oauthlint 0.2.4 → 0.4.0

package/dist/commands/scan.js

@@ -1,25 +1,98 @@
 import { resolve } from 'node:path';
 import { RULES_ROOT } from 'oauthlint-rules';
 import { SemgrepAdapter, SemgrepNotInstalledError, SemgrepOutputError, } from '../adapters/semgrep.js';
+import { BaselineNotFoundError, BaselineParseError, DEFAULT_BASELINE_FILE, loadBaseline, partitionByBaseline, } from '../core/baseline.js';
+import { GitError, resolveDiffFiles, resolveStagedFiles } from '../core/changed-files.js';
 import { loadConfig } from '../core/config.js';
 import { Reporter } from '../core/reporter.js';
 import { toSarif } from '../core/sarif.js';
 import { exitCodeFor, highestSeverity, meetsThreshold } from '../core/severity.js';
 import { applySuppressions } from '../core/suppress.js';
 export async function runScan(opts) {
-    const target = resolve(opts.path);
-    const config = await loadConfig(target);
+    const cwd = opts.cwd ?? process.cwd();
+    const config = await loadConfig(cwd);
     const rulesDir = opts.rulesDir ?? config.customRulesDir ?? RULES_ROOT;
     const failOn = opts.failOn ?? config.failOn ?? 'HIGH';
     const format = opts.format ?? (opts.json ? 'json' : 'pretty');
     const stream = opts.stream ?? process.stdout;
+    const errStream = opts.stream ?? process.stderr;
+    // Load the baseline up front so a missing/malformed file fails fast — before
+    // we pay for a full scan — with a clear error rather than a silent no-op.
+    let baseline = null;
+    if (opts.baseline !== undefined && opts.baseline !== false) {
+        const baselinePath = resolve(cwd, typeof opts.baseline === 'string' ? opts.baseline : DEFAULT_BASELINE_FILE);
+        try {
+            baseline = await loadBaseline(baselinePath);
+        }
+        catch (err) {
+            if (err instanceof BaselineNotFoundError || err instanceof BaselineParseError) {
+                errStream.write(`${err.message}\n`);
+                return 2;
+            }
+            throw err;
+        }
+    }
+    // Resolve the set of targets to hand Semgrep. Incremental flags (--diff /
+    // --staged) win and narrow the scan to changed files only; otherwise we scan
+    // the explicit path args (default ['.']).
+    let targets;
+    let incremental = false;
+    try {
+        if (opts.diff !== undefined && opts.diff !== false) {
+            incremental = true;
+            const ref = typeof opts.diff === 'string' ? opts.diff : undefined;
+            targets = await resolveDiffFiles(cwd, ref);
+        }
+        else if (opts.staged) {
+            incremental = true;
+            targets = await resolveStagedFiles(cwd);
+        }
+        else {
+            const requested = opts.paths?.length
+                ? opts.paths
+                : opts.path !== undefined
+                    ? [opts.path]
+                    : ['.'];
+            targets = requested.map((p) => resolve(cwd, p));
+        }
+    }
+    catch (err) {
+        if (err instanceof GitError) {
+            errStream.write(`${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
+    // Incremental change set is empty (nothing in a supported language changed).
+    // That's a success, not an error — pre-commit hooks and editors call this
+    // constantly and should exit 0 with a clear note rather than failing.
+    if (incremental && targets.length === 0) {
+        if (format === 'json') {
+            stream.write(`${JSON.stringify({ schemaVersion: 'oauthlint-v1', findings: [] })}\n`);
+        }
+        else if (format === 'sarif') {
+            const empty = await toSarif({
+                findings: [],
+                scannedFiles: 0,
+                durationMs: 0,
+                semgrepVersion: null,
+                errors: [],
+            });
+            stream.write(`${JSON.stringify(empty, null, 2)}\n`);
+        }
+        else {
+            stream.write('No changed files to scan.\n');
+        }
+        return 0;
+    }
+    const label = incremental ? `${targets.length} changed file(s)` : targets.join(', ');
     const reporter = new Reporter({ json: format === 'json', stream });
     if (format === 'pretty')
-        reporter.reportStart(target, await countRuleFiles(rulesDir));
+        reporter.reportStart(label, await countRuleFiles(rulesDir));
     const adapter = opts.adapter ?? new SemgrepAdapter({ configPath: rulesDir });
     let result;
     try {
-        result = await adapter.scan(target, { applyFixes: opts.fix });
+        result = await adapter.scan(targets, { applyFixes: opts.fix });
     }
     catch (err) {
         if (err instanceof SemgrepNotInstalledError) {
@@ -43,6 +116,14 @@ export async function runScan(opts) {
     if (minSeverity) {
         findings = findings.filter((f) => meetsThreshold(f.severity, minSeverity));
     }
+    // Baseline suppression: drop findings whose fingerprint is already recorded,
+    // so only genuinely NEW findings are reported and gate the exit code.
