capscan 0.1.0

package/dist/index.js

@@ -0,0 +1,727 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { defineCommand as defineCommand8, runMain } from "citty";
+
+// src/commands/scan.ts
+import { defineCommand } from "citty";
+import { scan } from "@capscan/engine";
+
+// src/reporters/terminal.ts
+var CATEGORY_ICONS = {
+  filesystem: "\u{1F4C1}",
+  network: "\u{1F310}",
+  process: "\u2699\uFE0F",
+  environment: "\u{1F511}",
+  crypto: "\u{1F510}",
+  dynamic_code: "\u{1F4E6}",
+  native: "\u{1F9E9}",
+  installation: "\u{1F527}",
+  obfuscation: "\u{1F3AD}"
+};
+var CATEGORY_LABELS = {
+  filesystem: "Filesystem",
+  network: "Network",
+  process: "Process",
+  environment: "Environment",
+  crypto: "Crypto",
+  dynamic_code: "Dynamic Code",
+  native: "Native",
+  installation: "Installation",
+  obfuscation: "Obfuscation"
+};
+var CONFIDENCE_COLORS = {
+  high: (s) => `\x1B[32m${s}\x1B[0m`,
+  medium: (s) => `\x1B[33m${s}\x1B[0m`,
+  low: (s) => `\x1B[31m${s}\x1B[0m`
+};
+function groupByCategory(findings) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const arr = grouped.get(f.capability.category) || [];
+    arr.push(f);
+    grouped.set(f.capability.category, arr);
+  }
+  return grouped;
+}
+function formatEvidenceLine(e, indent) {
+  const confColor = CONFIDENCE_COLORS[e.confidence] || CONFIDENCE_COLORS.medium;
+  const location = e.line > 0 ? `${e.file}:${e.line}` : e.file;
+  return `${indent}${confColor("\u25CF")} ${dim(location)}  ${bold(e.symbol)}`;
+}
+function dim(s) {
+  return `\x1B[2m${s}\x1B[0m`;
+}
+function bold(s) {
+  return `\x1B[1m${s}\x1B[0m`;
+}
+function formatPackage(pkg) {
+  const lines = [];
+  const grouped = groupByCategory(pkg.capabilities);
+  lines.push(`  \x1B[33m\u25CF\x1B[0m ${bold(pkg.name)}@${dim(pkg.version)}`);
+  for (const [category, findings] of grouped) {
+    const icon = CATEGORY_ICONS[category];
+    const label = CATEGORY_LABELS[category];
+    lines.push(`     ${icon} ${bold(label)}`);
+    const byPermission = /* @__PURE__ */ new Map();
+    for (const f of findings) {
+      const perm = f.capability.permission;
+      const arr = byPermission.get(perm) || [];
+      arr.push(f);
+      byPermission.set(perm, arr);
+    }
+    for (const [perm, permFindings] of byPermission) {
+      lines.push(`       ${dim(perm)}`);
+      for (const f of permFindings.slice(0, 3)) {
+        for (const e of f.evidence.slice(0, 2)) {
+          lines.push(formatEvidenceLine(e, "         "));
+        }
+      }
+      if (permFindings.length > 3) lines.push(dim(`         ... and ${permFindings.length - 3} more`));
+    }
+  }
+  return lines;
+}
+function reportTerminal(result) {
+  const lines = [];
+  lines.push("");
+  lines.push(`${bold("\x1B[36mCapScan\x1B[0m")} ${dim("v0.1.0 \u2014 deterministic capability analysis engine")}`);
+  lines.push("");
+  lines.push(`${bold("Project:")} ${result.meta.scanPath}`);
+  lines.push(`${bold("Package Manager:")} ${result.meta.packageManager}`);
+  lines.push(`${bold("Dependencies:")} ${result.summary.totalPackages.toString()}`);
+  lines.push("");
+  lines.push(bold("\x1B[4mCapabilities\x1B[0m"));
+  lines.push(" " + "\u2500".repeat(35));
+  for (const [cat, perms] of Object.entries(result.summary.capabilities)) {
+    const catLabel = CATEGORY_LABELS[cat];
+    const icon = CATEGORY_ICONS[cat];
+    const entries = Object.entries(perms).filter(([, c]) => c > 0);
+    if (entries.length === 0) continue;
+    lines.push(`  ${icon} ${bold(catLabel)}`);
+    for (const [perm, count] of entries) {
+      const dots = ".".repeat(Math.max(0, 25 - perm.length));
+      const pkgText = count === 1 ? "package" : "packages";
