oauthlint 0.3.0 → 0.5.0

package/dist/core/update-notifier.js

@@ -0,0 +1,267 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { request as httpsRequest } from 'node:https';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import pc from 'picocolors';
+/**
+ * A minimal, dependency-free "newer version available" notifier — the same
+ * idea as npm/eslint, kept deliberately small so it adds no transitive
+ * supply-chain surface (we don't pull in the `update-notifier` tree).
+ *
+ * Hard guarantees:
+ *  - NEVER blocks or delays the command. The check is fire-and-forget against a
+ *    ~24h cache; the network call has a short timeout and ALL errors are
+ *    swallowed (offline is completely silent).
+ *  - Writes ONLY to stderr, never stdout — so `--json` / `--format sarif`
+ *    piping is never corrupted.
+ *  - Suppressed whenever output is machine-readable, stderr isn't a TTY, a CI
+ *    env is detected, `NO_UPDATE_NOTIFIER` is set, or the user opted out.
+ */
+/** Package name on the npm registry. */
+const PACKAGE_NAME = 'oauthlint';
+/** How long a cached registry answer is trusted before we re-check. */
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h
+/** Network timeout — short, so a slow/blocked registry never stalls the CLI. */
+const NETWORK_TIMEOUT_MS = 2500;
+/**
+ * Decide whether a notice may be shown at all, independent of versions.
+ * Cheap, synchronous, and the single source of truth for suppression.
+ */
+export function shouldCheckForUpdate(opts) {
+    const env = opts.env ?? process.env;
+    if (opts.disabled)
+        return false;
+    if (opts.machineReadable)
+        return false;
+    // Explicit kill-switch honoured by the whole ecosystem.
+    if (env.NO_UPDATE_NOTIFIER)
+        return false;
+    // Any common CI signal — never nag automated runs.
+    if (isCI(env))
+        return false;
+    // Piped / redirected stderr: the notice would land in a log or get mangled.
+    const stderr = opts.stderr ?? process.stderr;
+    if (!stderr.isTTY)
+        return false;
+    return true;
+}
+function isCI(env) {
+    return Boolean(env.CI ||
+        env.CONTINUOUS_INTEGRATION ||
+        env.BUILD_NUMBER ||
+        env.GITHUB_ACTIONS ||
+        env.GITLAB_CI ||
+        env.CIRCLECI ||
+        env.TRAVIS ||
+        env.JENKINS_URL ||
+        env.TEAMCITY_VERSION ||
+        env.BITBUCKET_BUILD_NUMBER);
+}
+/** Default cache location: XDG_CACHE_HOME, else ~/.cache. */
+export function defaultCachePath(env = process.env) {
+    const base = env.XDG_CACHE_HOME?.trim() || join(homedir(), '.cache');
+    return join(base, 'oauthlint', 'update-check.json');
+}
+async function readCache(path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed &&
+            typeof parsed === 'object' &&
+            typeof parsed.lastCheck === 'number') {
+            const c = parsed;
+            const v = c.latestVersion;
+            // Validate the cached version: only accept null or a sane semver-ish
+            // string. Never trust arbitrary content (defends against a tampered file).
+            if (v === null || (typeof v === 'string' && isValidVersion(v))) {
+                return { lastCheck: c.lastCheck, latestVersion: v };
+            }
+        }
+    }
+    catch {
+        /* missing/corrupt cache → treat as no cache */
+    }
+    return null;
+}
+async function writeCache(path, cache) {
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, JSON.stringify(cache), 'utf8');
+    }
+    catch {
+        /* best-effort: a read-only home must never break the command */
+    }
+}
+/**
+ * Fetch the latest published version from the npm registry.
+ * Hits the lightweight dist-tags endpoint, validates the response, and returns
+ * null on any error/timeout. Nothing from the response is ever executed.
+ */
+export function fetchLatestVersion(name, timeoutMs = NETWORK_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(v);
+        };
+        const req = httpsRequest({
+            method: 'GET',
+            hostname: 'registry.npmjs.org',
+            path: `/-/package/${encodeURIComponent(name)}/dist-tags`,
+            headers: { accept: 'application/json' },
+            timeout: timeoutMs,
+        }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                done(null);
+                return;
+            }
+            let body = '';
+            let size = 0;
+            res.setEncoding('utf8');
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                // Cap the response we'll buffer — defensive against a hostile/huge body.
