ai-trust 0.1.2 → 0.2.0

package/dist/output/formatter.js

@@ -41,7 +41,6 @@ function trustLevelColor(level) {
 export function formatCheckResult(answer) {
     if (!answer.found) {
         return [
-            "",
             chalk.bold(`  ${answer.name}`),
             chalk.gray(`  Type: ${answer.packageType || "unknown"}`),
             chalk.gray("  Status: Not found in registry"),
@@ -51,7 +50,6 @@ export function formatCheckResult(answer) {
     const colorVerdict = verdictColor(answer.verdict);
     const colorTrust = trustLevelColor(answer.trustLevel);
     const lines = [
-        "",
         chalk.bold(`  ${answer.name}`),
         `  Type:           ${answer.packageType || "unknown"}`,
         `  Verdict:        ${colorVerdict(answer.verdict.toUpperCase())}`,
@@ -72,7 +70,6 @@ export function formatCheckResult(answer) {
 }
 export function formatBatchResults(response, minTrust) {
     const lines = [];
-    lines.push("");
     lines.push(chalk.bold(`  Trust Audit: ${response.meta.total} packages queried, ${response.meta.found} found, ${response.meta.notFound} not found`));
     lines.push("");
     // Table header
@@ -126,6 +123,47 @@ export function formatBatchResults(response, minTrust) {
     lines.push("");
     return lines.join("\n");
 }
+export function formatScanResult(result) {
+    const colorVerdict = verdictColor(result.verdict);
+    const colorTrust = trustLevelColor(result.trustLevel);
+    const lines = [
+        chalk.bold(`  ${result.packageName}`) +
+            chalk.gray("  (local scan)"),
+        `  Verdict:        ${colorVerdict(result.verdict.toUpperCase())}`,
+        `  Trust Level:    ${colorTrust(trustLevelLabel(result.trustLevel))} (${result.trustLevel}/4)`,
+        `  Trust Score:    ${result.trustScore.toFixed(2)}`,
+        `  HMA Score:      ${result.scan.score}/${result.scan.maxScore}`,
+    ];
+    const failed = result.scan.findings.filter((f) => !f.passed);
+    if (failed.length > 0) {
+        lines.push("");
+        lines.push(chalk.bold("  Findings"));
+        const bySeverity = {
+            critical: failed.filter((f) => f.severity === "critical"),
+            high: failed.filter((f) => f.severity === "high"),
+            medium: failed.filter((f) => f.severity === "medium"),
+            low: failed.filter((f) => f.severity === "low"),
+        };
+        for (const [sev, items] of Object.entries(bySeverity)) {
+            if (items.length === 0)
+                continue;
+            const colorFn = sev === "critical"
+                ? chalk.red
+                : sev === "high"
+                    ? chalk.yellow
+                    : chalk.gray;
+            for (const item of items) {
+                lines.push(`  ${colorFn(`[${sev.toUpperCase()}]`)} ${item.name}: ${item.message}`);
+            }
+        }
+    }
+    else {
+        lines.push("");
+        lines.push(chalk.green("  No security findings."));
+    }
+    lines.push("");
+    return lines.join("\n");
+}
 export function formatJson(data) {
     return JSON.stringify(data, null, 2);
 }

