@lunanoir/dep-lens 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dep-lens contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,22 @@
+# dep-lens
+
+Scan the licenses of your npm/yarn/pnpm and Cargo dependencies and report
+commercial-use risk, in an interactive terminal UI or as JSON/HTML for CI.
+
+```sh
+npm install -g dep-lens
+
+dep-lens                      # interactive TUI
+dep-lens --json               # raw JSON to stdout
+dep-lens --html report.html   # standalone HTML report
+dep-lens --fail-on gpl        # exit 1 when strong copyleft is found (CI gate)
+dep-lens --path ../my-app --ignore left-pad
+```
+
+Full documentation: https://github.com/dep-lens/dep-lens
+
+This package contains the CLI and TUI; the native scanner binary is delivered
+through a platform-specific optional dependency (Linux x64, macOS x64/arm64,
+Windows x64).
+
+License: MIT

package/dist/args.js

@@ -0,0 +1,113 @@
+export const USAGE = `dep-lens: scan dependencies for license risk
+
+USAGE:
+    dep-lens [OPTIONS]
+
+OPTIONS:
+    --json             Print the raw JSON report to stdout (no TUI)
+    --html <FILE>      Write an HTML report to FILE (no TUI)
+    --csv <FILE>       Write a CSV report to FILE (no TUI)
+    --md <FILE>        Write a Markdown report to FILE (no TUI)
+    --fail-on <KIND>   Exit with code 1 when matching licenses are found.
+                       KIND is "gpl" (any strong copyleft: GPL, AGPL) or
+                       "agpl" (AGPL only). Intended for CI/CD pipelines.
+    --path <DIR>       Project directory to scan (default: current directory)
+    --ignore <NAMES>   Comma-separated package names to exclude (repeatable)
+    --tr               Turkish UI (Turkce arayuz)
+    --help             Show this help
+    --version          Show version
+
+KEYS (interactive TUI):
+    up/down            Move selection (pgup/pgdn jump 10, g/G top/bottom)
+    enter              Open package detail pane
+    f                  Filter by package name, license, or category
+    1 / 2 / 3 / 4      Quick filter: Permissive / Weak / Strong / Unknown
+    0                  Clear all filters
+    s                  Cycle sort column
+    r                  Reverse sort direction
+    e                  Export menu (JSON / HTML)
+    h                  Help overlay
+    q                  Quit
+`;
+/**
+ * Parse CLI arguments. Throws an Error with a user-facing message on
+ * unknown flags, missing values, or invalid --fail-on kinds.
+ */
+export function parseArgs(argv) {
+    const options = {
+        json: false,
+        html: null,
+        csv: null,
+        markdown: null,
+        failOn: null,
+        path: '.',
+        ignore: [],
+        locale: 'en',
+        help: false,
+        version: false,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        switch (arg) {
+            case '--json':
+                options.json = true;
+                break;
+            case '--html':
+                options.html = requireValue(argv, i, '--html');
+                i += 1;
+                break;
+            case '--csv':
+                options.csv = requireValue(argv, i, '--csv');
+                i += 1;
+                break;
+            case '--md':
+            case '--markdown':
+                options.markdown = requireValue(argv, i, '--md');
+                i += 1;
+                break;
+            case '--fail-on': {
+                const value = requireValue(argv, i, '--fail-on');
+                i += 1;
+                if (value !== 'gpl' && value !== 'agpl') {
+                    throw new Error(`--fail-on must be "gpl" or "agpl", got "${value}"`);
+                }
+                options.failOn = value;
+                break;
+            }
+            case '--path':
+                options.path = requireValue(argv, i, '--path');
+                i += 1;
+                break;
+            case '--ignore': {
+                const value = requireValue(argv, i, '--ignore');
+                i += 1;
+                options.ignore.push(...value
+                    .split(',')
