oauthlint 0.2.4 → 0.4.0

package/dist/core/changed-files.js

@@ -0,0 +1,186 @@
+import { extname } from 'node:path';
+import { execa } from 'execa';
+/**
+ * Raised when a git operation can't be performed — most commonly because the
+ * target directory is not inside a git work tree, or `git` itself is missing.
+ * Callers (the scan command) translate this into a clean, non-crashing error
+ * message rather than a stack trace.
+ */
+export class GitError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitError';
+    }
+}
+/**
+ * File extensions for the languages the rule pack supports
+ * (javascript, typescript, python, go, java, rust). The change-set resolvers
+ * filter to these so we never hand Semgrep a Markdown/lockfile/binary path:
+ * incremental scanning only makes sense for source files semgrep can analyse,
+ * and skipping the rest keeps the scan fast.
+ *
+ * Kept deliberately broad within each supported language (e.g. both `.mjs`
+ * and `.cjs`) so a changed file is never silently dropped.
+ */
+const SUPPORTED_EXTENSIONS = new Set([
+    // JavaScript / TypeScript
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    // Python
+    '.py',
+    '.pyi',
+    // Go
+    '.go',
+    // Java
+    '.java',
+    // Rust
+    '.rs',
+]);
+/** True when `file` has an extension the rule pack can actually scan. */
+export function isScannableSourceFile(file) {
+    return SUPPORTED_EXTENSIONS.has(extname(file).toLowerCase());
+}
+/**
+ * Run `git` with the given args as an ARRAY (never a shell string), so user
+ * input — branch names, refs — can't be interpreted by a shell. `execa`
+ * spawns the process directly without `/bin/sh`, eliminating shell injection.
+ *
+ * @throws GitError when git is not installed or the command fails.
+ */
+async function git(cwd, args) {
+    try {
+        const { stdout } = await execa('git', args, { cwd, reject: true });
+        return stdout;
+    }
+    catch (err) {
+        if (isMissingGitBinary(err)) {
+            throw new GitError('git is not installed or not on PATH — cannot resolve changed files.');
+        }
+        const stderr = typeof err.stderr === 'string'
+            ? err.stderr.trim()
+            : '';
+        throw new GitError(stderr || (err instanceof Error ? err.message : String(err)));
+    }
+}
+function isMissingGitBinary(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const e = err;
+    return e.code === 'ENOENT' || e.cause?.code === 'ENOENT';
+}
+/**
+ * Throw a clear GitError unless `cwd` is inside a git work tree. Used by the
+ * diff/staged resolvers so "not a git repo" surfaces as a friendly message
+ * instead of a confusing low-level git error.
+ */
+async function assertGitRepo(cwd) {
+    let inside;
+    try {
+        inside = await git(cwd, ['rev-parse', '--is-inside-work-tree']);
+    }
+    catch (err) {
+        if (err instanceof GitError && /not a git repository/i.test(err.message)) {
+            throw new GitError(`Not a git repository: ${cwd}`);
+        }
+        throw err;
+    }
+    if (inside.trim() !== 'true') {
+        throw new GitError(`Not a git repository: ${cwd}`);
+    }
+}
+/**
+ * Resolve the git ref to diff against when `--diff` is passed without a value.
+ * We want the merge-base with the repository's default branch so a feature
+ * branch only scans what it actually changed (not unrelated commits already on
+ * the default branch). Resolution order:
+ *
+ *   1. `origin/HEAD` — the remote's default branch symref (most accurate)
+ *   2. `origin/main`
+ *   3. `origin/master`
+ *   4. `HEAD` — fallback when there is no remote (diffs only the work tree)
+ *
+ * For each candidate we use its merge-base with the current HEAD so the diff
+ * is scoped to the branch's own changes.
+ */
+async function resolveDefaultRef(cwd) {
+    for (const candidate of ['origin/HEAD', 'origin/main', 'origin/master']) {
+        try {
+            const base = (await git(cwd, ['merge-base', candidate, 'HEAD'])).trim();
+            if (base)
+                return base;
+        }
+        catch {
+            // candidate doesn't exist (no remote / different default) — try the next.
