oauthlint 0.1.0

package/dist/commands/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAA4B,MAAM,wBAAwB,CAAC;AAMlF,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,8CAA8C;IAC9C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DvE"}

package/dist/commands/scan.js

@@ -0,0 +1,73 @@
+import { resolve } from 'node:path';
+import { RULES_ROOT } from 'oauthlint-rules';
+import { SemgrepAdapter, SemgrepNotInstalledError } from '../adapters/semgrep.js';
+import { loadConfig } from '../core/config.js';
+import { Reporter } from '../core/reporter.js';
+import { toSarif } from '../core/sarif.js';
+import { exitCodeFor, highestSeverity, meetsThreshold } from '../core/severity.js';
+import { applySuppressions } from '../core/suppress.js';
+export async function runScan(opts) {
+    const target = resolve(opts.path);
+    const config = await loadConfig(target);
+    const rulesDir = opts.rulesDir ?? config.customRulesDir ?? RULES_ROOT;
+    const failOn = opts.failOn ?? config.failOn ?? 'HIGH';
+    const format = opts.format ?? (opts.json ? 'json' : 'pretty');
+    const stream = opts.stream ?? process.stdout;
+    const reporter = new Reporter({ json: format === 'json', stream });
+    if (format === 'pretty')
+        reporter.reportStart(target, await countRuleFiles(rulesDir));
+    const adapter = opts.adapter ?? new SemgrepAdapter({ configPath: rulesDir });
+    let result;
+    try {
+        result = await adapter.scan(target, { applyFixes: opts.fix });
+    }
+    catch (err) {
+        if (err instanceof SemgrepNotInstalledError) {
+            (opts.stream ?? process.stderr).write(`${err.message}\n`);
+            return 127;
+        }
+        throw err;
+    }
+    // Apply inline suppression directives first (they're source-truth)
+    // and then the severity filter on whatever survives.
+    let findings = result.findings;
+    const { kept, suppressed } = await applySuppressions(findings);
+    findings = kept;
+    const minSeverity = opts.severity;
+    if (minSeverity) {
+        findings = findings.filter((f) => meetsThreshold(f.severity, minSeverity));
+    }
+    if (format === 'sarif') {
+        const sarif = await toSarif({ ...result, findings });
+        stream.write(`${JSON.stringify(sarif, null, 2)}\n`);
+    }
+    else {
+        reporter.reportResult({ ...result, findings });
+        if (opts.fix && format === 'pretty') {
+            const fixed = findings.filter((f) => f.ruleId.startsWith('auth.cookie.')).length;
+            stream.write(`\n🛠 Auto-fix applied where possible — re-run \`oauthlint scan\` to confirm.${fixed > 0 ? ` (${fixed} cookie-* finding${fixed === 1 ? '' : 's'} eligible.)` : ''}\n`);
+        }
+        if (suppressed.length > 0 && format === 'pretty') {
+            stream.write(`\nℹ ${suppressed.length} finding${suppressed.length === 1 ? '' : 's'} suppressed via inline directives.\n`);
+        }
+    }
+    if (failOn === 'off')
+        return 0;
+    const worst = highestSeverity(findings);
+    if (worst === null)
+        return 0;
+    if (!meetsThreshold(worst, failOn))
+        return 0;
+    return exitCodeFor(worst);
+}
+async function countRuleFiles(dir) {
+    try {
+        const { loadAllRules } = await import('oauthlint-rules');
+        const rules = await loadAllRules(dir);
+        return rules.length;
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAyBxD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IACtD,MAAM,MAAM,GAAe,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,IAAI,QAAQ,GAAc,MAAM,CAAC,QAAQ,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;YACjF,MAAM,CAAC,KAAK,CACV,+EAA+E,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACtK,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,CAAC,KAAK,CACV,OAAO,UAAU,CAAC,MAAM,WACtB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,sCAAsC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/core/config.d.ts

