unguard 0.7.1 → 0.9.0

package/dist/cli.js

@@ -1,46 +1,89 @@
 import {
-  scan
-} from "./chunk-LEYOVUJE.js";
+  executeScan,
+  isFailOn,
+  isRulePolicySeverity,
+  isSeverity,
+  toRulePolicyEntries
+} from "./chunk-I4RZLVE2.js";
 
 // src/cli.ts
-import { relative } from "path";
+import { existsSync, readFileSync } from "fs";
+import { basename, relative, resolve } from "path";
+import { parseArgs } from "util";
 import pc from "picocolors";
-var SEVERITY_RANK = { info: 0, warning: 1, error: 2 };
-function isSeverity(value) {
-  return value === "info" || value === "warning" || value === "error";
-}
 async function main(argv) {
-  const args = argv.slice(2);
-  const first = args[0];
-  if (first === "-h" || first === "--help") {
+  const rawArgs = argv.slice(2);
+  const userArgs = rawArgs[0] === "scan" ? rawArgs.slice(1) : rawArgs;
+  const { values, positionals: cliPaths } = parseArgs({
+    args: userArgs,
+    options: {
+      strict: { type: "boolean", default: false },
+      filter: { type: "string" },
+      format: { type: "string", default: "grouped" },
+      severity: { type: "string", multiple: true, default: [] },
+      ignore: { type: "string", multiple: true, default: [] },
+      rule: { type: "string", multiple: true, default: [] },
+      config: { type: "string" },
+      "fail-on": { type: "string" },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: true
+  });
+  if (values.help) {
     printHelp();
     return 0;
   }
-  const userArgs = first === "scan" ? args.slice(1) : args;
-  const strict = userArgs.includes("--strict");
-  const filter = extractFlag(userArgs, "--filter");
-  const format = extractFlag(userArgs, "--format", "grouped");
-  const severityFilter = extractFlag(userArgs, "--severity");
-  const paths = userArgs.filter((a) => !a.startsWith("--"));
-  const result = await scan({
+  let config = null;
+  try {
+    const configPath = findConfigPath(values.config);
+    config = configPath ? loadConfig(configPath) : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(pc.red(message));
+    return 1;
+  }
+  const rulePolicyResult = parseRulePolicyArgs(values.rule);
+  if (!rulePolicyResult.ok) {
+    console.error(pc.red(rulePolicyResult.message));
+    return 1;
+  }
+  const severityFiltersResult = parseSeverityFilters(values.severity);
+  if (!severityFiltersResult.ok) {
+    console.error(pc.red(severityFiltersResult.message));
+    return 1;
+  }
+  const failOnResult = resolveFailOn(values["fail-on"], config?.failOn);
+  if (!failOnResult.ok) {
+    console.error(pc.red(failOnResult.message));
+    return 1;
+  }
+  const paths = cliPaths.length > 0 ? cliPaths : config?.paths ?? [];
+  const ignore = [...config?.ignore ?? [], ...values.ignore];
+  const rulePolicy = [
+    ...toRulePolicyEntries(config?.rules),
+    ...rulePolicyResult.value
+  ];
+  const execution = await executeScan({
     paths,
-    strict,
-    rules: filter ? [filter] : void 0
+    strict: values.strict,
+    rules: values.filter ? [values.filter] : void 0,
+    ignore: ignore.length > 0 ? ignore : void 0,
+    rulePolicy: rulePolicy.length > 0 ? rulePolicy : void 0,
+    showSeverities: severityFiltersResult.value.length > 0 ? severityFiltersResult.value : void 0,
+    failOn: failOnResult.value
   });
-  const minRank = severityFilter !== void 0 && isSeverity(severityFilter) ? SEVERITY_RANK[severityFilter] : 0;
-  const filtered = minRank > 0 ? result.diagnostics.filter((d) => SEVERITY_RANK[d.severity] >= minRank) : result.diagnostics;
-  if (filtered.length === 0) {
-    console.log(pc.green(`No issues found in ${result.fileCount} files.`));
-    return 0;
+  const diagnostics = execution.visibleDiagnostics;
+  if (diagnostics.length === 0) {
+    console.log(pc.green(`No issues found in ${execution.fileCount} files.`));
+    return execution.exitCode;
   }
-  if (format === "flat") {
-    printDiagnosticsFlat(filtered);
+  if (values.format === "flat") {
+    printDiagnosticsFlat(diagnostics);
   } else {
-    printDiagnostics(filtered);
+    printDiagnostics(diagnostics);
   }
-  printSummary(filtered, result.fileCount);
-  const hasError = filtered.some((d) => d.severity === "error");
-  return hasError ? 2 : 1;
+  printSummary(diagnostics, execution.fileCount);
+  return execution.exitCode;
 }
 function printHelp() {
   console.log(`unguard: data-shape static analyzer
@@ -50,62 +93,50 @@ Usage:
   unguard [paths...] [options]
 
 Options:
-  --strict              Treat all warnings as errors
+  --config <path>       Path to unguard config file (defaults to ./unguard.config.json)
+  --strict              Treat all diagnostics as errors
   --filter <rule>       Run only the specified rule
-  --severity <level>    Show only diagnostics at this level or above (error, warning, info)
+  --rule <sel=sev>      Override rule severity (supports id, *, category:<name>, tag:<name>)
+  --ignore <glob>       Ignore path glob. Repeatable.
+  --severity <levels>   Filter output by severity (comma-separated and/or repeatable)
+  --fail-on <level>     Exit threshold: none, error, warning, info (default: info)
   --format <mode>       Output format: grouped (default) or flat
   -h, --help            Show this help
 
 Exit codes:
-  0  No issues
-  1  Warnings or info only
-  2  At least one error
+  0  Clean, or does not meet --fail-on threshold
+  1  Meets threshold without errors
+  2  Meets threshold with at least one error
 