+                    .map((name) => name.trim())
+                    .filter((name) => name.length > 0));
+                break;
+            }
+            case '--tr':
+                options.locale = 'tr';
+                break;
+            case '--help':
+            case '-h':
+                options.help = true;
+                break;
+            case '--version':
+            case '-V':
+                options.version = true;
+                break;
+            default:
+                throw new Error(`unknown argument: ${String(arg)}`);
+        }
+    }
+    return options;
+}
+function requireValue(argv, index, flag) {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('--')) {
+        throw new Error(`${flag} requires a value`);
+    }
+    return value;
+}

package/dist/bridge.js

@@ -0,0 +1,117 @@
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const PLATFORM_PACKAGES = {
+    'linux-x64': '@lunanoir/dep-lens-linux-x64',
+    'darwin-arm64': '@lunanoir/dep-lens-darwin-arm64',
+    'darwin-x64': '@lunanoir/dep-lens-darwin-x64',
+    'win32-x64': '@lunanoir/dep-lens-win32-x64',
+};
+function binaryName() {
+    return process.platform === 'win32' ? 'dep-lens-core.exe' : 'dep-lens-core';
+}
+/**
+ * Locate the dep-lens-core binary. Resolution order:
+ * 1. DEP_LENS_BINARY environment variable (explicit override)
+ * 2. The platform-specific optional dependency (normal installs)
+ * 3. The Cargo target directory of this repository (development)
+ */
+export function resolveBinaryPath() {
+    const override = process.env['DEP_LENS_BINARY'];
+    if (override !== undefined && override.length > 0) {
+        return override;
+    }
+    const platformKey = `${process.platform}-${process.arch}`;
+    const packageName = PLATFORM_PACKAGES[platformKey];
+    if (packageName !== undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            return require.resolve(`${packageName}/bin/${binaryName()}`);
+        }
+        catch {
+            // Platform package not installed; fall through to development paths.
+        }
+    }
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    for (const profile of ['release', 'debug']) {
+        const candidate = path.resolve(here, '..', '..', '..', 'target', profile, binaryName());
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    throw new Error(`no native binary available for ${platformKey}. ` +
+        'Reinstall dep-lens so the platform package is picked up, or set DEP_LENS_BINARY.');
+}
+function scanArgs(options) {
+    const args = ['--path', options.path];
+    for (const name of options.ignore) {
+        args.push('--ignore', name);
+    }
+    if (options.locale) {
+        args.push('--lang', options.locale);
+    }
+    return args;
+}
+async function runCore(args) {
+    const binary = resolveBinaryPath();
+    try {
+        const { stdout } = await execFileAsync(binary, [...args], {
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    catch (error) {
+        const stderr = typeof error === 'object' && error !== null && 'stderr' in error
+            ? String(error.stderr).trim()
+            : '';
+        throw new Error(`core scanner failed${stderr.length > 0 ? `: ${stderr}` : ''}`);
+    }
+}
+/** Structural validation of the core binary's JSON output. */
+export function validateReport(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('core output is not a JSON object');
+    }
+    const record = value;
+    for (const field of ['project', 'scannedAt', 'path']) {
+        if (typeof record[field] !== 'string') {
+            throw new Error(`core output is missing string field "${field}"`);
+        }
+    }
+    const summary = record['summary'];
+    if (typeof summary !== 'object' || summary === null) {
+        throw new Error('core output is missing "summary"');
+    }
+    if (!Array.isArray(record['packages'])) {
+        throw new Error('core output is missing "packages" array');
+    }
+    return value;
+}
+/** Run a scan and return the parsed report. */
+export async function runScan(options) {