package/dist/output/formatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,SAAS,YAAY,CAAC,OAAe;IACnC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB;YACE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,YAAY,KAAK,GAAG,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,EAAE;YACF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC;YAC7C,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa;QACtB,EAAE;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,qBAAqB,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE;QACtD,qBAAqB,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE;QACjE,qBAAqB,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK;QAC9F,qBAAqB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE;KACtD,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,sBAAsB,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,QAAQ,CAAC,IAAI,CAAC,QAAQ,YAAY,CAC5H,CACF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAAG,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC;IAErB,KAAK,CAAC,IAAI,CACR,IAAI;QACF,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACxB,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1G,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK;YACjD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEhB,KAAK,CAAC,IAAI,CACR,IAAI;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACtB,CAAC,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACjF,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED,UAAU;IACV,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,SAAS,cAAc,CAAC,MAAM,yCAAyC,QAAQ,GAAG,CACnF,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,WAAW,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,UAAU,cAAc,GAAG,CAAC,OAAO,GAAG,CAC/E,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,SAAS,QAAQ,CAAC,MAAM,oCAAoC,CAC7D,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,KAAK,CACT,SAAS,QAAQ,CAAC,IAAI,CAAC,KAAK,sCAAsC,QAAQ,GAAG,CAC9E,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/output/formatter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,SAAS,YAAY,CAAC,OAAe;IACnC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB;YACE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC;QACnB,KAAK,CAAC;YACJ,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,YAAY,KAAK,GAAG,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC;YAC7C,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa;QACtB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,qBAAqB,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE;QACtD,qBAAqB,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE;QACjE,qBAAqB,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK;QAC9F,qBAAqB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE;KACtD,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,sBAAsB,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,QAAQ,CAAC,IAAI,CAAC,QAAQ,YAAY,CAC5H,CACF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAAG,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC;IAErB,KAAK,CAAC,IAAI,CACR,IAAI;QACF,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACxB,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1G,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK;YACjD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEhB,KAAK,CAAC,IAAI,CACR,IAAI;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACtB,CAAC,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACjF,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED,UAAU;IACV,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,SAAS,cAAc,CAAC,MAAM,yCAAyC,QAAQ,GAAG,CACnF,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CACV,WAAW,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,UAAU,cAAc,GAAG,CAAC,OAAO,GAAG,CAC/E,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,IAAI,CACR,SAAS,QAAQ,CAAC,MAAM,oCAAoC,CAC7D,CACF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,KAAK,CACT,SAAS,QAAQ,CAAC,IAAI,CAAC,KAAK,sCAAsC,QAAQ,GAAG,CAC9E,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa;QACtB,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC9B,qBAAqB,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE;QACjE,qBAAqB,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK;QAC9F,qBAAqB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;KACjE,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG;YACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;YACzD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACrD,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;SAChD,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,OAAO,GACX,GAAG,KAAK,UAAU;gBAChB,CAAC,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,GAAG,KAAK,MAAM;oBACd,CAAC,CAAC,KAAK,CAAC,MAAM;oBACd,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CACR,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CACvE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/scanner/downloader.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Package downloader - fetch npm tarballs and extract to temp directories.
+ */
+export interface DownloadResult {
+    /** Temporary directory containing the extracted package */
+    dir: string;
+    /** Cleanup function to remove the temp directory */
+    cleanup: () => Promise<void>;
+}
+/**
+ * Download an npm package tarball and extract it to a temp directory.
+ * Uses `npm pack --pack-destination` to fetch the tarball, then extracts it.
+ */
+export declare function downloadPackage(name: string): Promise<DownloadResult>;
+//# sourceMappingURL=downloader.d.ts.map

package/dist/scanner/downloader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloader.d.ts","sourceRoot":"","sources":["../../src/scanner/downloader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,CAAC,CAyDzB"}