+      lines.push(`    ${dim(perm)} ${dots} ${count.toString()} ${pkgText}`);
+    }
+  }
+  const packagesWithCaps = result.packages.filter((p) => p.capabilities.length > 0);
+  if (packagesWithCaps.length > 0) {
+    lines.push("");
+    lines.push(bold("\x1B[4mPackages with Capabilities\x1B[0m"));
+    lines.push(" " + "\u2500".repeat(35));
+    lines.push("");
+    for (const pkg of packagesWithCaps) {
+      lines.push(...formatPackage(pkg));
+      lines.push("");
+    }
+  }
+  lines.push(dim(` Scan completed at ${result.meta.timestamp}`));
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/reporters/json.ts
+import { writeFile } from "fs/promises";
+import { resolve } from "path";
+async function reportJson(result, outputPath) {
+  const json = JSON.stringify(result, null, 2);
+  if (outputPath) {
+    await writeFile(resolve(outputPath), json, "utf-8");
+    return outputPath;
+  }
+  return json;
+}
+
+// src/reporters/markdown.ts
+var CAPABILITY_LABELS = {
+  filesystem: "Filesystem",
+  network: "Network",
+  process: "Process",
+  environment: "Environment",
+  crypto: "Crypto",
+  dynamic_code: "Dynamic Code",
+  native: "Native",
+  installation: "Installation",
+  obfuscation: "Obfuscation"
+};
+function generateCapabilityTable(summary) {
+  const lines = [];
+  lines.push("| Category | Permission | Count |");
+  lines.push("|----------|------------|-------|");
+  for (const [cat, perms] of Object.entries(summary.capabilities)) {
+    for (const [perm, count] of Object.entries(perms)) {
+      if (count > 0) lines.push(`| ${CAPABILITY_LABELS[cat]} | \`${perm}\` | ${count} |`);
+    }
+  }
+  return lines.join("\n");
+}
+function reportMarkdown(result) {
+  const lines = [];
+  lines.push("# CapScan Report");
+  lines.push("");
+  lines.push(`**Generated**: ${result.meta.timestamp}`);
+  lines.push(`**Engine**: ${result.meta.engine}`);
+  lines.push(`**Package Manager**: ${result.meta.packageManager}`);
+  lines.push(`**Total Dependencies**: ${result.summary.totalPackages}`);
+  lines.push(`**Packages with Capabilities**: ${result.summary.packagesWithCapabilities}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(generateCapabilityTable(result.summary));
+  lines.push("");
+  const packagesWithCaps = result.packages.filter((p) => p.capabilities.length > 0);
+  if (packagesWithCaps.length > 0) {
+    lines.push("## Packages");
+    lines.push("");
+    for (const pkg of packagesWithCaps) {
+      lines.push(`### ${pkg.name}@${pkg.version}`);
+      lines.push("");
+      lines.push("| Permission | Symbol | File | Line | Confidence |");
+      lines.push("|------------|--------|------|------|------------|");
+      for (const f of pkg.capabilities) {
+        for (const e of f.evidence) {
+          lines.push(`| \`${f.capability.permission}\` | \`${e.symbol}\` | \`${e.file}\` | ${e.line} | ${e.confidence} |`);
+        }
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/commands/scan.ts
+import ora from "ora";
+import { writeFile as writeFile2 } from "fs/promises";
+var scanCommand = defineCommand({
+  meta: { name: "scan", description: "Scan a project for dependency capabilities" },
+  args: {
+    path: { type: "positional", description: "Path to project directory", default: "." },
+    format: { type: "string", description: "Output format (json, terminal, markdown)", default: "terminal", alias: "f" },
+    output: { type: "string", description: "Output file path", alias: "o" }
+  },
+  async run({ args }) {
+    const spinner = ora("Scanning project...").start();
+    try {
+      const result = await scan({ path: args.path });
