feat: typescript migration (#40)

* chore: initialize TypeScript configuration and build setup

- Add tsconfig.json for root and mcp-server with strict type checking
- Install typescript and @types/node as devDependencies
- Add npm build script for TypeScript compilation
- Update main entrypoint to compiled dist/shannon.js
- Update Dockerfile to build TypeScript before running
- Configure output directory and module resolution for Node.js

* refactor: migrate codebase from JavaScript to TypeScript

- Convert all 37 JavaScript files to TypeScript (.js -> .ts)
- Add type definitions in src/types/ for agents, config, errors, session
- Update mcp-server with proper TypeScript types
- Move entry point from shannon.mjs to src/shannon.ts
- Update tsconfig.json with rootDir: "./src" for cleaner dist output
- Update Dockerfile to build TypeScript before runtime
- Update package.json paths to use compiled dist/shannon.js

No runtime behavior changes - pure type safety migration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs: update CLI references from ./shannon.mjs to shannon

- Update help text in src/cli/ui.ts
- Update usage examples in src/cli/command-handler.ts
- Update setup message in src/shannon.ts
- Update CLAUDE.md documentation with TypeScript file structure
- Replace all ./shannon.mjs references with shannon command

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: remove unnecessary eslint-disable comments

ESLint is not configured in this project, making these comments redundant.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

mcp-server/src/validation/queue-validator.ts

@@ -11,33 +11,41 @@
  * Ported from tools/save_deliverable.js (lines 56-75).
  */
 
-/**
- * @typedef {Object} ValidationResult
- * @property {boolean} valid
- * @property {string} [message]
- * @property {Object} [data]
- */
+import type { VulnerabilityQueue } from '../types/deliverables.js';
+
+export interface ValidationResult {
+  valid: boolean;
+  message?: string;
+  data?: VulnerabilityQueue;
+}
 
 /**
  * Validate JSON structure for queue files
  * Queue files must have a 'vulnerabilities' array
- *
- * @param {string} content - JSON string to validate
- * @returns {ValidationResult} ValidationResult with valid flag, optional error message, and parsed data
  */
-export function validateQueueJson(content) {
+export function validateQueueJson(content: string): ValidationResult {
   try {
-    const parsed = JSON.parse(content);
+    const parsed = JSON.parse(content) as unknown;
+
+    // Type guard for the parsed result
+    if (typeof parsed !== 'object' || parsed === null) {
+      return {
+        valid: false,
+        message: `Invalid queue structure: Expected an object. Got: ${typeof parsed}`,
+      };
+    }
+
+    const obj = parsed as Record<string, unknown>;
 
     // Queue files must have a 'vulnerabilities' array
-    if (!parsed.vulnerabilities) {
+    if (!('vulnerabilities' in obj)) {
       return {
         valid: false,
         message: `Invalid queue structure: Missing 'vulnerabilities' property. Expected: {"vulnerabilities": [...]}`,
       };
     }
 
-    if (!Array.isArray(parsed.vulnerabilities)) {
+    if (!Array.isArray(obj.vulnerabilities)) {
       return {
         valid: false,
         message: `Invalid queue structure: 'vulnerabilities' must be an array. Expected: {"vulnerabilities": [...]}`,
@@ -46,7 +54,7 @@ export function validateQueueJson(content) {
 
     return {
       valid: true,
-      data: parsed,
+      data: parsed as VulnerabilityQueue,
     };
   } catch (error) {
     return {

mcp-server/src/validation/totp-validator.ts

@@ -14,11 +14,8 @@
 /**
  * Base32 decode function
  * Ported from generate-totp-standalone.mjs
- *
- * @param {string} encoded - Base32 encoded string
- * @returns {Buffer} Buffer containing decoded bytes
  */
-export function base32Decode(encoded) {
+export function base32Decode(encoded: string): Buffer {
   const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
   const cleanInput = encoded.toUpperCase().replace(/[^A-Z2-7]/g, '');
 
@@ -26,7 +23,7 @@ export function base32Decode(encoded) {
     return Buffer.alloc(0);
   }
 
-  const output = [];
+  const output: number[] = [];
   let bits = 0;
   let value = 0;
 
@@ -52,10 +49,9 @@ export function base32Decode(encoded) {
  * Validate TOTP secret
  * Must be base32-encoded string
  *
- * @param {string} secret - Secret to validate
- * @returns {boolean} true if valid, throws Error if invalid
+ * @returns true if valid, throws Error if invalid
  */
-export function validateTotpSecret(secret) {
+export function validateTotpSecret(secret: string): boolean {
   if (!secret || secret.length === 0) {
     throw new Error('TOTP secret cannot be empty');
   }