package/dist/scanner/downloader.js

@@ -0,0 +1,63 @@
+/**
+ * Package downloader - fetch npm tarballs and extract to temp directories.
+ */
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+/**
+ * Download an npm package tarball and extract it to a temp directory.
+ * Uses `npm pack --pack-destination` to fetch the tarball, then extracts it.
+ */
+export async function downloadPackage(name) {
+    const tempDir = await mkdtemp(join(tmpdir(), "ai-trust-scan-"));
+    try {
+        // Use npm pack to download the tarball
+        const { stdout } = await execFileAsync("npm", ["pack", name, "--pack-destination", tempDir], { timeout: 60_000 });
+        const tarball = stdout.trim().split("\n").pop();
+        const tarballPath = join(tempDir, tarball);
+        // Extract the tarball
+        const extractDir = join(tempDir, "package");
+        await execFileAsync("tar", ["xzf", tarballPath, "-C", tempDir], {
+            timeout: 30_000,
+        });
+        return {
+            dir: extractDir,
+            cleanup: async () => {
+                await rm(tempDir, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (err) {
+        // Clean up on failure
+        await rm(tempDir, { recursive: true, force: true });
+        // Extract a clean error message from npm's verbose stderr
+        let message;
+        if (err &&
+            typeof err === "object" &&
+            "stderr" in err &&
+            typeof err.stderr === "string") {
+            const stderr = err.stderr;
+            const notFound = stderr.includes("404") || stderr.includes("Not Found");
+            if (notFound) {
+                message = `Package "${name}" not found on npm. Verify the package name and try again.`;
+            }
+            else {
+                // Extract the first meaningful npm error line
+                const errorLine = stderr
+                    .split("\n")
+                    .find((l) => l.startsWith("npm error") && !l.includes("A complete log"));
+                message = errorLine
+                    ? errorLine.replace(/^npm error\s*/, "")
+                    : (err instanceof Error ? err.message : String(err));
+            }
+        }
+        else {
+            message = err instanceof Error ? err.message : String(err);
+        }
+        throw new Error(`Failed to download "${name}": ${message}`);
+    }
+}
+//# sourceMappingURL=downloader.js.map

package/dist/scanner/downloader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloader.js","sourceRoot":"","sources":["../../src/scanner/downloader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,uCAAuC;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAC7C,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAG,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3C,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC9D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,UAAU;YACf,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sBAAsB;QACtB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,0DAA0D;QAC1D,IAAI,OAAe,CAAC;QACpB,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,QAAQ,IAAI,GAAG;YACf,OAAQ,GAA2B,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACD,MAAM,MAAM,GAAI,GAA0B,CAAC,MAAM,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,YAAY,IAAI,4DAA4D,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,MAAM,SAAS,GAAG,MAAM;qBACrB,KAAK,CAAC,IAAI,CAAC;qBACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC3E,OAAO,GAAG,SAAS;oBACjB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;oBACxC,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/scanner/hma.d.ts

@@ -0,0 +1,37 @@
+/**
+ * HMA (HackMyAgent) subprocess runner.
+ * Detects availability and runs security scans against downloaded packages.
+ */
+export interface HmaScanResult {
+    score: number;
+    maxScore: number;
+    findings: HmaFinding[];
+    projectType: string;
+    timestamp: string;
+}
+export interface HmaFinding {
+    checkId: string;
+    name: string;
+    description: string;
+    category: string;
+    severity: "critical" | "high" | "medium" | "low";
+    passed: boolean;
+    message: string;
+    file?: string;
+    line?: number;
+    fix?: string;
+}
+/**
+ * Check if HMA (hackmyagent) is available on the system.
+ * Tries npx first, then checks for global install.
+ */
+export declare function isHmaAvailable(): Promise<boolean>;
+/**
+ * Run HMA security scan against a directory.
+ * Uses `npx hackmyagent secure --format json <dir>`.
+ *
+ * @returns Parsed scan results
+ * @throws If HMA is not available or scan fails to produce valid output
+ */
+export declare function runHmaScan(targetDir: string): Promise<HmaScanResult>;
+//# sourceMappingURL=hma.d.ts.map

package/dist/scanner/hma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hma.d.ts","sourceRoot":"","sources":["../../src/scanner/hma.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CASvD;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CA8BxB"}