+        }
+    }
+    return 'HEAD';
+}
+/** Absolute repo root for `cwd`, used to turn git's repo-relative paths absolute. */
+async function repoRoot(cwd) {
+    return (await git(cwd, ['rev-parse', '--show-toplevel'])).trim();
+}
+function toAbsolute(root, relPaths) {
+    // git emits forward-slash, repo-relative paths; join under the repo root.
+    return relPaths
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0)
+        .map((p) => `${root}/${p}`);
+}
+/**
+ * Files changed versus `ref` (or the default branch's merge-base when `ref` is
+ * undefined), as absolute paths, filtered to scannable source files.
+ *
+ * Combines four sets so nothing in flight is missed:
+ *   - committed changes since `ref`     (`git diff --name-only <ref>...`)
+ *   - unstaged work-tree changes        (`git diff --name-only`)
+ *   - staged-but-uncommitted changes    (`git diff --name-only --cached`)
+ *   - new, not-yet-tracked files        (`git ls-files --others --exclude-standard`)
+ *
+ * `--diff-filter=ACMR` keeps Added / Copied / Modified / Renamed and drops
+ * Deleted files (we can't scan a file that no longer exists). Untracked files
+ * are picked up separately because plain `git diff` only reports tracked paths —
+ * a freshly written, un-`add`ed source file would otherwise be missed.
+ *
+ * @throws GitError when not in a git repo (or git is unavailable).
+ */
+export async function resolveDiffFiles(cwd, ref) {
+    await assertGitRepo(cwd);
+    const baseRef = ref ?? (await resolveDefaultRef(cwd));
+    const root = await repoRoot(cwd);
+    const seen = new Set();
+    const batches = await Promise.all([
+        // `<ref>...` (three-dot) diffs against the merge-base of ref and HEAD,
+        // matching how code review compares a branch to its base.
+        git(cwd, ['diff', '--name-only', '--diff-filter=ACMR', `${baseRef}...`]),
+        git(cwd, ['diff', '--name-only', '--diff-filter=ACMR']),
+        git(cwd, ['diff', '--name-only', '--cached', '--diff-filter=ACMR']),
+        // Untracked (but not git-ignored) files — `git diff` never lists these.
+        git(cwd, ['ls-files', '--others', '--exclude-standard']),
+    ]);
+    for (const out of batches) {
+        for (const abs of toAbsolute(root, out.split('\n')))
+            seen.add(abs);
+    }
+    return [...seen].filter(isScannableSourceFile).sort();
+}
+/**
+ * Staged files (`git diff --name-only --cached --diff-filter=ACMR`) as absolute
+ * paths, filtered to scannable source files. This is the set a pre-commit hook
+ * cares about.
+ *
+ * @throws GitError when not in a git repo (or git is unavailable).
