oauthlint 0.4.0 → 0.6.0

package/README.md

@@ -2,15 +2,16 @@
 
 # oauthlint
 
-**Catch the OAuth / OIDC / JWT anti-patterns AI coding tools systematically produce.**
+**Catch the OAuth / OIDC / JWT / session / CORS anti-patterns AI coding tools systematically produce.**
 
-A curated, multi-language Semgrep rule pack · JS/TS · Python · Go · Java · Rust (and growing) · CLI + GitHub Action + VS Code · free & MIT
+A curated, multi-language Semgrep rule pack · JS/TS · Python · Go · Java · Rust · CLI + GitHub Action + VS Code · free & MIT
 
 [![npm](https://img.shields.io/npm/v/oauthlint.svg)](https://www.npmjs.com/package/oauthlint)
 [![npm downloads](https://img.shields.io/npm/dm/oauthlint.svg)](https://www.npmjs.com/package/oauthlint)
 [![CI](https://github.com/Auspeo/oauthlint/actions/workflows/ci.yml/badge.svg)](https://github.com/Auspeo/oauthlint/actions/workflows/ci.yml)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![docs](https://img.shields.io/badge/docs-oauthlint.dev-2f6feb.svg)](https://oauthlint.dev)
+[![powered by Semgrep](https://img.shields.io/badge/powered%20by-Semgrep-0a7d6b.svg)](https://semgrep.dev)
 
 </div>
 
@@ -20,59 +21,10 @@ npx oauthlint scan ./src
 
 > Requires [Semgrep](https://semgrep.dev/docs/getting-started/) on the machine running the scan (`pipx install semgrep` or `brew install semgrep`). The CLI invokes it under the hood and normalises the output for humans and CI.
 
-📖 **Full documentation & rule catalogue → [oauthlint.dev](https://oauthlint.dev)**
+📖 **Full docs & rule catalogue → [oauthlint.dev/docs](https://oauthlint.dev/docs)** · 🔬 **the research behind it → [oauthlint.dev/research](https://oauthlint.dev/research)**
 
 ---
 
-## The problem
-
-LLM coding assistants — Cursor, Claude, GitHub Copilot, Gemini — ship the *same*
-OAuth/JWT mistakes across every project they touch:
-
-- a JWT verified with `alg: none` accepted
-- `client_secret` hard-coded in source
-- an OAuth flow with no `state` and no PKCE
-- a token written to `localStorage`, readable by any XSS
-- `redirect_uri` allow-listed with a `*` wildcard
-- a `/login` POST with no rate limiting
-- a password persisted in plaintext
-- `Math.random()` used for a CSRF token
-
-oauthlint is the layer between generic SAST and an enterprise IAM program:
-**free, focused, developer-first.** Every finding names the rule, the exact
-`file:line`, *why* it's dangerous, and *how* to fix it — with CWE/OWASP mappings.
-
-<div align="center">
-
-![oauthlint scanning a project and flagging JWT auth issues](https://raw.githubusercontent.com/Auspeo/oauthlint/main/docs/public/demo.gif)
-
-</div>
-
-## Why oauthlint, and not just Semgrep?
-
-Honest answer: nothing stops you from writing these rules yourself. Semgrep is
-open source — it's the engine we run — and a capable engineer could reproduce a
-lot of this. There's no technical moat and we won't pretend otherwise. What
-oauthlint gives you is the work most people never do:
-
-- **Low false positives, validated against real auth libraries.** The rules are
-  run against `jose`, NextAuth, PyJWT, Authlib, `golang/oauth2`, `oauth2-rs`,
-  Spring Security and more. Anything that fires on mature library source goes to
-  a triage queue, not to you — validated across thousands of files of real
-  auth-library source, with **zero false positives** on the clean libraries
-  ([validation report](https://oauthlint.dev/VALIDATION)).
-- **One coherent product across every language it covers.** Same concepts, same ID scheme,
-  same docs — not a patchwork of community rules with mismatched styles.
-- **Every finding teaches.** The 100+ rules — across JS/TS · Python · Go · Java
-  · Rust — each link to a fix page with CWE and OWASP mappings. It's a lesson,
-  not a grep hit.
-- **The angle the registry doesn't have:** oauthlint specifically targets the
-  auth bugs AI coding tools ship on repeat, encoded in each rule's
-  `llm-prevalence` metadata and measured by a [reproducible benchmark](https://github.com/Auspeo/oauthlint/tree/main/benchmark).
-
-Use oauthlint when you'd rather not write and maintain an auth rule pack
-yourself. That's the whole pitch.
-
 ## Quick start
 
 ```bash
@@ -82,236 +34,56 @@ npx oauthlint scan ./src
 # fail CI on HIGH severity and above
 npx oauthlint scan ./src --fail-on HIGH
 
-# machine-readable output
-npx oauthlint scan ./src --json
-
-# GitHub Code Scanning
+# GitHub Code Scanning (SARIF) or a shareable HTML audit report
 npx oauthlint scan ./src --format sarif > oauthlint.sarif
+npx oauthlint scan ./src --format html  > report.html
 
-# auto-apply safe fixes (e.g. cookie flags)
-npx oauthlint scan ./src --fix
-
-# scan several explicit paths (e.g. a list of changed files)
-npx oauthlint scan src/auth.ts src/session.ts
-
-# scan only what changed vs the default branch (fast, incremental)
-npx oauthlint scan --diff
-
-# scan only git-staged files (ideal in a pre-commit hook)
-npx oauthlint scan --staged
-
-# adopt on a large existing codebase: snapshot today's findings…
-npx oauthlint baseline ./src
-# …then only get alerted on NEW findings from here on
-npx oauthlint scan ./src --baseline --fail-on HIGH
+# learn a rule in the terminal: the why, the fix, and vulnerable/safe examples
+npx oauthlint explain auth.jwt.alg-none
 ```
 