 Examples:
   unguard scan src
-  unguard scan src --strict
-  unguard scan src --filter no-empty-catch
-  unguard scan src --severity=error
-  unguard scan src --format=flat | grep error`);
-}
-function extractFlag(args, flag, fallback) {
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === void 0) continue;
-    if (arg === flag) {
-      const value = args[i + 1];
-      args.splice(i, 2);
-      return value;
-    }
-    if (arg.startsWith(flag + "=")) {
-      const value = arg.slice(flag.length + 1);
-      args.splice(i, 1);
-      return value;
-    }
-  }
-  return fallback;
+  unguard scan src --rule duplicate-*=warning
+  unguard scan src --rule category:cross-file=warning
+  unguard scan src --rule tag:safety=error
+  unguard scan src --severity=error,warning
+  unguard scan src --fail-on=error`);
 }
 function printDiagnostics(diagnostics) {
   const byFile = /* @__PURE__ */ new Map();
-  for (const d of diagnostics) {
-    let list = byFile.get(d.file);
+  for (const diagnostic of diagnostics) {
+    let list = byFile.get(diagnostic.file);
     if (list === void 0) {
       list = [];
-      byFile.set(d.file, list);
+      byFile.set(diagnostic.file, list);
     }
-    list.push(d);
+    list.push(diagnostic);
   }
-  const cwd = process.cwd() + "/";
+  const cwd = `${process.cwd()}/`;
   const cwdBase = process.cwd();
-  for (const [file, diags] of byFile) {
+  for (const [file, fileDiagnostics] of byFile) {
     const rel = relative(cwdBase, file);
     console.log(pc.underline(rel));
-    for (const d of diags) {
-      const loc = `${d.line}:${d.column}`;
-      const sev = d.severity === "error" ? pc.red("error") : d.severity === "warning" ? pc.yellow("warning") : pc.blue("info");
-      const msg = d.message.replaceAll(cwd, "");
-      const rule = pc.dim(d.ruleId);
-      const annotation = d.annotation !== void 0 ? `  ${pc.cyan(d.annotation)}` : "";
+    for (const diagnostic of fileDiagnostics) {
+      const loc = `${diagnostic.line}:${diagnostic.column}`;
+      const sev = diagnostic.severity === "error" ? pc.red("error") : diagnostic.severity === "warning" ? pc.yellow("warning") : pc.blue("info");
+      const msg = diagnostic.message.replaceAll(cwd, "");
+      const rule = pc.dim(diagnostic.ruleId);
+      const annotation = diagnostic.annotation !== void 0 ? `  ${pc.cyan(diagnostic.annotation)}` : "";
       console.log(`  ${pc.dim(loc.padEnd(10))} ${sev}  ${msg}  ${rule}${annotation}`);
     }
     console.log();
@@ -113,21 +144,21 @@ function printDiagnostics(diagnostics) {
 }
 function printDiagnosticsFlat(diagnostics) {
   const cwdBase = process.cwd();
-  const cwd = cwdBase + "/";
-  for (const d of diagnostics) {
-    const rel = relative(cwdBase, d.file);
-    const msg = d.message.replaceAll(cwd, "");
-    console.log(`${rel}:${d.line}:${d.column} ${d.severity} [${d.ruleId}] ${msg}`);
+  const cwd = `${cwdBase}/`;
+  for (const diagnostic of diagnostics) {
+    const rel = relative(cwdBase, diagnostic.file);
+    const msg = diagnostic.message.replaceAll(cwd, "");
+    console.log(`${rel}:${diagnostic.line}:${diagnostic.column} ${diagnostic.severity} [${diagnostic.ruleId}] ${msg}`);
   }
 }
 function printSummary(diagnostics, fileCount) {
   const counts = /* @__PURE__ */ new Map();
-  for (const d of diagnostics) {
-    const prev = counts.get(d.ruleId);
-    counts.set(d.ruleId, (prev === void 0 ? 0 : prev) + 1);
+  for (const diagnostic of diagnostics) {
+    const prev = counts.get(diagnostic.ruleId);
+    counts.set(diagnostic.ruleId, (prev === void 0 ? 0 : prev) + 1);
   }
   const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);
-  const maxRule = Math.max(...sorted.map(([r]) => r.length));
+  const maxRule = Math.max(...sorted.map(([rule]) => rule.length));
   console.log(pc.bold("Summary"));
   for (const [rule, count] of sorted) {
     console.log(`  ${rule.padEnd(maxRule)}  ${pc.bold(String(count))}`);
@@ -137,6 +168,112 @@ function printSummary(diagnostics, fileCount) {
 ${pc.bold(String(diagnostics.length))} issue${diagnostics.length === 1 ? "" : "s"} in ${fileCount} files.`
   );
 }
+function parseSeverityFilters(values) {
+  const levels = splitCsv(values);
+  const parsed = [];
+  for (const value of levels) {
+    if (!isSeverity(value)) {
+      return { ok: false, message: `Invalid --severity value "${value}". Use error, warning, info.` };
+    }
+    parsed.push(value);
+  }
+  return { ok: true, value: parsed };
+}
+function parseRulePolicyArgs(values) {
+  const entries = [];
+  for (const arg of values) {
+    const separator = resolveRuleSeparator(arg);
+    if (separator === null) {
+      return { ok: false, message: `Invalid --rule value "${arg}". Use <selector>=<off|info|warning|error>.` };
+    }
+    const selector = arg.slice(0, separator).trim();
+    const severity = arg.slice(separator + 1).trim();
+    if (!selector) {
+      return { ok: false, message: `Invalid --rule value "${arg}". Rule selector is required.` };
+    }
+    if (!isRulePolicySeverity(severity)) {
+      return { ok: false, message: `Invalid --rule value "${arg}". Severity must be off, info, warning, or error.` };
+    }
+    entries.push({ selector, severity });
+  }
+  return { ok: true, value: entries };
+}
+function resolveRuleSeparator(value) {
+  const equalIndex = value.indexOf("=");
+  if (equalIndex >= 0) return equalIndex;
+  const colonIndex = value.lastIndexOf(":");
+  if (colonIndex <= 0) return null;
+  return colonIndex;
+}
+function splitCsv(values) {
+  return values.flatMap((value) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
+}
+function findConfigPath(cliValue) {
+  if (cliValue) {
+    const explicitPath = resolve(process.cwd(), cliValue);
+    if (!existsSync(explicitPath)) throw new Error(`Config file not found: ${cliValue}`);
+    return explicitPath;
+  }
+  const candidates = ["unguard.config.json", ".unguardrc.json"];
+  for (const candidate of candidates) {
+    const candidatePath = resolve(process.cwd(), candidate);
+    if (existsSync(candidatePath)) return candidatePath;
+  }
+  return null;
+}
+function loadConfig(path) {
+  const text = readFileSync(path, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Invalid JSON in ${basename(path)}: ${message}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Invalid config in ${basename(path)}: expected a JSON object.`);
+  }
+  const raw = parsed;
+  const config = {};
+  if (raw.paths !== void 0) {
+    if (!isStringArray(raw.paths)) throw new Error(`Invalid config in ${basename(path)}: "paths" must be a string array.`);
+    config.paths = raw.paths;
+  }
+  if (raw.ignore !== void 0) {
+    if (!isStringArray(raw.ignore)) throw new Error(`Invalid config in ${basename(path)}: "ignore" must be a string array.`);
+    config.ignore = raw.ignore;
+  }
+  if (raw.failOn !== void 0) {
+    if (typeof raw.failOn !== "string" || !isFailOn(raw.failOn)) {
+      throw new Error(`Invalid config in ${basename(path)}: "failOn" must be one of none, error, warning, info.`);
+    }
+    config.failOn = raw.failOn;
+  }
+  if (raw.rules !== void 0) {
+    if (typeof raw.rules !== "object" || raw.rules === null || Array.isArray(raw.rules)) {
+      throw new Error(`Invalid config in ${basename(path)}: "rules" must be an object.`);
+    }
+    const rules = {};
+    for (const [selector, severity] of Object.entries(raw.rules)) {
+      if (typeof severity !== "string" || !isRulePolicySeverity(severity)) {
+        throw new Error(`Invalid config in ${basename(path)}: rule "${selector}" must be off, info, warning, or error.`);
+      }
+      rules[selector] = severity;
+    }
+    config.rules = rules;
+  }
+  return config;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function resolveFailOn(cliValue, configValue) {
+  const selected = cliValue ?? configValue ?? "info";
+  if (!isFailOn(selected)) {
+    return { ok: false, message: `Invalid --fail-on value "${selected}". Use none, error, warning, or info.` };
+  }
+  return { ok: true, value: selected };
+}
 export {
   main
 };