+                if (size > 64 * 1024) {
+                    req.destroy();
+                    done(null);
+                    return;
+                }
+                body += chunk;
+            });
+            res.on('end', () => {
+                try {
+                    const json = JSON.parse(body);
+                    const latest = json.latest;
+                    done(typeof latest === 'string' && isValidVersion(latest) ? latest : null);
+                }
+                catch {
+                    done(null);
+                }
+            });
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            done(null);
+        });
+        req.on('error', () => done(null));
+        req.end();
+    });
+}
+/**
+ * Run the update check and, when appropriate, print a single notice to stderr.
+ * Designed to be awaited right before the process exits so the notice appears
+ * AFTER the command's normal output and never interleaves.
+ *
+ * It resolves to the notice string it printed (or null), which is handy for
+ * tests; production callers can ignore the return value.
+ */
+export async function maybeNotifyUpdate(opts) {
+    const env = opts.env ?? process.env;
+    const stderr = opts.stderr ?? process.stderr;
+    if (!shouldCheckForUpdate({
+        machineReadable: opts.machineReadable,
+        disabled: opts.disabled,
+        stderr,
+        env,
+    })) {
+        return null;
+    }
+    // A bad/dev version (e.g. '0.0.0') can't be meaningfully compared.
+    if (!isValidVersion(opts.currentVersion))
+        return null;
+    const now = opts.now ?? Date.now;
+    const cachePath = opts.cachePath ?? defaultCachePath(env);
+    const fetchLatest = opts.fetchLatest ?? fetchLatestVersion;
+    try {
+        const cache = await readCache(cachePath);
+        let latest = cache?.latestVersion ?? null;
+        const fresh = cache !== null && now() - cache.lastCheck < CHECK_INTERVAL_MS;
+        if (!fresh) {
+            // Cache is stale or absent → check the registry, then persist the answer
+            // (and the timestamp) so we don't hit the network again for ~24h.
+            latest = await fetchLatest(PACKAGE_NAME, NETWORK_TIMEOUT_MS);
+            await writeCache(cachePath, { lastCheck: now(), latestVersion: latest });
+        }
+        if (!latest || !isValidVersion(latest))
+            return null;
+        if (compareSemver(latest, opts.currentVersion) <= 0)
+            return null;
+        const notice = formatNotice(opts.currentVersion, latest);
+        stderr.write(`${notice}\n`);
+        return notice;
+    }
+    catch {
+        // Belt-and-braces: nothing here may ever surface to the user.
+        return null;
+    }
+}
+function formatNotice(current, latest) {
+    const headline = `${pc.dim('Update available')} ${pc.dim(current)} ${pc.dim('→')} ${pc.green(latest)}`;
+    const upgrade = `Run ${pc.cyan('npm i -g oauthlint')} ${pc.dim('(or')} ${pc.cyan('npx oauthlint@latest')}${pc.dim(')')}`;
+    const optOut = pc.dim('Disable: --no-update-check or NO_UPDATE_NOTIFIER=1');
+    return `\n${headline}\n${upgrade}\n${optOut}`;
+}
+// ---------------------------------------------------------------------------
+// Semver: a tiny, self-contained comparator. Enough for "is latest > current",
+// including basic prerelease ordering, without a dependency.
+// ---------------------------------------------------------------------------
+const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+export function isValidVersion(v) {
+    return VERSION_RE.test(v.trim());
+}
+/**
+ * Compare two semver strings. Returns >0 if a>b, <0 if a<b, 0 if equal.
+ * Honours prerelease precedence (1.0.0-rc < 1.0.0) per the semver spec's
+ * common cases. Invalid input sorts as "not greater" so we never nag wrongly.
+ */
+export function compareSemver(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    if (!pa || !pb)
+        return 0;
+    for (let i = 0; i < 3; i++) {
+        if (pa.main[i] !== pb.main[i])
+            return pa.main[i] - pb.main[i];
+    }
+    // Equal core. A version WITH a prerelease is lower than one without.