-## Adopting on an existing codebase (baseline)
-
-Turning a linter on for the first time on a large repo usually drowns you in
-pre-existing findings. A **baseline** snapshots the findings that exist *today*
-so `scan` only alerts on **new** ones — letting you adopt OAuthLint without
-fixing everything up front.
+Scan only what changed for fast pre-commit hooks and editors with `--diff` / `--staged`, or adopt on a large repo with a [baseline](https://oauthlint.dev/docs/baseline) (`oauthlint baseline ./src` then `scan --baseline`) so you're alerted on **new** findings only. Other commands: `list`, `explain`, `init`, `doctor`. Run `oauthlint --help` or see the [full CLI reference](https://oauthlint.dev/docs/cli).
 
-```bash
-# 1. capture the current findings into .oauthlint-baseline.json (commit this file)
-oauthlint baseline ./src
-
-# 2. from now on, scan reports only findings NOT in the baseline
-oauthlint scan ./src --baseline --fail-on HIGH
-```
+### Every finding teaches
 
-- **`oauthlint baseline [paths...]`** scans and writes
-  `.oauthlint-baseline.json` (override with `-o, --output <file>`). It prints how
-  many findings were baselined. Commit the file so the whole team shares it.
-- **`oauthlint scan --baseline [file]`** runs a normal scan, then suppresses any
-  finding already in the baseline and reports only the rest. `--fail-on` and the
-  exit code consider **only the new findings**. With no value it defaults to
-  `.oauthlint-baseline.json`; a missing baseline file is a **clear error**
-  (exit `2`), never silently treated as empty.
-
-**How a finding is fingerprinted.** Each finding gets a stable fingerprint —
-`sha256(oauthlintRuleId + repo-relative path + a whitespace-normalised snapshot
-of the matched code)`. Crucially the **raw line number is not part of the hash**,
-so moving a finding up or down (adding imports, reformatting) keeps it
-baselined, while **changing the flagged code** surfaces it as new. The same
-fingerprint occurring multiple times in one file is disambiguated by a
-deterministic occurrence index. Paths are normalised to repo/cwd-relative
-(POSIX separators) so a baseline is portable across machines, and unreadable
-files (deleted/binary) degrade gracefully instead of crashing. The baseline
-JSON is small, sorted and human-diffable (a `version`, a `generatedAt`, and the
-fingerprint list).
-
-## Incremental scanning
-
-For pre-commit hooks and editor integrations, scanning the whole tree on every
-keystroke is wasteful. OAuthLint can scan **only the files that changed**:
+Each finding ends with a hint, `↳ run \`oauthlint explain <rule-id>\` for details + the fix`. `oauthlint explain` brings the rule docs into your terminal, offline, from the bundled pack: severity, CWE/OWASP with canonical links, `llm-prevalence`, the why + how-to-fix, and side-by-side **vulnerable** vs **safe** code. It resolves a rule by id (`auth.jwt.alg-none`), slug (`jwt-alg-none`), or oauthlint-rule-id (`AUTH-JWT-001`); add `--json` for the structured rule object.
 