+    const stdout = await runCore([...scanArgs(options), '--format', 'json']);
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error('core output is not valid JSON');
+    }
+    return validateReport(parsed);
+}
+/** Run a scan and return the standalone HTML report. */
+export async function renderHtml(options) {
+    return runCore([...scanArgs(options), '--format', 'html']);
+}
+/** Run a scan and return the CSV report. */
+export async function renderCsv(options) {
+    return runCore([...scanArgs(options), '--format', 'csv']);
+}
+/** Run a scan and return the Markdown report. */
+export async function renderMarkdown(options) {
+    return runCore([...scanArgs(options), '--format', 'markdown']);
+}

package/dist/cli.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import { writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import React from 'react';
+import { render } from 'ink';
+import { parseArgs, USAGE } from './args.js';
+import { renderCsv, renderHtml, renderMarkdown, runScan } from './bridge.js';
+import { violations } from './utils.js';
+import { Root } from './ui/Root.js';
+function packageVersion() {
+    const require = createRequire(import.meta.url);
+    const manifest = require('../package.json');
+    return manifest.version;
+}
+function applyFailOn(report, options) {
+    if (options.failOn === null) {
+        return;
+    }
+    const offenders = violations(report, options.failOn);
+    if (offenders.length > 0) {
+        process.stderr.write(`dep-lens: --fail-on ${options.failOn} matched ${offenders.length} package(s):\n`);
+        for (const pkg of offenders) {
+            process.stderr.write(`  ${pkg.name}@${pkg.version} (${pkg.license})\n`);
+        }
+        process.exitCode = 1;
+    }
+}
+async function main() {
+    let options;
+    try {
+        options = parseArgs(process.argv.slice(2));
+    }
+    catch (error) {
+        process.stderr.write(`dep-lens: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.stderr.write('Run dep-lens --help for usage.\n');
+        process.exitCode = 2;
+        return;
+    }
+    if (options.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (options.version) {
+        process.stdout.write(`dep-lens ${packageVersion()}\n`);
+        return;
+    }
+    const scanOptions = { path: options.path, ignore: options.ignore, locale: options.locale };
+    if (options.json) {
+        const report = await runScan(scanOptions);
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        applyFailOn(report, options);
+        return;
+    }
+    if (options.html !== null) {
+        const report = await runScan(scanOptions);
+        const html = await renderHtml(scanOptions);
+        await writeFile(options.html, html);
+        process.stderr.write(`dep-lens: HTML report written to ${options.html}\n`);
+        applyFailOn(report, options);
+        return;
+    }
+    if (options.csv !== null) {
+        const report = await runScan(scanOptions);
+        const csv = await renderCsv(scanOptions);
+        await writeFile(options.csv, csv);
+        process.stderr.write(`dep-lens: CSV report written to ${options.csv}\n`);
+        applyFailOn(report, options);
+        return;
+    }
+    if (options.markdown !== null) {
+        const report = await runScan(scanOptions);
+        const md = await renderMarkdown(scanOptions);
+        await writeFile(options.markdown, md);
+        process.stderr.write(`dep-lens: Markdown report written to ${options.markdown}\n`);
+        applyFailOn(report, options);
+        return;
+    }
+    if (process.stdout.isTTY !== true) {
+        // Piped or redirected output: emit JSON instead of starting the TUI.
+        const report = await runScan(scanOptions);
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        applyFailOn(report, options);
+        return;
+    }
+    // Interactive TUI: the scan runs inside the UI behind an animated
+    // progress screen; the report is captured for the --fail-on gate.
+    const captured = { report: null };
+    const app = render(React.createElement(Root, {
+        locale: options.locale,
