pkgwise 0.1.0-alpha.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# PkgWise changelog
+
+## 0.1.0-alpha.0
+
+- Initial alpha CLI with scan, inspect, compare, explain, doctor, and cache commands.
+- Added `scan --remote` OSV enrichment with terminal, JSON, Markdown, SARIF, offline-cache, and policy
+  support.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LovlyDev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# PkgWise
+
+Explainable, local-first dependency analysis for JavaScript and TypeScript projects.
+
+```bash
+npx pkgwise scan .
+npx pkgwise --concurrency 4 scan . --remote
+npx pkgwise inspect lodash@4.17.20 --remote
+npx pkgwise --offline scan . --remote
+```
+
+PkgWise parses project metadata and supported lockfiles without executing dependency code. Remote
+inspection uses the public npm Registry and OSV API. `scan --remote` queries OSV for every unique exact
+package coordinate in the lockfile. Both paths support an owned checksum-validated cache and can be
+run without network access after data has been cached.
+
+Node.js 22 or newer is required. This package is an alpha: report and API contracts may still evolve.

package/dist/bin/pkgwise.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=pkgwise.d.ts.map

package/dist/bin/pkgwise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkgwise.d.ts","sourceRoot":"","sources":["../../src/bin/pkgwise.ts"],"names":[],"mappings":""}

package/dist/bin/pkgwise.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { runCli } from '../runCli.js';
+const controller = new AbortController();
+let interruptionCount = 0;
+process.on('SIGINT', () => {
+    interruptionCount += 1;
+    if (interruptionCount === 1) {
+        controller.abort();
+        process.exitCode = 130;
+        return;
+    }
+    process.exit(130);
+});
+const exitCode = await runCli(process.argv.slice(2), { signal: controller.signal });
+process.exitCode = controller.signal.aborted ? 130 : exitCode;
+//# sourceMappingURL=pkgwise.js.map

package/dist/bin/pkgwise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkgwise.js","sourceRoot":"","sources":["../../src/bin/pkgwise.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;AACzC,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,iBAAiB,IAAI,CAAC,CAAC;IACvB,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC;QACvB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AACpF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC"}

package/dist/commands/CommandContext.d.ts

@@ -0,0 +1,9 @@
+import type { PkgWiseClient } from '@lovlydev/pkgwise-core';
+import type { CliIo } from '../io/CliIo.js';
+export interface CommandContext {
+    readonly client: PkgWiseClient;
+    readonly io: CliIo;
+    readonly signal: AbortSignal;
+    setExitCode(code: number): void;
+}
+//# sourceMappingURL=CommandContext.d.ts.map

package/dist/commands/CommandContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandContext.d.ts","sourceRoot":"","sources":["../../src/commands/CommandContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC"}

package/dist/commands/CommandContext.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CommandContext.js.map

package/dist/commands/CommandContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandContext.js","sourceRoot":"","sources":["../../src/commands/CommandContext.ts"],"names":[],"mappings":""}

package/dist/commands/createCacheCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createCacheCommand(context: CommandContext): Command;
+//# sourceMappingURL=createCacheCommand.d.ts.map

package/dist/commands/createCacheCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCacheCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createCacheCommand.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAmDnE"}

package/dist/commands/createCacheCommand.js

@@ -0,0 +1,58 @@
+import { PkgWiseError, } from '@lovlydev/pkgwise-core';
+import { Command } from 'commander';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createCacheCommand(context) {
+    const command = new Command('cache').description('inspect or clear the PkgWise cache');
+    command
+        .command('status')
+        .description('show cache location and usage')
+        .action(async (_local, child) => {
+        const global = readGlobalOptions(child);
+        const report = await context.client.getCacheStatus({
+            signal: context.signal,
+            ...(global.cacheDir === undefined ? {} : { cacheDirectory: global.cacheDir }),
+        });
+        await writeTextOutput(global.format === 'terminal'
+            ? renderCacheStatus(report)
+            : renderStructuredResult(report, global.format), global.output, context.io);
+    });
+    command
+        .command('clear')
+        .description('clear the owned PkgWise cache namespace')
+        .option('--provider <id>', 'clear only entries for a provider')
+        .option('--yes', 'confirm non-interactively', false)
+        .action(async (local, child) => {
+        if (!local.yes) {
+            throw new PkgWiseError({
+                code: 'PW_CLI_INVALID_ARGUMENT',
+                userMessage: 'Cache clearing requires --yes because the CLI does not prompt interactively.',
+                recoverable: false,
+            });
+        }
+        const global = readGlobalOptions(child);
+        const result = await context.client.clearCache({
+            signal: context.signal,
+            ...(global.cacheDir === undefined ? {} : { cacheDirectory: global.cacheDir }),
+            ...(local.provider === undefined ? {} : { provider: local.provider }),
+        });
+        await writeTextOutput(global.format === 'terminal'
+            ? renderCacheClear(result)
+            : renderStructuredResult(result, global.format), global.output, context.io);
+    });
+    return command;
+}
+function renderCacheStatus(report) {
+    return `${[
+        `PkgWise cache · ${report.exists ? (report.owned ? 'owned' : 'unowned') : 'empty'}`,
+        '',
+        `Path: ${report.path}`,
+        `Entries: ${report.entryCount} · ${report.totalBytes} bytes`,
+        `Expired: ${report.expiredEntryCount} · corrupt: ${report.corruptEntryCount}`,
+    ].join('\n')}\n`;
+}
+function renderCacheClear(result) {
+    return `PkgWise cache cleared${result.provider === undefined ? '' : ` for ${result.provider}`}: ${result.removedEntries} entries · ${result.removedBytes} bytes\n`;
+}
+//# sourceMappingURL=createCacheCommand.js.map

