swarmdo 1.19.0 → 1.27.0

package/v3/@swarmdo/cli/dist/src/env/env.js

@@ -28,6 +28,8 @@ const REF_PATTERNS = [
     /os\.environ\.get\(\s*['"]([^'"]+)['"]\s*\)/g,
     /os\.getenv\(\s*['"]([^'"]+)['"]\s*\)/g,
 ];
+/** `const { A, B } = process.env` — the brace body (group 1) holds one or more refs. */
+const DESTRUCTURE_RE = /\{\s*([^}]+)\}\s*=\s*process\.env\b(?![.[])/g;
 /** Non-secret prefixes on `import.meta.env` that are Vite builtins, not user vars. */
 const VITE_BUILTINS = new Set(['MODE', 'BASE_URL', 'PROD', 'DEV', 'SSR']);
 /** Extract env-var references from one source file. Pure. */
@@ -48,13 +50,32 @@ export function extractEnvRefs(source, file) {
                 out.push({ key, file, line: i + 1 });
             }
         }
+        // Destructuring reads: `const { PORT, DB_URL } = process.env` (each property
+        // key is an env-var reference). The `(?![.[])` guard keeps it to the bare
+        // `process.env` object, not `= process.env.FOO`. Single-line, like the rest.
+        DESTRUCTURE_RE.lastIndex = 0;
+        let dm;
+        while ((dm = DESTRUCTURE_RE.exec(line)) !== null) {
+            for (const part of dm[1].split(',')) {
+                // The env-var name is the property key — left of a rename `:` or default `=`.
+                const key = part.trim().split(/[:=]/)[0].trim();
+                if (!/^[A-Za-z_$][\w$]*$/.test(key))
+                    continue; // skip `...rest`, empties
+                if (VITE_BUILTINS.has(key))
+                    continue;
+                out.push({ key, file, line: i + 1 });
+            }
+        }
     }
     return out;
 }
 /**
  * Parse a `.env` file into an ordered list of declared keys. Handles `KEY=val`,
- * `export KEY=val`, quoted values, `# comments`, and blank lines. Values are
- * ignored — we only reconcile key presence. Pure.
+ * `export KEY=val`, quoted values, `# comments`, and blank lines. The key
+ * charset + `:` separator mirror the reference `dotenv` package's grammar
+ * (`[\w.-]+` with `=` or `: ` as separator), so dotted/hyphenated keys like
+ * `APP.NAME` aren't silently dropped. Values are ignored — we only reconcile
+ * key presence. Pure.
  */
 export function parseDotenv(text) {
     const keys = [];
@@ -63,7 +84,7 @@ export function parseDotenv(text) {
         const line = raw.trim();
         if (!line || line.startsWith('#'))
             continue;
-        const m = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        const m = line.match(/^(?:export\s+)?([\w.-]+)(?:\s*=|:\s)/);
         if (!m)
             continue;
         if (seen.has(m[1]))

package/v3/@swarmdo/cli/dist/src/hotspots/hotspots.d.ts

@@ -45,6 +45,21 @@ export interface HotspotOptions {
     /** keep only the top N after sorting (default: all) */
     top?: number;
 }
+/**
+ * Resolve git's rename/copy numstat notation to the file's CURRENT (new) path.
+ *
+ * When rename/copy detection fires (git's default for merges, and often
+ * otherwise), `--numstat` doesn't emit a plain path. It emits either the
+ * compact braces form with a shared prefix/suffix around the changed run:
+ *   `src/{old => new}/file.ts`   ·   `{old => new}/file.ts`   ·   `dir/{old => }/f`
+ * or, when there's no shared prefix/suffix, the full form:
+ *   `old/path.ts => new/path.ts`
+ *
+ * We attribute churn to the file's current identity (the NEW path) so a renamed
+ * file's history folds into one entry instead of splitting across two phantom
+ * names. Plain paths pass through untouched. Pure — no git call.
+ */
+export declare function resolveRenamePath(raw: string): string;
 /** Parse a control-char-delimited `git log --numstat` dump into commits. Pure. */
 export declare function parseGitLog(raw: string): Commit[];
 /** Aggregate commits into per-file hotspots, scored and ranked. Pure. */

