@realmonsters/scan 0.0.0-stage → 0.0.2

package/README.md

@@ -1,3 +1,23 @@
-# Temporary Holding Version
+# @realmonsters/scan
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Builds an inventory of what a repository depends on: packages, runtimes, container images, GitHub Actions, LLM model IDs and public vendor API hosts, each with file:line evidence and the places in code that use them.
+
+```sh
+npx @realmonsters/scan . --out inventory.json
+```
+
+## What it does not do
+
+- **No network.** The scanner imports no network or process modules. You can prove it by running it under Node's permission model, which denies network and child processes unless explicitly allowed:
+
+  ```sh
+  node --permission --allow-fs-read="$(pwd)/*" --allow-fs-read="$(npm root -g)/*" \
+       --allow-fs-write="$(pwd)/inventory.json" \
+       "$(npm root -g)/@realmonsters/scan/dist/cli.js" . --out inventory.json
+  ```
+
+- **No source code.** The output contains file paths, line numbers, package names, versions, model IDs, imported symbol names and public vendor hostnames. It never contains a line of your code.
+- **No secrets.** Real `.env*` files, `.envrc`, `.npmrc`, `.netrc` and key files are never opened. Anything credential-shaped is withheld, and every output string must pass a strict allow-list.
+- **No internal hostnames.** Only known public vendors are named (e.g. `api.anthropic.com`, `zendesk.com`). Internal hosts, IP addresses, private registries and custom CI runner names are counted, never named.
+
+Read `inventory.json` before you send it anywhere.

package/dist/chunk-SXEJJ3CT.js

@@ -0,0 +1,864 @@
+// src/scan.ts
+import { readFile, readdir, lstat, open } from "node:fs/promises";
+import path from "node:path";
+
+// ../core/src/index.ts
+var INVENTORY_SCHEMA = "realmonsters.inventory/0.1";
+
+// src/redact.ts
+var KW = "(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|client[_-]?secret|private[_-]?key|auth[_-]?token|credentials?|dsn|sas)";
+var PATTERNS = [
+  // cloud
+  /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA)[0-9A-Z]{16}\b/,
+  // AWS key ids
+  /aws.{0,24}secret.{0,24}[:=]\s*['"]?[A-Za-z0-9/+=]{40}/i,
+  // AWS secret access key in context
+  /AccountKey=[^;\s'"]+/i,
+  /SharedAccessKey=[^;\s'"]+/i,
+  /[?&]sig=[A-Za-z0-9%+/=]{16,}/i,
+  // Azure
+  /"private_key(?:_id)?"\s*:/,
+  /"type"\s*:\s*"service_account"/,
+  // GCP service-account JSON
+  /\bAIza[0-9A-Za-z_-]{30,}/,
+  // Google API key
+  // source control and registries
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}/,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/,
+  /\bglpat-[A-Za-z0-9_-]{20,}/,
+  /\bgldt-[A-Za-z0-9_-]{20,}/,
+  /\bnpm_[A-Za-z0-9]{36}\b/,
+  /\bpypi-[A-Za-z0-9_-]{16,}/,
+  /\/\/[^\s/]*:_authToken=/,
+  // .npmrc
+  // AI providers
+  /\bsk-ant-[A-Za-z0-9_-]{20,}/,
+  /\bsk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}/,
+  // payments, messaging, SaaS
+  /\b[rsp]k_(?:live|test)_[A-Za-z0-9]{16,}/,
+  /\bwhsec_[A-Za-z0-9]{16,}/,
+  // Stripe
+  /\bSK[0-9a-fA-F]{32}\b/,
+  /\bAC[0-9a-fA-F]{32}\b/,
+  // Twilio
+  /\bSG\.[\w-]{16,}\.[\w-]{16,}/,
+  // SendGrid
+  /\bxox[abprse]-[A-Za-z0-9-]{10,}/,
+  /hooks\.slack\.com\/services\/[A-Z0-9/]+/i,
+  /discord(?:app)?\.com\/api\/webhooks\/\d+\/[\w-]+/i,
+  /\bntn_[A-Za-z0-9]{30,}/,
+  /\bsecret_[A-Za-z0-9]{30,}/,
+  // Notion
+  /\bhv[sbr]\.[A-Za-z0-9_-]{20,}/,
+  // HashiCorp Vault
+  /\blin_api_[A-Za-z0-9]{30,}/,
+  // Linear
+  /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}/,
+  // Shopify
+  /\bdapi[a-f0-9]{32}/,
+  // Databricks
+  /\b(?:dd|datadog)[_-]?(?:api|app)[_-]?key\s*[:=]/i,
+  // Datadog in context
+  // structure
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+  // JWT
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /-----BEGIN OPENSSH PRIVATE KEY-----/,
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@'"]*:[^\s/@'"]+@/i,
+  // basic-auth in any scheme
+  /[?&](?:token|key|api[_-]?key|apikey|access_token|auth|signature|secret|password|pwd)=[^&\s'"]{6,}/i,
+  new RegExp(`(?<![A-Za-z0-9])[A-Za-z0-9_]*${KW}[A-Za-z0-9_]*\\s*[:=]\\s*['"]?[^\\s'",;]{8,}`, "i")
+];
+function looksSecret(s) {
+  return PATTERNS.some((re) => re.test(s));
+}
+function lineLooksSecret(line) {
+  return looksSecret(line);
+}
+var SAFE = /^[A-Za-z0-9@._/:^~<>=!*+,| -]{1,120}$/;
+var BLOB = /[A-Za-z0-9+/]{32,}={0,2}/g;
+function hasBlob(s) {
+  for (const m of s.matchAll(BLOB)) if (!/^[0-9a-f]+$/.test(m[0])) return true;
+  return false;
+}
+function safeToken(raw) {
+  if (raw === void 0) return { ok: false, reason: "unsafe" };
+  const s = raw.trim();
+  if (looksSecret(s)) return { ok: false, reason: "secret" };
+  if (!SAFE.test(s)) return { ok: false, reason: "unsafe" };
+  if (hasBlob(s)) return { ok: false, reason: "secret" };
+  return { ok: true, value: s };
+}
+
+// src/hosts.ts
+var VENDOR_DOMAINS = [
+  // AI
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "aiplatform.googleapis.com",
+  "api.mistral.ai",
+  "api.cohere.com",