-```bash
-# files changed vs the merge-base with the repo's default branch
-oauthlint scan --diff
+## What it catches
 
-# files changed vs an explicit ref (branch, tag, or commit)
-oauthlint scan --diff origin/main
-oauthlint scan --diff HEAD~5
+LLM coding assistants (Cursor, Claude, Copilot, Gemini) ship the *same* auth bugs across every project: a JWT accepted with `alg: none`, a hard-coded `client_secret`, an OAuth flow with no `state`/PKCE, a token in `localStorage`, a `*` wildcard `redirect_uri`, an unrate-limited `/login`, a plaintext password, `Math.random()` for a CSRF token.
 
-# only git-staged files — drop this in a pre-commit hook
-oauthlint scan --staged --fail-on HIGH
-```
+- **100+ rules** across **JS/TS · Python · Go · Java · Rust**, each mapped to CWE/OWASP with a fix page (a lesson, not a grep hit).
+- **Dataflow (taint) analysis.** Beyond pattern-matching, the pack traces untrusted input through to dangerous sinks to catch **open-redirect** and **SSRF**.
+- **HTML report.** `scan --format html` renders a self-contained, offline, no-JavaScript audit you can email or attach to a PR.
+- Plus **SARIF** for Code Scanning, `--fix` for safe auto-fixes, incremental `--diff`/`--staged`, and a [baseline](https://oauthlint.dev/docs/baseline) for existing codebases.
 
-How the change set is resolved:
+👉 **Browse the always-current catalogue at [oauthlint.dev/rules](https://oauthlint.dev/rules/).**
 
-- **`--diff [ref]`** — when no `ref` is given, the base is the merge-base with the
-  repo's default branch (`origin/HEAD` → `origin/main` → `origin/master`, falling
-  back to `HEAD` when there's no remote). The change set is everything Added /
-  Copied / Modified / Renamed since that base, plus uncommitted work-tree and
-  staged changes, plus new untracked files. Deleted files are skipped.
-- **`--staged`** — only the staged set (`git diff --cached`), the same files a
-  commit is about to capture.
-- Explicit path args (`oauthlint scan a.ts b.ts`) scan exactly those paths.
+## Use directly with Semgrep, no install
 