+      spinner.succeed(`Found ${result.summary.packagesWithCapabilities} packages with capabilities`);
+      if (args.format === "json") {
+        const out = await reportJson(result, args.output);
+        if (args.output) console.log(`Report saved to ${args.output}`);
+        else console.log(out);
+      } else if (args.format === "markdown") {
+        const md = reportMarkdown(result);
+        if (args.output) {
+          await writeFile2(args.output, md, "utf-8");
+          console.log(`Report saved to ${args.output}`);
+        } else {
+          console.log(md);
+        }
+      } else {
+        console.log(reportTerminal(result));
+      }
+    } catch (error) {
+      spinner.fail("Scan failed");
+      console.error(error);
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/diff.ts
+import { defineCommand as defineCommand2 } from "citty";
+import { scan as scan2, createSnapshot, loadSnapshot, diffSnapshots } from "@capscan/engine";
+import { join } from "path";
+import ora2 from "ora";
+var diffCommand = defineCommand2({
+  meta: { name: "diff", description: "Compare current scan with last snapshot" },
+  args: {
+    path: { type: "positional", description: "Path to project directory", default: "." },
+    snapshot: { type: "string", description: "Snapshot file path", default: ".capscan/snapshot.json" }
+  },
+  async run({ args }) {
+    const spinner = ora2("Scanning project...").start();
+    try {
+      const snapshotPath = join(args.path, args.snapshot);
+      const oldSnap = await loadSnapshot(snapshotPath);
+      if (!oldSnap) {
+        spinner.fail(`No snapshot found at ${args.snapshot}`);
+        console.log("\nRun `capscan snapshot` first to create a baseline.");
+        return;
+      }
+      const result = await scan2({ path: args.path });
+      const newSnap = await createSnapshot(result, snapshotPath);
+      const diff = diffSnapshots(oldSnap, newSnap);
+      spinner.succeed("Diff complete");
+      if (diff.added.length === 0 && diff.removed.length === 0) {
+        console.log("\n  No capability changes detected.\n");
+        return;
+      }
+      const lines = [];
+      lines.push("");
+      if (diff.added.length > 0) {
+        lines.push("  \x1B[32m+ Added\x1B[0m");
+        for (const item of diff.added) {
+          lines.push(`    + ${item.permission}  in ${item.package}`);
+        }
+        lines.push("");
+      }
+      if (diff.removed.length > 0) {
+        lines.push("  \x1B[31m- Removed\x1B[0m");
+        for (const item of diff.removed) {
+          lines.push(`    - ${item.permission}  in ${item.package}`);
+        }
+        lines.push("");
+      }
+      console.log(lines.join("\n"));
+    } catch (error) {
+      spinner.fail("Diff failed");
+      console.error(error);
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/snapshot.ts
+import { defineCommand as defineCommand3 } from "citty";
+import { scan as scan3, createSnapshot as createSnapshot2 } from "@capscan/engine";
+import { join as join2 } from "path";
+import ora3 from "ora";
+var snapshotCommand = defineCommand3({
+  meta: { name: "snapshot", description: "Create a capability snapshot for diffing" },
+  args: {
+    path: { type: "positional", description: "Path to project directory", default: "." },
+    output: { type: "string", description: "Snapshot file path", default: ".capscan/snapshot.json" }
+  },
+  async run({ args }) {
+    const spinner = ora3("Creating snapshot...").start();
+    try {
+      const result = await scan3({ path: args.path });
+      const snapshotPath = join2(args.path, args.output);
+      const snapshot = await createSnapshot2(result, snapshotPath);