+ */
+export async function resolveStagedFiles(cwd) {
+    await assertGitRepo(cwd);
+    const root = await repoRoot(cwd);
+    const out = await git(cwd, ['diff', '--name-only', '--cached', '--diff-filter=ACMR']);
+    const abs = toAbsolute(root, out.split('\n'));
+    return [...new Set(abs)].filter(isScannableSourceFile).sort();
+}
+//# sourceMappingURL=changed-files.js.map

package/dist/core/changed-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-files.js","sourceRoot":"","sources":["../../src/core/changed-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,0BAA0B;IAC1B,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,qEAAqE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GACV,OAAQ,GAA4B,CAAC,MAAM,KAAK,QAAQ;YACtD,CAAC,CAAE,GAA0B,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAAmD,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,0EAA0E;IAC1E,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAY;IAC9D,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChC,uEAAuE;QACvE,0DAA0D;QAC1D,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC;QACxE,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACnE,wEAAwE;QACxE,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;KACzD,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC"}

package/dist/core/update-notifier.d.ts

@@ -0,0 +1,61 @@
+export interface NotifierCache {
+    /** Epoch ms of the last successful registry check. */
+    lastCheck: number;
+    /** The latest version string the registry reported, or null on failure. */
+    latestVersion: string | null;
+}
+export interface UpdateNotifierOptions {
+    /** Currently-installed version (from package.json). */
+    currentVersion: string;
+    /** True when the command emits machine-readable output (json/sarif). */
+    machineReadable?: boolean;
+    /** Explicit opt-out (e.g. `--no-update-check` or config). */
+    disabled?: boolean;
+    /** Streams/env are injected so tests stay deterministic and offline. */
+    stderr?: NodeJS.WriteStream & {
+        isTTY?: boolean;
+    };
+    env?: NodeJS.ProcessEnv;
+    /** Override the cache file location (tests). */
+    cachePath?: string;
+    /** Inject the registry fetch + clock (tests). */
+    fetchLatest?: (name: string, timeoutMs: number) => Promise<string | null>;
+    now?: () => number;
+}
+/**
+ * Decide whether a notice may be shown at all, independent of versions.
+ * Cheap, synchronous, and the single source of truth for suppression.
+ */
+export declare function shouldCheckForUpdate(opts: {
+    machineReadable?: boolean;
+    disabled?: boolean;
+    stderr?: {
+        isTTY?: boolean;
+    };
+    env?: NodeJS.ProcessEnv;
+}): boolean;
+/** Default cache location: XDG_CACHE_HOME, else ~/.cache. */
+export declare function defaultCachePath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Fetch the latest published version from the npm registry.
+ * Hits the lightweight dist-tags endpoint, validates the response, and returns
+ * null on any error/timeout. Nothing from the response is ever executed.
+ */
+export declare function fetchLatestVersion(name: string, timeoutMs?: number): Promise<string | null>;
+/**
+ * Run the update check and, when appropriate, print a single notice to stderr.
+ * Designed to be awaited right before the process exits so the notice appears
+ * AFTER the command's normal output and never interleaves.
+ *
+ * It resolves to the notice string it printed (or null), which is handy for
+ * tests; production callers can ignore the return value.
+ */
+export declare function maybeNotifyUpdate(opts: UpdateNotifierOptions): Promise<string | null>;
+export declare function isValidVersion(v: string): boolean;
+/**
+ * Compare two semver strings. Returns >0 if a>b, <0 if a<b, 0 if equal.
+ * Honours prerelease precedence (1.0.0-rc < 1.0.0) per the semver spec's
+ * common cases. Invalid input sorts as "not greater" so we never nag wrongly.
+ */
+export declare function compareSemver(a: string, b: string): number;
+//# sourceMappingURL=update-notifier.d.ts.map

package/dist/core/update-notifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notifier.d.ts","sourceRoot":"","sources":["../../src/core/update-notifier.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAYV;AAiBD,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAA2B,GACrC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4C3F;AAgBD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B1D"}

package/dist/core/update-notifier.js

@@ -0,0 +1,267 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { request as httpsRequest } from 'node:https';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import pc from 'picocolors';
+/**
+ * A minimal, dependency-free "newer version available" notifier — the same
+ * idea as npm/eslint, kept deliberately small so it adds no transitive
+ * supply-chain surface (we don't pull in the `update-notifier` tree).
+ *
+ * Hard guarantees:
+ *  - NEVER blocks or delays the command. The check is fire-and-forget against a
+ *    ~24h cache; the network call has a short timeout and ALL errors are
+ *    swallowed (offline is completely silent).
+ *  - Writes ONLY to stderr, never stdout — so `--json` / `--format sarif`
+ *    piping is never corrupted.
+ *  - Suppressed whenever output is machine-readable, stderr isn't a TTY, a CI
+ *    env is detected, `NO_UPDATE_NOTIFIER` is set, or the user opted out.