-In every mode, files in a language the rule pack doesn't cover (Markdown,
-lockfiles, images, …) are filtered out automatically, and an **empty change set
-exits `0`** with a `No changed files to scan.` note — it never fails your commit.
-Outside a git repository, `--diff` / `--staged` print a clear error and exit `2`
-instead of crashing. Git is always invoked with arguments passed as an array
-(never a shell string), so a ref name can't inject a shell command.
-
-Example pre-commit hook (`.git/hooks/pre-commit`):
+Already have [Semgrep](https://semgrep.dev)? Run the full pack with one command, no config file:
 
 ```bash
-#!/bin/sh
-npx oauthlint scan --staged --fail-on HIGH
-```
-
-## Commands
-
-```
-oauthlint scan [paths...]       Scan files/directories (default: current dir)
-oauthlint scan a.ts b.ts        Scan an explicit list of paths
-oauthlint scan --diff [ref]     Scan only files changed vs a git ref
-oauthlint scan --staged         Scan only git-staged files (pre-commit)
-oauthlint scan --json           Emit machine-readable JSON
-oauthlint scan --format sarif   Emit SARIF for GitHub Code Scanning
-oauthlint scan --severity HIGH  Only show findings ≥ HIGH
-oauthlint scan --fail-on off    Never fail the build (CI dry-run)
-oauthlint scan --fix            Auto-apply safe fixes
-oauthlint scan --baseline       Report only findings NOT in the baseline
-oauthlint baseline [paths...]   Snapshot current findings to a baseline file
-oauthlint baseline -o <file>    Write the baseline to a custom path
-oauthlint list                  List every shipped rule
-oauthlint list --json           Same, as JSON
-oauthlint init                  Generate .oauthlintrc.yml at cwd
-oauthlint init --force          Overwrite an existing config
-oauthlint doctor                Check your setup (Semgrep, config, …)
-oauthlint --no-update-check     Skip the "update available" check (any command)
-```
-
-## Use it in CI
-
-Run the CLI in a workflow and upload SARIF to **GitHub Code Scanning** so
-findings appear inline on the PR:
-
-```yaml
-# .github/workflows/oauthlint.yml
-jobs:
-  oauthlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: pipx install semgrep          # the engine oauthlint runs
-      - run: npx oauthlint scan ./src --format sarif > oauthlint.sarif
-      - uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: oauthlint.sarif
-```
-
-Or just fail the build on HIGH findings: `npx oauthlint scan ./src --fail-on HIGH`.
-
-### GitHub Action
-
-Prefer not to wire up the CLI by hand? The **[GitHub Action](https://github.com/Auspeo/oauthlint/tree/main/action)** wraps it for you — it's Docker-based, so it runs in any repo regardless of language:
-
-```yaml
-- uses: Auspeo/oauthlint/action@v1
-  with:
-    severity: HIGH
-    fail-on: HIGH
+semgrep --config https://oauthlint.dev/r/oauthlint.yaml ./src
 ```
 
-### VS Code extension
+Per-language bundles exist too (`oauthlint-python.yaml`, `oauthlint-go.yaml`, …). That URL is always the latest pack; for a pinned ruleset in CI, use this CLI (`npx oauthlint@<version> scan`) or vendor [`oauthlint-rules`](https://www.npmjs.com/package/oauthlint-rules). See [the Semgrep docs](https://oauthlint.dev/docs/semgrep).
 
-Catch findings as you type. Install **[oauthlint](https://marketplace.visualstudio.com/items?itemName=auspeo.oauthlint-vscode)** (`auspeo.oauthlint-vscode`) from the VS Code Marketplace for inline diagnostics on save, plus Quick Fix suppressions.
-
-## What it catches
-
-Rules across OAuth 2.0, OIDC, JWT, cookies, CORS, secrets and session hygiene —
-each mapped to CWE & OWASP, each with a documentation page. Languages covered
-today (more on the way):
-
-| Language | Libraries |
-|----------|-----------|
-| JavaScript / TypeScript | jose, jsonwebtoken, NextAuth, express, … |
-| Python | PyJWT, Authlib, requests, Flask, Django |
-| Java | Spring Security, jjwt, nimbus-jose-jwt |
-| Go | golang-jwt, crypto/tls, net/http |
-| Rust | jsonwebtoken, reqwest, actix/tower |
-
-👉 **Browse the full, always-current catalogue at [oauthlint.dev/rules](https://oauthlint.dev/rules/).**
-
-## Configuration
-
-Generate a `.oauthlintrc.yml` at your repo root with `oauthlint init`:
-
-```yaml
-version: 1
-include:
-  - "src/**/*.{ts,tsx,js,jsx}"
-exclude:
-  - "**/*.test.ts"
-rules:
-  auth.cookie.no-samesite: warn
-  auth.session.id-in-url: off
-failOn: HIGH
-```
-
-### Inline suppression
-
-```ts
-// oauthlint-disable-next-line auth.jwt.alg-none -- legacy code, replaced in Q2
-return jwt.verify(token, key, { algorithms: ['RS256', 'none'] });
-```
-
-Wholesale silencing (`oauthlint-disable-file *`) is intentionally unsupported —
-the next reviewer needs to see exactly which lines opted out, and why.
-
-## Exit codes
-
-| Code | When |
-|:----:|------|
-| `0` | No finding at or above the `--fail-on` threshold |
-| `1` | At least one **HIGH** finding |
-| `2` | At least one **CRITICAL** finding, a scan whose output could not be parsed (it never silently exits clean), or a missing/malformed `--baseline` file |
-| `127` | Semgrep is not installed |
+## Why oauthlint, and not just Semgrep?
 