+    if (pa.pre.length === 0 && pb.pre.length === 0)
+        return 0;
+    if (pa.pre.length === 0)
+        return 1; // a is a release, b is a prerelease
+    if (pb.pre.length === 0)
+        return -1; // a is a prerelease, b is a release
+    const len = Math.max(pa.pre.length, pb.pre.length);
+    for (let i = 0; i < len; i++) {
+        const x = pa.pre[i];
+        const y = pb.pre[i];
+        if (x === undefined)
+            return -1; // shorter prerelease set has lower precedence
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        const xn = /^\d+$/.test(x);
+        const yn = /^\d+$/.test(y);
+        if (xn && yn)
+            return Number(x) - Number(y);
+        if (xn)
+            return -1; // numeric identifiers are lower than alphanumeric
+        if (yn)
+            return 1;
+        return x < y ? -1 : 1; // lexical ASCII order
+    }
+    return 0;
+}
+function parseVersion(v) {
+    const m = VERSION_RE.exec(v.trim());
+    if (!m)
+        return null;
+    return {
+        main: [Number(m[1]), Number(m[2]), Number(m[3])],
+        pre: m[4] ? m[4].split('.') : [],
+    };
+}
+//# sourceMappingURL=update-notifier.js.map

package/dist/core/update-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notifier.js","sourceRoot":"","sources":["../../src/core/update-notifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AAEH,wCAAwC;AACxC,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AACrD,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AA0BhC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACvC,wDAAwD;IACxD,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACzC,mDAAmD;IACnD,IAAI,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,sBAAsB,CAC7B,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAQ,MAAwB,CAAC,SAAS,KAAK,QAAQ,EACvD,CAAC;YACD,MAAM,CAAC,GAAG,MAAuB,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YAC1B,qEAAqE;YACrE,2EAA2E;YAC3E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAoB;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,YAAoB,kBAAkB;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAQ,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,YAAY,CACtB;YACE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,oBAAoB;YAC9B,IAAI,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,YAAY;YACxD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,yEAAyE;gBACzE,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBACrB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,IAAI,CAAC,IAAI,CAAC,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;oBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,IACE,CAAC,oBAAoB,CAAC;QACpB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,GAAG;KACJ,CAAC,EACF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,KAAK,EAAE,aAAa,IAAI,IAAI,CAAC;QAE1C,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,iBAAiB,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IACzH,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5E,OAAO,KAAK,QAAQ,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,UAAU,GAAG,kEAAkE,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,oCAAoC;IACvE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,oCAAoC;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,8CAA8C;QAC9E,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,kDAAkD;QACrE,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;KACjC,CAAC;AACJ,CAAC"}

package/dist/formatters/html.d.ts

@@ -0,0 +1,50 @@
+import type { ScanResult } from '../types.js';
+/**
+ * Render a scan result as a single, self-contained HTML document.
+ *
+ * Design goals:
+ * - **Self-contained**: all CSS is inlined; no external requests, no JavaScript.
+ *   The file works opened straight from disk and prints cleanly.
+ * - **Shareable audit artifact**: dark header, severity-coloured badges, a
+ *   per-severity summary, and findings grouped by severity (worst first).
+ * - **Safe**: EVERY interpolated value (paths, messages, rule ids, code
+ *   snippets, scan target) is HTML-escaped via {@link escapeHtml}, so hostile
+ *   source under scan — even a literal `</script>` or `<img onerror>` — is
+ *   rendered as inert text and can never execute in the report.
+ *
+ * Output is deterministic given its inputs: the timestamp is injected (see
+ * {@link HtmlReportOptions.generatedAt}) rather than read from the clock, so
+ * the same scan always produces byte-identical HTML — which keeps tests stable.
+ */
+export interface HtmlReportOptions {
+    /** The scan target(s) shown in the header (e.g. `./src` or a file list). */
+    target: string;
+    /**
+     * Timestamp shown in the header. Injected for determinism; defaults to now.