package/v3/@swarmdo/cli/dist/src/hotspots/hotspots.js

@@ -17,6 +17,38 @@
  */
 const SOH = '\x01'; // start-of-commit marker (git --format=format:%x01...)
 const US = '\x1f'; // field separator (%x1f)
+/**
+ * Resolve git's rename/copy numstat notation to the file's CURRENT (new) path.
+ *
+ * When rename/copy detection fires (git's default for merges, and often
+ * otherwise), `--numstat` doesn't emit a plain path. It emits either the
+ * compact braces form with a shared prefix/suffix around the changed run:
+ *   `src/{old => new}/file.ts`   ·   `{old => new}/file.ts`   ·   `dir/{old => }/f`
+ * or, when there's no shared prefix/suffix, the full form:
+ *   `old/path.ts => new/path.ts`
+ *
+ * We attribute churn to the file's current identity (the NEW path) so a renamed
+ * file's history folds into one entry instead of splitting across two phantom
+ * names. Plain paths pass through untouched. Pure — no git call.
+ */
+export function resolveRenamePath(raw) {
+    const open = raw.indexOf('{');
+    if (open >= 0) {
+        const arrow = raw.indexOf(' => ', open);
+        const close = arrow >= 0 ? raw.indexOf('}', arrow) : -1;
+        if (arrow >= 0 && close >= 0) {
+            const prefix = raw.slice(0, open);
+            const newPart = raw.slice(arrow + 4, close);
+            const suffix = raw.slice(close + 1);
+            // Collapse the empty-side double slash (e.g. `dir/{old => }/f` → `dir/f`).
+            return (prefix + newPart + suffix).replace(/\/{2,}/g, '/');
+        }
+    }
+    const arrow = raw.indexOf(' => ');
+    if (arrow >= 0)
+        return raw.slice(arrow + 4);
+    return raw;
+}
 /** Parse a control-char-delimited `git log --numstat` dump into commits. Pure. */
 export function parseGitLog(raw) {
     const commits = [];
@@ -40,7 +72,7 @@ export function parseGitLog(raw) {
             continue;
         const a = line.slice(0, tab1);
         const d = line.slice(tab1 + 1, tab2);
-        const path = line.slice(tab2 + 1);
+        const path = resolveRenamePath(line.slice(tab2 + 1));
         if (!path)
             continue;
         cur.files.push({ path, added: a === '-' ? 0 : parseInt(a, 10) || 0, deleted: d === '-' ? 0 : parseInt(d, 10) || 0 });

package/v3/@swarmdo/cli/dist/src/license/license.d.ts

@@ -38,7 +38,8 @@ export interface LicenseReport {
 /**
  * Normalize a package.json `license`/`licenses` field to an SPDX string.
  * Handles the modern string, the legacy `{type}` object, and the legacy
- * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ * `licenses: [{type}]` array (→ `A OR B`). npm special values and a missing
+ * field → 'UNKNOWN'.
  */
 export declare function classifyLicense(pkg: {
     license?: unknown;
@@ -46,7 +47,35 @@ export declare function classifyLicense(pkg: {
 }): string;
 /** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
 export declare function spdxComponents(expr: string): string[];
-/** Evaluate one dep against the policy; null if it passes. Pure. */
+/**
+ * Parse an SPDX license expression into DISJUNCTIVE NORMAL FORM: a list of
+ * conjunctive terms, each a set of license ids. `A OR (B AND C)` →
+ * `[['A'], ['B','C']]`. Precedence per the SPDX spec (Annex D): `WITH` binds
+ * tighter than `AND`, `AND` tighter than `OR`; parentheses override.
+ *
+ * Each DNF term is a set of licenses that ALL apply simultaneously (the AND
+ * conjunction); the terms are the mutually-exclusive CHOICES (the OR). A policy
+ * is satisfied iff SOME term is acceptable — the semantics `evaluateDep` needs.
+ * `A WITH B` contributes the base license `A` (exceptions aren't standalone
+ * licenses in allow/deny lists). Trailing `+` is stripped. Pure.
+ */
+export declare function parseSpdxDnf(expr: string): string[][];
+/**
+ * Expand a license id to the set of ids it should match for policy comparison.
+ * A DEPRECATED bare GNU id is ambiguous (only? or-later?), so it matches either
+ * suffixed form; the suffixed forms stay exact, so `-only` and `-or-later` never
+ * match each other directly. Trailing `+` is treated as `-or-later`. Pure.
+ */
+export declare function expandLicenseId(id: string): string[];
+/**
+ * Evaluate one dep against the policy; null if it passes. Pure.
+ *
+ * SPDX-aware: a dep is acceptable iff SOME DNF term (a lawful realization of the
+ * license) violates nothing — every license in that term is un-denied and (under
+ * an allowlist) allowed. So `(MIT OR GPL-3.0)` with `deny:[GPL-3.0]` PASSES (take
+ * MIT), while `MIT AND GPL-3.0` under `allow:[MIT]` FAILS (GPL-3.0 also applies).
+ * Deprecated bare GNU ids (`GPL-2.0`) match either suffixed policy form.
+ */
 export declare function evaluateDep(dep: DepLicense, policy: LicensePolicy): Violation | null;
 /** Audit a dependency set against a policy. Pure. */
 export declare function auditLicenses(deps: DepLicense[], policy?: LicensePolicy): LicenseReport;