+  "api.cohere.ai",
+  "api.groq.com",
+  "api.together.xyz",
+  "api.fireworks.ai",
+  "api.deepseek.com",
+  "api.x.ai",
+  "api.perplexity.ai",
+  "api.replicate.com",
+  "api-inference.huggingface.co",
+  "huggingface.co",
+  "api.elevenlabs.io",
+  "api.deepgram.com",
+  "api.assemblyai.com",
+  "openai.azure.com",
+  "bedrock-runtime.amazonaws.com",
+  "api.voyageai.com",
+  "api.pinecone.io",
+  // dev platforms
+  "api.github.com",
+  "gitlab.com",
+  "api.bitbucket.org",
+  "api.vercel.com",
+  "api.netlify.com",
+  "api.cloudflare.com",
+  "api.render.com",
+  "api.fly.io",
+  "api.heroku.com",
+  "api.digitalocean.com",
+  "supabase.co",
+  "firebaseio.com",
+  "api.linear.app",
+  "sentry.io",
+  "api.datadoghq.com",
+  "api.datadoghq.eu",
+  "api.pagerduty.com",
+  "api.honeycomb.io",
+  "api.launchdarkly.com",
+  "api.statsig.com",
+  "api.segment.io",
+  "api.mixpanel.com",
+  "api.amplitude.com",
+  "app.posthog.com",
+  "us.i.posthog.com",
+  "eu.i.posthog.com",
+  // collaboration
+  "api.notion.com",
+  "slack.com",
+  "api.slack.com",
+  "graph.microsoft.com",
+  "login.microsoftonline.com",
+  "atlassian.net",
+  "api.atlassian.com",
+  "api.asana.com",
+  "api.monday.com",
+  "api.clickup.com",
+  "api.airtable.com",
+  "api.figma.com",
+  "api.zoom.us",
+  "www.googleapis.com",
+  "sheets.googleapis.com",
+  "gmail.googleapis.com",
+  "calendar.googleapis.com",
+  "drive.googleapis.com",
+  "discord.com",
+  "api.telegram.org",
+  "graph.facebook.com",
+  // business
+  "api.stripe.com",
+  "api.paypal.com",
+  "api-m.paypal.com",
+  "connect.squareup.com",
+  "api.adyen.com",
+  "plaid.com",
+  "api.wise.com",
+  "salesforce.com",
+  "force.com",
+  "api.hubapi.com",
+  "zendesk.com",
+  "api.intercom.io",
+  "myshopify.com",
+  "api.shopify.com",
+  "api.twilio.com",
+  "api.sendgrid.com",
+  "api.mailgun.net",
+  "api.postmarkapp.com",
+  "api.resend.com",
+  "api.brevo.com",
+  "api.docusign.net",
+  "api.xero.com",
+  "quickbooks.api.intuit.com",
+  "api.chargebee.com",
+  "api.paddle.com",
+  "api.lemonsqueezy.com",
+  // identity / security / maps
+  "okta.com",
+  "auth0.com",
+  "api.workos.com",
+  "api.clerk.com",
+  "maps.googleapis.com",
+  "api.mapbox.com",
+  "acme-v02.api.letsencrypt.org"
+];
+var IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+var PRIVATE_TLD = /\.(?:internal|local|localhost|lan|corp|home|intranet|private|test|invalid|example)$/i;
+function publicVendorHost(host) {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  if (IPV4.test(h) || h.includes(":") || PRIVATE_TLD.test(h)) return null;
+  if (/^bedrock-runtime\.[a-z0-9-]+\.amazonaws\.com$/.test(h)) return "bedrock-runtime.amazonaws.com";
+  for (const d of VENDOR_DOMAINS) if (h === d || h.endsWith("." + d)) return d;
+  return null;
+}
+
+// src/callsites.ts
+import ts from "typescript";
+var JS_EXT = /\.(?:[cm]?[jt]sx?)$/;
+function packageOf(spec) {
+  if (!spec || spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("node:") || spec.startsWith("#")) return null;
+  const parts = spec.split("/");
+  if (spec.startsWith("@")) return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : null;
+  return parts[0];
+}
+function jsImports(file, text) {
+  if (!JS_EXT.test(file)) return [];
+  const kind = /\.tsx$|\.jsx$/.test(file) ? ts.ScriptKind.TSX : /\.ts$|\.mts$|\.cts$/.test(file) ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+  const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false, kind);
+  const hits = [];
+  const at = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+  const push = (spec, node, symbol) => {
+    const pkg = packageOf(spec);
+    if (pkg) hits.push({ pkg, site: { file, line: at(node), ...symbol ? { symbol } : {} } });
+  };
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      const spec = node.moduleSpecifier.text;
+      const c = node.importClause;
+      const names = [];
+      if (c?.name) names.push(c.name.text);
+      if (c?.namedBindings) {
+        if (ts.isNamespaceImport(c.namedBindings)) names.push(`* as ${c.namedBindings.name.text}`);
+        else for (const el of c.namedBindings.elements) names.push((el.propertyName ?? el.name).text);
+      }
+      push(spec, node, names.length ? names.join(", ") : void 0);
+    } else if (ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+      push(node.moduleSpecifier.text, node, "re-export");
+    } else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference) && ts.isStringLiteral(node.moduleReference.expression)) {
+      push(node.moduleReference.expression.text, node, node.name.text);
+    } else if (ts.isCallExpression(node) && node.arguments.length >= 1 && ts.isStringLiteralLike(node.arguments[0])) {
+      const callee = node.expression;
+      if (callee.kind === ts.SyntaxKind.ImportKeyword) push(node.arguments[0].text, node, "dynamic import");
+      else if (ts.isIdentifier(callee) && callee.text === "require") push(node.arguments[0].text, node, "require");