+    let baselinedCount = 0;
+    if (baseline) {
+        const { newFindings, baselined } = await partitionByBaseline(findings, baseline, cwd);
+        findings = newFindings;
+        baselinedCount = baselined.length;
+    }
     if (format === 'sarif') {
         const sarif = await toSarif({ ...result, findings });
         stream.write(`${JSON.stringify(sarif, null, 2)}\n`);
@@ -56,6 +137,9 @@ export async function runScan(opts) {
         if (suppressed.length > 0 && format === 'pretty') {
             stream.write(`\nℹ ${suppressed.length} finding${suppressed.length === 1 ? '' : 's'} suppressed via inline directives.\n`);
         }
+        if (baselinedCount > 0 && format === 'pretty') {
+            stream.write(`\nℹ ${baselinedCount} finding${baselinedCount === 1 ? '' : 's'} already in the baseline (reporting NEW findings only).\n`);
+        }
     }
     if (failOn === 'off')
         return 0;

package/dist/commands/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAyBxD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IACtD,MAAM,MAAM,GAAe,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,mEAAmE;YACnE,mDAAmD;YACnD,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,IAAI,QAAQ,GAAc,MAAM,CAAC,QAAQ,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;YACjF,MAAM,CAAC,KAAK,CACV,+EAA+E,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACtK,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,CAAC,KAAK,CACV,OAAO,UAAU,CAAC,MAAM,WACtB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,sCAAsC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAiDxD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAwB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IACtD,MAAM,MAAM,GAAe,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAEhD,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,QAAQ,GAAoD,IAAI,CAAC;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EACH,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAC1E,CAAC;QACF,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBAC9E,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBACpC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,0CAA0C;IAC1C,IAAI,OAAiB,CAAC;IACtB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM;gBAClC,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;oBACvB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBACb,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACZ,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC1B,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,IAAI;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,mEAAmE;YACnE,mDAAmD;YACnD,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,IAAI,QAAQ,GAAc,MAAM,CAAC,QAAQ,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtF,QAAQ,GAAG,WAAW,CAAC;QACvB,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;YACjF,MAAM,CAAC,KAAK,CACV,+EAA+E,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACtK,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,CAAC,KAAK,CACV,OAAO,UAAU,CAAC,MAAM,WACtB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,GAAG,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CACV,OAAO,cAAc,WACnB,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC9B,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/core/baseline.d.ts

@@ -0,0 +1,102 @@
+import type { Finding } from '../types.js';
+/**
+ * Baseline support: capture the CURRENT set of findings so a team can adopt
+ * OAuthLint on a large existing codebase and only be alerted on NEW issues.
+ *
+ * The hard requirement is a fingerprint that is stable across edits that move
+ * a finding around without changing it: inserting an import, reformatting a
+ * block, or shifting code down N lines must NOT resurface a baselined finding,
+ * while genuinely changing the flagged code MUST surface it as new.
+ *
+ * Fingerprint = sha256 of three parts joined by NULs:
+ *   1. the rule identity — `oauthlintRuleId` when present, else `ruleId`
+ *   2. the repo/cwd-relative file path (POSIX separators, so it's portable)
+ *   3. a NORMALISED snapshot of the matched source (the `startLine..endLine`
+ *      span, whitespace-collapsed) — explicitly NOT the raw line numbers
+ *
+ * When the file can't be read (deleted, binary, permission error) we fall back
+ * to the trimmed `message` as the snapshot so a fingerprint can still be
+ * produced — degraded but deterministic, never a crash.