+        version: packageVersion(),
+        scan: () => runScan(scanOptions),
+        getHtml: () => renderHtml(scanOptions),
+        onReport: (report) => {
+            captured.report = report;
+        },
+        onError: () => {
+            process.exitCode = 2;
+        },
+    }));
+    await app.waitUntilExit();
+    if (captured.report !== null) {
+        applyFailOn(captured.report, options);
+    }
+}
+main().catch((error) => {
+    process.stderr.write(`dep-lens: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 2;
+});

package/dist/i18n.js

@@ -0,0 +1,231 @@
+/** Replace `{name}` placeholders in a catalog template. */
+export function format(template, values) {
+    return template.replace(/\{(\w+)\}/g, (match, key) => key in values ? String(values[key]) : match);
+}
+export const EN = {
+    header: {
+        scanned: 'scanned',
+        packages: 'packages',
+        health: {
+            good: 'good',
+            ok: 'needs attention',
+            poor: 'at risk',
+        },
+    },
+    categories: {
+        Permissive: 'Permissive',
+        WeakCopyleft: 'Weak Copyleft',
+        StrongCopyleft: 'Strong Copyleft',
+        Unknown: 'Unknown',
+    },
+    summaryShort: {
+        Permissive: 'Permissive',
+        WeakCopyleft: 'Weak',
+        StrongCopyleft: 'Strong',
+        Unknown: 'Unknown',
+    },
+    riskLevels: {
+        low: 'low',
+        medium: 'medium',
+        high: 'high',
+    },
+    commercial: {
+        yes: 'yes',
+        caution: 'caution',
+        restricted: 'restricted',
+        review: 'review',
+    },
+    sources: {
+        declared: 'declared in manifest',
+        licenseFile: 'detected from LICENSE file',
+        none: 'not found',
+    },
+    types: {
+        direct: 'direct',
+        transitive: 'transitive',
+    },
+    advice: {
+        Permissive: 'Safe for commercial use. Keep the copyright notice.',
+        WeakCopyleft: 'Commercial use is fine; modifications to this library itself must stay open.',
+        StrongCopyleft: 'Copyleft terms can extend to derivative works. Legal review required.',
+        Unknown: 'License could not be identified. Review this package manually.',
+    },
+    table: {
+        package: 'PACKAGE',
+        version: 'VERSION',
+        license: 'LICENSE',
+        category: 'CATEGORY',
+        type: 'TYPE',
+        risk: 'RISK',
+        commercial: 'COMMERCIAL',
+        empty: 'No packages match the current filter.',
+        rows: 'rows {start}-{end} of {total}',
+    },
+    footer: 'arrows  enter detail  f filter  1-4 cat  s sort  e export  h help  q quit',
+    filtersLabel: 'filters: {list}',
+    filterText: 'text "{query}"',
+    filterCategory: 'category {category}',
+    filterBar: {
+        label: 'filter: ',
+        hint: '  (enter apply, esc clear)',
+    },
+    exportMenu: {
+        title: 'export (enter select, esc cancel)',
+        json: 'Export JSON  (dep-lens-report.json)',
+        html: 'Export HTML  (dep-lens-report.html)',
+        cancel: 'Cancel',
+        writing: 'writing {file} ...',
+        wrote: 'wrote {file}',
+        failed: 'export failed: {error}',
+    },
+    detail: {
+        hint: '(enter/esc close)',
+        ecosystem: 'ecosystem',
+        license: 'license',
+        category: 'category',
+        risk: 'risk',
+        commercial: 'commercial',
+        advice: 'advice',
+        riskValue: '{score}/100 ({level})',
+    },
+    help: {
+        title: 'keys (h or esc to close)',
+        bindings: [
+            ['up/down', 'move selection'],
+            ['pgup/pgdn', 'jump 10 rows'],
+            ['g / G', 'jump to top / bottom'],
+            ['enter', 'open package detail'],
+            ['f', 'free-text filter (name, license, category)'],
+            ['1 / 2 / 3 / 4', 'quick filter: Permissive / Weak / Strong / Unknown'],
+            ['0', 'clear all filters'],
+            ['s', 'cycle sort column'],
+            ['r', 'reverse sort direction'],
+            ['e', 'export menu (JSON / HTML)'],
+            ['h', 'toggle this help'],
+            ['q', 'quit'],