package/dist/scanner/hma.js

@@ -0,0 +1,90 @@
+/**
+ * HMA (HackMyAgent) subprocess runner.
+ * Detects availability and runs security scans against downloaded packages.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+/**
+ * Check if HMA (hackmyagent) is available on the system.
+ * Tries npx first, then checks for global install.
+ */
+export async function isHmaAvailable() {
+    try {
+        await execFileAsync("npx", ["hackmyagent", "--version"], {
+            timeout: 15_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run HMA security scan against a directory.
+ * Uses `npx hackmyagent secure --format json <dir>`.
+ *
+ * @returns Parsed scan results
+ * @throws If HMA is not available or scan fails to produce valid output
+ */
+export async function runHmaScan(targetDir) {
+    try {
+        // HMA may exit non-zero when findings exist, so we handle that
+        const { stdout } = await execFileAsync("npx", ["hackmyagent", "secure", "--format", "json", targetDir], { timeout: 120_000 });
+        return parseHmaOutput(stdout);
+    }
+    catch (err) {
+        // HMA exits with code 1 when it finds issues but still outputs JSON
+        if (err &&
+            typeof err === "object" &&
+            "stdout" in err &&
+            typeof err.stdout === "string") {
+            const stdout = err.stdout;
+            if (stdout.trim()) {
+                try {
+                    return parseHmaOutput(stdout);
+                }
+                catch {
+                    // Fall through to throw
+                }
+            }
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`HMA scan failed: ${message}`);
+    }
+}
+function parseHmaOutput(stdout) {
+    // HMA may output non-JSON lines before the JSON; find the JSON object
+    const lines = stdout.split("\n");
+    let jsonStr = "";
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (line.startsWith("{")) {
+            jsonStr = lines.slice(i).join("\n");
+            break;
+        }
+    }
+    if (!jsonStr) {
+        throw new Error("No JSON output found from HMA scan");
+    }
+    const raw = JSON.parse(jsonStr);
+    return {
+        score: raw.score ?? 0,
+        maxScore: raw.maxScore ?? 100,
+        findings: (raw.findings ?? []).map((f) => ({
+            checkId: f.checkId ?? "",
+            name: f.name ?? "",
+            description: f.description ?? "",
+            category: f.category ?? "",
+            severity: f.severity ?? "low",
+            passed: f.passed ?? true,
+            message: f.message ?? "",
+            file: f.file,
+            line: f.line,
+            fix: f.fix,
+        })),
+        projectType: raw.projectType ?? "unknown",
+        timestamp: raw.timestamp ?? new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=hma.js.map

package/dist/scanner/hma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hma.js","sourceRoot":"","sources":["../../src/scanner/hma.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAuB1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE;YACvD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB;IAEjB,IAAI,CAAC;QACH,+DAA+D;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EACxD,EAAE,OAAO,EAAE,OAAO,EAAE,CACrB,CAAC;QAEF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,oEAAoE;QACpE,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,QAAQ,IAAI,GAAG;YACf,OAAQ,GAA2B,CAAC,MAAM,KAAK,QAAQ,EACvD,CAAC;YACD,MAAM,MAAM,GAAI,GAA0B,CAAC,MAAM,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;QACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;QAC7B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;YACxB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;SACX,CAAC,CAAC;QACH,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC"}

package/dist/scanner/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Scanner module - orchestrates package download, HMA scan, and cleanup.
+ */
+export { downloadPackage } from "./downloader.js";
+export type { DownloadResult } from "./downloader.js";
+export { isHmaAvailable, runHmaScan } from "./hma.js";
+export type { HmaScanResult, HmaFinding } from "./hma.js";
+import type { HmaScanResult } from "./hma.js";
+export interface ScanResult {
+    packageName: string;
+    scan: HmaScanResult;
+    /** Trust score derived from HMA score (0.0-1.0) */
+    trustScore: number;
+    /** Trust level derived from scan (0-4) */
+    trustLevel: number;
+    /** Verdict derived from scan results */
+    verdict: "safe" | "warning" | "blocked";
+}
+/**
+ * Download a package, scan it with HMA, and return results.
+ * Cleans up the temp directory after scanning.
+ */
+export declare function scanPackage(name: string): Promise<ScanResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAI1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,aAAa,CAAC;IACpB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/scanner/index.js