+     * Accepts a `Date` or a pre-formatted string.
+     */
+    generatedAt?: Date | string;
+    /** Tool version, shown in the footer. */
+    version?: string;
+    /**
+     * Best-effort source-snippet lookup. When omitted, snippets are read from
+     * disk by {@link Finding.filePath}. Injectable so tests need no real files
+     * and so the caller can supply already-resolved snippets. Return
+     * `null`/`undefined` for "no snippet available".
+     */
+    readSnippet?: (filePath: string, startLine: number) => string | null | undefined;
+}
+/**
+ * HTML-escape a value for safe interpolation in element text OR attribute
+ * context. Covers `&`, `<`, `>`, `"`, and `'` — the full set needed so that
+ * neither markup nor an attribute-quote breakout is possible. `&` is replaced
+ * first so the other entities aren't double-encoded.
+ */
+export declare function escapeHtml(value: unknown): string;
+/**
+ * Build the full HTML report document for a scan result. The only side effect
+ * is best-effort disk reads for code snippets (skippable via
+ * {@link HtmlReportOptions.readSnippet}). Returns the complete document string.
+ */
+export declare function renderHtmlReport(result: ScanResult, options: HtmlReportOptions): Promise<string>;
+//# sourceMappingURL=html.d.ts.map

package/dist/formatters/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/formatters/html.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,UAAU,EAAgB,MAAM,aAAa,CAAC;AAErE;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC5B,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClF;AAID;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD;AA+PD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,CAAC,CAgDjB"}

package/dist/formatters/html.js

@@ -0,0 +1,308 @@
+import { readFile } from 'node:fs/promises';
+const SEVERITY_ORDER = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+/**
+ * HTML-escape a value for safe interpolation in element text OR attribute
+ * context. Covers `&`, `<`, `>`, `"`, and `'` — the full set needed so that
+ * neither markup nor an attribute-quote breakout is possible. `&` is replaced
+ * first so the other entities aren't double-encoded.
+ */
+export function escapeHtml(value) {
+    return String(value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function severityCounts(findings) {
+    const counts = {
+        CRITICAL: 0,
+        HIGH: 0,
+        MEDIUM: 0,
+        LOW: 0,
+        INFO: 0,
+    };
+    for (const f of findings)
+        counts[f.severity]++;
+    return counts;
+}
+/** Read the flagged source line from disk, best-effort. Never throws. */
+async function defaultReadSnippet(filePath, startLine) {
+    if (!filePath || startLine < 1)
+        return null;
+    try {
+        const text = await readFile(filePath, 'utf8');
+        const lines = text.split(/\r?\n/);
+        return lines[startLine - 1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a snippet for each finding up front (async disk reads), keyed by the
+ * finding object, so the synchronous render pass below stays simple. The
+ * injectable {@link HtmlReportOptions.readSnippet} short-circuits disk access.
+ */
+async function resolveSnippets(findings, read) {
+    const out = new Map();
+    await Promise.all(findings.map(async (f) => {
+        let snippet;
+        if (read) {
+            snippet = read(f.filePath, f.startLine);
+        }
+        else {
+            snippet = await defaultReadSnippet(f.filePath, f.startLine);
+        }
+        out.set(f, snippet ?? null);
+    }));
+    return out;
+}
+const STYLES = `
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    color: #1b2330;
+    background: #f4f6fa;
+    line-height: 1.5;
+  }