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { relative } from \"node:path\";\nimport pc from \"picocolors\";\nimport { scan } from \"./engine.ts\";\nimport type { Diagnostic } from \"./rules/types.ts\";\n\ntype Severity = \"info\" | \"warning\" | \"error\";\nconst SEVERITY_RANK: Record<Severity, number> = { info: 0, warning: 1, error: 2 };\n\nfunction isSeverity(value: string): value is Severity {\n  return value === \"info\" || value === \"warning\" || value === \"error\";\n}\n\nexport async function main(argv: string[]): Promise<number> {\n  const args = argv.slice(2);\n  const first = args[0];\n\n  if (first === \"-h\" || first === \"--help\") {\n    printHelp();\n    return 0;\n  }\n\n  const userArgs = first === \"scan\" ? args.slice(1) : args;\n  const strict = userArgs.includes(\"--strict\");\n  const filter = extractFlag(userArgs, \"--filter\");\n  const format = extractFlag(userArgs, \"--format\", \"grouped\");\n  const severityFilter = extractFlag(userArgs, \"--severity\");\n  const paths = userArgs.filter((a) => !a.startsWith(\"--\"));\n\n  const result = await scan({\n    paths,\n    strict,\n    rules: filter ? [filter] : undefined,\n  });\n\n  const minRank = severityFilter !== undefined && isSeverity(severityFilter) ? SEVERITY_RANK[severityFilter] : 0;\n  const filtered = minRank > 0 ? result.diagnostics.filter((d) => SEVERITY_RANK[d.severity] >= minRank) : result.diagnostics;\n\n  if (filtered.length === 0) {\n    console.log(pc.green(`No issues found in ${result.fileCount} files.`));\n    return 0;\n  }\n\n  if (format === \"flat\") {\n    printDiagnosticsFlat(filtered);\n  } else {\n    printDiagnostics(filtered);\n  }\n  printSummary(filtered, result.fileCount);\n\n  const hasError = filtered.some((d) => d.severity === \"error\");\n  return hasError ? 2 : 1;\n}\n\nfunction printHelp() {\n  console.log(`unguard: data-shape static analyzer\n\nUsage:\n  unguard scan [paths...] [options]\n  unguard [paths...] [options]\n\nOptions:\n  --strict              Treat all warnings as errors\n  --filter <rule>       Run only the specified rule\n  --severity <level>    Show only diagnostics at this level or above (error, warning, info)\n  --format <mode>       Output format: grouped (default) or flat\n  -h, --help            Show this help\n\nExit codes:\n  0  No issues\n  1  Warnings or info only\n  2  At least one error\n\nExamples:\n  unguard scan src\n  unguard scan src --strict\n  unguard scan src --filter no-empty-catch\n  unguard scan src --severity=error\n  unguard scan src --format=flat | grep error`);\n}\n\nfunction extractFlag(args: string[], flag: string, fallback?: string): string | undefined {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (arg === undefined) continue;\n    if (arg === flag) {\n      const value = args[i + 1];\n      args.splice(i, 2);\n      return value;\n    }\n    if (arg.startsWith(flag + \"=\")) {\n      const value = arg.slice(flag.length + 1);\n      args.splice(i, 1);\n      return value;\n    }\n  }\n  return fallback;\n}\n\nfunction printDiagnostics(diagnostics: Diagnostic[]) {\n  const byFile = new Map<string, Diagnostic[]>();\n  for (const d of diagnostics) {\n    let list = byFile.get(d.file);\n    if (list === undefined) {\n      list = [];\n      byFile.set(d.file, list);\n    }\n    list.push(d);\n  }\n\n  const cwd = process.cwd() + \"/\";\n  const cwdBase = process.cwd();\n\n  for (const [file, diags] of byFile) {\n    const rel = relative(cwdBase, file);\n    console.log(pc.underline(rel));\n\n    for (const d of diags) {\n      const loc = `${d.line}:${d.column}`;\n      const sev = d.severity === \"error\" ? pc.red(\"error\") : d.severity === \"warning\" ? pc.yellow(\"warning\") : pc.blue(\"info\");\n      const msg = d.message.replaceAll(cwd, \"\");\n      const rule = pc.dim(d.ruleId);\n      const annotation = d.annotation !== undefined ? `  ${pc.cyan(d.annotation)}` : \"\";\n      console.log(`  ${pc.dim(loc.padEnd(10))} ${sev}  ${msg}  ${rule}${annotation}`);\n    }\n\n    console.log();\n  }\n}\n\nfunction printDiagnosticsFlat(diagnostics: Diagnostic[]) {\n  const cwdBase = process.cwd();\n  const cwd = cwdBase + \"/\";\n\n  for (const d of diagnostics) {\n    const rel = relative(cwdBase, d.file);\n    const msg = d.message.replaceAll(cwd, \"\");\n    console.log(`${rel}:${d.line}:${d.column} ${d.severity} [${d.ruleId}] ${msg}`);\n  }\n}\n\nfunction printSummary(diagnostics: Diagnostic[], fileCount: number) {\n  const counts = new Map<string, number>();\n  for (const d of diagnostics) {\n    const prev = counts.get(d.ruleId);\n    counts.set(d.ruleId, (prev === undefined ? 0 : prev) + 1);\n  }\n\n  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);\n  const maxRule = Math.max(...sorted.map(([r]) => r.length));\n\n  console.log(pc.bold(\"Summary\"));\n  for (const [rule, count] of sorted) {\n    console.log(`  ${rule.padEnd(maxRule)}  ${pc.bold(String(count))}`);\n  }\n\n  console.log(\n    `\\n${pc.bold(String(diagnostics.length))} issue${diagnostics.length === 1 ? \"\" : \"s\"} in ${fileCount} files.