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return hits;
+}
+var PY_DIST = {
+  sklearn: "scikit-learn",
+  cv2: "opencv-python",
+  PIL: "pillow",
+  yaml: "pyyaml",
+  bs4: "beautifulsoup4",
+  google: "google-cloud",
+  dateutil: "python-dateutil",
+  jwt: "pyjwt",
+  dotenv: "python-dotenv",
+  psycopg2: "psycopg2-binary"
+};
+function pyImports(file, text) {
+  if (!file.endsWith(".py")) return [];
+  const hits = [];
+  text.split(/\r?\n/).forEach((raw, i) => {
+    const line = raw.trim();
+    let m = /^from\s+([A-Za-z_][\w]*)(?:\.[\w.]*)?\s+import\s+(.+)$/.exec(line);
+    if (m && m[1] !== "__future__") {
+      hits.push({ pkg: (PY_DIST[m[1]] ?? m[1]).toLowerCase().replace(/_/g, "-"), site: { file, line: i + 1, symbol: m[2].replace(/[()]/g, "").split("#")[0].trim().slice(0, 80) } });
+      return;
+    }
+    m = /^import\s+(.+)$/.exec(line);
+    if (m) for (const part of m[1].split("#")[0].split(",")) {
+      const mod = part.trim().split(/\s+as\s+/)[0].split(".")[0];
+      if (/^[A-Za-z_]\w*$/.test(mod)) hits.push({ pkg: (PY_DIST[mod] ?? mod).toLowerCase().replace(/_/g, "-"), site: { file, line: i + 1, symbol: part.trim().slice(0, 80) } });
+    }
+  });
+  return hits;
+}
+
+// src/lockfiles.ts
+var isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function keyLines(text) {
+  const m = /* @__PURE__ */ new Map();
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const k = /^\s*"([^"]+)"\s*:/.exec(lines[i]);
+    if (k && !m.has(k[1])) m.set(k[1], i + 1);
+  }
+  return m;
+}
+function npmPackageLock(text) {
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return [];
+  }
+  if (!isObj(doc)) return [];
+  const lines = keyLines(text);
+  const out = [];
+  if (isObj(doc.packages)) {
+    for (const [key, v] of Object.entries(doc.packages)) {
+      const m = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/.exec(key);
+      if (m && isObj(v) && typeof v.version === "string") out.push({ ecosystem: "npm", name: m[1], version: v.version, line: lines.get(key) ?? 1 });
+    }
+  } else if (isObj(doc.dependencies)) {
+    for (const [name, v] of Object.entries(doc.dependencies)) {
+      if (isObj(v) && typeof v.version === "string") out.push({ ecosystem: "npm", name, version: v.version, line: lines.get(name) ?? 1 });
+    }
+  }
+  return out;
+}
+function pnpmLock(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  const hasImporters = lines.some((l) => /^importers:/.test(l));
+  const depIndent = hasImporters ? 4 : 0;
+  let inRoot = !hasImporters, inDeps = false, current = null;
+  const ind = (n) => " ".repeat(n);
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    if (hasImporters) {
+      if (/^importers:/.test(raw)) {
+        inRoot = false;
+        continue;
+      }
+      if (/^  \.:\s*$/.test(raw)) {
+        inRoot = true;
+        continue;
+      }
+      if (/^  \S/.test(raw) || /^\S/.test(raw)) {
+        inRoot = false;
+        inDeps = false;
+      }
+    } else if (/^\S/.test(raw)) {
+      inDeps = /^(dependencies|devDependencies|optionalDependencies):/.test(raw);
+      continue;
+    }
+    if (!inRoot) continue;
+    if (hasImporters && new RegExp(`^${ind(depIndent)}(dependencies|devDependencies|optionalDependencies):`).test(raw)) {
+      inDeps = true;
+      continue;
+    }
+    if (hasImporters && new RegExp(`^${ind(depIndent)}\\S`).test(raw)) {
+      inDeps = false;
+      continue;
+    }
+    if (!inDeps) continue;
+    const nameRe = new RegExp(`^${ind(depIndent + 2)}'?((?:@[^/'\\s]+/)?[^:'\\s]+)'?:\\s*(.*)$`);
+    const n = nameRe.exec(raw);
+    if (n) {
+      const inline = /^'?([0-9][^('\s]*)/.exec(n[2]);
+      if (inline) {
+        out.push({ ecosystem: "npm", name: n[1], version: inline[1], line: i + 1 });
+        current = null;
+      } else current = n[1];
+      continue;
+    }
+    const v = new RegExp(`^${ind(depIndent + 4)}version:\\s*'?([0-9][^('\\s]*)`).exec(raw);
+    if (v && current) {
+      out.push({ ecosystem: "npm", name: current, version: v[1], line: i + 1 });
+      current = null;
+    }
+  }
+  return out;
+}
+function yarnLock(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  let name = null, line = 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    if (!raw.startsWith(" ") && raw.trim() && !raw.startsWith("#") && !raw.startsWith("__metadata")) {
+      const h = /^"?((?:@[^@/"]+\/)?[^@"\s]+)@/.exec(raw);
+      name = h ? h[1] : null;
+      line = i + 1;
+      continue;
+    }
+    const v = /^\s+version:?\s+"?([0-9][^"\s]*)"?/.exec(raw);
+    if (v && name && !seen.has(name)) {
+      out.push({ ecosystem: "npm", name, version: v[1], line });
+      seen.add(name);
+      name = null;
+    }
+  }
+  return out;
+}
+function tomlPackageLock(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  let name = null, line = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    if (/^\[\[package\]\]/.test(raw)) {
+      name = null;
+      continue;
+    }
+    const n = /^name\s*=\s*"([^"]+)"/.exec(raw);
+    if (n) {