+ */
+/** Package name on the npm registry. */
+const PACKAGE_NAME = 'oauthlint';
+/** How long a cached registry answer is trusted before we re-check. */
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h
+/** Network timeout — short, so a slow/blocked registry never stalls the CLI. */
+const NETWORK_TIMEOUT_MS = 2500;
+/**
+ * Decide whether a notice may be shown at all, independent of versions.
+ * Cheap, synchronous, and the single source of truth for suppression.
+ */
+export function shouldCheckForUpdate(opts) {
+    const env = opts.env ?? process.env;
+    if (opts.disabled)
+        return false;
+    if (opts.machineReadable)
+        return false;
+    // Explicit kill-switch honoured by the whole ecosystem.
+    if (env.NO_UPDATE_NOTIFIER)
+        return false;
+    // Any common CI signal — never nag automated runs.
+    if (isCI(env))
+        return false;
+    // Piped / redirected stderr: the notice would land in a log or get mangled.
+    const stderr = opts.stderr ?? process.stderr;
+    if (!stderr.isTTY)
+        return false;
+    return true;
+}
+function isCI(env) {
+    return Boolean(env.CI ||
+        env.CONTINUOUS_INTEGRATION ||
+        env.BUILD_NUMBER ||
+        env.GITHUB_ACTIONS ||
+        env.GITLAB_CI ||
+        env.CIRCLECI ||
+        env.TRAVIS ||
+        env.JENKINS_URL ||
+        env.TEAMCITY_VERSION ||
+        env.BITBUCKET_BUILD_NUMBER);
+}
+/** Default cache location: XDG_CACHE_HOME, else ~/.cache. */
+export function defaultCachePath(env = process.env) {
+    const base = env.XDG_CACHE_HOME?.trim() || join(homedir(), '.cache');
+    return join(base, 'oauthlint', 'update-check.json');
+}
+async function readCache(path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed &&
+            typeof parsed === 'object' &&
+            typeof parsed.lastCheck === 'number') {
+            const c = parsed;
+            const v = c.latestVersion;
+            // Validate the cached version: only accept null or a sane semver-ish
+            // string. Never trust arbitrary content (defends against a tampered file).
+            if (v === null || (typeof v === 'string' && isValidVersion(v))) {
+                return { lastCheck: c.lastCheck, latestVersion: v };
+            }
+        }
+    }
+    catch {
+        /* missing/corrupt cache → treat as no cache */
+    }
+    return null;
+}
+async function writeCache(path, cache) {
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, JSON.stringify(cache), 'utf8');
+    }
+    catch {
+        /* best-effort: a read-only home must never break the command */
+    }
+}
+/**
+ * Fetch the latest published version from the npm registry.
+ * Hits the lightweight dist-tags endpoint, validates the response, and returns
+ * null on any error/timeout. Nothing from the response is ever executed.
+ */
+export function fetchLatestVersion(name, timeoutMs = NETWORK_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(v);
+        };
+        const req = httpsRequest({
+            method: 'GET',
+            hostname: 'registry.npmjs.org',
+            path: `/-/package/${encodeURIComponent(name)}/dist-tags`,
+            headers: { accept: 'application/json' },
+            timeout: timeoutMs,
+        }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                done(null);
+                return;
+            }
+            let body = '';
+            let size = 0;
+            res.setEncoding('utf8');
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                // Cap the response we'll buffer — defensive against a hostile/huge body.
+                if (size > 64 * 1024) {
+                    req.destroy();
+                    done(null);
+                    return;
+                }
+                body += chunk;
+            });
+            res.on('end', () => {
+                try {
+                    const json = JSON.parse(body);
+                    const latest = json.latest;
+                    done(typeof latest === 'string' && isValidVersion(latest) ? latest : null);
+                }
+                catch {
+                    done(null);
+                }
+            });
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            done(null);
+        });
+        req.on('error', () => done(null));
+        req.end();
+    });
+}
+/**
+ * Run the update check and, when appropriate, print a single notice to stderr.