+  .wrap { max-width: 960px; margin: 0 auto; padding: 0 24px 64px; }
+  header.report {
+    background: #0f1729;
+    color: #f4f6fa;
+    padding: 32px 0;
+    border-bottom: 4px solid #2f6feb;
+  }
+  header.report .wrap { padding-bottom: 0; }
+  header.report h1 { margin: 0 0 4px; font-size: 24px; letter-spacing: -0.01em; }
+  header.report h1 .mark { color: #6ea8ff; }
+  header.report .meta { margin: 12px 0 0; font-size: 13px; color: #9fb0c9; }
+  header.report .meta code {
+    background: rgba(255,255,255,0.08);
+    padding: 1px 6px;
+    border-radius: 4px;
+    font-size: 12px;
+    color: #d6e2f5;
+  }
+  .summary {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin: 24px 0 8px;
+  }
+  .pill {
+    display: inline-flex;
+    align-items: baseline;
+    gap: 6px;
+    padding: 6px 12px;
+    border-radius: 999px;
+    font-size: 13px;
+    font-weight: 600;
+    border: 1px solid transparent;
+  }
+  .pill .n { font-size: 15px; }
+  .pill.total { background: #fff; border-color: #d7deea; color: #1b2330; }
+  .badge, .pill {
+    --crit-bg: #fde7e9; --crit-fg: #8a1020; --crit-bd: #f3b7c0;
+    --high-bg: #fdecea; --high-fg: #a01b12; --high-bd: #f4bcb6;
+    --med-bg:  #fff4e0; --med-fg:  #8a5a00; --med-bd:  #f3d79a;
+    --low-bg:  #e8eefc; --low-fg:  #244a9c; --low-bd:  #c4d3f4;
+    --info-bg: #eef1f5; --info-fg: #4a5568; --info-bd: #d4dae3;
+  }
+  .pill.CRITICAL { background: var(--crit-bg); color: var(--crit-fg); border-color: var(--crit-bd); }
+  .pill.HIGH     { background: var(--high-bg); color: var(--high-fg); border-color: var(--high-bd); }
+  .pill.MEDIUM   { background: var(--med-bg);  color: var(--med-fg);  border-color: var(--med-bd); }
+  .pill.LOW      { background: var(--low-bg);  color: var(--low-fg);  border-color: var(--low-bd); }
+  .pill.INFO     { background: var(--info-bg); color: var(--info-fg); border-color: var(--info-bd); }
+  .group { margin-top: 32px; }
+  .group > h2 {
+    font-size: 13px;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    color: #5b6b85;
+    border-bottom: 1px solid #dde3ed;
+    padding-bottom: 8px;
+    margin: 0 0 16px;
+  }
+  .finding {
+    background: #fff;
+    border: 1px solid #e2e7f0;
+    border-left: 4px solid #c4d3f4;
+    border-radius: 8px;
+    padding: 16px 18px;
+    margin-bottom: 14px;
+  }
+  .finding.CRITICAL { border-left-color: #c0182e; }
+  .finding.HIGH     { border-left-color: #d63a2e; }
+  .finding.MEDIUM   { border-left-color: #e0921a; }
+  .finding.LOW      { border-left-color: #3a6fd8; }
+  .finding.INFO     { border-left-color: #8e9aad; }
+  .finding .head { display: flex; flex-wrap: wrap; align-items: center; gap: 10px; }
+  .badge {
+    display: inline-block;
+    padding: 2px 9px;
+    border-radius: 5px;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.04em;
+    border: 1px solid transparent;
+  }
+  .badge.CRITICAL { background: var(--crit-bg); color: var(--crit-fg); border-color: var(--crit-bd); }
+  .badge.HIGH     { background: var(--high-bg); color: var(--high-fg); border-color: var(--high-bd); }
+  .badge.MEDIUM   { background: var(--med-bg);  color: var(--med-fg);  border-color: var(--med-bd); }
+  .badge.LOW      { background: var(--low-bg);  color: var(--low-fg);  border-color: var(--low-bd); }
+  .badge.INFO     { background: var(--info-bg); color: var(--info-fg); border-color: var(--info-bd); }
+  .finding .rule { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 13px; font-weight: 600; }
+  .finding .oid { color: #5b6b85; font-size: 12px; font-weight: 500; }
+  .finding .loc {
+    margin: 8px 0 0;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    color: #5b6b85;
+  }
+  .finding .msg { margin: 8px 0 0; }
+  .finding pre {