package/dist/commands/createCacheCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCacheCommand.js","sourceRoot":"","sources":["../../src/commands/createCacheCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAEvF,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,eAAe,CACnB,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EACjD,MAAM,CAAC,MAAM,EACb,OAAO,CAAC,EAAE,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;SAC9D,MAAM,CAAC,OAAO,EAAE,2BAA2B,EAAE,KAAK,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,KAA0C,EAAE,KAAK,EAAE,EAAE;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EACT,8EAA8E;gBAChF,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,eAAe,CACnB,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EACjD,MAAM,CAAC,MAAM,EACb,OAAO,CAAC,EAAE,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,OAAO,GAAG;QACR,mBAAmB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;QACnF,EAAE;QACF,SAAS,MAAM,CAAC,IAAI,EAAE;QACtB,YAAY,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,UAAU,QAAQ;QAC5D,YAAY,MAAM,CAAC,iBAAiB,eAAe,MAAM,CAAC,iBAAiB,EAAE;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwB;IAChD,OAAO,wBAAwB,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,cAAc,cAAc,MAAM,CAAC,YAAY,UAAU,CAAC;AACrK,CAAC"}

package/dist/commands/createCompareCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createCompareCommand(context: CommandContext): Command;
+//# sourceMappingURL=createCompareCommand.d.ts.map

package/dist/commands/createCompareCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCompareCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createCompareCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAyCrE"}

package/dist/commands/createCompareCommand.js

@@ -0,0 +1,38 @@
+import { Command } from 'commander';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { renderPackageComparison } from '../output/renderPackageComparison.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createCompareCommand(context) {
+    return new Command('compare')
+        .description('compare two package candidates with a shared evidence context')
+        .argument('<package-a>', 'first package spec')
+        .argument('<package-b>', 'second package spec')
+        .option('--project <path>', 'project used for compatibility context')
+        .option('--target-node <version>', 'target Node.js version')
+        .option('--metric <name>', 'include a metric (repeatable)', collect, [])
+        .option('--no-recommendation', 'omit the contextual recommendation')
+        .action(async (packageA, packageB, local, command) => {
+        const global = readGlobalOptions(command);
+        const result = await context.client.comparePackages({
+            packageA,
+            packageB,
+            signal: context.signal,
+            ...(global.config === undefined ? {} : { configFile: global.config }),
+            ...(local.project === undefined && global.root === undefined
+                ? {}
+                : { projectRoot: local.project ?? global.root }),
+            ...(local.targetNode === undefined ? {} : { targetNode: local.targetNode }),
+            ...(local.metric.length === 0 ? {} : { metrics: local.metric }),
+            includeRecommendation: local.recommendation,
+        });
+        const content = global.format === 'terminal'
+            ? renderPackageComparison(result)
+            : renderStructuredResult(result, global.format);
+        await writeTextOutput(content, global.output, context.io);
+    });
+}
+function collect(value, values) {
+    return [...values, value];
+}
+//# sourceMappingURL=createCompareCommand.js.map

package/dist/commands/createCompareCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCompareCommand.js","sourceRoot":"","sources":["../../src/commands/createCompareCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,+DAA+D,CAAC;SAC5E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;SAC7C,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACpE,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,+BAA+B,EAAE,OAAO,EAAE,EAAE,CAAC;SACvE,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;SACnE,MAAM,CACL,KAAK,EACH,QAAgB,EAChB,QAAgB,EAChB,KAKC,EACD,OAAO,EACP,EAAE;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAClD,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,qBAAqB,EAAE,KAAK,CAAC,cAAc;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAgB;IAC9C,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/commands/createDoctorCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createDoctorCommand(context: CommandContext): Command;
+//# sourceMappingURL=createDoctorCommand.d.ts.map

package/dist/commands/createDoctorCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDoctorCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createDoctorCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAoBpE"}