`,\n  );\n}\n"],"mappings":";;;;;AAAA,SAAS,gBAAgB;AACzB,OAAO,QAAQ;AAKf,IAAM,gBAA0C,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE;AAEhF,SAAS,WAAW,OAAkC;AACpD,SAAO,UAAU,UAAU,UAAU,aAAa,UAAU;AAC9D;AAEA,eAAsB,KAAK,MAAiC;AAC1D,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,QAAM,QAAQ,KAAK,CAAC;AAEpB,MAAI,UAAU,QAAQ,UAAU,UAAU;AACxC,cAAU;AACV,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,UAAU,SAAS,KAAK,MAAM,CAAC,IAAI;AACpD,QAAM,SAAS,SAAS,SAAS,UAAU;AAC3C,QAAM,SAAS,YAAY,UAAU,UAAU;AAC/C,QAAM,SAAS,YAAY,UAAU,YAAY,SAAS;AAC1D,QAAM,iBAAiB,YAAY,UAAU,YAAY;AACzD,QAAM,QAAQ,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC;AAExD,QAAM,SAAS,MAAM,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA,OAAO,SAAS,CAAC,MAAM,IAAI;AAAA,EAC7B,CAAC;AAED,QAAM,UAAU,mBAAmB,UAAa,WAAW,cAAc,IAAI,cAAc,cAAc,IAAI;AAC7G,QAAM,WAAW,UAAU,IAAI,OAAO,YAAY,OAAO,CAAC,MAAM,cAAc,EAAE,QAAQ,KAAK,OAAO,IAAI,OAAO;AAE/G,MAAI,SAAS,WAAW,GAAG;AACzB,YAAQ,IAAI,GAAG,MAAM,sBAAsB,OAAO,SAAS,SAAS,CAAC;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,QAAQ;AACrB,yBAAqB,QAAQ;AAAA,EAC/B,OAAO;AACL,qBAAiB,QAAQ;AAAA,EAC3B;AACA,eAAa,UAAU,OAAO,SAAS;AAEvC,QAAM,WAAW,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,OAAO;AAC5D,SAAO,WAAW,IAAI;AACxB;AAEA,SAAS,YAAY;AACnB,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8CAuBgC;AAC9C;AAEA,SAAS,YAAY,MAAgB,MAAc,UAAuC;AACxF,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,QAAQ,OAAW;AACvB,QAAI,QAAQ,MAAM;AAChB,YAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,WAAK,OAAO,GAAG,CAAC;AAChB,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,OAAO,GAAG,GAAG;AAC9B,YAAM,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACvC,WAAK,OAAO,GAAG,CAAC;AAChB,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,aAA2B;AACnD,QAAM,SAAS,oBAAI,IAA0B;AAC7C,aAAW,KAAK,aAAa;AAC3B,QAAI,OAAO,OAAO,IAAI,EAAE,IAAI;AAC5B,QAAI,SAAS,QAAW;AACtB,aAAO,CAAC;AACR,aAAO,IAAI,EAAE,MAAM,IAAI;AAAA,IACzB;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AAEA,QAAM,MAAM,QAAQ,IAAI,IAAI;AAC5B,QAAM,UAAU,QAAQ,IAAI;AAE5B,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,UAAM,MAAM,SAAS,SAAS,IAAI;AAClC,YAAQ,IAAI,GAAG,UAAU,GAAG,CAAC;AAE7B,eAAW,KAAK,OAAO;AACrB,YAAM,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,MAAM;AACjC,YAAM,MAAM,EAAE,aAAa,UAAU,GAAG,IAAI,OAAO,IAAI,EAAE,aAAa,YAAY,GAAG,OAAO,SAAS,IAAI,GAAG,KAAK,MAAM;AACvH,YAAM,MAAM,EAAE,QAAQ,WAAW,KAAK,EAAE;AACxC,YAAM,OAAO,GAAG,IAAI,EAAE,MAAM;AAC5B,YAAM,aAAa,EAAE,eAAe,SAAY,KAAK,GAAG,KAAK,EAAE,UAAU,CAAC,KAAK;AAC/E,cAAQ,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,GAAG,UAAU,EAAE;AAAA,IAChF;AAEA,YAAQ,IAAI;AAAA,EACd;AACF;AAEA,SAAS,qBAAqB,aAA2B;AACvD,QAAM,UAAU,QAAQ,IAAI;AAC5B,QAAM,MAAM,UAAU;AAEtB,aAAW,KAAK,aAAa;AAC3B,UAAM,MAAM,SAAS,SAAS,EAAE,IAAI;AACpC,UAAM,MAAM,EAAE,QAAQ,WAAW,KAAK,EAAE;AACxC,YAAQ,IAAI,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE,QAAQ,KAAK,EAAE,MAAM,KAAK,GAAG,EAAE;AAAA,EAC/E;AACF;AAEA,SAAS,aAAa,aAA2B,WAAmB;AAClE,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,KAAK,aAAa;AAC3B,UAAM,OAAO,OAAO,IAAI,EAAE,MAAM;AAChC,WAAO,IAAI,EAAE,SAAS,SAAS,SAAY,IAAI,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/D,QAAM,UAAU,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;AAEzD,UAAQ,IAAI,GAAG,KAAK,SAAS,CAAC;AAC9B,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,YAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,CAAC,KAAK,GAAG,KAAK,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EACpE;AAEA,UAAQ;AAAA,IACN;AAAA,EAAK,GAAG,KAAK,OAAO,YAAY,MAAM,CAAC,CAAC,SAAS,YAAY,WAAW,IAAI,KAAK,GAAG,OAAO,SAAS;AAAA,EACtG;AACF;","names":[]}
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { basename, relative, resolve } from \"node:path\";\nimport { parseArgs } from \"node:util\";\nimport pc from \"picocolors\";\nimport { executeScan, type FailOn, type RulePolicyEntry, type RulePolicySeverity, type Severity } from \"./engine.ts\";\nimport { isFailOn, isRulePolicySeverity, isSeverity, toRulePolicyEntries } from \"./scan/config.ts\";\nimport type { RulePolicy } from \"./scan/types.ts\";\nimport type { Diagnostic } from \"./rules/types.ts\";\n\ninterface UnguardConfig {\n  paths?: string[];\n  ignore?: string[];\n  rules?: RulePolicy;\n  failOn?: FailOn;\n}\n\nexport async function main(argv: string[]): Promise<number> {\n  const rawArgs = argv.slice(2);\n  const userArgs = rawArgs[0] === \"scan\" ? rawArgs.slice(1) : rawArgs;\n\n  const { values, positionals: cliPaths } = parseArgs({\n    args: userArgs,\n    options: {\n      strict: { type: \"boolean\", default: false },\n      filter: { type: \"string\" },\n      format: { type: \"string\", default: \"grouped\" },\n      severity: { type: \"string\", multiple: true, default: [] },\n      ignore: { type: \"string\", multiple: true, default: [] },\n      rule: { type: \"string\", multiple: true, default: [] },\n      config: { type: \"string\" },\n      \"fail-on\": { type: \"string\" },\n      help: { type: \"boolean\", short: \"h\", default: false },\n    },\n    allowPositionals: true,\n  });\n\n  if (values.help) {\n    printHelp();\n    return 0;\n  }\n\n  let config: UnguardConfig | null = null;\n  try {\n    const configPath = findConfigPath(values.config);\n    config = configPath ? loadConfig(configPath) : null;\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    console.error(pc.red(message));\n    return 1;\n  }\n\n  const rulePolicyResult = parseRulePolicyArgs(values.rule);\n  if (!rulePolicyResult.ok) {\n    console.error(pc.red(rulePolicyResult.message));\n    return 1;\n  }\n\n  const severityFiltersResult = parseSeverityFilters(values.severity);\n  if (!severityFiltersResult.ok) {\n    console.error(pc.red(severityFiltersResult.message));\n    return 1;\n  }\n\n  const failOnResult = resolveFailOn(values[\"fail-on\"], config?.failOn);\n  if (!failOnResult.ok) {\n    console.error(pc.red(failOnResult.message));\n    return 1;\n  }\n\n  const paths = cliPaths.length > 0 ? cliPaths : config?.paths ?? [];\n  const ignore = [...