+      const pkgCount = Object.keys(snapshot.packages).length;
+      spinner.succeed(`Snapshot saved to ${args.output}`);
+      console.log(`  ${pkgCount} packages with capabilities recorded.`);
+    } catch (error) {
+      spinner.fail("Snapshot failed");
+      console.error(error);
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/why.ts
+import { defineCommand as defineCommand4 } from "citty";
+import { scan as scan4 } from "@capscan/engine";
+function dim2(s) {
+  return `\x1B[2m${s}\x1B[0m`;
+}
+function bold2(s) {
+  return `\x1B[1m${s}\x1B[0m`;
+}
+var CATEGORY_LABELS2 = {
+  filesystem: "Filesystem",
+  network: "Network",
+  process: "Process",
+  environment: "Environment",
+  crypto: "Crypto",
+  dynamic_code: "Dynamic Code",
+  native: "Native",
+  installation: "Installation",
+  obfuscation: "Obfuscation"
+};
+var CATEGORY_ICONS2 = {
+  filesystem: "\u{1F4C1}",
+  network: "\u{1F310}",
+  process: "\u2699\uFE0F",
+  environment: "\u{1F511}",
+  crypto: "\u{1F510}",
+  dynamic_code: "\u{1F4E6}",
+  native: "\u{1F9E9}",
+  installation: "\u{1F527}",
+  obfuscation: "\u{1F3AD}"
+};
+function isCategory(input) {
+  return Object.keys(CATEGORY_LABELS2).includes(input);
+}
+function printFindings(label, findings) {
+  const lines = [];
+  lines.push("");
+  lines.push(`  ${bold2(label)}`);
+  lines.push(`  ${dim2("\u2500".repeat(50))}`);
+  lines.push("");
+  const byPkg = /* @__PURE__ */ new Map();
+  for (const { pkg, finding } of findings) {
+    const arr = byPkg.get(pkg.name) || [];
+    arr.push({ finding });
+    byPkg.set(pkg.name, arr);
+  }
+  let totalEvidence = 0;
+  for (const [pkgName, items] of byPkg) {
+    const pkgVersion = items[0] ? findings.find((f) => f.pkg.name === pkgName)?.pkg.version : "";
+    lines.push(`  ${bold2(pkgName)}@${dim2(pkgVersion || "")}`);
+    for (const { finding } of items) {
+      for (const e of finding.evidence) {
+        totalEvidence++;
+        const loc = e.line > 0 ? `${e.file}:${e.line}` : e.file;
+        lines.push(`    \u2514\u2500\u2500 ${dim2(loc)}  ${bold2(e.symbol)}`);
+      }
+    }
+    lines.push("");
+  }
+  lines.push(`  ${dim2(`${totalEvidence} evidence points across ${byPkg.size} packages`)}`);
+  lines.push("");
+  console.log(lines.join("\n"));
+}
+var whyCommand = defineCommand4({
+  meta: { name: "why", description: "Explain why a capability, permission, or package is detected" },
+  args: {
+    target: { type: "positional", description: "Category, permission, or package name", required: true },
+    extra: { type: "positional", description: "Second filter (permission or package)", required: false },
+    path: { type: "string", description: "Path to project directory", default: ".", alias: "p" }
+  },
+  async run({ args }) {
+    const result = await scan4({ path: args.path });
+    const target = args.target.toLowerCase();
+    const extra = args.extra?.toLowerCase();
+    const matches = [];
+    for (const pkg of result.packages) {
+      for (const finding of pkg.capabilities) {
+        const matchesTarget = isCategory(target) && finding.capability.category === target || finding.capability.permission === target || pkg.name.toLowerCase() === target || pkg.name.toLowerCase().includes(target);
+        const matchesExtra = !extra || finding.capability.permission === extra || pkg.name.toLowerCase() === extra || pkg.name.toLowerCase().includes(extra);
+        if (matchesTarget && matchesExtra) {
+          matches.push({ pkg, finding });
+        }
+      }
+    }
+    if (matches.length === 0) {
+      console.log(`
+  No findings for "${args.target}${extra ? " " + extra : ""}".