-> With `--baseline`, the `--fail-on` gate and these exit codes consider only the
-> **new** (non-baselined) findings.
+Honest answer: nothing stops you writing these rules yourself. Semgrep is open source and it's the engine we run, so there's no technical moat. What oauthlint gives you is the work most people never do:
 
-## Stay up to date
+- **Low false positives, validated against real auth libraries.** `jose`, NextAuth, PyJWT, Authlib, `golang/oauth2`, `oauth2-rs`, Spring Security and more. Anything that fires on mature library source goes to a triage queue, not to you ([validation report](https://oauthlint.dev/VALIDATION)).
+- **One coherent product across every language.** Same concepts, same ID scheme, same docs, not a patchwork of community rules.
+- **The angle the registry doesn't have.** It targets the auth bugs AI tools ship on repeat, encoded in each rule's `llm-prevalence` metadata and measured by a reproducible benchmark ([the research](https://oauthlint.dev/research)).
 
-oauthlint occasionally prints a short *"Update available"* notice to **stderr**
-when a newer version is on npm. It's designed to stay out of your way:
+Use oauthlint when you'd rather not write and maintain an auth rule pack yourself. That's the whole pitch.
 
-- It's **non-blocking** and checks npm at most **once a day** (the result is
-  cached), so it never slows a scan down.
-- It writes to **stderr only** and is **silent** under `--json` / `--format
-  sarif`, when output is piped, in CI, and offline — so it can never corrupt a
-  machine-readable report or nag automated runs.
+## Also available
 
-To turn it off entirely, pass `--no-update-check` or set the standard
-`NO_UPDATE_NOTIFIER=1` environment variable.
+- **GitHub Action.** `Auspeo/oauthlint/action@v1`, Docker-based (any language), with inline PR annotations and a job summary. [Docs](https://github.com/Auspeo/oauthlint/tree/main/action).
+- **VS Code / Cursor / Windsurf.** [oauthlint](https://marketplace.visualstudio.com/items?itemName=auspeo.oauthlint-vscode) on the VS Code Marketplace and [OpenVSX](https://open-vsx.org/extension/auspeo/oauthlint-vscode): inline diagnostics on save, a status-bar finding count, and Quick Fix suppressions.
 
 ## License
 
-MIT — see [LICENSE](https://github.com/Auspeo/oauthlint/blob/main/LICENSE).
-Built and maintained by [Auspeo](https://github.com/Auspeo).
+MIT. See [LICENSE](https://github.com/Auspeo/oauthlint/blob/main/LICENSE). Built and maintained by [Auspeo](https://github.com/Auspeo).

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyEpC,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAwHrD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0EpC,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAyIrD"}