+ *
+ * Identical fingerprints within one file (e.g. the same anti-pattern repeated)
+ * are disambiguated by a stable per-file occurrence index, assigned in source
+ * order, so each physical finding maps to a distinct baseline entry.
+ */
+export declare const BASELINE_VERSION: 1;
+export declare const DEFAULT_BASELINE_FILE = ".oauthlint-baseline.json";
+/** A single baselined finding, keyed by its stable fingerprint. */
+export interface BaselineEntry {
+    /** Stable fingerprint (see module docs). Survives line shifts. */
+    fingerprint: string;
+    /** Rule identity used in the hash — for human-diffability of the file. */
+    ruleId: string;
+    /** Repo/cwd-relative path used in the hash — for human-diffability. */
+    filePath: string;
+}
+export interface BaselineFile {
+    version: typeof BASELINE_VERSION;
+    generatedAt: string;
+    /** Sorted, deterministic list of baselined fingerprints. */
+    findings: BaselineEntry[];
+}
+/** In-memory baseline: just the set of fingerprints we suppress against. */
+export interface Baseline {
+    fingerprints: Set<string>;
+}
+export declare class BaselineNotFoundError extends Error {
+    constructor(path: string);
+}
+export declare class BaselineParseError extends Error {
+    constructor(path: string, detail: string);
+}
+/**
+ * Turn a finding's `filePath` into a portable, repo/cwd-relative path with
+ * POSIX separators. Absolute paths are made relative to `cwd`; paths that are
+ * already relative are normalised as-is. We never let an absolute path leak
+ * into a fingerprint, so a baseline is portable across machines/checkouts.
+ */
+export declare function toRelativePath(filePath: string, cwd: string): string;
+/**
+ * Compute the stable fingerprint for a finding (without the occurrence index).
+ * Two findings of the same rule on the same (relative) file with the same
+ * normalised snippet share this value — they're disambiguated by the index
+ * added in {@link fingerprintFindings}.
+ */
+export declare function baseFingerprint(finding: Finding, cwd: string, cache: Map<string, string[] | null>): Promise<string>;
+/** A finding paired with its final, occurrence-disambiguated fingerprint. */
+export interface FingerprintedFinding {
+    finding: Finding;
+    fingerprint: string;
+}
+/**
+ * Fingerprint a list of findings deterministically. Findings are processed in
+ * a stable order, and identical base fingerprints within the run get an
+ * occurrence index (`<base>:<n>`) so repeated anti-patterns each get a unique
+ * key. The same input list always yields the same fingerprints.
+ */
+export declare function fingerprintFindings(findings: Finding[], cwd: string): Promise<FingerprintedFinding[]>;
+/**
+ * Build a serialisable baseline file from a set of findings. The entry list is
+ * sorted so the JSON is stable and human-diffable across runs.
+ */
+export declare function buildBaseline(findings: Finding[], cwd: string): Promise<BaselineFile>;
+/** Serialise a baseline file to pretty JSON (trailing newline for clean diffs). */
+export declare function serialiseBaseline(baseline: BaselineFile): string;
+/**
+ * Load a baseline from disk into an in-memory fingerprint set.
+ *
+ * @throws BaselineNotFoundError when the file is absent — deliberately NOT
+ *   treated as an empty allow-list, so a misspelt `--baseline path` fails loud
+ *   instead of silently suppressing nothing (or everything).
+ * @throws BaselineParseError when the file is present but malformed.
+ */
+export declare function loadBaseline(path: string): Promise<Baseline>;
+/**
+ * Split findings into those already present in the baseline (suppressed) and
+ * genuinely new ones, by fingerprinting and matching against the baseline set.
+ */
+export declare function partitionByBaseline(findings: Finding[], baseline: Baseline, cwd: string): Promise<{
+    newFindings: Finding[];
+    baselined: Finding[];
+}>;
+//# sourceMappingURL=baseline.d.ts.map

package/dist/core/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../src/core/baseline.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,gBAAgB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,IAAI,EAAE,MAAM;CAMzB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAIzC;AAYD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGpE;AAuDD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAClC,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAuBjC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkB3F;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8BlE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAS3D"}

package/dist/core/baseline.js

@@ -0,0 +1,223 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+/**
+ * Baseline support: capture the CURRENT set of findings so a team can adopt
+ * OAuthLint on a large existing codebase and only be alerted on NEW issues.