+    margin: 12px 0 0;
+    background: #0f1729;
+    color: #e4ebf5;
+    border-radius: 6px;
+    padding: 12px 14px;
+    overflow-x: auto;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12.5px;
+    line-height: 1.45;
+  }
+  .finding pre .ln { color: #5b6b85; user-select: none; margin-right: 14px; }
+  .finding .doc { margin: 10px 0 0; font-size: 13px; }
+  .finding .doc a { color: #2f6feb; text-decoration: none; }
+  .finding .doc a:hover { text-decoration: underline; }
+  .empty {
+    margin-top: 40px;
+    text-align: center;
+    background: #fff;
+    border: 1px solid #e2e7f0;
+    border-radius: 10px;
+    padding: 48px 24px;
+  }
+  .empty .check { font-size: 40px; color: #1f9d55; }
+  .empty h2 { margin: 12px 0 4px; font-size: 20px; }
+  .empty p { margin: 0; color: #5b6b85; }
+  footer.report { margin-top: 40px; color: #8090a8; font-size: 12px; text-align: center; }
+  footer.report a { color: #5b6b85; }
+  @media print {
+    body { background: #fff; }
+    .finding, .empty { break-inside: avoid; }
+  }
+`;
+const SEVERITY_LABEL = {
+    CRITICAL: 'Critical',
+    HIGH: 'High',
+    MEDIUM: 'Medium',
+    LOW: 'Low',
+    INFO: 'Info',
+};
+function renderSummary(counts, total) {
+    const pills = SEVERITY_ORDER.filter((s) => counts[s] > 0)
+        .map((s) => `<span class="pill ${s}"><span class="n">${counts[s]}</span> ${escapeHtml(SEVERITY_LABEL[s])}</span>`)
+        .join('\n        ');
+    const totalPill = `<span class="pill total"><span class="n">${total}</span> total</span>`;
+    return `<div class="summary">\n        ${totalPill}${pills ? `\n        ${pills}` : ''}\n      </div>`;
+}
+function renderSnippet(snippet, startLine) {
+    if (snippet === null)
+        return '';
+    // A blank flagged line is worth nothing to show; skip it.
+    if (snippet.trim() === '')
+        return '';
+    return `\n        <pre><span class="ln">${escapeHtml(startLine)}</span>${escapeHtml(snippet)}</pre>`;
+}
+function renderFinding(f, snippet) {
+    const oid = f.oauthlintRuleId
+        ? ` <span class="oid">(${escapeHtml(f.oauthlintRuleId)})</span>`
+        : '';
+    const message = escapeHtml(f.message).replace(/\r?\n/g, '<br>');
+    const doc = f.docUrl
+        ? `\n        <p class="doc">📖 <a href="${escapeHtml(f.docUrl)}" rel="noreferrer noopener">${escapeHtml(f.docUrl)}</a></p>`
+        : '';
+    return `      <article class="finding ${f.severity}">
+        <div class="head">
+          <span class="badge ${f.severity}">${escapeHtml(f.severity)}</span>
+          <span class="rule">${escapeHtml(f.ruleId)}</span>${oid}
+        </div>
+        <p class="loc">${escapeHtml(f.filePath)}:${escapeHtml(f.startLine)}</p>
+        <p class="msg">${message}</p>${renderSnippet(snippet, f.startLine)}${doc}
+      </article>`;
+}
+function renderGroups(findings, snippets) {
+    const groups = [];
+    for (const sev of SEVERITY_ORDER) {
+        const inGroup = findings.filter((f) => f.severity === sev);
+        if (inGroup.length === 0)
+            continue;
+        const body = inGroup.map((f) => renderFinding(f, snippets.get(f) ?? null)).join('\n');
+        groups.push(`    <section class="group">
+      <h2>${escapeHtml(SEVERITY_LABEL[sev])} · ${inGroup.length}</h2>
+${body}
+    </section>`);
+    }
+    return groups.join('\n');
+}
+function formatTimestamp(generatedAt) {
+    if (typeof generatedAt === 'string')
+        return generatedAt;
+    const d = generatedAt ?? new Date();
+    return d.toISOString();
+}
+/**
+ * Build the full HTML report document for a scan result. The only side effect
+ * is best-effort disk reads for code snippets (skippable via
+ * {@link HtmlReportOptions.readSnippet}). Returns the complete document string.