+      name = n[1].toLowerCase().replace(/_/g, "-");
+      line = i + 1;
+      continue;
+    }
+    const v = /^version\s*=\s*"([^"]+)"/.exec(raw);
+    if (v && name) {
+      out.push({ ecosystem: "pypi", name, version: v[1], line });
+      name = null;
+    }
+  }
+  return out;
+}
+
+// src/scan.ts
+var SCANNER = { name: "@realmonsters/scan", version: "0.0.2" };
+var IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".yarn", ".pnpm-store", ".gradle", ".m2", "bower_components", "Pods", ".serverless", ".aws-sam", ".vercel", ".netlify", "dist", "build", "out", ".next", ".nuxt", ".turbo", ".cache", "coverage", ".venv", "venv", "__pycache__", ".terraform", ".tox", ".mypy_cache", ".pytest_cache", "vendor", "target", ".idea", ".vscode"]);
+var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".py", ".json", ".yaml", ".yml", ".toml", ".tf"]);
+var LOCKFILES = /* @__PURE__ */ new Set(["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "poetry.lock", "uv.lock"]);
+var MANIFESTS = /* @__PURE__ */ new Set(["package.json", "pyproject.toml", "requirements.txt", "Pipfile"]);
+var SECRET_FILES = /* @__PURE__ */ new Set([".envrc", ".npmrc", ".pypirc", ".netrc", ".git-credentials", "credentials", "id_rsa", "id_ed25519"]);
+var MAX_SOURCE_BYTES = 1e6;
+var MAX_LOCK_BYTES = 5e7;
+var MAX_FILES = 2e5;
+var SKIP_EXT = /\.(?:png|jpe?g|gif|webp|ico|svg|pdf|zip|tgz|gz|bz2|xz|7z|rar|jar|war|whl|so|dylib|dll|exe|bin|wasm|woff2?|ttf|otf|eot|mp[34]|mov|avi|webm|wav|csv|tsv|parquet|sqlite|db|snap|map|min\.js)$/i;
+var MODEL_CORE = "claude-(?:[a-z0-9]+-)*[a-z0-9.]+(?:@\\d{8})?|(?:chatgpt-)?gpt-(?:4o|4\\.1|4\\.5|4|5(?:\\.\\d+)?|6(?:\\.\\d+)?|3\\.5|realtime|audio|image)[a-z0-9.-]*|chatgpt-(?:4o|image)[a-z0-9.-]*|o[134](?:-mini|-pro|-preview)?(?:-deep-research)?(?:-\\d{4}-\\d{2}-\\d{2})?|tts-1(?:-hd)?(?:-\\d{4})?|whisper-1|dall-e-[23]|sora-2[a-z0-9.-]*|computer-use-preview[a-z0-9.-]*|codex-mini-latest|text-moderation-[a-z0-9-]+|text-(?:davinci|curie|babbage|ada)-(?:edit-)?\\d{3}|(?:babbage|davinci)-002|code-(?:davinci|cushman)-(?:edit-)?\\d{3}|(?:text|code)-(?:similarity|search)-[a-z0-9-]+|gemini-(?:\\d+(?:\\.\\d+)?|embedding|nano|omni|robotics|live|pro|flash|exp)[a-z0-9.-]*|embedding-(?:gecko-)?001|imagen-[0-9a-z.-]+|veo-\\d[a-z0-9.-]*|lyria-[a-z0-9.-]+|(?:open-)?mistral-[a-z0-9.-]+|(?:codestral|pixtral|ministral)-[a-z0-9.-]+|(?:meta-)?llama-?\\d(?:\\.\\d+)?-[0-9]+b[a-z0-9.-]*|text-embedding-[a-z0-9-]+|command-r[a-z0-9.+-]*";
+var MODEL_RE = new RegExp(`(?<=["'\`=:]\\s?)(?:us\\.|eu\\.|apac\\.)?(?:anthropic\\.|models/)?(${MODEL_CORE})(?=["'\`\\s,;)]|$|-v\\d)`, "g");
+var HOST_RE = /https?:\/\/([a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+)/gi;
+var PUBLIC_REGISTRIES = /* @__PURE__ */ new Set(["docker.io", "index.docker.io", "ghcr.io", "public.ecr.aws", "gcr.io", "mcr.microsoft.com", "quay.io", "registry.k8s.io"]);
+var GH_HOSTED_RUNNER = /^(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)$/;
+var BASE_RUNTIME = { node: "node", nodejs: "node", python: "python", postgres: "postgres", postgresql: "postgres", "aurora-postgresql": "postgres", mysql: "mysql", "aurora-mysql": "mysql", mariadb: "mariadb", redis: "redis", nginx: "nginx", ubuntu: "ubuntu", debian: "debian", alpine: "alpine" };
+function modelEcosystem(id) {
+  if (id.startsWith("claude")) return "anthropic";
+  if (/^(?:gemini|embedding-|imagen-|veo-|lyria-)|^text-embedding-00\d/.test(id)) return "google";
+  if (/^(?:chatgpt-|gpt-|o[134]|tts-|whisper-|dall-e|sora-|computer-use|codex-|text-moderation|text-(?:davinci|curie|babbage|ada|similarity|search)|babbage-|davinci-|code-(?:davinci|cushman|search)|text-embedding)/.test(id)) return "openai";
+  if (/mistral|codestral|pixtral|ministral/.test(id)) return "mistral";
+  if (id.includes("llama")) return "meta";
+  return "other";
+}
+function normalizeVersion(raw) {
+  if (typeof raw !== "string") return void 0;
+  const v = raw.trim();
+  if (!v) return void 0;
+  if (/^(?:git\+|git:|github:|gitlab:|bitbucket:)|\.git(?:#|$)/i.test(v) || /^[\w.-]+\/[\w.-]+(?:#.*)?$/.test(v)) return "git";
+  if (/^https?:/i.test(v)) return "url";
+  if (/^(?:file|link|portal):/i.test(v) || v.startsWith(".") || v.startsWith("/") || v.startsWith("~/")) return "local";
+  if (/^workspace:/i.test(v)) return "workspace";
+  if (/^npm:/i.test(v)) return "alias";
+  if (/^catalog:/i.test(v)) return "catalog";
+  if (/^[a-z][a-z0-9-]{0,20}$/i.test(v)) return v.toLowerCase();
+  if (/^[\d^~<>=!*xX.|, +a-z-]{1,40}$/i.test(v)) return v.replace(/\s+/g, " ");
+  return "other";
+}
+var Collector = class {
+  constructor(stats) {
+    this.stats = stats;
+  }
+  map = /* @__PURE__ */ new Map();
+  add(kind, ecosystem, name, file, line, token, version, versionSource) {
+    const n = safeToken(name), t = safeToken(token);
+    if (!n.ok || !t.ok) {
+      if (!n.ok && n.reason === "secret" || !t.ok && t.reason === "secret") this.stats.redactions++;
+      else this.stats.tokensDropped++;
+      return;
+    }
+    let ver;
+    if (version !== void 0) {