package/v3/@swarmdo/cli/dist/src/license/license.js

@@ -8,17 +8,32 @@
  * {name, version, license} plus a policy and returns violations. The fs walk
  * over node_modules lives in ../commands/license.ts.
  */
+/**
+ * npm's documented non-SPDX license sentinels → 'UNKNOWN' (needs human review).
+ * `SEE LICENSE IN <file>` (custom license) and `UNLICENSED` (proprietary) are
+ * NOT SPDX ids; left as-is they'd be tokenized by parseSpdxDnf into a garbage
+ * atom (`"SEE"`), giving a misleading policy verdict. Pure.
+ */
+function normalizeNpmLicense(s) {
+    const t = s.trim();
+    if (!t)
+        return 'UNKNOWN';
+    if (/^SEE LICENSE IN\b/i.test(t) || /^UNLICENSED$/i.test(t))
+        return 'UNKNOWN';
+    return t;
+}
 /**
  * Normalize a package.json `license`/`licenses` field to an SPDX string.
  * Handles the modern string, the legacy `{type}` object, and the legacy
- * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ * `licenses: [{type}]` array (→ `A OR B`). npm special values and a missing
+ * field → 'UNKNOWN'.
  */
 export function classifyLicense(pkg) {
     const l = pkg.license;
     if (typeof l === 'string' && l.trim())
-        return l.trim();
+        return normalizeNpmLicense(l);
     if (l && typeof l === 'object' && typeof l.type === 'string') {
-        return l.type.trim() || 'UNKNOWN';
+        return normalizeNpmLicense(l.type);
     }
     const arr = pkg.licenses;
     if (Array.isArray(arr) && arr.length) {
@@ -38,22 +53,129 @@ export function spdxComponents(expr) {
         .map((s) => s.trim().replace(/\+$/, ''))
         .filter(Boolean);
 }
-/** Evaluate one dep against the policy; null if it passes. Pure. */
+/**
+ * Parse an SPDX license expression into DISJUNCTIVE NORMAL FORM: a list of
+ * conjunctive terms, each a set of license ids. `A OR (B AND C)` →
+ * `[['A'], ['B','C']]`. Precedence per the SPDX spec (Annex D): `WITH` binds
+ * tighter than `AND`, `AND` tighter than `OR`; parentheses override.
+ *
+ * Each DNF term is a set of licenses that ALL apply simultaneously (the AND
+ * conjunction); the terms are the mutually-exclusive CHOICES (the OR). A policy
+ * is satisfied iff SOME term is acceptable — the semantics `evaluateDep` needs.
+ * `A WITH B` contributes the base license `A` (exceptions aren't standalone
+ * licenses in allow/deny lists). Trailing `+` is stripped. Pure.
+ */
+export function parseSpdxDnf(expr) {
+    const tokens = expr.replace(/([()])/g, ' $1 ').split(/\s+/).filter(Boolean);
+    let pos = 0;
+    const peek = () => tokens[pos];
+    const isOp = (t, op) => !!t && t.toUpperCase() === op;
+    // expr := term (OR term)*  → concatenate the alternatives
+    const parseExpr = () => {
+        let terms = parseTerm();
+        while (isOp(peek(), 'OR')) {
+            pos++;
+            terms = terms.concat(parseTerm());
+        }
+        return terms;
+    };
+    // term := factor (AND factor)*  → cartesian union of the conjuncts
+    const parseTerm = () => {
+        let left = parseFactor();
+        while (isOp(peek(), 'AND')) {
+            pos++;
+            const right = parseFactor();
+            const merged = [];
+            for (const a of left)
+                for (const b of right)
+                    merged.push([...new Set([...a, ...b])]);
+            left = merged;
+        }
+        return left;
+    };
+    // factor := '(' expr ')' | license [WITH exception]
+    const parseFactor = () => {
+        if (peek() === '(') {
+            pos++;
+            const inner = parseExpr();
+            if (peek() === ')')
+                pos++;
+            return inner;
+        }
+        const lic = (tokens[pos++] ?? '').replace(/\+$/, '');