@@ -0,0 +1,4 @@
+import { type OAuthLintConfig } from '../types.js';
+export declare const DEFAULT_CONFIG: OAuthLintConfig;
+export declare function loadConfig(cwd: string): Promise<OAuthLintConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,eAAe,EAAc,MAAM,aAAa,CAAC;AAa/D,eAAO,MAAM,cAAc,EAAE,eAE5B,CAAC;AAEF,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwBtE"}

package/dist/core/config.js

@@ -0,0 +1,40 @@
+import { cosmiconfig } from 'cosmiconfig';
+import { z } from 'zod';
+import { SEVERITIES } from '../types.js';
+const SeverityValue = z.enum(SEVERITIES);
+const ConfigSchema = z.object({
+    version: z.number().default(1),
+    include: z.array(z.string()).optional(),
+    exclude: z.array(z.string()).optional(),
+    rules: z.record(z.union([z.literal('off'), z.literal('warn'), SeverityValue])).optional(),
+    customRulesDir: z.string().optional(),
+    failOn: z.union([SeverityValue, z.literal('off')]).default('HIGH'),
+});
+export const DEFAULT_CONFIG = {
+    failOn: 'HIGH',
+};
+export async function loadConfig(cwd) {
+    const explorer = cosmiconfig('oauthlint', {
+        searchPlaces: [
+            '.oauthlintrc',
+            '.oauthlintrc.json',
+            '.oauthlintrc.yml',
+            '.oauthlintrc.yaml',
+            'oauthlint.config.js',
+            'oauthlint.config.mjs',
+            'oauthlint.config.cjs',
+            'package.json',
+        ],
+    });
+    const result = await explorer.search(cwd);
+    if (!result || result.isEmpty)
+        return DEFAULT_CONFIG;
+    const parsed = ConfigSchema.safeParse(result.config);
+    if (!parsed.success) {
+        throw new Error(`Invalid oauthlint config in ${result.filepath}:\n${parsed.error.issues
+            .map((i) => `  - ${i.path.join('.')}: ${i.message}`)
+            .join('\n')}`);
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAEzC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE;QACxC,YAAY,EAAE;YACZ,cAAc;YACd,mBAAmB;YACnB,kBAAkB;YAClB,mBAAmB;YACnB,qBAAqB;YACrB,sBAAsB;YACtB,sBAAsB;YACtB,cAAc;SACf;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,cAAc,CAAC;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM;aACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/core/reporter.d.ts

@@ -0,0 +1,17 @@
+import type { ScanResult } from '../types.js';
+export interface ReporterOptions {
+    /** When true, emit machine-readable JSON instead of pretty output. */
+    json?: boolean;
+    /** Stream to write to (defaults to process.stdout). */
+    stream?: NodeJS.WritableStream;
+}
+export declare class Reporter {
+    private readonly json;
+    private readonly stream;
+    constructor(opts?: ReporterOptions);
+    reportStart(target: string, ruleCount: number): void;
+    reportResult(result: ScanResult): void;
+    private printFinding;
+    private line;
+}
+//# sourceMappingURL=reporter.d.ts.map

package/dist/core/reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../src/core/reporter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,UAAU,EAAgB,MAAM,aAAa,CAAC;AAUrE,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,IAAI,GAAE,eAAoB;IAKtC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAOpD,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAiFtC,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,IAAI;CAGb"}