+      const sv = safeToken(version);
+      if (sv.ok) ver = sv.value;
+      else this.stats.tokensDropped++;
+    }
+    const id = `${kind}:${ecosystem}/${n.value}`;
+    let u = this.map.get(id);
+    if (!u) {
+      u = { id, kind, ecosystem, name: n.value, evidence: [], callSites: [], versions: [], versionConflict: false };
+      this.map.set(id, u);
+    }
+    if (ver) {
+      if (!u.versions.includes(ver)) u.versions.push(ver);
+      if (!u.version) {
+        u.version = ver;
+        u.versionSource = versionSource;
+      }
+    }
+    if (!u.evidence.some((e) => e.file === file && e.line === line)) u.evidence.push({ file, line, token: t.value, ...ver ? { version: ver } : {} });
+  }
+  setLockVersion(id, version, file, line, token) {
+    const u = this.map.get(id);
+    const sv = safeToken(version), t = safeToken(token);
+    if (!u || !sv.ok || !t.ok) return;
+    u.version = sv.value;
+    u.versionSource = "lockfile";
+    if (!u.versions.includes(sv.value)) u.versions.push(sv.value);
+    if (!u.evidence.some((e) => e.file === file && e.line === line)) u.evidence.push({ file, line, token: t.value, version: sv.value });
+  }
+  addCallSite(id, site) {
+    const u = this.map.get(id);
+    if (!u) return;
+    if (site.symbol !== void 0) {
+      const s = safeToken(site.symbol);
+      site = s.ok ? { ...site, symbol: s.value } : { file: site.file, line: site.line };
+    }
+    if (!u.callSites.some((c) => c.file === site.file && c.line === site.line)) u.callSites.push(site);
+  }
+  all() {
+    const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+    return [...this.map.values()].map((u) => {
+      u.versions.sort(cmp);
+      u.versionConflict = conflicting(u);
+      u.evidence.sort((a, b) => cmp(a.file, b.file) || a.line - b.line);
+      u.callSites.sort((a, b) => cmp(a.file, b.file) || a.line - b.line);
+      return u;
+    }).sort((a, b) => cmp(a.id, b.id));
+  }
+};
+function conflicting(u) {
+  const declared = u.evidence.filter((e) => e.version && !/^[\^~<>=]/.test(e.version)).map((e) => /(\d+)/.exec(e.version)?.[1]);
+  return new Set(declared.filter(Boolean)).size > 1;
+}
+async function walk(root, stats) {
+  const out = [];
+  const stack = [""];
+  while (stack.length && out.length < MAX_FILES) {
+    const rel = stack.pop();
+    let entries;
+    try {
+      entries = await readdir(path.join(root, rel), { withFileTypes: true });
+    } catch {
+      stats.filesSkipped++;
+      continue;
+    }
+    for (const e of entries) {
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isSymbolicLink()) {
+        stats.filesSkipped++;
+        continue;
+      }
+      if (e.isDirectory()) {
+        if (!IGNORE_DIRS.has(e.name)) stack.push(r);
+        continue;
+      }
+      if (e.isFile()) out.push(r);
+    }
+  }
+  return out.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+}
+async function readText(abs, max) {
+  const s = await lstat(abs);
+  if (!s.isFile() || s.size > max) return null;
+  const fh = await open(abs, "r");
+  try {
+    const head = Buffer.alloc(Math.min(8192, s.size));
+    await fh.read(head, 0, head.length, 0);
+    if (head.includes(0)) return null;
+  } finally {
+    await fh.close();
+  }
+  return (await readFile(abs)).toString("utf8");
+}
+async function scan(rootDir) {
+  const root = path.resolve(rootDir);
+  const rs = await lstat(root).catch(() => null);
+  if (!rs || !rs.isDirectory()) throw new Error(`not a directory: ${path.basename(rootDir) || rootDir}`);
+  const stats = { filesScanned: 0, filesSkipped: 0, redactions: 0, tokensDropped: 0, hostsWithheld: 0 };
+  const col = new Collector(stats);
+  const imports = [];
+  const resolved = [];
+  for (const rel of await walk(root, stats)) {
+    const base = path.posix.basename(rel);
+    const isEnvExample = /^\.env\.(?:example|sample|template)$/.test(base);
+    if (base.startsWith(".env") && !isEnvExample || SECRET_FILES.has(base) || /\.(?:pem|key|p12|pfx|jks)$/i.test(base)) {
+      stats.filesSkipped++;
+      continue;
+    }
+    if (SKIP_EXT.test(base)) {
+      stats.filesSkipped++;
+      continue;
+    }
+    const ext = path.posix.extname(base);
+    const isLock = LOCKFILES.has(base);
+    let text;
+    try {
+      text = await readText(path.join(root, rel), isLock ? MAX_LOCK_BYTES : MAX_SOURCE_BYTES);
+    } catch {
+      text = null;
+    }
+    if (text === null) {
+      stats.filesSkipped++;
+      continue;
+    }
+    if (ext === ".json" && /"schema"\s*:\s*"realmonsters\./.test(text.slice(0, 400))) {
+      stats.filesSkipped++;
+      continue;
+    }
+    try {
+      const lines = text.split(/\r?\n/);
+      if (isLock) {
+        const list = base === "pnpm-lock.yaml" ? pnpmLock(text) : base === "yarn.lock" ? yarnLock(text) : base.endsWith(".lock") ? tomlPackageLock(text) : npmPackageLock(text);
+        resolved.push(...list.map((r) => ({ ...r, file: rel })));
+        stats.filesScanned++;
+        continue;
+      }