+        if (isOp(peek(), 'WITH')) {
+            pos++;
+            pos++;
+        } // consume `WITH <exception>` — base license only
+        return lic ? [[lic]] : [[]];
+    };
+    const dnf = parseExpr();
+    // Fall back to treating the whole string as one atomic license if parse yielded nothing.
+    return dnf.length && dnf.some((t) => t.length) ? dnf : [[expr.trim()]];
+}
+/**
+ * SPDX 3.0 deprecated the bare GNU-family ids in favor of explicit `-only` /
+ * `-or-later` variants, but npm packages still declare the bare form en masse.
+ */
+const DEPRECATED_GNU_BARE = new Set([
+    'GPL-1.0', 'GPL-2.0', 'GPL-3.0',
+    'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0',
+    'AGPL-1.0', 'AGPL-3.0',
+    'GFDL-1.1', 'GFDL-1.2', 'GFDL-1.3',
+]);
+/**
+ * Expand a license id to the set of ids it should match for policy comparison.
+ * A DEPRECATED bare GNU id is ambiguous (only? or-later?), so it matches either
+ * suffixed form; the suffixed forms stay exact, so `-only` and `-or-later` never
+ * match each other directly. Trailing `+` is treated as `-or-later`. Pure.
+ */
+export function expandLicenseId(id) {
+    if (DEPRECATED_GNU_BARE.has(id))
+        return [id, `${id}-only`, `${id}-or-later`];
+    const plus = id.replace(/\+$/, '');
+    if (id.endsWith('+') && DEPRECATED_GNU_BARE.has(plus))
+        return [id, `${plus}-or-later`];
+    return [id];
+}
+/** Membership test aware of deprecated-bare-id aliases (both sides expanded). */
+function inPolicySet(c, expandedPolicy) {
+    return expandLicenseId(c).some((e) => expandedPolicy.has(e));
+}
+function expandPolicy(ids) {
+    const out = new Set();
+    for (const id of ids ?? [])
+        for (const e of expandLicenseId(id))
+            out.add(e);
+    return out;
+}
+/**
+ * Evaluate one dep against the policy; null if it passes. Pure.
+ *
+ * SPDX-aware: a dep is acceptable iff SOME DNF term (a lawful realization of the
+ * license) violates nothing — every license in that term is un-denied and (under
+ * an allowlist) allowed. So `(MIT OR GPL-3.0)` with `deny:[GPL-3.0]` PASSES (take
+ * MIT), while `MIT AND GPL-3.0` under `allow:[MIT]` FAILS (GPL-3.0 also applies).
+ * Deprecated bare GNU ids (`GPL-2.0`) match either suffixed policy form.
+ */
 export function evaluateDep(dep, policy) {
-    const allow = new Set(policy.allow ?? []);
-    const deny = new Set(policy.deny ?? []);
+    const allow = expandPolicy(policy.allow);
+    const deny = expandPolicy(policy.deny);
     const isUnknown = dep.license === 'UNKNOWN' || !dep.license;
-    const components = isUnknown ? [] : spdxComponents(dep.license);
-    if (components.some((c) => deny.has(c))) {
-        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
-    }
     if (isUnknown) {
         if (allow.size > 0 && !policy.allowUnknown) {
             return { name: dep.name, version: dep.version, license: 'UNKNOWN', reason: 'unknown' };
         }
         return null;
     }
-    if (allow.size > 0 && !components.some((c) => allow.has(c))) {
+    const terms = parseSpdxDnf(dep.license);
+    // Terms that avoid every denied license (a realization the consumer may choose).
+    const undenied = terms.filter((t) => !t.some((c) => inPolicySet(c, deny)));
+    if (undenied.length === 0) {
+        // No lawful realization avoids a denied license → genuinely denied.
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
+    }
+    if (allow.size > 0 && !undenied.some((t) => t.every((c) => inPolicySet(c, allow)))) {
+        // A denylist is satisfiable, but no un-denied realization is fully allowed.
         return { name: dep.name, version: dep.version, license: dep.license, reason: 'not-allowed' };
     }
     return null;