package/dist/cli.js

@@ -5,6 +5,7 @@ import { Command } from 'commander';
 import pc from 'picocolors';
 import { runBaseline } from './commands/baseline.js';
 import { runDoctor } from './commands/doctor.js';
+import { runExplain } from './commands/explain.js';
 import { runInit } from './commands/init.js';
 import { runList } from './commands/list.js';
 import { runScan } from './commands/scan.js';
@@ -80,7 +81,7 @@ export async function buildProgram() {
         .argument('[paths...]', 'One or more files/directories to scan', ['.'])
         .description('Scan files or directories for auth misconfigurations')
         .option('--json', 'Emit JSON (shortcut for --format json)')
-        .option('--format <fmt>', 'Output format: pretty | json | sarif', parseFormat)
+        .option('--format <fmt>', 'Output format: pretty | json | sarif | html', parseFormat)
         .option('--severity <level>', 'Only emit findings ≥ this severity', parseSeverity)
         .option('--fail-on <level>', 'Process exits non-zero if any finding ≥ this severity', parseFailOn)
         .option('--diff [ref]', 'Scan only files changed vs a git ref (default: merge-base with the default branch)')
@@ -101,7 +102,10 @@ export async function buildProgram() {
             fix: opts.fix,
             baseline: opts.baseline,
         });
-        const machineReadable = opts.json === true || opts.format === 'json' || opts.format === 'sarif';
+        const machineReadable = opts.json === true ||
+            opts.format === 'json' ||
+            opts.format === 'sarif' ||
+            opts.format === 'html';
         await finishWithNotice(code, { version, machineReadable, updateCheck: updateCheckEnabled() });
     });
     program
@@ -147,6 +151,19 @@ export async function buildProgram() {
             updateCheck: updateCheckEnabled(),
         });
     });
+    program
+        .command('explain')
+        .argument('<rule>', 'A rule id (auth.jwt.alg-none), slug (jwt-alg-none), or AUTH-JWT-001')
+        .description('Explain one rule — why it matters, the fix, and vulnerable/safe examples')
+        .option('--json', 'Emit the structured rule object instead of pretty output')
+        .action(async (rule, opts) => {
+        const code = await runExplain({ rule, json: opts.json });
+        await finishWithNotice(code, {
+            version,
+            machineReadable: opts.json === true,
+            updateCheck: updateCheckEnabled(),
+        });
+    });
     program
         .command('doctor')
         .description('Diagnose your OAuthLint install (Node, Semgrep, rule pack)')
@@ -174,7 +191,7 @@ function parseFailOn(v) {
         return 'off';
     return parseSeverity(v);
 }
-const FORMATS = ['pretty', 'json', 'sarif'];
+const FORMATS = ['pretty', 'json', 'sarif', 'html'];
 function parseFormat(v) {
     const lower = v.toLowerCase();
     if (!FORMATS.includes(lower)) {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAM3D;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,EAAE,CAAC;YACN,OAAO;QACT,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,GAAwE;IAExE,MAAM,iBAAiB,CAAC;QACtB,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,iDAAiD;IACjD,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;SACJ,IAAI,CAAC,WAAW,CAAC;SACjB,WAAW,CACV,4FAA4F,CAC7F;SACA,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;IAEjF,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC;IAE/E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,WAAW,CAAC;SAC7E,MAAM,CAAC,oBAAoB,EAAE,oCAAoC,EAAE,aAAa,CAAC;SACjF,MAAM,CACL,mBAAmB,EACnB,uDAAuD,EACvD,WAAW,CACZ;SACA,MAAM,CACL,cAAc,EACd,oFAAoF,CACrF;SACA,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,4DAA4D,CAAC;SAC7E,MAAM,CACL,mBAAmB,EACnB,4GAA4G,CAC7G;SACA,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAoB,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,eAAe,GACnB,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC;QAC1E,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CACV,sFAAsF,CACvF;SACA,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,EAAE,0BAA0B,CAAC;SAC7F,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAwB,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,iEAAiE;QACjE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAsBD,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAkB,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AACrD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAgB,CAAC;IAC5C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAmB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAM3D;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,EAAE,CAAC;YACN,OAAO;QACT,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,GAAwE;IAExE,MAAM,iBAAiB,CAAC;QACtB,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,iDAAiD;IACjD,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI;QACtB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACnC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;YACrE,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE3C,OAAO;SACJ,IAAI,CAAC,WAAW,CAAC;SACjB,WAAW,CACV,4FAA4F,CAC7F;SACA,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;IAEjF,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC;IAE/E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,WAAW,CAAC;SACpF,MAAM,CAAC,oBAAoB,EAAE,oCAAoC,EAAE,aAAa,CAAC;SACjF,MAAM,CACL,mBAAmB,EACnB,uDAAuD,EACvD,WAAW,CACZ;SACA,MAAM,CACL,cAAc,EACd,oFAAoF,CACrF;SACA,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,4DAA4D,CAAC;SAC7E,MAAM,CACL,mBAAmB,EACnB,4GAA4G,CAC7G;SACA,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAoB,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,eAAe,GACnB,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,IAAI,CAAC,MAAM,KAAK,OAAO;YACvB,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACzB,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CAAC,YAAY,EAAE,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC;SACtE,WAAW,CACV,sFAAsF,CACvF;SACA,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,EAAE,0BAA0B,CAAC;SAC7F,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,IAAwB,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,iEAAiE;QACjE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,QAAQ,CAAC,QAAQ,EAAE,qEAAqE,CAAC;SACzF,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CAAC,QAAQ,EAAE,0DAA0D,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAwB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,gBAAgB,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACnC,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,CAAC;AACjB,CAAC;AAsBD,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAkB,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC7D,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAgB,CAAC;IAC5C,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/explain.d.ts