+      const fileImports = [...jsImports(rel, text), ...pyImports(rel, text)];
+      if (base === "package.json") detectPackageJson(rel, text, col);
+      else if (base === "requirements.txt" || /^requirements[-._].*\.txt$/.test(base) || /(?:^|\/)requirements\/[^/]+\.txt$/.test(rel)) detectRequirements(rel, lines, col);
+      else if (base === "pyproject.toml") detectPyproject(rel, lines, col);
+      else if (base === ".nvmrc" || base === ".node-version") addRuntimeFile(rel, lines[0], "node", col);
+      else if (base === ".python-version") addRuntimeFile(rel, lines[0], "python", col);
+      else if (base === ".tool-versions") detectToolVersions(rel, lines, col);
+      else if (/^dockerfile(?:\.|$)|\.dockerfile$/i.test(base)) detectDockerfile(rel, lines, col);
+      else if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(rel)) detectWorkflow(rel, lines, col);
+      else if (ext === ".tf") detectTerraform(rel, lines, col);
+      if ((SOURCE_EXT.has(ext) || isEnvExample) && !MANIFESTS.has(base)) {
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (line.length > 4e3) continue;
+          if (lineLooksSecret(line)) {
+            stats.redactions++;
+            continue;
+          }
+          for (const m of line.matchAll(MODEL_RE)) {
+            if (/^o[134]/.test(m[1]) && !/["'`]/.test(line[(m.index ?? 0) - 1] ?? "")) continue;
+            const id = m[1].replace(/@(\d{8})$/, "-$1");
+            col.add("llm-model", modelEcosystem(id), id, rel, i + 1, id);
+          }
+          if (isEnvExample) continue;
+          for (const m of line.matchAll(HOST_RE)) {
+            const vendor = publicVendorHost(m[1]);
+            if (vendor) col.add("api-host", "other", vendor, rel, i + 1, vendor);
+            else stats.hostsWithheld++;
+          }
+        }
+      }
+      imports.push(...fileImports);
+      stats.filesScanned++;
+    } catch {
+      stats.filesSkipped++;
+    }
+  }
+  for (const r of resolved) col.setLockVersion(`package:${r.ecosystem}/${r.name}`, r.version, r.file, r.line, `${r.name}@${r.version}`);
+  for (const h of imports) for (const eco of ["npm", "pypi"]) col.addCallSite(`package:${eco}/${h.pkg}`, h.site);
+  for (const u of col.all()) if (u.kind === "llm-model" || u.kind === "api-host") for (const e of u.evidence) col.addCallSite(u.id, { file: e.file, line: e.line, symbol: e.token });
+  const upstreams = col.all();
+  const byKind = {};
+  for (const u of upstreams) byKind[u.kind] = (byKind[u.kind] ?? 0) + 1;
+  return { schema: INVENTORY_SCHEMA, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), root: path.basename(root), scanner: SCANNER, upstreams, stats: { ...stats, byKind } };
+}
+function lineIndex(text) {
+  const lines = text.split(/\r?\n/);
+  return (needle) => {
+    const i = lines.findIndex((l) => l.includes(needle));
+    return i < 0 ? 1 : i + 1;
+  };
+}
+function detectPackageJson(rel, text, col) {
+  let pkg;
+  try {
+    pkg = JSON.parse(text);
+  } catch {
+    return;
+  }
+  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) return;
+  const p = pkg;
+  const at = lineIndex(text);
+  for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const deps = p[field];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps)) continue;
+    const blockStart = at(`"${field}"`);
+    const lines = text.split(/\r?\n/);
+    for (const [name, range] of Object.entries(deps)) {
+      const v = normalizeVersion(range);
+      let line = blockStart;
+      for (let i = blockStart; i < lines.length; i++) if (lines[i].includes(`"${name}"`)) {
+        line = i + 1;
+        break;
+      }
+      col.add("package", "npm", name, rel, line, v ? `${name}@${v}` : name, v, "manifest");
+    }
+  }
+  const node = p.engines && typeof p.engines === "object" ? normalizeVersion(p.engines.node) : void 0;
+  if (node) col.add("runtime", "other", "node", rel, at('"node"'), `node ${node}`, node, "manifest");
+  if (typeof p.packageManager === "string") {
+    const m = /^([a-z]+)@([\d.]+)/.exec(p.packageManager);
+    if (m) col.add("package", "npm", m[1], rel, at('"packageManager"'), `${m[1]}@${m[2]}`, m[2], "manifest");
+  }
+}
+var PY_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var PY_SPEC = /^(?:===|==|>=|<=|~=|!=|>|<)\s*[A-Za-z0-9.*+!-]+(?:\s*,\s*(?:===|==|>=|<=|~=|!=|>|<)\s*[A-Za-z0-9.*+!-]+)*$/;
+function pyDep(raw) {
+  const s = raw.split(";")[0].split("#")[0].trim();
+  if (!s || s.startsWith("-") || s.includes("://") || s.includes(" @ ") || s.startsWith(".") || s.startsWith("/")) return null;
+  const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*(.*)$/.exec(s);
+  if (!m || !PY_NAME.test(m[1])) return null;
+  const spec = m[2].trim().replace(/^\(|\)$/g, "");
+  return { name: m[1].toLowerCase().replace(/_/g, "-"), spec: spec && PY_SPEC.test(spec) ? spec.replace(/\s+/g, "") : void 0 };
+}
+function pyVersion(spec) {
+  if (!spec) return void 0;
+  return spec.startsWith("==") && !spec.includes(",") ? spec.slice(2) : spec;
+}
+function detectRequirements(rel, lines, col) {