(config?.ignore ?? []), ...values.ignore];\n  const rulePolicy = [\n    ...toRulePolicyEntries(config?.rules),\n    ...rulePolicyResult.value,\n  ];\n\n  const execution = await executeScan({\n    paths,\n    strict: values.strict,\n    rules: values.filter ? [values.filter] : undefined,\n    ignore: ignore.length > 0 ? ignore : undefined,\n    rulePolicy: rulePolicy.length > 0 ? rulePolicy : undefined,\n    showSeverities: severityFiltersResult.value.length > 0 ? severityFiltersResult.value : undefined,\n    failOn: failOnResult.value,\n  });\n\n  const diagnostics = execution.visibleDiagnostics;\n  if (diagnostics.length === 0) {\n    console.log(pc.green(`No issues found in ${execution.fileCount} files.`));\n    return execution.exitCode;\n  }\n\n  if (values.format === \"flat\") {\n    printDiagnosticsFlat(diagnostics);\n  } else {\n    printDiagnostics(diagnostics);\n  }\n  printSummary(diagnostics, execution.fileCount);\n\n  return execution.exitCode;\n}\n\nfunction printHelp() {\n  console.log(`unguard: data-shape static analyzer\n\nUsage:\n  unguard scan [paths...] [options]\n  unguard [paths...] [options]\n\nOptions:\n  --config <path>       Path to unguard config file (defaults to ./unguard.config.json)\n  --strict              Treat all diagnostics as errors\n  --filter <rule>       Run only the specified rule\n  --rule <sel=sev>      Override rule severity (supports id, *, category:<name>, tag:<name>)\n  --ignore <glob>       Ignore path glob. Repeatable.\n  --severity <levels>   Filter output by severity (comma-separated and/or repeatable)\n  --fail-on <level>     Exit threshold: none, error, warning, info (default: info)\n  --format <mode>       Output format: grouped (default) or flat\n  -h, --help            Show this help\n\nExit codes:\n  0  Clean, or does not meet --fail-on threshold\n  1  Meets threshold without errors\n  2  Meets threshold with at least one error\n\nExamples:\n  unguard scan src\n  unguard scan src --rule duplicate-*=warning\n  unguard scan src --rule category:cross-file=warning\n  unguard scan src --rule tag:safety=error\n  unguard scan src --severity=error,warning\n  unguard scan src --fail-on=error`);\n}\n\nfunction printDiagnostics(diagnostics: Diagnostic[]) {\n  const byFile = new Map<string, Diagnostic[]>();\n  for (const diagnostic of diagnostics) {\n    let list = byFile.get(diagnostic.file);\n    if (list === undefined) {\n      list = [];\n      byFile.set(diagnostic.file, list);\n    }\n    list.push(diagnostic);\n  }\n\n  const cwd = `${process.cwd()}/`;\n  const cwdBase = process.cwd();\n\n  for (const [file, fileDiagnostics] of byFile) {\n    const rel = relative(cwdBase, file);\n    console.log(pc.underline(rel));\n\n    for (const diagnostic of fileDiagnostics) {\n      const loc = `${diagnostic.line}:${diagnostic.column}`;\n      const sev = diagnostic.severity === \"error\"\n        ? pc.red(\"error\")\n        : diagnostic.severity === \"warning\"\n        ? pc.yellow(\"warning\")\n        : pc.blue(\"info\");\n      const msg = diagnostic.message.replaceAll(cwd, \"\");\n      const rule = pc.dim(diagnostic.ruleId);\n      const annotation = diagnostic.annotation !== undefined ? `  ${pc.cyan(diagnostic.annotation)}` : \"\";\n      console.log(`  ${pc.dim(loc.padEnd(10))} ${sev}  ${msg}  ${rule}${annotation}`);\n    }\n\n    console.log();\n  }\n}\n\nfunction printDiagnosticsFlat(diagnostics: Diagnostic[]) {\n  const cwdBase = process.cwd();\n  const cwd = `${cwdBase}/`;\n\n  for (const diagnostic of diagnostics) {\n    const rel = relative(cwdBase, diagnostic.file);\n    const msg = diagnostic.message.replaceAll(cwd, \"\");\n    console.log(`${rel}:${diagnostic.line}:${diagnostic.column} ${diagnostic.severity} [${diagnostic.ruleId}] ${msg}`);\n  }\n}\n\nfunction printSummary(diagnostics: Diagnostic[], fileCount: number) {\n  const counts = new Map<string, number>();\n  for (const diagnostic of diagnostics) {\n    const prev = counts.get(diagnostic.ruleId);\n    counts.set(diagnostic.ruleId, (prev === undefined ? 0 : prev) + 1);\n  }\n\n  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);\n  const maxRule = Math.max(...sorted.map(([rule]) => rule.length));\n\n  console.log(pc.bold(\"Summary\"));\n  for (const [rule, count] of sorted) {\n    console.log(`  ${rule.padEnd(maxRule)}  ${pc.bold(String(count))}`);\n  }\n\n  console.log(\n    `\\n${pc.bold(String(diagnostics.length))} issue${diagnostics.length === 1 ? \"\" : \"s\"} in ${fileCount} files.`,\n  );\n}\n\nfunction parseSeverityFilters(values: string[]): { ok: true; value: Severity[] } | { ok: false; message: string } {\n  const levels = splitCsv(values);\n  const parsed: Severity[] = [];\n  for (const value of levels) {\n    if (!isSeverity(value)) {\n      return { ok: false, message: `Invalid --severity value \"${value}\". Use error, warning, info.` };\n    }\n    parsed.push(value);\n  }\n  return { ok: true, value: parsed };\n}\n\nfunction parseRulePolicyArgs(values: string[]): { ok: true; value: RulePolicyEntry[] } | { ok: false; message: string } {\n  const entries: RulePolicyEntry[] = [];\n\n  for (const arg of values) {\n    const separator = resolveRuleSeparator(arg);\n    if (separator === null) {\n      return { ok: false, message: `Invalid --rule value \"${arg}\". Use <selector>=<off|info|warning|error>.