@@ -0,0 +1,55 @@
+/**
+ * Scanner module - orchestrates package download, HMA scan, and cleanup.
+ */
+export { downloadPackage } from "./downloader.js";
+export { isHmaAvailable, runHmaScan } from "./hma.js";
+import { downloadPackage } from "./downloader.js";
+import { runHmaScan } from "./hma.js";
+/**
+ * Download a package, scan it with HMA, and return results.
+ * Cleans up the temp directory after scanning.
+ */
+export async function scanPackage(name) {
+    const download = await downloadPackage(name);
+    try {
+        const scan = await runHmaScan(download.dir);
+        const trustScore = scan.score / scan.maxScore;
+        const trustLevel = deriveTrustLevel(scan);
+        const verdict = deriveVerdict(scan);
+        return {
+            packageName: name,
+            scan,
+            trustScore,
+            trustLevel,
+            verdict,
+        };
+    }
+    finally {
+        await download.cleanup();
+    }
+}
+function deriveTrustLevel(scan) {
+    const ratio = scan.score / scan.maxScore;
+    if (ratio >= 0.9)
+        return 3; // Scanned, high trust
+    if (ratio >= 0.7)
+        return 2; // Listed, moderate trust
+    if (ratio >= 0.4)
+        return 1; // Warning
+    return 0; // Blocked
+}
+function deriveVerdict(scan) {
+    const hasCritical = scan.findings.some((f) => !f.passed && f.severity === "critical");
+    const hasHigh = scan.findings.some((f) => !f.passed && f.severity === "high");
+    if (hasCritical)
+        return "blocked";
+    if (hasHigh)
+        return "warning";
+    const ratio = scan.score / scan.maxScore;
+    if (ratio >= 0.7)
+        return "safe";
+    if (ratio >= 0.4)
+        return "warning";
+    return "blocked";
+}
+//# sourceMappingURL=index.js.map

package/dist/scanner/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AActC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,IAAI;YACJ,UAAU;YACV,UAAU;YACV,OAAO;SACR,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB;IAClD,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,yBAAyB;IACrD,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,UAAU;IACtC,OAAO,CAAC,CAAC,CAAC,UAAU;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,IAAmB;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAC1C,CAAC;IAEF,IAAI,WAAW;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAezB"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAoBzB"}

package/dist/utils/parser.js

@@ -6,13 +6,21 @@ import { basename } from "node:path";
 export async function parseDependencyFile(filePath) {
     const fileName = basename(filePath);
     const content = await readFile(filePath, "utf-8");
-    if (fileName === "package.json") {
+    // Detect format by filename or extension
+    if (fileName.endsWith(".json")) {
         return parsePackageJson(content);
     }
-    if (fileName === "requirements.txt") {
+    if (fileName.endsWith(".txt") || fileName === "requirements") {
+        return parseRequirementsTxt(content);
+    }
+    // Try JSON first, fall back to requirements.txt format
+    try {
+        JSON.parse(content);
+        return parsePackageJson(content);
+    }
+    catch {
         return parseRequirementsTxt(content);
     }
-    throw new Error(`Unsupported dependency file: ${fileName}. Supported: package.json, requirements.txt`);
 }
 function parsePackageJson(content) {
     const pkg = JSON.parse(content);

package/dist/utils/parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,6CAA6C,CACtF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAG7B,CAAC;IAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,uDAAuD;YACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/utils/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,yCAAyC;IACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAG7B,CAAC;IAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE5B,gCAAgC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,uDAAuD;YACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/utils/prompt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Interactive prompt utility for terminal input.
+ */
+/**
+ * Ask a yes/no question. Returns true for yes (default), false for no.
+ * In non-interactive mode (no TTY), returns the default value.
+ */
+export declare function confirm(question: string, defaultYes?: boolean): Promise<boolean>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/utils/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/utils/prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,UAAO,GAChB,OAAO,CAAC,OAAO,CAAC,CAsBlB"}

package/dist/utils/prompt.js

@@ -0,0 +1,31 @@
+/**
+ * Interactive prompt utility for terminal input.
+ */
+import { createInterface } from "node:readline";
+/**
+ * Ask a yes/no question. Returns true for yes (default), false for no.
+ * In non-interactive mode (no TTY), returns the default value.
+ */
+export async function confirm(question, defaultYes = true) {
+    if (!process.stdin.isTTY) {
+        return defaultYes;
+    }
+    const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr, // Use stderr so stdout stays clean for JSON/piping
+    });
+    return new Promise((resolve) => {
+        rl.question(`${question} ${suffix} `, (answer) => {
+            rl.close();
+            const trimmed = answer.trim().toLowerCase();
+            if (trimmed === "") {
+                resolve(defaultYes);
+            }
+            else {
+                resolve(trimmed === "y" || trimmed === "yes");
+            }
+        });
+    });
+}
+//# sourceMappingURL=prompt.js.map

package/dist/utils/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/utils/prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAgB,EAChB,UAAU,GAAG,IAAI;IAEjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,mDAAmD;KAC5E,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/resolve.d.ts