@@ -0,0 +1,58 @@
+import { type SeverityName } from '../types.js';
+export interface ExplainOptions {
+    /** The rule to explain — a rule id, slug, or oauthlint-rule-id. */
+    rule: string;
+    /** When true, emit the structured rule object as JSON instead of pretty output. */
+    json?: boolean;
+    /** Stream to write the explanation to (defaults to process.stdout). */
+    stream?: NodeJS.WritableStream;
+    /** Stream for errors / chrome (defaults to process.stderr). */
+    errStream?: NodeJS.WritableStream;
+    /** Override the bundled rules root (used by tests). */
+    rulesRoot?: string;
+}
+interface CodeExample {
+    /** Absolute path to the fixture file the example was read from. */
+    file: string;
+    /** The fixture source, with Semgrep test annotations stripped. */
+    code: string;
+}
+/** The structured object emitted by `--json` and rendered by the pretty path. */
+export interface ExplainedRule {
+    id: string;
+    oauthlintRuleId: string;
+    slug: string;
+    /** Rule-declared Semgrep severity (INFO | WARNING | ERROR). */
+    severity: string;
+    /** The 5-level severity a scan finding would carry (mapped from `severity`). */
+    findingSeverity: SeverityName;
+    /** Rule family taken from the id, e.g. `jwt`, `oauth`, `cookie`. */
+    category: string;
+    /** Language segment of the id for language packs (e.g. `py`, `go`), else null. */
+    language: string | null;
+    languages: string[];
+    cwe: string | null;
+    cweUrl: string | null;
+    owasp: string | null;
+    owaspUrl: string | null;
+    llmPrevalence: 'HIGH' | 'MEDIUM' | 'LOW';
+    message: string;
+    docUrl: string;
+    references: string[];
+    technology: string[];
+    examples: {
+        vulnerable: CodeExample | null;
+        safe: CodeExample | null;
+    };
+}
+/**
+ * `oauthlint explain <rule>` — bring the rule docs into the terminal.
+ *
+ * Resolves `<rule>` offline from the bundled pack by rule id
+ * (`auth.jwt.alg-none`), slug (`jwt-alg-none`), or oauthlint-rule-id
+ * (`AUTH-JWT-001`), then prints the why/how-to-fix plus the vulnerable & safe
+ * code examples. `--json` emits the structured rule object instead.
+ */
+export declare function runExplain(opts: ExplainOptions): Promise<number>;
+export {};
+//# sourceMappingURL=explain.d.ts.map

package/dist/commands/explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.d.ts","sourceRoot":"","sources":["../../src/commands/explain.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAClC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,WAAW;IACnB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,eAAe,EAAE,YAAY,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE;QACR,UAAU,EAAE,WAAW,GAAG,IAAI,CAAC;QAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBtE"}