+ */
+export async function renderHtmlReport(result, options) {
+    const { findings } = result;
+    const counts = severityCounts(findings);
+    const total = findings.length;
+    const timestamp = formatTimestamp(options.generatedAt);
+    const snippets = await resolveSnippets(findings, options.readSnippet);
+    const body = total === 0
+        ? `    <div class="empty">
+      <div class="check">✓</div>
+      <h2>No issues found</h2>
+      <p>OAuthLint scanned the target${result.scannedFiles ? ` (${result.scannedFiles} file${result.scannedFiles === 1 ? '' : 's'})` : ''} and found no auth misconfigurations.</p>
+    </div>`
+        : `${renderSummary(counts, total)}
+${renderGroups(findings, snippets)}`;
+    const footerBits = [
+        options.version ? `OAuthLint v${escapeHtml(options.version)}` : 'OAuthLint',
+        result.semgrepVersion ? `semgrep ${escapeHtml(result.semgrepVersion)}` : null,
+        result.scannedFiles ? `${result.scannedFiles} file(s) scanned` : null,
+    ].filter((x) => x !== null);
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>OAuthLint Report</title>
+<style>${STYLES}</style>
+</head>
+<body>
+  <header class="report">
+    <div class="wrap">
+      <h1><span class="mark">OAuth</span>Lint — Security Audit Report</h1>
+      <p class="meta">
+        Target: <code>${escapeHtml(options.target)}</code><br>
+        Generated: <code>${escapeHtml(timestamp)}</code>
+      </p>
+    </div>
+  </header>
+  <main class="wrap">
+${body}
+    <footer class="report">${escapeHtml(footerBits.join(' · '))}</footer>
+  </main>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=html.js.map

package/dist/formatters/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/formatters/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAwC5C,MAAM,cAAc,GAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,QAAmB;IACzC,MAAM,MAAM,GAAiC;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IACnE,IAAI,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAmB,EACnB,IAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,OAAkC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyId,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,aAAa,CAAC,MAAoC,EAAE,KAAa;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACtD,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,qBAAqB,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CACxG;SACA,IAAI,CAAC,YAAY,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,4CAA4C,KAAK,sBAAsB,CAAC;IAC1F,OAAO,kCAAkC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,SAAiB;IAC9D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,0DAA0D;IAC1D,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,mCAAmC,UAAU,CAAC,SAAS,CAAC,UAAU,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;AACvG,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,OAAsB;IACvD,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe;QAC3B,CAAC,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU;QAChE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM;QAClB,CAAC,CAAC,wCAAwC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,+BAA+B,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;QAC3H,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,iCAAiC,CAAC,CAAC,QAAQ;;+BAErB,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;+BACrC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG;;yBAEvC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;yBACjD,OAAO,OAAO,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG;iBAC/D,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,QAAmB,EAAE,QAAqC;IAC9E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CACT;YACM,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM;EAC7D,IAAI;eACS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,WAAsC;IAC7D,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IACxD,MAAM,CAAC,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEtE,MAAM,IAAI,GACR,KAAK,KAAK,CAAC;QACT,CAAC,CAAC;;;uCAG+B,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE;WAC9H;QACL,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;EACrC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW;QAC3E,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC7E,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,kBAAkB,CAAC,CAAC,CAAC,IAAI;KACtE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEzC,OAAO;;;;;;SAMA,MAAM;;;;;;;wBAOS,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;2BACvB,UAAU,CAAC,SAAS,CAAC;;;;;EAK9C,IAAI;6BACuB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;;;CAI9D,CAAC;AACF,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { buildProgram } from './cli.js';
 export { runScan, type ScanCommandOptions } from './commands/scan.js';
+export { runBaseline, type BaselineCommandOptions } from './commands/baseline.js';
+export { BASELINE_VERSION, DEFAULT_BASELINE_FILE, type Baseline, type BaselineEntry, type BaselineFile, BaselineNotFoundError, BaselineParseError, buildBaseline, fingerprintFindings, loadBaseline, partitionByBaseline, serialiseBaseline, } from './core/baseline.js';
 export { runList, type ListOptions } from './commands/list.js';
 export { runInit, type InitOptions } from './commands/init.js';
 export { runDoctor, type DoctorOptions } from './commands/doctor.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}