id-in-url: off\n\n# Custom rules directory (in addition to the bundled rules)\n# customRulesDir: ./security/oauthlint-rules\n\n# Exit code policy: fail when any finding \u2265 this severity is present.\n# Use \"off\" to never fail the run.\nfailOn: HIGH\n";
+export declare const __join: (...paths: string[]) => string;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAWhE;AAGD,eAAO,MAAM,UAAU,syBAAW,CAAC;AAGnC,eAAO,MAAM,MAAM,gCAAO,CAAC"}

package/dist/commands/init.js

@@ -0,0 +1,51 @@
+import { existsSync } from 'node:fs';
+import { writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import pc from 'picocolors';
+const TEMPLATE = `# OAuthLint config
+# Documentation: https://oauthlint.dev/docs/config
+version: 1
+
+# Files to scan
+include:
+  - "src/**/*.{ts,tsx,js,jsx,mjs,cjs}"
+exclude:
+  - "**/*.test.{ts,tsx,js,jsx}"
+  - "**/*.spec.{ts,tsx,js,jsx}"
+  - "node_modules/**"
+  - "dist/**"
+  - "build/**"
+
+# Per-rule overrides:
+#   off    → disable the rule
+#   warn   → emit but don't affect exit code
+#   <SEV>  → override severity (INFO | LOW | MEDIUM | HIGH | CRITICAL)
+# rules:
+#   auth.cookie.no-samesite: warn
+#   auth.session.id-in-url: off
+
+# Custom rules directory (in addition to the bundled rules)
+# customRulesDir: ./security/oauthlint-rules
+
+# Exit code policy: fail when any finding ≥ this severity is present.
+# Use "off" to never fail the run.
+failOn: HIGH
+`;
+export async function runInit(opts) {
+    const out = opts.stream ?? process.stdout;
+    const target = resolve(opts.cwd, '.oauthlintrc.yml');
+    if (existsSync(target) && !opts.force) {
+        out.write(pc.yellow(`✗ ${target} already exists — pass --force to overwrite.\n`));
+        return 1;
+    }
+    await writeFile(target, TEMPLATE, 'utf8');
+    out.write(pc.green(`✓ Wrote ${target}\n`));
+    out.write(pc.dim(`Next: run ${pc.bold('npx oauthlint scan .')} to try it.\n`));
+    return 0;
+}
+// Exported for tests so we can assert on the template content directly.
+export const __TEMPLATE = TEMPLATE;
+// Keep `join` available for downstream tests that want to construct paths
+// without re-importing node:path.
+export const __join = join;
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BhB,CAAC;AAQF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,MAAM,gDAAgD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,0EAA0E;AAC1E,kCAAkC;AAClC,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC"}

package/dist/commands/list.d.ts

@@ -0,0 +1,6 @@
+export interface ListOptions {
+    json?: boolean;
+    stream?: NodeJS.WritableStream;
+}
+export declare function runList(opts?: ListOptions): Promise<number>;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAED,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBrE"}

package/dist/commands/list.js

@@ -0,0 +1,32 @@
+import { buildManifest } from 'oauthlint-rules';
+import pc from 'picocolors';
+export async function runList(opts = {}) {
+    const out = opts.stream ?? process.stdout;
+    const manifest = await buildManifest();
+    if (opts.json) {
+        out.write(`${JSON.stringify(manifest, null, 2)}\n`);
+        return 0;
+    }
+    out.write(pc.bold(`OAuthLint — ${manifest.length} rules\n`));
+    out.write(`${pc.dim('─'.repeat(70))}\n`);
+    for (const m of manifest) {
+        const sev = badge(m.severity);
+        const llm = m.llmPrevalence === 'HIGH' ? pc.magenta('LLM↑') : pc.dim('     ');
+        const id = pc.bold(m.id.padEnd(38, ' '));
+        out.write(`${sev} ${llm} ${id} ${pc.dim(m.oauthlintId)}\n`);
+        if (m.description)
+            out.write(pc.dim(`         ${m.description}\n`));
+    }
+    return 0;
+}
+function badge(sev) {
+    switch (sev) {
+        case 'ERROR':
+            return pc.red(' ERR ');
+        case 'WARNING':
+            return pc.yellow(' WRN ');
+        default:
+            return pc.gray(' INF ');
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,YAAY,CAAC;AAO5B,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAoB,EAAE;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IAEvC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B;YACE,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/commands/scan.d.ts

@@ -0,0 +1,24 @@
+import { SemgrepAdapter } from '../adapters/semgrep.js';
+import type { SeverityName } from '../types.js';
+export type ScanFormat = 'pretty' | 'json' | 'sarif';
+export interface ScanCommandOptions {
+    path: string;
+    /** Legacy boolean — equivalent to `format: 'json'`. */
+    json?: boolean;
+    /** Output format. Overrides `json` when set. */
+    format?: ScanFormat;
+    severity?: SeverityName;
+    failOn?: SeverityName | 'off';
+    rulesDir?: string;
+    /**
+     * Apply auto-fixes (rewrites source files in place) for rules that
+     * ship a `fix:` template. Currently the cookie-* rules.
+     */
+    fix?: boolean;
+    /** Used by tests to inject a mock adapter. */
+    adapter?: SemgrepAdapter;
+    /** Used by tests to capture output. */
+    stream?: NodeJS.WritableStream;
+}
+export declare function runScan(opts: ScanCommandOptions): Promise<number>;
+//# sourceMappingURL=scan.d.ts.map