package/dist/core/reporter.js

@@ -0,0 +1,111 @@
+import pc from 'picocolors';
+const SEVERITY_COLOR = {
+    CRITICAL: (s) => pc.bgRed(pc.white(s)),
+    HIGH: pc.red,
+    MEDIUM: pc.yellow,
+    LOW: pc.cyan,
+    INFO: pc.gray,
+};
+export class Reporter {
+    json;
+    stream;
+    constructor(opts = {}) {
+        this.json = opts.json ?? false;
+        this.stream = opts.stream ?? process.stdout;
+    }
+    reportStart(target, ruleCount) {
+        if (this.json)
+            return;
+        this.line(pc.dim(`OAuthLint — scanning ${pc.bold(target)}`));
+        this.line(pc.dim(`Loaded ${ruleCount} rules`));
+        this.line('');
+    }
+    reportResult(result) {
+        if (this.json) {
+            const payload = {
+                schemaVersion: 'oauthlint-v1',
+                scannedFiles: result.scannedFiles,
+                durationMs: result.durationMs,
+                semgrepVersion: result.semgrepVersion,
+                errors: result.errors,
+                findings: result.findings.map((f) => ({
+                    ruleId: f.ruleId,
+                    oauthlintRuleId: f.oauthlintRuleId,
+                    severity: f.severity,
+                    filePath: f.filePath,
+                    startLine: f.startLine,
+                    endLine: f.endLine,
+                    message: f.message,
+                    docUrl: f.docUrl,
+                    cwe: f.cwe,
+                    llmPrevalence: f.llmPrevalence,
+                })),
+            };
+            this.line(JSON.stringify(payload, null, 2));
+            return;
+        }
+        const sep = pc.dim('━'.repeat(60));
+        if (result.findings.length === 0) {
+            this.line(pc.green('✓ No auth issues found.'));
+            this.line(pc.dim(`Scanned ${result.scannedFiles} file${result.scannedFiles === 1 ? '' : 's'} in ${result.durationMs}ms.`));
+            return;
+        }
+        const counts = countBySeverity(result.findings);
+        const summary = [
+            counts.CRITICAL ? pc.red(`${counts.CRITICAL} critical`) : null,
+            counts.HIGH ? pc.red(`${counts.HIGH} high`) : null,
+            counts.MEDIUM ? pc.yellow(`${counts.MEDIUM} medium`) : null,
+            counts.LOW ? pc.cyan(`${counts.LOW} low`) : null,
+            counts.INFO ? pc.gray(`${counts.INFO} info`) : null,
+        ]
+            .filter((x) => x !== null)
+            .join(pc.dim(' · '));
+        this.line(sep);
+        this.line(pc.bold(`Found ${result.findings.length} issue${result.findings.length === 1 ? '' : 's'}: `) +
+            summary);
+        this.line('');
+        const sorted = [...result.findings].sort((a, b) => {
+            const order = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+            return order.indexOf(a.severity) - order.indexOf(b.severity);
+        });
+        for (const f of sorted) {
+            this.printFinding(f);
+        }
+        this.line(sep);
+        this.line(pc.dim(`Scanned ${result.scannedFiles} files in ${result.durationMs}ms${result.semgrepVersion ? ` · semgrep ${result.semgrepVersion}` : ''}`));
+        if (result.errors.length > 0) {
+            this.line(pc.yellow(`⚠ ${result.errors.length} semgrep error${result.errors.length === 1 ? '' : 's'}:`));
+            for (const e of result.errors) {
+                this.line(pc.dim(`  · ${e}`));
+            }
+        }
+    }
+    printFinding(f) {
+        const tag = SEVERITY_COLOR[f.severity](` ${f.severity} `);
+        const id = pc.bold(f.ruleId);
+        this.line(`${tag} ${id}${f.oauthlintRuleId ? pc.dim(` (${f.oauthlintRuleId})`) : ''}`);
+        this.line(pc.dim(`  ${f.filePath}:${f.startLine}`));
+        const firstLine = f.message.split('\n')[0]?.trim() ?? '';
+        if (firstLine)
+            this.line(pc.dim('  → ') + firstLine);
+        if (f.docUrl)
+            this.line(pc.dim(`  📖 ${f.docUrl}`));
+        this.line('');
+    }
+    line(s = '') {
+        this.stream.write(`${s}\n`);
+    }
+}
+function countBySeverity(findings) {
+    const counts = {
+        CRITICAL: 0,
+        HIGH: 0,
+        MEDIUM: 0,
+        LOW: 0,
+        INFO: 0,
+    };
+    for (const f of findings)
+        counts[f.severity]++;
+    return counts;
+}
+//# sourceMappingURL=reporter.js.map