+ * Designed to be awaited right before the process exits so the notice appears
+ * AFTER the command's normal output and never interleaves.
+ *
+ * It resolves to the notice string it printed (or null), which is handy for
+ * tests; production callers can ignore the return value.
+ */
+export async function maybeNotifyUpdate(opts) {
+    const env = opts.env ?? process.env;
+    const stderr = opts.stderr ?? process.stderr;
+    if (!shouldCheckForUpdate({
+        machineReadable: opts.machineReadable,
+        disabled: opts.disabled,
+        stderr,
+        env,
+    })) {
+        return null;
+    }
+    // A bad/dev version (e.g. '0.0.0') can't be meaningfully compared.
+    if (!isValidVersion(opts.currentVersion))
+        return null;
+    const now = opts.now ?? Date.now;
+    const cachePath = opts.cachePath ?? defaultCachePath(env);
+    const fetchLatest = opts.fetchLatest ?? fetchLatestVersion;
+    try {
+        const cache = await readCache(cachePath);
+        let latest = cache?.latestVersion ?? null;
+        const fresh = cache !== null && now() - cache.lastCheck < CHECK_INTERVAL_MS;
+        if (!fresh) {
+            // Cache is stale or absent → check the registry, then persist the answer
+            // (and the timestamp) so we don't hit the network again for ~24h.
+            latest = await fetchLatest(PACKAGE_NAME, NETWORK_TIMEOUT_MS);
+            await writeCache(cachePath, { lastCheck: now(), latestVersion: latest });
+        }
+        if (!latest || !isValidVersion(latest))
+            return null;
+        if (compareSemver(latest, opts.currentVersion) <= 0)
+            return null;
+        const notice = formatNotice(opts.currentVersion, latest);
+        stderr.write(`${notice}\n`);
+        return notice;
+    }
+    catch {
+        // Belt-and-braces: nothing here may ever surface to the user.
+        return null;
+    }
+}
+function formatNotice(current, latest) {
+    const headline = `${pc.dim('Update available')} ${pc.dim(current)} ${pc.dim('→')} ${pc.green(latest)}`;
+    const upgrade = `Run ${pc.cyan('npm i -g oauthlint')} ${pc.dim('(or')} ${pc.cyan('npx oauthlint@latest')}${pc.dim(')')}`;
+    const optOut = pc.dim('Disable: --no-update-check or NO_UPDATE_NOTIFIER=1');
+    return `\n${headline}\n${upgrade}\n${optOut}`;
+}
+// ---------------------------------------------------------------------------
+// Semver: a tiny, self-contained comparator. Enough for "is latest > current",
+// including basic prerelease ordering, without a dependency.
+// ---------------------------------------------------------------------------
+const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+export function isValidVersion(v) {
+    return VERSION_RE.test(v.trim());
+}
+/**
+ * Compare two semver strings. Returns >0 if a>b, <0 if a<b, 0 if equal.
+ * Honours prerelease precedence (1.0.0-rc < 1.0.0) per the semver spec's
+ * common cases. Invalid input sorts as "not greater" so we never nag wrongly.
+ */
+export function compareSemver(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (!pa || !pb)
+        return 0;
+    for (let i = 0; i < 3; i++) {
+        if (pa.main[i] !== pb.main[i])
+            return pa.main[i] - pb.main[i];
+    }
+    // Equal core. A version WITH a prerelease is lower than one without.