+`);
+      return;
+    }
+    let label;
+    if (isCategory(target)) {
+      label = `${CATEGORY_ICONS2[target]} ${CATEGORY_LABELS2[target]}`;
+    } else if (matches[0]?.finding.capability.permission === target) {
+      label = target;
+    } else {
+      label = `Package: ${target}`;
+    }
+    printFindings(label, matches);
+  }
+});
+
+// src/commands/compare.ts
+import { defineCommand as defineCommand5 } from "citty";
+import { scan as scan5 } from "@capscan/engine";
+function bold3(s) {
+  return `\x1B[1m${s}\x1B[0m`;
+}
+function getPermissions(pkg) {
+  const perms = /* @__PURE__ */ new Map();
+  for (const f of pkg.capabilities) {
+    const key = f.capability.category;
+    const arr = perms.get(key) || [];
+    arr.push(f.capability.permission);
+    perms.set(key, [...new Set(arr)]);
+  }
+  return perms;
+}
+var compareCommand = defineCommand5({
+  meta: { name: "compare", description: "Compare capabilities of two dependency versions" },
+  args: {
+    pkgA: { type: "positional", description: "First package (name or name@version)", required: true },
+    pkgB: { type: "positional", description: "Second package (name or name@version)", required: true },
+    path: { type: "string", description: "Path to project directory", default: ".", alias: "p" }
+  },
+  async run({ args }) {
+    const [nameA, verA] = args.pkgA.includes("@") ? args.pkgA.split("@") : [args.pkgA, ""];
+    const [nameB, verB] = args.pkgB.includes("@") ? args.pkgB.split("@") : [args.pkgB, ""];
+    console.log(`
+  Scanning packages...`);
+    const result = await scan5({ path: args.path });
+    const pkgA = result.packages.find((p) => p.name === nameA);
+    const pkgB = result.packages.find((p) => p.name === nameB);
+    if (!pkgA && !pkgB) {
+      console.log(`
+  Neither "${nameA}" nor "${nameB}" found in dependencies.
+`);
+      return;
+    }
+    if (!pkgA) {
+      console.log(`
+  "${nameA}" not found in dependencies.
+`);
+      return;
+    }
+    if (!pkgB) {
+      console.log(`
+  "${nameB}" not found in dependencies.
+`);
+      return;
+    }
+    const permsA = getPermissions(pkgA);
+    const permsB = getPermissions(pkgB);
+    const flatA = /* @__PURE__ */ new Set();
+    const flatB = /* @__PURE__ */ new Set();
+    for (const perms of permsA.values()) for (const p of perms) flatA.add(p);
+    for (const perms of permsB.values()) for (const p of perms) flatB.add(p);
+    const added = [...flatB].filter((p) => !flatA.has(p));
+    const removed = [...flatA].filter((p) => !flatB.has(p));
+    const unchanged = [...flatA].filter((p) => flatB.has(p));
+    const lines = [];
+    lines.push("");
+    lines.push(`  ${bold3(`Capability changes: ${pkgA.name}@${pkgA.version} \u2192 ${pkgB.name}@${pkgB.version}`)}`);
+    lines.push("");
+    if (added.length > 0) {
+      lines.push("  \x1B[32m+ Added\x1B[0m");
+      for (const p of added) lines.push(`    + ${p}`);
+      lines.push("");
+    }
+    if (removed.length > 0) {
+      lines.push("  \x1B[31m- Removed\x1B[0m");
+      for (const p of removed) lines.push(`    - ${p}`);
+      lines.push("");
+    }
+    if (unchanged.length > 0) {
+      lines.push("  \x1B[36m\u2713 Unchanged\x1B[0m");
+      for (const p of unchanged) lines.push(`    \u2713 ${p}`);
+      lines.push("");
+    }
+    if (added.length === 0 && removed.length === 0) {
+      lines.push("  No capability differences found.");
+      lines.push("");
+    }
+    console.log(lines.join("\n"));
+  }
+});
+
+// src/commands/check.ts
+import { defineCommand as defineCommand6 } from "citty";
+import { scan as scan6 } from "@capscan/engine";