` };\n    }\n\n    const selector = arg.slice(0, separator).trim();\n    const severity = arg.slice(separator + 1).trim();\n    if (!selector) {\n      return { ok: false, message: `Invalid --rule value \"${arg}\". Rule selector is required.` };\n    }\n    if (!isRulePolicySeverity(severity)) {\n      return { ok: false, message: `Invalid --rule value \"${arg}\". Severity must be off, info, warning, or error.` };\n    }\n\n    entries.push({ selector, severity });\n  }\n\n  return { ok: true, value: entries };\n}\n\nfunction resolveRuleSeparator(value: string): number | null {\n  const equalIndex = value.indexOf(\"=\");\n  if (equalIndex >= 0) return equalIndex;\n  const colonIndex = value.lastIndexOf(\":\");\n  if (colonIndex <= 0) return null;\n  return colonIndex;\n}\n\nfunction splitCsv(values: string[]): string[] {\n  return values\n    .flatMap((value) => value.split(\",\"))\n    .map((value) => value.trim())\n    .filter((value) => value.length > 0);\n}\n\nfunction findConfigPath(cliValue: string | undefined): string | null {\n  if (cliValue) {\n    const explicitPath = resolve(process.cwd(), cliValue);\n    if (!existsSync(explicitPath)) throw new Error(`Config file not found: ${cliValue}`);\n    return explicitPath;\n  }\n\n  const candidates = [\"unguard.config.json\", \".unguardrc.json\"];\n  for (const candidate of candidates) {\n    const candidatePath = resolve(process.cwd(), candidate);\n    if (existsSync(candidatePath)) return candidatePath;\n  }\n  return null;\n}\n\nfunction loadConfig(path: string): UnguardConfig {\n  const text = readFileSync(path, \"utf8\");\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    throw new Error(`Invalid JSON in ${basename(path)}: ${message}`);\n  }\n\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(`Invalid config in ${basename(path)}: expected a JSON object.`);\n  }\n\n  const raw = parsed as Record<string, unknown>;\n  const config: UnguardConfig = {};\n\n  if (raw.paths !== undefined) {\n    if (!isStringArray(raw.paths)) throw new Error(`Invalid config in ${basename(path)}: \"paths\" must be a string array.`);\n    config.paths = raw.paths;\n  }\n\n  if (raw.ignore !== undefined) {\n    if (!isStringArray(raw.ignore)) throw new Error(`Invalid config in ${basename(path)}: \"ignore\" must be a string array.`);\n    config.ignore = raw.ignore;\n  }\n\n  if (raw.failOn !== undefined) {\n    if (typeof raw.failOn !== \"string\" || !isFailOn(raw.failOn)) {\n      throw new Error(`Invalid config in ${basename(path)}: \"failOn\" must be one of none, error, warning, info.`);\n    }\n    config.failOn = raw.failOn;\n  }\n\n  if (raw.rules !== undefined) {\n    if (typeof raw.rules !== \"object\" || raw.rules === null || Array.isArray(raw.rules)) {\n      throw new Error(`Invalid config in ${basename(path)}: \"rules\" must be an object.`);\n    }\n\n    const rules: Record<string, RulePolicySeverity> = {};\n    for (const [selector, severity] of Object.entries(raw.rules as Record<string, unknown>)) {\n      if (typeof severity !== \"string\" || !isRulePolicySeverity(severity)) {\n        throw new Error(`Invalid config in ${basename(path)}: rule \"${selector}\" must be off, info, warning, or error.`);\n      }\n      rules[selector] = severity;\n    }\n    config.rules = rules;\n  }\n\n  return config;\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every((entry) => typeof entry === \"string\");\n}\n\nfunction resolveFailOn(\n  cliValue: string | undefined,\n  configValue: FailOn | undefined,\n): { ok: true; value: FailOn } | { ok: false; message: string } {\n  const selected = cliValue ?? configValue ?? \"info\";\n  if (!isFailOn(selected)) {\n    return { ok: false, message: `Invalid --fail-on value \"${selected}\". Use none, error, warning, or info.` };\n  }\n  return { ok: true, value: selected };\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,UAAU,eAAe;AAC5C,SAAS,iBAAiB;AAC1B,OAAO,QAAQ;AAaf,eAAsB,KAAK,MAAiC;AAC1D,QAAM,UAAU,KAAK,MAAM,CAAC;AAC5B,QAAM,WAAW,QAAQ,CAAC,MAAM,SAAS,QAAQ,MAAM,CAAC,IAAI;AAE5D,QAAM,EAAE,QAAQ,aAAa,SAAS,IAAI,UAAU;AAAA,IAClD,MAAM;AAAA,IACN,SAAS;AAAA,MACP,QAAQ,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,MAC1C,QAAQ,EAAE,MAAM,SAAS;AAAA,MACzB,QAAQ,EAAE,MAAM,UAAU,SAAS,UAAU;AAAA,MAC7C,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,SAAS,CAAC,EAAE;AAAA,MACxD,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM,SAAS,CAAC,EAAE;AAAA,MACtD,MAAM,EAAE,MAAM,UAAU,UAAU,MAAM,SAAS,CAAC,EAAE;AAAA,MACpD,QAAQ,EAAE,MAAM,SAAS;AAAA,MACzB,WAAW,EAAE,MAAM,SAAS;AAAA,MAC5B,MAAM,EAAE,MAAM,WAAW,OAAO,KAAK,SAAS,MAAM;AAAA,IACtD;AAAA,IACA,kBAAkB;AAAA,EACpB,CAAC;AAED,MAAI,OAAO,MAAM;AACf,cAAU;AACV,WAAO;AAAA,EACT;AAEA,MAAI,SAA+B;AACnC,MAAI;AACF,UAAM,aAAa,eAAe,OAAO,MAAM;AAC/C,aAAS,aAAa,WAAW,UAAU,IAAI;AAAA,EACjD,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,YAAQ,MAAM,GAAG,IAAI,OAAO,CAAC;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,oBAAoB,OAAO,IAAI;AACxD,MAAI,CAAC,iBAAiB,IAAI;AACxB,YAAQ,MAAM,GAAG,IAAI,iBAAiB,OAAO,CAAC;AAC9C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,qBAAqB,OAAO,QAAQ;AAClE,MAAI,CAAC,sBAAsB,IAAI;AAC7B,YAAQ,MAAM,GAAG,IAAI,sBAAsB,OAAO,CAAC;AACnD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,cAAc,OAAO,SAAS,GAAG,QAAQ,MAAM;AACpE,MAAI,CAAC,aAAa,IAAI;AACpB,YAAQ,MAAM,GAAG,IAAI,aAAa,OAAO,CAAC;AAC1C,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,SAAS,SAAS,IAAI,WAAW,QAAQ,SAAS,CAAC;AACjE,QAAM,SAAS,CAAC,GAAI,QAAQ,UAAU,CAAC,GAAI,GAAG,OAAO,MAAM;AAC3D,QAAM,aAAa;AAAA,IACjB,GAAG,oBAAoB,QAAQ,KAAK;AAAA,IACpC,GAAG,iBAAiB;AAAA,EACtB;AAEA,QAAM,YAAY,MAAM,YAAY;AAAA,IAClC;