+    if (pa.pre.length === 0 && pb.pre.length === 0)
+        return 0;
+    if (pa.pre.length === 0)
+        return 1; // a is a release, b is a prerelease
+    if (pb.pre.length === 0)
+        return -1; // a is a prerelease, b is a release
+    const len = Math.max(pa.pre.length, pb.pre.length);
+    for (let i = 0; i < len; i++) {
+        const x = pa.pre[i];
+        const y = pb.pre[i];
+        if (x === undefined)
+            return -1; // shorter prerelease set has lower precedence
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        const xn = /^\d+$/.test(x);
+        const yn = /^\d+$/.test(y);
+        if (xn && yn)
+            return Number(x) - Number(y);
+        if (xn)
+            return -1; // numeric identifiers are lower than alphanumeric
+        if (yn)
+            return 1;
+        return x < y ? -1 : 1; // lexical ASCII order
+    }
+    return 0;
+}
+function parseVersion(v) {
+    const m = VERSION_RE.exec(v.trim());
+    if (!m)
+        return null;
+    return {
+        main: [Number(m[1]), Number(m[2]), Number(m[3])],
+        pre: m[4] ? m[4].split('.') : [],
+    };
+}
+//# sourceMappingURL=update-notifier.js.map

package/dist/core/update-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notifier.js","sourceRoot":"","sources":["../../src/core/update-notifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AAEH,wCAAwC;AACxC,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AACrD,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AA0BhC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACvC,wDAAwD;IACxD,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACzC,mDAAmD;IACnD,IAAI,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,sBAAsB,CAC7B,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAQ,MAAwB,CAAC,SAAS,KAAK,QAAQ,EACvD,CAAC;YACD,MAAM,CAAC,GAAG,MAAuB,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YAC1B,qEAAqE;YACrE,2EAA2E;YAC3E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAoB;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,YAAoB,kBAAkB;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAQ,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,YAAY,CACtB;YACE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,oBAAoB;YAC9B,IAAI,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,YAAY;YACxD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,yEAAyE;gBACzE,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBACrB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,IAAI,CAAC,IAAI,CAAC,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;oBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,IACE,CAAC,oBAAoB,CAAC;QACpB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,GAAG;KACJ,CAAC,EACF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,KAAK,EAAE,aAAa,IAAI,IAAI,CAAC;QAE1C,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,iBAAiB,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IACzH,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5E,OAAO,KAAK,QAAQ,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,UAAU,GAAG,kEAAkE,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,oCAAoC;IACvE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,oCAAoC;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,8CAA8C;QAC9E,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,kDAAkD;QACrE,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;KACjC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { buildProgram } from './cli.js';
 export { runScan, type ScanCommandOptions } from './commands/scan.js';
+export { runBaseline, type BaselineCommandOptions } from './commands/baseline.js';
+export { BASELINE_VERSION, DEFAULT_BASELINE_FILE, type Baseline, type BaselineEntry, type BaselineFile, BaselineNotFoundError, BaselineParseError, buildBaseline, fingerprintFindings, loadBaseline, partitionByBaseline, serialiseBaseline, } from './core/baseline.js';
 export { runList, type ListOptions } from './commands/list.js';
 export { runInit, type InitOptions } from './commands/init.js';
 export { runDoctor, type DoctorOptions } from './commands/doctor.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { buildProgram } from './cli.js';
 export { runScan } from './commands/scan.js';
+export { runBaseline } from './commands/baseline.js';
+export { BASELINE_VERSION, DEFAULT_BASELINE_FILE, BaselineNotFoundError, BaselineParseError, buildBaseline, fingerprintFindings, loadBaseline, partitionByBaseline, serialiseBaseline, } from './core/baseline.js';
 export { runList } from './commands/list.js';
 export { runInit } from './commands/init.js';
 export { runDoctor } from './commands/doctor.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAA2B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAA2B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAA+B,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EAIrB,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint",
-  "version": "0.2.4",
+  "version": "0.4.0",
   "description": "Catch the OAuth/OIDC/JWT anti-patterns AI coding tools systematically produce. CLI wrapper around the oauthlint-rules Semgrep rule pack.",
   "type": "module",
   "main": "./dist/index.js",
@@ -47,7 +47,7 @@
     "picocolors": "1.1.1",
     "yaml": "2.9.0",
     "zod": "3.24.1",
-    "oauthlint-rules": "0.2.2"
+    "oauthlint-rules": "0.2.4"
   },
   "devDependencies": {
     "@types/node": "22.10.5",