package/v3/@swarmdo/cli/dist/src/pack/pack.d.ts

@@ -51,9 +51,8 @@ export declare function buildTree(paths: string[]): string;
 export declare function packFiles(input: PackFile[], opts?: PackOptions): PackResult;
 /**
  * Minimal .gitignore-style matcher. Handles the common cases — plain names,
- * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
- * spec (no `**` depth semantics beyond substring, no nested ignore files).
- * Good enough to keep obvious noise out; full semantics is a follow-up.
+ * `dir/`, `*.ext` globs, `**` depth globs (gitignore(5) semantics), leading `/`
+ * anchors, and `!` negation. Not the full spec (no nested ignore files).
  */
 export declare function makeIgnoreMatcher(patterns: string[]): (relPath: string) => boolean;
 //# sourceMappingURL=pack.d.ts.map

package/v3/@swarmdo/cli/dist/src/pack/pack.js

@@ -80,7 +80,15 @@ function renderMarkdown(files, opts) {
     return parts.join('\n');
 }
 function escapeXml(s) {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    // All five predefined XML entities — the quote escapes matter because this
+    // value is also interpolated into a double-quoted `path="…"` attribute, where
+    // an unescaped `"` in a file path would break out of the attribute.
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
 }
 function renderXml(files, opts) {
     const parts = ['<repository>'];
@@ -138,11 +146,42 @@ export function packFiles(input, opts = {}) {
         },
     };
 }
+/**
+ * Convert a .gitignore glob body to a regex source (no anchors). Handles a
+ * double-star with correct gitignore(5) depth semantics: a double-star path
+ * segment matches zero or more directories (so `a/[star][star]/b` matches
+ * `a/b`, `a/x/b`, `a/x/y/b`); a leading one matches in any directory; a
+ * trailing one matches everything below. Single `*`/`?` stay within one path
+ * segment; other consecutive asterisks degrade to regular stars, per the spec.
+ * Pure.
+ */
+function globToRegExp(body) {
+    const esc = (s) => s.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]');
+    const parts = body.split('/');
+    let re = '';
+    for (let i = 0; i < parts.length; i++) {
+        const last = i === parts.length - 1;
+        if (parts[i] === '**') {
+            if (last) {
+                re += '.*';
+            } // trailing /** — everything below
+            else {
+                re += '(?:[^/]*/)*';
+                continue;
+            } // absorbs the following slash → zero-or-more dirs
+        }
+        else {
+            re += esc(parts[i]);
+        }
+        if (!last)
+            re += '/';
+    }
+    return re;
+}
 /**
  * Minimal .gitignore-style matcher. Handles the common cases — plain names,
- * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
- * spec (no `**` depth semantics beyond substring, no nested ignore files).
- * Good enough to keep obvious noise out; full semantics is a follow-up.
+ * `dir/`, `*.ext` globs, `**` depth globs (gitignore(5) semantics), leading `/`
+ * anchors, and `!` negation. Not the full spec (no nested ignore files).
  */
 export function makeIgnoreMatcher(patterns) {
     const rules = patterns
@@ -157,22 +196,39 @@ export function makeIgnoreMatcher(patterns) {
         const anchored = body.startsWith('/');
         if (anchored)
             body = body.slice(1);
-        const re = new RegExp('^' +
-            body
-                .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-                .replace(/\*/g, '[^/]*')
-                .replace(/\?/g, '[^/]') +
-            (dirOnly ? '(/|$)' : '($|/)'));
+        const re = new RegExp('^' + globToRegExp(body) + (dirOnly ? '(/|$)' : '($|/)'));
         return { negate, anchored, re };
     });
-    return (relPath) => {
+    // Ignored status of a single path (last-match-wins over the ordered rules).
+    const ruleVerdict = (path) => {
         let ignored = false;
         for (const r of rules) {
-            const candidates = r.anchored ? [relPath] : [relPath, ...relPath.split('/').map((_, i, a) => a.slice(i).join('/'))];
+            const candidates = r.anchored ? [path] : [path, ...path.split('/').map((_, i, a) => a.slice(i).join('/'))];
             if (candidates.some((c) => r.re.test(c)))
                 ignored = !r.negate;
         }
         return ignored;
     };
+    return (relPath) => {
+        // Walk ancestor dirs top-down: once a parent directory is excluded, the file
+        // stays excluded — a negation cannot re-include under an excluded parent
+        // (gitignore(5): "not possible to re-include a file if a parent directory of
+        // that file is excluded").
+        const parts = relPath.split('/').filter(Boolean);
+        let parentIgnored = false;
+        for (let i = 0; i < parts.length; i++) {
+            const isLast = i === parts.length - 1;
+            if (parentIgnored) {
+                if (isLast)
+                    return true;
+                continue; // excluded ancestor carries down
+            }
+            const verdict = ruleVerdict(parts.slice(0, i + 1).join('/'));
+            if (isLast)
+                return verdict;
+            parentIgnored = verdict; // this directory prefix carries forward
+        }
+        return false;
+    };
 }
 //# sourceMappingURL=pack.js.map