+  lines.forEach((raw, i) => {
+    const d = pyDep(raw);
+    if (d) col.add("package", "pypi", d.name, rel, i + 1, d.spec ? `${d.name}${d.spec}` : d.name, pyVersion(d.spec), "manifest");
+  });
+}
+function detectPyproject(rel, lines, col) {
+  let section = "", inArray = false;
+  lines.forEach((raw, i) => {
+    const line = raw.trim();
+    const sec = /^\[([^\]]+)\]$/.exec(line);
+    if (sec) {
+      section = sec[1];
+      inArray = false;
+      return;
+    }
+    if (section === "project" && /^requires-python\s*=/.test(line)) {
+      const v = normalizeVersion(line.split("=").slice(1).join("=").trim().replace(/^["']|["']$/g, ""));
+      if (v) col.add("runtime", "other", "python", rel, i + 1, `python ${v}`, v, "manifest");
+    }
+    const arrayStart = section === "project" && /^dependencies\s*=\s*\[/.test(line) || (section === "project.optional-dependencies" || section === "dependency-groups") && /^[\w.-]+\s*=\s*\[/.test(line);
+    if (arrayStart || inArray) {
+      for (const m of line.matchAll(/["']([^"']+)["']/g)) {
+        const d = pyDep(m[1]);
+        if (d) col.add("package", "pypi", d.name, rel, i + 1, d.spec ? `${d.name}${d.spec}` : d.name, pyVersion(d.spec), "manifest");
+      }
+      inArray = !line.includes("]");
+      return;
+    }
+    if (/^tool\.poetry(?:\.group\.[\w-]+)?\.(?:dev-)?dependencies$/.test(section)) {
+      const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=\s*(?:"([^"]*)"|\{.*?\bversion\s*=\s*"([^"]*)".*\}|\{.*\})/.exec(line);
+      if (!m) return;
+      const name = m[1].toLowerCase().replace(/_/g, "-");
+      const v = normalizeVersion(m[2] ?? m[3]);
+      if (name === "python") {
+        if (v) col.add("runtime", "other", "python", rel, i + 1, `python ${v}`, v, "manifest");
+        return;
+      }
+      col.add("package", "pypi", name, rel, i + 1, v ? `${name} ${v}` : name, v, "manifest");
+    }
+  });
+}
+function addRuntimeFile(rel, first, name, col) {
+  const v = /^v?(\d[\w.]*)/.exec((first ?? "").trim())?.[1];
+  if (v) col.add("runtime", "other", name, rel, 1, `${name} ${v}`, v, "runtime-file");
+}
+function detectToolVersions(rel, lines, col) {
+  lines.forEach((l, i) => {
+    const m = /^(nodejs|node|python|postgres|terraform|golang|ruby)\s+v?(\d[\w.]*)/.exec(l.trim());
+    if (!m) return;
+    const name = m[1] === "nodejs" ? "node" : m[1];
+    col.add("runtime", "other", name, rel, i + 1, `${name} ${m[2]}`, m[2], "runtime-file");
+  });
+}
+function parseImageRef(ref) {
+  if (ref.includes("$")) return null;
+  const noDigest = ref.split("@")[0];
+  const slash = noDigest.lastIndexOf("/");
+  const colon = noDigest.lastIndexOf(":");
+  const name = colon > slash ? noDigest.slice(0, colon) : noDigest;
+  const tag = colon > slash ? noDigest.slice(colon + 1) : void 0;
+  const parts = name.split("/");
+  const first = parts[0];
+  const hasRegistry = parts.length > 1 && (first.includes(".") || first.includes(":") || first === "localhost");
+  if (hasRegistry && !PUBLIC_REGISTRIES.has(first.toLowerCase())) return { image: `private-registry/${parts[parts.length - 1]}`, tag };
+  const image = hasRegistry ? parts.slice(1).join("/") : name;
+  return { image: image.replace(/^library\//, ""), tag };
+}
+function detectDockerfile(rel, lines, col) {
+  const stages = /* @__PURE__ */ new Set();
+  lines.forEach((raw, i) => {
+    const m = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?/i.exec(raw);
+    if (!m) return;
+    const ref = m[1];
+    const isStageRef = stages.has(ref.toLowerCase());
+    if (m[2]) stages.add(m[2].toLowerCase());
+    if (ref === "scratch" || isStageRef) return;
+    const p = parseImageRef(ref);
+    if (!p) return;
+    col.add("container-image", "docker", p.image, rel, i + 1, p.tag ? `${p.image}:${p.tag}` : p.image, p.tag, "dockerfile");
+    const rt = BASE_RUNTIME[p.image.split("/").pop() ?? p.image];
+    const v = p.tag?.split("-")[0];
+    if (rt && v && /^\d/.test(v)) col.add("runtime", "other", rt, rel, i + 1, `${p.image}:${p.tag}`, v, "inferred");
+  });
+}
+function detectWorkflow(rel, lines, col) {
+  lines.forEach((raw, i) => {
+    const u = /^\s*-?\s*uses:\s*["']?([^\s"'#]+)/.exec(raw);
+    if (u && !u[1].startsWith("./") && !u[1].startsWith("docker://") && !u[1].includes("${{")) {
+      const [action, ref] = u[1].split("@");
+      col.add("github-action", "github-actions", action, rel, i + 1, ref ? `${action}@${ref}` : action, ref, "manifest");
+    }
+    const r = /^\s*runs-on:\s*(.+)$/.exec(raw);
+    if (r) {
+      const val = r[1].split("#")[0].trim().replace(/^["']|["']$/g, "");
+      if (!val.includes("${{")) {
+        const labels = val.replace(/^\[|\]$/g, "").split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+        const name = labels.find((l) => GH_HOSTED_RUNNER.test(l)) ?? "self-hosted";
+        col.add("github-runner", "github-actions", name, rel, i + 1, name);
+      }
+    }
+    const n = /^\s*node-version:\s*["']?(\d[\w.]*)/.exec(raw);