package/dist/core/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../src/core/reporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,MAAM,cAAc,GAAgD;IAClE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,EAAE,EAAE,CAAC,GAAG;IACZ,MAAM,EAAE,EAAE,CAAC,MAAM;IACjB,GAAG,EAAE,EAAE,CAAC,IAAI;IACZ,IAAI,EAAE,EAAE,CAAC,IAAI;CACd,CAAC;AASF,MAAM,OAAO,QAAQ;IACF,IAAI,CAAU;IACd,MAAM,CAAwB;IAE/C,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,SAAiB;QAC3C,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,SAAS,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,YAAY,CAAC,MAAkB;QAC7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,OAAO,GAAG;gBACd,aAAa,EAAE,cAAc;gBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,eAAe,EAAE,CAAC,CAAC,eAAe;oBAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,aAAa,EAAE,CAAC,CAAC,aAAa;iBAC/B,CAAC,CAAC;aACJ,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,GAAG,CACJ,WAAW,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,CACxG,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG;YACd,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAChD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;SACpD;aACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;aACtC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC1F,OAAO,CACV,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEd,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChD,MAAM,KAAK,GAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,GAAG,CACJ,WAAW,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtI,CACF,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,MAAM,CACP,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACnF,CACF,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,CAAU;QAC7B,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAEO,IAAI,CAAC,CAAC,GAAG,EAAE;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,eAAe,CAAC,QAAmB;IAC1C,MAAM,MAAM,GAAiC;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/sarif.d.ts

@@ -0,0 +1,69 @@
+import type { ScanResult } from '../types.js';
+/**
+ * Convert OAuthLint scan results into SARIF v2.1.0.
+ *
+ * Spec: https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html
+ *
+ * GitHub Code Scanning consumes SARIF directly via the
+ * `github/codeql-action/upload-sarif` action, which is the integration
+ * path most enterprise teams want.
+ */
+interface SarifReport {
+    $schema: string;
+    version: string;
+    runs: SarifRun[];
+}
+interface SarifRun {
+    tool: {
+        driver: SarifDriver;
+    };
+    results: SarifResult[];
+}
+interface SarifDriver {
+    name: string;
+    version: string;
+    informationUri: string;
+    rules: SarifRule[];
+}
+interface SarifRule {
+    id: string;
+    name: string;
+    shortDescription: {
+        text: string;
+    };
+    fullDescription: {
+        text: string;
+    };
+    helpUri?: string;
+    defaultConfiguration: {
+        level: 'note' | 'warning' | 'error';
+    };
+    properties: {
+        tags: string[];
+        precision?: string;
+        security_severity?: string;
+    };
+}
+interface SarifResult {
+    ruleId: string;
+    level: 'note' | 'warning' | 'error';
+    message: {
+        text: string;
+    };
+    locations: SarifLocation[];
+    properties?: Record<string, unknown>;
+}
+interface SarifLocation {
+    physicalLocation: {
+        artifactLocation: {
+            uri: string;
+        };
+        region: {
+            startLine: number;
+            endLine: number;
+        };
+    };
+}
+export declare function toSarif(result: ScanResult): Promise<SarifReport>;
+export {};
+//# sourceMappingURL=sarif.d.ts.map

package/dist/core/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/core/sarif.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,UAAU,EAAgB,MAAM,aAAa,CAAC;AAErE;;;;;;;;GAQG;AAEH,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAC9B,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACpC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,UAAU,aAAa;IACrB,gBAAgB,EAAE;QAChB,gBAAgB,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAClC,MAAM,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,CAAC;CACH;AAoCD,wBAAsB,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBtE"}