+function parseAllowList(allow) {
+  if (!allow) return [];
+  return allow.split(",").map((s) => s.trim());
+}
+function checkCapabilities(result, allowedPermissions) {
+  const blocked = [];
+  const allowedSet = new Set(allowedPermissions);
+  for (const pkg of result.packages) {
+    for (const finding of pkg.capabilities) {
+      if (!allowedSet.has(finding.capability.permission)) {
+        blocked.push({
+          package: pkg.name,
+          permission: finding.capability.permission,
+          evidence: finding.evidence.map((e) => ({
+            file: e.file,
+            line: e.line,
+            symbol: e.symbol
+          }))
+        });
+      }
+    }
+  }
+  return {
+    allowed: blocked.length === 0,
+    blocked,
+    summary: {
+      totalPackages: result.summary.totalPackages,
+      packagesWithCapabilities: result.summary.packagesWithCapabilities,
+      blockedCount: blocked.length
+    }
+  };
+}
+function formatCheckOutput(result, quiet) {
+  if (quiet && result.allowed) {
+    return "";
+  }
+  const lines = [];
+  if (result.allowed) {
+    lines.push("\x1B[32m\u2713\x1B[0m All capabilities allowed");
+    lines.push(`  ${result.summary.packagesWithCapabilities} packages with capabilities`);
+    return lines.join("\n");
+  }
+  lines.push("");
+  lines.push("\x1B[31m\u2717\x1B[0m \x1B[1mBlocked capabilities detected\x1B[0m");
+  lines.push("");
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const item of result.blocked) {
+    const arr = byPackage.get(item.package) || [];
+    arr.push(item);
+    byPackage.set(item.package, arr);
+  }
+  for (const [pkg, items] of byPackage) {
+    lines.push(`  \x1B[33m\u25CF\x1B[0m ${pkg}`);
+    for (const item of items) {
+      const evidence = item.evidence[0];
+      const location = evidence ? `${evidence.file}:${evidence.line}` : "";
+      lines.push(`    \x1B[31m\u2717\x1B[0m ${item.permission}  ${location ? `\x1B[2m${location}\x1B[0m` : ""}`);
+    }
+    lines.push("");
+  }
+  lines.push(`  \x1B[2m${result.summary.blockedCount} blocked capabilities\x1B[0m`);
+  lines.push("");
+  return lines.join("\n");
+}
+var checkCommand = defineCommand6({
+  meta: {
+    name: "check",
+    description: "Check if project capabilities are within allowed permissions"
+  },
+  args: {
+    path: { type: "positional", description: "Path to project directory", default: "." },
+    allow: {
+      type: "string",
+      description: "Comma-separated list of allowed permissions (e.g., fs:read,env:read)",
+      alias: "a"
+    },
+    quiet: {
+      type: "boolean",
+      description: "Only output if blocked",
+      default: false,
+      alias: "q"
+    }
+  },
+  async run({ args }) {
+    try {
+      const result = await scan6({ path: args.path });
+      const allowedPermissions = parseAllowList(args.allow);
+      const checkResult = checkCapabilities(result, allowedPermissions);
+      const output = formatCheckOutput(checkResult, args.quiet);
+      if (output) {
+        console.log(output);
+      }
+      process.exit(checkResult.allowed ? 0 : 1);
+    } catch (error) {
+      console.error("\x1B[31m\u2717\x1B[0m Check failed:", error);
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/init.ts
+import { defineCommand as defineCommand7 } from "citty";
+import { readFile, writeFile as writeFile3, access } from "fs/promises";
+import { join as join3 } from "path";
+var NPMRC_CONTENT = `
+# CapScan pre-install hook
+# Checks dependency capabilities before installing
+preinstall = npx capscan check --quiet
+`.trim();
+var GITIGNORE_LINE = "node_modules/";