+    if (n) col.add("runtime", "other", "node", rel, i + 1, `node ${n[1]}`, n[1], "manifest");
+    const p = /^\s*python-version:\s*["']?(\d[\w.]*)/.exec(raw);
+    if (p) col.add("runtime", "other", "python", rel, i + 1, `python ${p[1]}`, p[1], "manifest");
+  });
+}
+function detectTerraform(rel, lines, col) {
+  let depth = 0;
+  let block = {};
+  const flush = () => {
+    if (block.engine) {
+      const name = BASE_RUNTIME[block.engine] ?? block.engine;
+      col.add("runtime", "other", name, rel, block.versionLine ?? block.engineLine ?? 1, block.version ? `${name} ${block.version}` : name, block.version, "terraform");
+    }
+    block = {};
+  };
+  lines.forEach((raw, i) => {
+    const line = raw.split("#")[0];
+    const rt = /^\s*runtime\s*=\s*"([a-z]+?)(\d+(?:\.\d+)*)(?:\.x)?"/.exec(line);
+    if (rt) {
+      const name = BASE_RUNTIME[rt[1]] ?? rt[1];
+      col.add("runtime", "other", name, rel, i + 1, `${rt[1]}${rt[2]}`, rt[2], "terraform");
+    }
+    const en = /^\s*engine\s*=\s*"([a-z0-9-]+)"/.exec(line);
+    if (en) {
+      block.engine = en[1];
+      block.engineLine = i + 1;
+    }
+    const ev = /^\s*engine_version\s*=\s*"([\d.]+)"/.exec(line);
+    if (ev) {
+      block.version = ev[1];
+      block.versionLine = i + 1;
+    }
+    const im = /^\s*image\s*=\s*"([^"]+)"/.exec(line);
+    if (im) {
+      const p = parseImageRef(im[1]);
+      if (p) col.add("container-image", "docker", p.image, rel, i + 1, p.tag ? `${p.image}:${p.tag}` : p.image, p.tag, "terraform");
+    }
+    for (const ch of line) {
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) flush();
+      }
+    }
+  });
+  flush();
+}
+
+export {
+  SCANNER,
+  normalizeVersion,
+  scan,
+  parseImageRef
+};

package/dist/cli.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+import {
+  SCANNER,
+  scan
+} from "./chunk-SXEJJ3CT.js";
+
+// src/cli.ts
+import { writeFile } from "node:fs/promises";
+var HELP = `${SCANNER.name} ${SCANNER.version}
+Usage: realmonsters-scan <dir> [--out <file>] [--quiet]
+
+Builds inventory.json for a repository: packages, runtimes, container images,
+GitHub Actions, LLM model IDs and public vendor API hosts, each with file:line evidence.
+Runs entirely offline. Never copies source lines; withholds anything that looks like a
+secret and any hostname that is not a known public vendor. Read the output before you
+send it anywhere.
+`;
+function parse(argv) {
+  const r = { quiet: false, help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") r.help = true;
+    else if (a === "--quiet" || a === "-q") r.quiet = true;
+    else if (a === "--out" || a === "-o") {
+      r.out = argv[++i];
+      if (!r.out) r.error = "--out needs a file name";
+    } else if (a.startsWith("-")) r.error = `unknown option ${a}`;
+    else if (r.dir) r.error = `unexpected argument ${a}`;
+    else r.dir = a;
+  }
+  return r;
+}
+var args = parse(process.argv.slice(2));
+if (args.help || !args.dir && !args.error) {
+  process.stdout.write(HELP);
+  process.exit(args.help ? 0 : 2);
+}
+if (args.error) {
+  process.stderr.write(`realmonsters-scan: ${args.error}
+`);
+  process.exit(2);
+}
+try {
+  const inv = await scan(args.dir);
+  const json = JSON.stringify(inv, null, 2) + "\n";
+  if (args.out) await writeFile(args.out, json);
+  else process.stdout.write(json);
+  if (!args.quiet) {
+    const s = inv.stats;
+    process.stderr.write(
+      `${SCANNER.name}: ${inv.upstreams.length} watched upstreams in ${inv.root} (${Object.entries(s.byKind).map(([a, b]) => `${b} ${a}`).join(", ")}); ${s.filesScanned} files scanned, ${s.filesSkipped} skipped, ${s.redactions} redacted, ${s.hostsWithheld} non-vendor hosts withheld` + (args.out ? ` \u2192 ${args.out}` : "") + "\n"
+    );
+  }
+} catch (e) {
+  process.stderr.write(`realmonsters-scan: ${e instanceof Error ? e.message : "scan failed"}
+`);
+  process.exit(1);
+}

package/dist/scan.js

@@ -0,0 +1,12 @@
+import {
+  SCANNER,
+  normalizeVersion,
+  parseImageRef,
+  scan
+} from "./chunk-SXEJJ3CT.js";
+export {
+  SCANNER,
+  normalizeVersion,
+  parseImageRef,
+  scan
+};

package/package.json

@@ -1,6 +1,44 @@
 {
   "name": "@realmonsters/scan",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.2",
+  "description": "realMonsters local inventory scanner. Runs offline; writes inventory.json (paths, lines, symbols, versions). Never source, never secrets.",
+  "type": "module",
+  "bin": {
+    "realmonsters-scan": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/scan.ts",
+      "default": "./dist/scan.js"
+    }
+  },
+  "license": "UNLICENSED",
+  "dependencies": {
+    "typescript": "5.9.3"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node build.mjs"
+  },
+  "devDependencies": {
+    "@realmonsters/core": "0.0.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/realmonsters-hq/realmonsters.git"
+  },
+  "homepage": "https://realmonsters.dev",
+  "keywords": [
+    "inventory",
+    "dependencies",
+    "deprecation",
+    "eol",
+    "realmonsters"
+  ]
+}