package/dist/core/sarif.js

@@ -0,0 +1,115 @@
+import { readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const SARIF_LEVEL = {
+    INFO: 'note',
+    LOW: 'note',
+    MEDIUM: 'warning',
+    HIGH: 'error',
+    CRITICAL: 'error',
+};
+// GitHub uses a 0.0–10.0 numeric "security severity" to colour the
+// inline annotations in the Security tab.
+const SECURITY_SEVERITY = {
+    INFO: '1.0',
+    LOW: '3.0',
+    MEDIUM: '5.5',
+    HIGH: '7.5',
+    CRITICAL: '9.5',
+};
+async function readToolVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    for (const candidate of [
+        resolve(here, '..', '..', 'package.json'),
+        resolve(here, '..', '..', '..', 'package.json'),
+    ]) {
+        try {
+            const pkg = JSON.parse(await readFile(candidate, 'utf8'));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return '0.0.0';
+}
+export async function toSarif(result) {
+    const version = await readToolVersion();
+    const ruleIndex = new Map();
+    for (const f of result.findings) {
+        if (ruleIndex.has(f.ruleId))
+            continue;
+        ruleIndex.set(f.ruleId, buildRule(f));
+    }
+    return {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'OAuthLint',
+                        version,
+                        informationUri: 'https://oauthlint.dev',
+                        rules: [...ruleIndex.values()],
+                    },
+                },
+                results: result.findings.map((f) => buildResult(f)),
+            },
+        ],
+    };
+}
+function buildRule(f) {
+    const tags = ['security', 'oauthlint'];
+    if (f.cwe)
+        tags.push(`external/cwe/${f.cwe.toLowerCase()}`);
+    if (f.llmPrevalence)
+        tags.push(`llm-prevalence/${f.llmPrevalence.toLowerCase()}`);
+    return {
+        id: f.ruleId,
+        name: f.ruleId,
+        shortDescription: { text: f.message.split('\n')[0]?.trim() ?? f.ruleId },
+        fullDescription: { text: f.message.trim() },
+        helpUri: f.docUrl,
+        defaultConfiguration: { level: SARIF_LEVEL[f.severity] },
+        properties: {
+            tags,
+            precision: 'medium',
+            security_severity: SECURITY_SEVERITY[f.severity],
+        },
+    };
+}
+function buildResult(f) {
+    return {
+        ruleId: f.ruleId,
+        level: SARIF_LEVEL[f.severity],
+        message: { text: f.message.split('\n')[0]?.trim() ?? f.ruleId },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: relativise(f.filePath) },
+                    region: { startLine: f.startLine, endLine: f.endLine },
+                },
+            },
+        ],
+        properties: {
+            oauthlintRuleId: f.oauthlintRuleId,
+            severity: f.severity,
+            llmPrevalence: f.llmPrevalence,
+        },
+    };
+}
+function relativise(filePath) {
+    // GitHub Code Scanning wants paths relative to the repo root. Strip
+    // the cwd if present; otherwise leave the path alone (caller responsibility).
+    const cwd = process.cwd();
+    if (filePath.startsWith(`${cwd}/`)) {
+        return filePath.slice(cwd.length + 1);
+    }
+    if (filePath.startsWith(cwd)) {
+        return filePath.slice(cwd.length).replace(/^\/+/, '');
+    }
+    return filePath;
+}
+//# sourceMappingURL=sarif.js.map

package/dist/core/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/core/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAwDzC,MAAM,WAAW,GAAuD;IACtE,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,OAAO;CAClB,CAAC;AAEF,mEAAmE;AACnE,0CAA0C;AAC1C,MAAM,iBAAiB,GAAiC;IACtD,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF,KAAK,UAAU,eAAe;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACzC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAChD,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAyB,CAAC;YAClF,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAkB;IAC9C,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,WAAW;wBACjB,OAAO;wBACP,cAAc,EAAE,uBAAuB;wBACvC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;qBAC/B;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAElF,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,MAAM;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM;QACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE;QACxE,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;QAC3C,OAAO,EAAE,CAAC,CAAC,MAAM;QACjB,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACxD,UAAU,EAAE;YACV,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE;QAC/D,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;oBACjD,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QACD,UAAU,EAAE;YACV,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,oEAAoE;IACpE,8EAA8E;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/severity.d.ts

@@ -0,0 +1,23 @@
+import { type SeverityName } from '../types.js';
+/**
+ * Lower index = less severe. Used for "fail if any finding ≥ threshold".
+ */
+export declare function severityRank(s: SeverityName): number;
+/**
+ * Return true if `actual` meets or exceeds the `threshold` severity.
+ */
+export declare function meetsThreshold(actual: SeverityName, threshold: SeverityName): boolean;
+/**
+ * Map our 5-level scale to a process exit code:
+ *  - 0  → no finding worth blocking on
+ *  - 1  → at least one HIGH
+ *  - 2  → at least one CRITICAL
+ */
+export declare function exitCodeFor(highest: SeverityName | null): number;
+/**
+ * Find the highest severity in a list of findings.
+ */
+export declare function highestSeverity(findings: {
+    severity: SeverityName;
+}[]): SeverityName | null;
+//# sourceMappingURL=severity.d.ts.map