package/v3/@swarmdo/cli/dist/src/redact/redact.js

@@ -26,6 +26,7 @@ export const RULES = [
     { id: 'anthropic-key', description: 'Anthropic API key', regex: /\bsk-ant-[0-9A-Za-z-]{16,}\b/g },
     { id: 'openai-key', description: 'OpenAI API key', regex: /\bsk-(?:proj-)?[0-9A-Za-z]{20,}\b/g },
     { id: 'google-api-key', description: 'Google API key', regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: 'google-oauth-token', description: 'Google OAuth access token', regex: /\bya29\.[0-9A-Za-z_-]{20,}/g },
     { id: 'slack-token', description: 'Slack token', regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
     { id: 'slack-webhook', description: 'Slack incoming webhook', regex: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Za-z_]+\/B[0-9A-Za-z_]+\/[0-9A-Za-z_]+/g },
     { id: 'stripe-key', description: 'Stripe secret/restricted key', regex: /\b(?:sk|rk)_live_[0-9A-Za-z]{24,}\b/g },
@@ -33,9 +34,20 @@ export const RULES = [
     { id: 'twilio-key', description: 'Twilio API key SID', regex: /\bSK[0-9a-fA-F]{32}\b/g },
     { id: 'npm-token', description: 'npm access token', regex: /\bnpm_[0-9A-Za-z]{36}\b/g },
     { id: 'jwt', description: 'JSON Web Token', regex: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}\b/g },
+    // RFC 6750 Bearer credential. Last (most generic): specific token rules above
+    // claim their range first. 16+ b64token chars keeps prose ("Bearer document")
+    // from matching; only the token (group 1) is masked, not the `Bearer ` prefix.
+    { id: 'bearer-token', description: 'HTTP Bearer token (RFC 6750)', regex: /\bBearer\s+([A-Za-z0-9\-._~+/]{16,}=*)/g, group: 1 },
 ];
-/** Keyword-prefixed assignment, e.g. `api_key = "..."` — the value is group 1. */
-const ASSIGNMENT_RE = /(?:pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret)["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
+/**
+ * Keyword-prefixed assignment, e.g. `api_key = "..."` — the value is group 1.
+ * Keyword set mirrors gitleaks' reference `generic-api-key` rule (adds bare
+ * `key`, `credential`, `creds` so `PRIVATE_KEY=`/`ENCRYPTION_KEY=`/`DB_CREDENTIAL=`
+ * secrets reach the entropy check). The `[:=]` immediately after the keyword
+ * anchors it, so `keyboard=`/`monkey_val=` don't match; the entropy + length
+ * gates keep low-entropy values (paths, short flags) from being flagged.
+ */
+const ASSIGNMENT_RE = /(?:pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret|credential|creds|key)["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
 /** Shannon entropy in bits/char. Pure; used by the assignment fallback. */
 export function shannonEntropy(s) {
     if (!s)