+ *
+ * The hard requirement is a fingerprint that is stable across edits that move
+ * a finding around without changing it: inserting an import, reformatting a
+ * block, or shifting code down N lines must NOT resurface a baselined finding,
+ * while genuinely changing the flagged code MUST surface it as new.
+ *
+ * Fingerprint = sha256 of three parts joined by NULs:
+ *   1. the rule identity — `oauthlintRuleId` when present, else `ruleId`
+ *   2. the repo/cwd-relative file path (POSIX separators, so it's portable)
+ *   3. a NORMALISED snapshot of the matched source (the `startLine..endLine`
+ *      span, whitespace-collapsed) — explicitly NOT the raw line numbers
+ *
+ * When the file can't be read (deleted, binary, permission error) we fall back
+ * to the trimmed `message` as the snapshot so a fingerprint can still be
+ * produced — degraded but deterministic, never a crash.
+ *
+ * Identical fingerprints within one file (e.g. the same anti-pattern repeated)
+ * are disambiguated by a stable per-file occurrence index, assigned in source
+ * order, so each physical finding maps to a distinct baseline entry.
+ */
+export const BASELINE_VERSION = 1;
+export const DEFAULT_BASELINE_FILE = '.oauthlint-baseline.json';
+export class BaselineNotFoundError extends Error {
+    constructor(path) {
+        super(`Baseline file not found: ${path}\nCreate one first with: oauthlint baseline\n(an absent baseline is treated as an error, not an empty allow-list, so a typo never silently disables suppression).`);
+        this.name = 'BaselineNotFoundError';
+    }
+}
+export class BaselineParseError extends Error {
+    constructor(path, detail) {
+        super(`Could not parse baseline file ${path}: ${detail}`);
+        this.name = 'BaselineParseError';
+    }
+}
+/** Collapse runs of whitespace and trim, so reformatting doesn't churn fingerprints. */
+function normaliseSnippet(text) {
+    return text.replace(/\s+/g, ' ').trim();
+}
+/** Rule identity that goes into the hash — prefer the stable OAuthLint id. */
+function ruleIdentity(finding) {
+    return finding.oauthlintRuleId ?? finding.ruleId;
+}
+/**
+ * Turn a finding's `filePath` into a portable, repo/cwd-relative path with
+ * POSIX separators. Absolute paths are made relative to `cwd`; paths that are
+ * already relative are normalised as-is. We never let an absolute path leak
+ * into a fingerprint, so a baseline is portable across machines/checkouts.
+ */
+export function toRelativePath(filePath, cwd) {
+    const rel = isAbsolute(filePath) ? relative(cwd, filePath) : filePath;
+    return rel.split('\\').join('/');
+}
+/**
+ * Read the matched source span for a finding and return it normalised. On any
+ * read/decoding problem, fall back to the finding's message so we still get a
+ * deterministic value rather than throwing.
+ */
+async function snapshotFor(finding, cwd, cache) {
+    const abs = isAbsolute(finding.filePath) ? finding.filePath : resolve(cwd, finding.filePath);
+    let lines = cache.get(abs);
+    if (lines === undefined) {
+        lines = await readLinesSafe(abs);
+        cache.set(abs, lines);
+    }
+    if (lines === null) {
+        // Unreadable (missing/binary/permission) — degrade to the message text.
+        return normaliseSnippet(finding.message);
+    }
+    // Finding lines are 1-based and inclusive. Clamp into range defensively in
+    // case the file changed between scan and fingerprinting.
+    const start = Math.max(1, finding.startLine);
+    const end = Math.max(start, finding.endLine);
+    const span = lines.slice(start - 1, end).join('\n');
+    const normalised = normaliseSnippet(span);
+    // If the span is empty (out-of-range lines after a shrink), fall back so the
+    // fingerprint is never the hash of an empty string for every such finding.