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readOrCreateNpmrc(projectPath) {
+  const npmrcPath = join3(projectPath, ".npmrc");
+  if (await fileExists(npmrcPath)) {
+    return await readFile(npmrcPath, "utf-8");
+  }
+  return "";
+}
+async function readOrCreateGitignore(projectPath) {
+  const gitignorePath = join3(projectPath, ".gitignore");
+  if (await fileExists(gitignorePath)) {
+    return await readFile(gitignorePath, "utf-8");
+  }
+  return "";
+}
+function hasCapscanHook(content) {
+  return content.includes("capscan check");
+}
+function addCapscanHook(content) {
+  if (hasCapscanHook(content)) {
+    return content;
+  }
+  const lines = content.split("\n");
+  const lastEmptyIndex = lines.length - 1;
+  let insertIndex = lastEmptyIndex;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (lines[i].trim() === "") {
+      insertIndex = i;
+      break;
+    }
+  }
+  if (insertIndex === lastEmptyIndex && lines[lastEmptyIndex]?.trim() !== "") {
+    lines.push("");
+    insertIndex = lines.length;
+  }
+  lines.splice(insertIndex, 0, ...NPMRC_CONTENT.split("\n"));
+  return lines.join("\n");
+}
+function addNodeModulesToGitignore(content) {
+  if (content.includes("node_modules/")) {
+    return content;
+  }
+  return content.trim() + "\n\n" + GITIGNORE_LINE + "\n";
+}
+var initCommand = defineCommand7({
+  meta: {
+    name: "init",
+    description: "Initialize CapScan hooks in your project"
+  },
+  args: {
+    path: { type: "positional", description: "Path to project directory", default: "." },
+    force: {
+      type: "boolean",
+      description: "Overwrite existing configuration",
+      default: false,
+      alias: "f"
+    }
+  },
+  async run({ args }) {
+    const projectPath = args.path;
+    try {
+      console.log("\n  \x1B[36mCapScan\x1B[0m \x1B[2mInit\x1B[0m\n");
+      const npmrcContent = await readOrCreateNpmrc(projectPath);
+      if (hasCapscanHook(npmrcContent) && !args.force) {
+        console.log("  \x1B[33m\u25CF\x1B[0m .npmrc already configured");
+      } else {
+        const newNpmrc = addCapscanHook(npmrcContent);
+        const npmrcPath = join3(projectPath, ".npmrc");
+        await writeFile3(npmrcPath, newNpmrc, "utf-8");
+        console.log("  \x1B[32m\u2713\x1B[0m .npmrc updated");
+      }
+      const gitignoreContent = await readOrCreateGitignore(projectPath);
+      if (gitignoreContent.includes("node_modules/")) {
+        console.log("  \x1B[33m\u25CF\x1B[0m .gitignore already has node_modules/");
+      } else {
+        const newGitignore = addNodeModulesToGitignore(gitignoreContent);
+        const gitignorePath = join3(projectPath, ".gitignore");
+        await writeFile3(gitignorePath, newGitignore, "utf-8");
+        console.log("  \x1B[32m\u2713\x1B[0m .gitignore updated");
+      }
+      console.log("\n  \x1B[2mCapScan will now check capabilities before each install.\x1B[0m");
+      console.log('  \x1B[2mTo disable: remove the "preinstall" line from .npmrc\x1B[0m\n');
+    } catch (error) {
+      console.error("\x1B[31m\u2717\x1B[0m Init failed:", error);
+      process.exit(1);
+    }
+  }
+});
+
+// src/index.ts
+var main = defineCommand8({
+  meta: {
+    name: "capscan",
+    version: "0.1.0",
+    description: "Deterministic capability analysis engine for software dependencies"
+  },
+  subCommands: {
+    scan: scanCommand,
+    why: whyCommand,
+    diff: diffCommand,
+    snapshot: snapshotCommand,
+    compare: compareCommand,
+    check: checkCommand,
+    init: initCommand
+  }
+});
+runMain(main);
+//# sourceMappingURL=index.js.map