package/dist/core/severity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.d.ts","sourceRoot":"","sources":["../../src/core/severity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5D;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAGpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,CAKhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,QAAQ,EAAE,YAAY,CAAA;CAAE,EAAE,GAAG,YAAY,GAAG,IAAI,CAQ3F"}

package/dist/core/severity.js

@@ -0,0 +1,42 @@
+import { SEVERITIES } from '../types.js';
+/**
+ * Lower index = less severe. Used for "fail if any finding ≥ threshold".
+ */
+export function severityRank(s) {
+    const idx = SEVERITIES.indexOf(s);
+    return idx === -1 ? 0 : idx;
+}
+/**
+ * Return true if `actual` meets or exceeds the `threshold` severity.
+ */
+export function meetsThreshold(actual, threshold) {
+    return severityRank(actual) >= severityRank(threshold);
+}
+/**
+ * Map our 5-level scale to a process exit code:
+ *  - 0  → no finding worth blocking on
+ *  - 1  → at least one HIGH
+ *  - 2  → at least one CRITICAL
+ */
+export function exitCodeFor(highest) {
+    if (highest === null)
+        return 0;
+    if (severityRank(highest) >= severityRank('CRITICAL'))
+        return 2;
+    if (severityRank(highest) >= severityRank('HIGH'))
+        return 1;
+    return 0;
+}
+/**
+ * Find the highest severity in a list of findings.
+ */
+export function highestSeverity(findings) {
+    let highest = null;
+    for (const f of findings) {
+        if (!highest || severityRank(f.severity) > severityRank(highest)) {
+            highest = f.severity;
+        }
+    }
+    return highest;
+}
+//# sourceMappingURL=severity.js.map

package/dist/core/severity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.js","sourceRoot":"","sources":["../../src/core/severity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,SAAuB;IAC1E,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAsC;IACpE,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/suppress.d.ts

@@ -0,0 +1,40 @@
+import type { Finding } from '../types.js';
+/**
+ * Inline suppression directives recognised by OAuthLint.
+ *
+ * `oauthlint-disable-next-line <rule-id> [-- <reason>]`
+ *   Suppress findings on the immediately following line. The rule id is
+ *   required (we don't support blanket "disable everything" because it
+ *   silently hides future findings — bad smell). The reason is optional
+ *   but encouraged.
+ *
+ * `oauthlint-disable-line <rule-id> [-- <reason>]`
+ *   Same, but applies to the current line (the line the comment is on).
+ *
+ * `oauthlint-disable-file <rule-id> [-- <reason>]`
+ *   Disable the rule for the entire file. Goes anywhere in the file.
+ *
+ * Glob `*` is accepted as a rule id placeholder for the wildcard case,
+ * but ONLY for `oauthlint-disable-next-line` / `disable-line` (not
+ * disable-file) so that wholesale silencing requires an explicit
+ * line-by-line decision.
+ */
+interface SuppressionMaps {
+    /** rule id (or '*') → set of zero-based line numbers to suppress */
+    byLine: Map<string, Set<number>>;
+    /** rule ids (or '*') suppressed for the whole file */
+    fileWide: Set<string>;
+}
+export declare function loadSuppressionMap(filePath: string): Promise<SuppressionMaps>;
+export declare function parseSuppressionsFromSource(source: string): SuppressionMaps;
+export declare function isSuppressed(finding: Finding, maps: SuppressionMaps): boolean;
+/**
+ * Apply suppression to a list of findings. Caches the parsed directive
+ * map per-file so we only read each file once.
+ */
+export declare function applySuppressions(findings: Finding[]): Promise<{
+    kept: Finding[];
+    suppressed: Finding[];
+}>;
+export {};
+//# sourceMappingURL=suppress.d.ts.map

package/dist/core/suppress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppress.d.ts","sourceRoot":"","sources":["../../src/core/suppress.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,UAAU,eAAe;IACvB,oEAAoE;IACpE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,sDAAsD;IACtD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvB;AAID,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAQnF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAgC3E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAY7E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,EAAE,CAAC;CACvB,CAAC,CAkBD"}