+    return normalised || normaliseSnippet(finding.message);
+}
+/** Read a file as lines, returning null when it's missing or looks binary. */
+async function readLinesSafe(absPath) {
+    let buf;
+    try {
+        buf = await readFile(absPath);
+    }
+    catch {
+        return null;
+    }
+    // Treat NUL bytes as the binary signal (cheap, matches common heuristics).
+    if (buf.includes(0))
+        return null;
+    return buf.toString('utf8').split('\n');
+}
+function hash(parts) {
+    const h = createHash('sha256');
+    // NUL separator can't appear in any of the parts (path/id are text, the
+    // snippet has NULs stripped by the binary check), so there's no collision
+    // between e.g. ["ab","c"] and ["a","bc"].
+    h.update(parts.join('\0'));
+    return h.digest('hex');
+}
+/**
+ * Compute the stable fingerprint for a finding (without the occurrence index).
+ * Two findings of the same rule on the same (relative) file with the same
+ * normalised snippet share this value — they're disambiguated by the index
+ * added in {@link fingerprintFindings}.
+ */
+export async function baseFingerprint(finding, cwd, cache) {
+    const rel = toRelativePath(finding.filePath, cwd);
+    const snippet = await snapshotFor(finding, cwd, cache);
+    return hash([ruleIdentity(finding), rel, snippet]);
+}
+/**
+ * Fingerprint a list of findings deterministically. Findings are processed in
+ * a stable order, and identical base fingerprints within the run get an
+ * occurrence index (`<base>:<n>`) so repeated anti-patterns each get a unique
+ * key. The same input list always yields the same fingerprints.
+ */
+export async function fingerprintFindings(findings, cwd) {
+    const cache = new Map();
+    // Stable processing order so occurrence indices are reproducible regardless
+    // of the adapter's emission order: by relative path, then line, then rule.
+    const ordered = [...findings]
+        .map((finding) => ({ finding, rel: toRelativePath(finding.filePath, cwd) }))
+        .sort((a, b) => a.rel.localeCompare(b.rel) ||
+        a.finding.startLine - b.finding.startLine ||
+        a.finding.endLine - b.finding.endLine ||
+        ruleIdentity(a.finding).localeCompare(ruleIdentity(b.finding)));
+    const seen = new Map();
+    const out = [];
+    for (const { finding } of ordered) {
+        const base = await baseFingerprint(finding, cwd, cache);
+        const n = seen.get(base) ?? 0;
+        seen.set(base, n + 1);
+        out.push({ finding, fingerprint: `${base}:${n}` });
+    }
+    return out;
+}
+/**
+ * Build a serialisable baseline file from a set of findings. The entry list is
+ * sorted so the JSON is stable and human-diffable across runs.
+ */
+export async function buildBaseline(findings, cwd) {
+    const fingerprinted = await fingerprintFindings(findings, cwd);
+    const entries = fingerprinted.map(({ finding, fingerprint }) => ({
+        fingerprint,
+        ruleId: ruleIdentity(finding),
+        filePath: toRelativePath(finding.filePath, cwd),
+    }));
+    entries.sort((a, b) => a.filePath.localeCompare(b.filePath) ||
+        a.ruleId.localeCompare(b.ruleId) ||
+        a.fingerprint.localeCompare(b.fingerprint));
+    return {
+        version: BASELINE_VERSION,
+        generatedAt: new Date().toISOString(),
+        findings: entries,
+    };
+}
+/** Serialise a baseline file to pretty JSON (trailing newline for clean diffs). */
+export function serialiseBaseline(baseline) {
+    return `${JSON.stringify(baseline, null, 2)}\n`;
+}
+/**
+ * Load a baseline from disk into an in-memory fingerprint set.
+ *
+ * @throws BaselineNotFoundError when the file is absent — deliberately NOT
+ *   treated as an empty allow-list, so a misspelt `--baseline path` fails loud
+ *   instead of silently suppressing nothing (or everything).
+ * @throws BaselineParseError when the file is present but malformed.