+        ],
+    },
+    scanning: {
+        title: 'scanning dependencies',
+        elapsed: '{seconds}s elapsed',
+    },
+    error: {
+        title: 'scan failed',
+        hint: 'press q to quit',
+    },
+};
+export const TR = {
+    header: {
+        scanned: 'tarandı',
+        packages: 'paket',
+        health: {
+            good: 'iyi',
+            ok: 'dikkat gerekli',
+            poor: 'riskli',
+        },
+    },
+    categories: {
+        Permissive: 'İzinli',
+        WeakCopyleft: 'Zayıf Copyleft',
+        StrongCopyleft: 'Güçlü Copyleft',
+        Unknown: 'Bilinmeyen',
+    },
+    summaryShort: {
+        Permissive: 'İzinli',
+        WeakCopyleft: 'Zayıf',
+        StrongCopyleft: 'Güçlü',
+        Unknown: 'Bilinmeyen',
+    },
+    riskLevels: {
+        low: 'düşük',
+        medium: 'orta',
+        high: 'yüksek',
+    },
+    commercial: {
+        yes: 'evet',
+        caution: 'dikkat',
+        restricted: 'kısıtlı',
+        review: 'incele',
+    },
+    sources: {
+        declared: 'manifestte bildirilmiş',
+        licenseFile: 'LICENSE dosyasından tespit edildi',
+        none: 'bulunamadı',
+    },
+    types: {
+        direct: 'doğrudan',
+        transitive: 'dolaylı',
+    },
+    advice: {
+        Permissive: 'Ticari kullanım için güvenli. Telif bildirimini koruyun.',
+        WeakCopyleft: 'Ticari kullanım uygundur; bu kütüphanede yapılan değişiklikler açık kalmalıdır.',
+        StrongCopyleft: 'Copyleft şartları türev çalışmalara yayılabilir. Hukuki inceleme gerekir.',
+        Unknown: 'Lisans tespit edilemedi. Bu paketi elle inceleyin.',
+    },
+    table: {
+        package: 'PAKET',
+        version: 'SÜRÜM',
+        license: 'LİSANS',
+        category: 'KATEGORİ',
+        type: 'TÜR',
+        risk: 'RİSK',
+        commercial: 'TİCARİ',
+        empty: 'Filtreyle eşleşen paket yok.',
+        rows: 'satır {start}-{end} / {total}',
+    },
+    footer: 'oklar  enter detay  f filtre  1-4 kategori  s sırala  e aktar  h yardım  q çıkış',
+    filtersLabel: 'filtreler: {list}',
+    filterText: 'metin "{query}"',
+    filterCategory: 'kategori {category}',
+    filterBar: {
+        label: 'filtre: ',
+        hint: '  (enter uygula, esc temizle)',
+    },
+    exportMenu: {
+        title: 'dışa aktar (enter seç, esc iptal)',
+        json: 'JSON aktar  (dep-lens-report.json)',
+        html: 'HTML aktar  (dep-lens-report.html)',
+        cancel: 'İptal',
+        writing: '{file} yazılıyor ...',
+        wrote: '{file} yazıldı',
+        failed: 'dışa aktarma başarısız: {error}',
+    },
+    detail: {
+        hint: '(enter/esc kapat)',
+        ecosystem: 'ekosistem',
+        license: 'lisans',
+        category: 'kategori',
+        risk: 'risk',
+        commercial: 'ticari',
+        advice: 'tavsiye',
+        riskValue: '{score}/100 ({level})',
+    },
+    help: {
+        title: 'tuşlar (kapatmak için h veya esc)',
+        bindings: [
+            ['yukarı/aşağı', 'seçimi taşı'],
+            ['pgup/pgdn', '10 satır atla'],
+            ['g / G', 'başa / sona git'],
+            ['enter', 'paket detayını aç'],
+            ['f', 'serbest metin filtresi (ad, lisans, kategori)'],
+            ['1 / 2 / 3 / 4', 'hızlı filtre: İzinli / Zayıf / Güçlü / Bilinmeyen'],
+            ['0', 'tüm filtreleri temizle'],
+            ['s', 'sıralama sütununu değiştir'],
+            ['r', 'sıralama yönünü ters çevir'],
+            ['e', 'dışa aktarma menüsü (JSON / HTML)'],
+            ['h', 'bu yardımı aç/kapat'],
+            ['q', 'çıkış'],
+        ],
+    },
+    scanning: {
+        title: 'bağımlılıklar taranıyor',
+        elapsed: '{seconds}sn geçti',
+    },
+    error: {
+        title: 'tarama başarısız',
+        hint: 'çıkmak için q',
+    },
+};
+export function getMessages(locale) {
+    return locale === 'tr' ? TR : EN;
+}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * TypeScript mirror of the JSON contract emitted by the dep-lens-core binary.
+ * Field names and enum string values must stay in sync with
+ * crates/dep-lens-core/src/model.rs.
+ */
+export {};