@@ -0,0 +1,22 @@
+/**
+ * MCP package name shorthand resolution.
+ *
+ * Converts short forms like "server-filesystem" or "mcp-server-fetch"
+ * into the full scoped name "@modelcontextprotocol/server-*".
+ */
+/**
+ * Resolve a package name, expanding MCP shorthand if applicable.
+ *
+ * Rules (applied in order):
+ * 1. Starts with `@` -- use as-is (already scoped).
+ * 2. Starts with `server-` -- prefix with @modelcontextprotocol/.
+ * 3. Starts with `mcp/server-` or `mcp-server-` -- convert to @modelcontextprotocol/server-*.
+ * 4. Otherwise -- use as-is (regular npm package).
+ */
+export declare function resolvePackageName(name: string): string;
+/**
+ * Resolve a package name and log a note if resolution changed it.
+ * Returns the resolved name.
+ */
+export declare function resolveAndLog(name: string): string;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/utils/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/utils/resolve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD"}

package/dist/utils/resolve.js

@@ -0,0 +1,50 @@
+/**
+ * MCP package name shorthand resolution.
+ *
+ * Converts short forms like "server-filesystem" or "mcp-server-fetch"
+ * into the full scoped name "@modelcontextprotocol/server-*".
+ */
+const MCP_SCOPE = "@modelcontextprotocol";
+/**
+ * Resolve a package name, expanding MCP shorthand if applicable.
+ *
+ * Rules (applied in order):
+ * 1. Starts with `@` -- use as-is (already scoped).
+ * 2. Starts with `server-` -- prefix with @modelcontextprotocol/.
+ * 3. Starts with `mcp/server-` or `mcp-server-` -- convert to @modelcontextprotocol/server-*.
+ * 4. Otherwise -- use as-is (regular npm package).
+ */
+export function resolvePackageName(name) {
+    // Rule 1: already scoped
+    if (name.startsWith("@")) {
+        return name;
+    }
+    // Rule 2: server-* shorthand (must have at least one char after "server-")
+    if (name.startsWith("server-") && name.length > "server-".length) {
+        return `${MCP_SCOPE}/${name}`;
+    }
+    // Rule 3a: mcp/server-* notation (must have at least one char after "mcp/server-")
+    if (name.startsWith("mcp/server-") && name.length > "mcp/server-".length) {
+        const serverPart = name.slice("mcp/".length);
+        return `${MCP_SCOPE}/${serverPart}`;
+    }
+    // Rule 3b: mcp-server-* notation (must have at least one char after "mcp-server-")
+    if (name.startsWith("mcp-server-") && name.length > "mcp-server-".length) {
+        const serverPart = name.slice("mcp-".length);
+        return `${MCP_SCOPE}/${serverPart}`;
+    }
+    // Rule 4: regular package
+    return name;
+}
+/**
+ * Resolve a package name and log a note if resolution changed it.
+ * Returns the resolved name.
+ */
+export function resolveAndLog(name) {
+    const resolved = resolvePackageName(name);
+    if (resolved !== name) {
+        console.error(`Resolved: ${name} -> ${resolved}`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/utils/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/utils/resolve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,yBAAyB;IACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACjE,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,mFAAmF;IACnF,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IACtC,CAAC;IAED,mFAAmF;IACnF,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IACtC,CAAC;IAED,0BAA0B;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-trust",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Trust verification CLI for AI packages — check MCP servers, A2A agents, and AI tools before you install",
   "type": "module",
   "main": "dist/index.js",