+ */
+export async function loadBaseline(path) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            throw new BaselineNotFoundError(path);
+        }
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new BaselineParseError(path, err instanceof Error ? err.message : String(err));
+    }
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        !Array.isArray(parsed.findings)) {
+        throw new BaselineParseError(path, 'expected an object with a "findings" array');
+    }
+    const fingerprints = new Set();
+    for (const entry of parsed.findings) {
+        if (entry && typeof entry.fingerprint === 'string') {
+            fingerprints.add(entry.fingerprint);
+        }
+    }
+    return { fingerprints };
+}
+/**
+ * Split findings into those already present in the baseline (suppressed) and
+ * genuinely new ones, by fingerprinting and matching against the baseline set.
+ */
+export async function partitionByBaseline(findings, baseline, cwd) {
+    const fingerprinted = await fingerprintFindings(findings, cwd);
+    const newFindings = [];
+    const baselined = [];
+    for (const { finding, fingerprint } of fingerprinted) {
+        if (baseline.fingerprints.has(fingerprint))
+            baselined.push(finding);
+        else
+            newFindings.push(finding);
+    }
+    return { newFindings, baselined };
+}
+//# sourceMappingURL=baseline.js.map

package/dist/core/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/core/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAwBhE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,IAAY;QACtB,KAAK,CACH,4BAA4B,IAAI,mKAAmK,CACpM,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,iCAAiC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,wFAAwF;AACxF,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAgB;IACpC,OAAO,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAW;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,GAAW,EACX,KAAmC;IAEnC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,wEAAwE;QACxE,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,UAAU,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,IAAI,CAAC,KAAe;IAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,GAAW,EACX,KAAmC;IAEnC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAmB,EACnB,GAAW;IAEX,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC;SAC1B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SAC3E,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS;QACzC,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO;QACrC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACjE,CAAC;IAEJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAmB,EAAE,GAAW;IAClE,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAoB,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,WAAW;QACX,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;KAChD,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,QAAsB;IACtD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,KAAK,CAAC,OAAO,CAAE,MAAiC,CAAC,QAAQ,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAK,MAAuB,CAAC,QAAQ,EAAE,CAAC;QACtD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAmB,EACnB,QAAkB,EAClB,GAAW;IAEX,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,aAAa,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;YAC/D,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC"}

package/dist/core/changed-files.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Raised when a git operation can't be performed — most commonly because the
+ * target directory is not inside a git work tree, or `git` itself is missing.
+ * Callers (the scan command) translate this into a clean, non-crashing error
+ * message rather than a stack trace.
+ */
+export declare class GitError extends Error {
+    constructor(message: string);
+}
+/** True when `file` has an extension the rule pack can actually scan. */
+export declare function isScannableSourceFile(file: string): boolean;
+/**
+ * Files changed versus `ref` (or the default branch's merge-base when `ref` is
+ * undefined), as absolute paths, filtered to scannable source files.
+ *
+ * Combines four sets so nothing in flight is missed:
+ *   - committed changes since `ref`     (`git diff --name-only <ref>...`)
+ *   - unstaged work-tree changes        (`git diff --name-only`)
+ *   - staged-but-uncommitted changes    (`git diff --name-only --cached`)
+ *   - new, not-yet-tracked files        (`git ls-files --others --exclude-standard`)
+ *
+ * `--diff-filter=ACMR` keeps Added / Copied / Modified / Renamed and drops
+ * Deleted files (we can't scan a file that no longer exists). Untracked files
+ * are picked up separately because plain `git diff` only reports tracked paths —
+ * a freshly written, un-`add`ed source file would otherwise be missed.
+ *
+ * @throws GitError when not in a git repo (or git is unavailable).
+ */
+export declare function resolveDiffFiles(cwd: string, ref?: string): Promise<string[]>;
+/**
+ * Staged files (`git diff --name-only --cached --diff-filter=ACMR`) as absolute
+ * paths, filtered to scannable source files. This is the set a pre-commit hook
+ * cares about.
+ *
+ * @throws GitError when not in a git repo (or git is unavailable).
+ */
+export declare function resolveStagedFiles(cwd: string): Promise<string[]>;
+//# sourceMappingURL=changed-files.d.ts.map

package/dist/core/changed-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-files.d.ts","sourceRoot":"","sources":["../../src/core/changed-files.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAiCD,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AA0FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMvE"}