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO,SAAS,CAAC,OAAO,MAAM,IAAI;AAAA,IACzC,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,IACrC,YAAY,WAAW,SAAS,IAAI,aAAa;AAAA,IACjD,gBAAgB,sBAAsB,MAAM,SAAS,IAAI,sBAAsB,QAAQ;AAAA,IACvF,QAAQ,aAAa;AAAA,EACvB,CAAC;AAED,QAAM,cAAc,UAAU;AAC9B,MAAI,YAAY,WAAW,GAAG;AAC5B,YAAQ,IAAI,GAAG,MAAM,sBAAsB,UAAU,SAAS,SAAS,CAAC;AACxE,WAAO,UAAU;AAAA,EACnB;AAEA,MAAI,OAAO,WAAW,QAAQ;AAC5B,yBAAqB,WAAW;AAAA,EAClC,OAAO;AACL,qBAAiB,WAAW;AAAA,EAC9B;AACA,eAAa,aAAa,UAAU,SAAS;AAE7C,SAAO,UAAU;AACnB;AAEA,SAAS,YAAY;AACnB,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCA4BqB;AACnC;AAEA,SAAS,iBAAiB,aAA2B;AACnD,QAAM,SAAS,oBAAI,IAA0B;AAC7C,aAAW,cAAc,aAAa;AACpC,QAAI,OAAO,OAAO,IAAI,WAAW,IAAI;AACrC,QAAI,SAAS,QAAW;AACtB,aAAO,CAAC;AACR,aAAO,IAAI,WAAW,MAAM,IAAI;AAAA,IAClC;AACA,SAAK,KAAK,UAAU;AAAA,EACtB;AAEA,QAAM,MAAM,GAAG,QAAQ,IAAI,CAAC;AAC5B,QAAM,UAAU,QAAQ,IAAI;AAE5B,aAAW,CAAC,MAAM,eAAe,KAAK,QAAQ;AAC5C,UAAM,MAAM,SAAS,SAAS,IAAI;AAClC,YAAQ,IAAI,GAAG,UAAU,GAAG,CAAC;AAE7B,eAAW,cAAc,iBAAiB;AACxC,YAAM,MAAM,GAAG,WAAW,IAAI,IAAI,WAAW,MAAM;AACnD,YAAM,MAAM,WAAW,aAAa,UAChC,GAAG,IAAI,OAAO,IACd,WAAW,aAAa,YACxB,GAAG,OAAO,SAAS,IACnB,GAAG,KAAK,MAAM;AAClB,YAAM,MAAM,WAAW,QAAQ,WAAW,KAAK,EAAE;AACjD,YAAM,OAAO,GAAG,IAAI,WAAW,MAAM;AACrC,YAAM,aAAa,WAAW,eAAe,SAAY,KAAK,GAAG,KAAK,WAAW,UAAU,CAAC,KAAK;AACjG,cAAQ,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,GAAG,UAAU,EAAE;AAAA,IAChF;AAEA,YAAQ,IAAI;AAAA,EACd;AACF;AAEA,SAAS,qBAAqB,aAA2B;AACvD,QAAM,UAAU,QAAQ,IAAI;AAC5B,QAAM,MAAM,GAAG,OAAO;AAEtB,aAAW,cAAc,aAAa;AACpC,UAAM,MAAM,SAAS,SAAS,WAAW,IAAI;AAC7C,UAAM,MAAM,WAAW,QAAQ,WAAW,KAAK,EAAE;AACjD,YAAQ,IAAI,GAAG,GAAG,IAAI,WAAW,IAAI,IAAI,WAAW,MAAM,IAAI,WAAW,QAAQ,KAAK,WAAW,MAAM,KAAK,GAAG,EAAE;AAAA,EACnH;AACF;AAEA,SAAS,aAAa,aAA2B,WAAmB;AAClE,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,cAAc,aAAa;AACpC,UAAM,OAAO,OAAO,IAAI,WAAW,MAAM;AACzC,WAAO,IAAI,WAAW,SAAS,SAAS,SAAY,IAAI,QAAQ,CAAC;AAAA,EACnE;AAEA,QAAM,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/D,QAAM,UAAU,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC;AAE/D,UAAQ,IAAI,GAAG,KAAK,SAAS,CAAC;AAC9B,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,YAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,CAAC,KAAK,GAAG,KAAK,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EACpE;AAEA,UAAQ;AAAA,IACN;AAAA,EAAK,GAAG,KAAK,OAAO,YAAY,MAAM,CAAC,CAAC,SAAS,YAAY,WAAW,IAAI,KAAK,GAAG,OAAO,SAAS;AAAA,EACtG;AACF;AAEA,SAAS,qBAAqB,QAAoF;AAChH,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,SAAqB,CAAC;AAC5B,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,WAAW,KAAK,GAAG;AACtB,aAAO,EAAE,IAAI,OAAO,SAAS,6BAA6B,KAAK,+BAA+B;AAAA,IAChG;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,OAAO;AACnC;AAEA,SAAS,oBAAoB,QAA2F;AACtH,QAAM,UAA6B,CAAC;AAEpC,aAAW,OAAO,QAAQ;AACxB,UAAM,YAAY,qBAAqB,GAAG;AAC1C,QAAI,cAAc,MAAM;AACtB,aAAO,EAAE,IAAI,OAAO,SAAS,yBAAyB,GAAG,8CAA8C;AAAA,IACzG;AAEA,UAAM,WAAW,IAAI,MAAM,GAAG,SAAS,EAAE,KAAK;AAC9C,UAAM,WAAW,IAAI,MAAM,YAAY,CAAC,EAAE,KAAK;AAC/C,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,IAAI,OAAO,SAAS,yBAAyB,GAAG,gCAAgC;AAAA,IAC3F;AACA,QAAI,CAAC,qBAAqB,QAAQ,GAAG;AACnC,aAAO,EAAE,IAAI,OAAO,SAAS,yBAAyB,GAAG,oDAAoD;AAAA,IAC/G;AAEA,YAAQ,KAAK,EAAE,UAAU,SAAS,CAAC;AAAA,EACrC;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,QAAQ;AACpC;AAEA,SAAS,qBAAqB,OAA8B;AAC1D,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,MAAI,cAAc,EAAG,QAAO;AAC5B,QAAM,aAAa,MAAM,YAAY,GAAG;AACxC,MAAI,cAAc,EAAG,QAAO;AAC5B,SAAO;AACT;AAEA,SAAS,SAAS,QAA4B;AAC5C,SAAO,OACJ,QAAQ,CAAC,UAAU,MAAM,MAAM,GAAG,CAAC,EACnC,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACvC;AAEA,SAAS,eAAe,UAA6C;AACnE,MAAI,UAAU;AACZ,UAAM,eAAe,QAAQ,QAAQ,IAAI,GAAG,QAAQ;AACpD,QAAI,CAAC,WAAW,YAAY,EAAG,OAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AACnF,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,CAAC,uBAAuB,iBAAiB;AAC5D,aAAW,aAAa,YAAY;AAClC,UAAM,gBAAgB,QAAQ,QAAQ,IAAI,GAAG,SAAS;AACtD,QAAI,WAAW,aAAa,EAAG,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAA6B;AAC/C,QAAM,OAAO,aAAa,MAAM,MAAM;AACtC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,MAAM,mBAAmB,SAAS,IAAI,CAAC,KAAK,OAAO,EAAE;AAAA,EACjE;AAEA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,2BAA2B;AAAA,EAChF;AAEA,QAAM,MAAM;AACZ,QAAM,SAAwB,CAAC;AAE/B,MAAI,IAAI,UAAU,QAAW;AAC3B,QAAI,CAAC,cAAc,IAAI,KAAK,EAAG,OAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,mCAAmC;AACrH,WAAO,QAAQ,IAAI;AAAA,EACrB;AAEA,MAAI,IAAI,WAAW,QAAW;AAC5B,QAAI,CAAC,cAAc,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,oCAAoC;AACvH,WAAO,SAAS,IAAI;AAAA,EACtB;AAEA,MAAI,IAAI,WAAW,QAAW;AAC5B,QAAI,OAAO,IAAI,WAAW,YAAY,CAAC,SAAS,IAAI,MAAM,GAAG;AAC3D,YAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,uDAAuD;AAAA,IAC5G;AACA,WAAO,SAAS,IAAI;AAAA,EACtB;AAEA,MAAI,IAAI,UAAU,QAAW;AAC3B,QAAI,OAAO,IAAI,UAAU,YAAY,IAAI,UAAU,QAAQ,MAAM,QAAQ,IAAI,KAAK,GAAG;AACnF,YAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,8BAA8B;AAAA,IACnF;AAEA,UAAM,QAA4C,CAAC;AACnD,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,IAAI,KAAgC,GAAG;AACvF,UAAI,OAAO,aAAa,YAAY,CAAC,qBAAqB,QAAQ,GAAG;AACnE,cAAM,IAAI,MAAM,qBAAqB,SAAS,IAAI,CAAC,WAAW,QAAQ,yCAAyC;AAAA,MACjH;AACA,YAAM,QAAQ,IAAI;AAAA,IACpB;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,SAAO;AACT;AAEA,SAAS,cAAc,OAAmC;AACxD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AACjF;AAEA,SAAS,cACP,UACA,aAC8D;AAC9D,QAAM,WAAW,YAAY,eAAe;AAC5C,MAAI,CAAC,SAAS,QAAQ,GAAG;AACvB,WAAO,EAAE,IAAI,OAAO,SAAS,4BAA4B,QAAQ,wCAAwC;AAAA,EAC3G;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,SAAS;AACrC;","names":[]}