package/v3/@swarmdo/cli/dist/src/sbom/sbom.d.ts

@@ -21,6 +21,7 @@ export interface Component {
         content: string;
     };
     dev?: boolean;
+    optional?: boolean;
 }
 interface NpmLockEntry {
     version?: string;
@@ -53,6 +54,21 @@ export interface BomMeta {
     name: string;
     version: string;
 }
+/**
+ * Is this npm `license` string an SPDX *expression* (compound), rather than a
+ * single license identifier? npm permits expressions like `(MIT OR Apache-2.0)`
+ * or `Apache-2.0 WITH LLVM-exception` for dual/multi-licensed packages. SPDX
+ * operators are uppercase and space-delimited, so a single ID (`MIT`,
+ * `BSD-3-Clause`, `CC-BY-SA-4.0`) never matches. Pure.
+ */
+export declare function isSpdxExpression(license: string): boolean;
+/**
+ * A CycloneDX `licenses[]` entry for a license string. CycloneDX requires
+ * `license.id` to be a single valid SPDX identifier, so an expression must use
+ * the sibling `expression` field instead — otherwise strict validators and
+ * scanners (Dependency-Track, Grype) reject or mis-parse the component. Pure.
+ */
+export declare function cdxLicenseEntry(license: string): Record<string, unknown>;
 /** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
 export declare function buildCycloneDX(components: Component[], meta: BomMeta): Record<string, unknown>;
 /** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */

package/v3/@swarmdo/cli/dist/src/sbom/sbom.js

@@ -77,11 +77,32 @@ export function componentsFromNpmLock(lock, opts = {}) {
         }
         if (entry.dev)
             comp.dev = true;
+        if (entry.optional)
+            comp.optional = true;
         out.push(comp);
     }
     out.sort((a, b) => (a.name === b.name ? a.version.localeCompare(b.version) : a.name.localeCompare(b.name)));
     return out;
 }
+/**
+ * Is this npm `license` string an SPDX *expression* (compound), rather than a
+ * single license identifier? npm permits expressions like `(MIT OR Apache-2.0)`
+ * or `Apache-2.0 WITH LLVM-exception` for dual/multi-licensed packages. SPDX
+ * operators are uppercase and space-delimited, so a single ID (`MIT`,
+ * `BSD-3-Clause`, `CC-BY-SA-4.0`) never matches. Pure.
+ */
+export function isSpdxExpression(license) {
+    return / (OR|AND|WITH) /.test(license) || license.includes('(');
+}
+/**
+ * A CycloneDX `licenses[]` entry for a license string. CycloneDX requires
+ * `license.id` to be a single valid SPDX identifier, so an expression must use
+ * the sibling `expression` field instead — otherwise strict validators and
+ * scanners (Dependency-Track, Grype) reject or mis-parse the component. Pure.
+ */
+export function cdxLicenseEntry(license) {
+    return isSpdxExpression(license) ? { expression: license } : { license: { id: license } };
+}
 /** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
 export function buildCycloneDX(components, meta) {
     return {
@@ -93,10 +114,16 @@ export function buildCycloneDX(components, meta) {
         },
         components: components.map((c) => {
             const comp = { type: 'library', name: c.name, version: c.version, purl: c.purl };
+            // CycloneDX 1.5 `scope`: dev-only deps are `excluded` (not shipped),
+            // optional deps are `optional`; a required runtime dep omits it (implicit
+            // `required`), keeping the common case clean. dev wins over optional.
+            const scope = c.dev ? 'excluded' : c.optional ? 'optional' : undefined;
+            if (scope)
+                comp.scope = scope;
             if (c.hash)
                 comp.hashes = [{ alg: c.hash.alg, content: c.hash.content }];
             if (c.license)
-                comp.licenses = [{ license: { id: c.license } }];
+                comp.licenses = [cdxLicenseEntry(c.license)];
             return comp;
         }),
     };

package/v3/@swarmdo/cli/dist/src/testreport/testreport.d.ts

@@ -28,6 +28,20 @@ export interface TestSummary {
     total: number;
     durationMs: number;
     failures: TestFailure[];
+    /**
+     * TAP `# TODO` tests — "not expected to succeed" per the TAP spec, so a
+     * `not ok … # TODO` is a KNOWN-incomplete stub, counted here as a success,
+     * never a failure. Absent (0) for JUnit and TODO-free TAP.
+     */
+    todo?: number;
+    /**
+     * True if a TAP `Bail out!` line aborted the run. The counts are then
+     * INCOMPLETE — the suite stopped early, so a "0 failed" here does NOT mean
+     * the suite passed. Callers/CI must treat this as a failure.
+     */
+    bailedOut?: boolean;
+    /** Optional reason text following `Bail out!`. */
+    bailReason?: string;
 }
 /** Pull a `file:line` out of a stack-trace / assertion message. Pure. */
 export declare function extractFileLine(text: string): {