package/dist/index.d.ts

@@ -1,17 +1,17 @@
-import { Node, Comment } from 'oxc-parser';
+import * as ts from 'typescript';
 
 interface TypeEntry {
     name: string;
     file: string;
     line: number;
     hash: string;
-    node: Node;
+    node: ts.Node;
     exported: boolean;
 }
 declare class TypeRegistry {
     private entries;
     private byHash;
-    add(name: string, file: string, line: number, typeNode: Node, source: string, exported: boolean): void;
+    add(name: string, file: string, line: number, typeNode: ts.Node, sourceFile: ts.SourceFile, exported: boolean): void;
     getDuplicateGroups(): TypeEntry[][];
     getAll(): TypeEntry[];
     getNameCollisionGroups(): TypeEntry[][];
@@ -29,8 +29,9 @@ interface FunctionEntry {
     line: number;
     hash: string;
     params: ParamInfo[];
-    node: Node;
+    node: ts.Node;
     exported: boolean;
+    symbol?: ts.Symbol;
 }
 declare class FunctionRegistry {
     private entries;
@@ -42,6 +43,12 @@ declare class FunctionRegistry {
     getNameCollisionGroups(): FunctionEntry[][];
 }
 
+interface CommentInfo {
+    type: "Line" | "Block";
+    value: string;
+    start: number;
+    end: number;
+}
 interface ProjectIndex {
     types: TypeRegistry;
     functions: FunctionRegistry;
@@ -49,8 +56,8 @@ interface ProjectIndex {
     imports: ImportEntry[];
     files: Map<string, {
         source: string;
-        program: Node;
-        comments: Comment[];
+        sourceFile: ts.SourceFile;
+        comments: CommentInfo[];
     }>;
 }
 interface CallSite {
@@ -58,7 +65,8 @@ interface CallSite {
     file: string;
     line: number;
     argCount: number;
-    node: Node;
+    node: ts.CallExpression;
+    symbol?: ts.Symbol;
 }
 interface ImportEntry {
     file: string;
@@ -76,22 +84,22 @@ interface Diagnostic {
     column: number;
     annotation?: string;
 }
-interface Span {
-    start: number;
-    end: number;
-}
-interface VisitContext {
-    report(span: Span, message?: string): void;
+interface TSVisitContext {
+    report(node: ts.Node, message?: string): void;
+    reportAtOffset(offset: number, message?: string): void;
     filename: string;
     source: string;
-    comments: Comment[];
+    sourceFile: ts.SourceFile;
+    checker: ts.TypeChecker;
+    isNullable(node: ts.Node): boolean;
+    isExternal(node: ts.Node): boolean;
 }
-interface SingleFileRule {
+interface TSRule {
+    kind: "ts";
     id: string;
     severity: "info" | "warning" | "error";
     message: string;
-    visit(node: Node, parent: Node | null, ctx: VisitContext): void;
-    visitComment?(comment: Comment, ctx: VisitContext): void;
+    visit(node: ts.Node, ctx: TSVisitContext): void;
 }
 
 interface CrossFileRule {
@@ -100,19 +108,44 @@ interface CrossFileRule {
     message: string;
     analyze(project: ProjectIndex): Diagnostic[];
 }
-type Rule = SingleFileRule | CrossFileRule;
+type Rule = CrossFileRule | TSRule;
+
+type RuleCategory = "type-evasion" | "defensive-code" | "error-handling" | "interface-design" | "cross-file" | "imports";
+interface RuleMetadata {
+    category: RuleCategory;
+    tags: string[];
+}
+declare const allRules: Rule[];
+declare function getRuleMetadata(ruleId: string): RuleMetadata;
 
+type Severity = Diagnostic["severity"];
+type RulePolicySeverity = Severity | "off";
+type FailOn = "none" | Severity;
+interface RulePolicyEntry {
+    selector: string;
+    severity: RulePolicySeverity;
+}
+type RulePolicy = Record<string, RulePolicySeverity> | RulePolicyEntry[];
 interface ScanOptions {
     paths: string[];
     strict?: boolean;
     rules?: string[];
+    ignore?: string[];
+    rulePolicy?: RulePolicy;
+    showSeverities?: Severity[];
+    failOn?: FailOn;
+    useGitIgnore?: boolean;
 }
 interface ScanResult {
     diagnostics: Diagnostic[];
     fileCount: number;
 }
-declare function scan(options: ScanOptions): Promise<ScanResult>;
+interface ScanExecutionResult extends ScanResult {
+    visibleDiagnostics: Diagnostic[];
+    exitCode: number;
+}
 
-declare const allRules: Rule[];
+declare function executeScan(options: ScanOptions): Promise<ScanExecutionResult>;
+declare function scan(options: ScanOptions): Promise<ScanResult>;
 
-export { type CrossFileRule, type Diagnostic, type Rule, type ScanOptions, type ScanResult, type SingleFileRule, allRules, scan };
+export { type CrossFileRule, type Diagnostic, type Rule, type RuleCategory, type RuleMetadata, type ScanExecutionResult, type ScanOptions, type ScanResult, type TSRule, type TSVisitContext, allRules, executeScan, getRuleMetadata, scan };

package/dist/index.js

@@ -1,9 +1,13 @@
 import {
   allRules,
+  executeScan,
+  getRuleMetadata,
   scan
-} from "./chunk-LEYOVUJE.js";
+} from "./chunk-I4RZLVE2.js";
 export {
   allRules,
+  executeScan,
+  getRuleMetadata,
   scan
 };
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unguard",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "Detect overdefensive AI-generated code",
   "author": "Seva Maltsev <me@seva.dev> (https://seva.dev)",
   "license": "MIT",
@@ -36,10 +36,12 @@
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc",
+    "lint:biome": "biome lint src tests/**/*.test.ts tests/harness.ts",
+    "lint": "npm run lint:biome",
     "test": "vitest run",
     "test:watch": "vitest",
-    "scan": "node ./bin/unguard.mjs scan .",
-    "scan:strict": "node ./bin/unguard.mjs scan . --strict",
+    "scan": "node ./bin/unguard.mjs scan src \"tests/**/*.test.ts\" tests/harness.ts --fail-on=error",
+    "scan:strict": "node ./bin/unguard.mjs scan src \"tests/**/*.test.ts\" tests/harness.ts --strict --fail-on=error",
     "prepublishOnly": "npm run build && npm run test"
   },
   "engines": {
@@ -47,15 +49,14 @@
   },
   "dependencies": {
     "fast-glob": "^3.3.3",
-    "oxc-parser": "^0.114.0",
-    "oxc-walker": "^0.7.0",
-    "picocolors": "^1.1.1"
+    "ignore": "^7.0.5",
+    "picocolors": "^1.1.1",
+    "typescript": "^5.9.3"
   },
   "devDependencies": {
-    "@oxc-project/types": "^0.114.0",
+    "@biomejs/biome": "^1.9.4",
     "@types/node": "^25.3.0",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   }
 }