package/dist/commands/createDoctorCommand.js

@@ -0,0 +1,26 @@
+import { Command } from 'commander';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { renderDoctorReport } from '../output/renderDoctorReport.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createDoctorCommand(context) {
+    return new Command('doctor')
+        .description('run read-only environment and project diagnostics')
+        .action(async (_local, command) => {
+        const global = readGlobalOptions(command);
+        const report = await context.client.diagnose({
+            signal: context.signal,
+            offline: global.offline,
+            ...(global.config === undefined ? {} : { configFile: global.config }),
+            cache: global.cache,
+            ...(global.cacheDir === undefined ? {} : { cacheDirectory: global.cacheDir }),
+            ...(global.root === undefined ? {} : { root: global.root }),
+        });
+        const content = global.format === 'terminal'
+            ? renderDoctorReport(report)
+            : renderStructuredResult(report, global.format);
+        await writeTextOutput(content, global.output, context.io);
+        context.setExitCode(report.status === 'degraded' ? 3 : 0);
+    });
+}
+//# sourceMappingURL=createDoctorCommand.js.map

package/dist/commands/createDoctorCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDoctorCommand.js","sourceRoot":"","sources":["../../src/commands/createDoctorCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IACzD,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/createExplainCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createExplainCommand(context: CommandContext): Command;
+//# sourceMappingURL=createExplainCommand.d.ts.map

package/dist/commands/createExplainCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createExplainCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createExplainCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAqBrE"}

package/dist/commands/createExplainCommand.js

@@ -0,0 +1,27 @@
+import { Command } from 'commander';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { renderFindingExplanation } from '../output/renderFindingExplanation.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createExplainCommand(context) {
+    return new Command('explain')
+        .description('explain a finding by fingerprint, rule, or package')
+        .argument('<selector>', 'finding fingerprint, rule ID, or package name')
+        .option('--project <path>', 'project to analyze')
+        .action(async (selector, local, command) => {
+        const global = readGlobalOptions(command);
+        const result = await context.client.explainFinding({
+            selector,
+            signal: context.signal,
+            ...(global.config === undefined ? {} : { configFile: global.config }),
+            ...(local.project === undefined && global.root === undefined
+                ? {}
+                : { projectRoot: local.project ?? global.root }),
+        });
+        const content = global.format === 'terminal'
+            ? renderFindingExplanation(result)
+            : renderStructuredResult(result, global.format);
+        await writeTextOutput(content, global.output, context.io);
+    });
+}
+//# sourceMappingURL=createExplainCommand.js.map

package/dist/commands/createExplainCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createExplainCommand.js","sourceRoot":"","sources":["../../src/commands/createExplainCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,oDAAoD,CAAC;SACjE,QAAQ,CAAC,YAAY,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,KAA2B,EAAE,OAAO,EAAE,EAAE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YACjD,QAAQ;YACR,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/createInspectCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createInspectCommand(context: CommandContext): Command;
+//# sourceMappingURL=createInspectCommand.d.ts.map

package/dist/commands/createInspectCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInspectCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createInspectCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAuCrE"}

package/dist/commands/createInspectCommand.js

@@ -0,0 +1,39 @@
+import { Command } from 'commander';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { renderPackageInspection } from '../output/renderPackageInspection.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createInspectCommand(context) {
+    return new Command('inspect')
+        .description('inspect an installed or remote package')
+        .argument('<package>', 'package name or exact package spec')
+        .option('--all-versions', 'inspect every installed version', false)
+        .option('--remote', 'allow remote-only inspection', false)
+        .option('--project <path>', 'project used for graph context')
+        .option('--paths', 'include dependency paths')
+        .option('--no-paths', 'exclude dependency paths')
+        .action(async (packageSpec, local, command) => {
+        const global = readGlobalOptions(command);
+        const result = await context.client.inspectPackage({
+            packageSpec,
+            signal: context.signal,
+            ...(global.config === undefined ? {} : { configFile: global.config }),
+            offline: global.offline,
+            refresh: global.refresh,
+            cache: global.cache,
+            ...(global.cacheDir === undefined ? {} : { cacheDirectory: global.cacheDir }),
+            timeoutMs: global.timeout,
+            allVersions: local.allVersions,
+            remote: local.remote,
+            ...(local.paths === undefined ? {} : { includePaths: local.paths }),
+            ...(local.project === undefined && global.root === undefined
+                ? {}
+                : { projectRoot: local.project ?? global.root }),
+        });
+        const content = global.format === 'terminal'
+            ? renderPackageInspection(result)
+            : renderStructuredResult(result, global.format);
+        await writeTextOutput(content, global.output, context.io);
+    });
+}
+//# sourceMappingURL=createInspectCommand.js.map

package/dist/commands/createInspectCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createInspectCommand.js","sourceRoot":"","sources":["../../src/commands/createInspectCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,wCAAwC,CAAC;SACrD,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAClE,MAAM,CAAC,UAAU,EAAE,8BAA8B,EAAE,KAAK,CAAC;SACzD,MAAM,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;SAC5D,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;SAC7C,MAAM,CAAC,YAAY,EAAE,0BAA0B,CAAC;SAChD,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,KAAmF,EACnF,OAAO,EACP,EAAE;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YACjD,WAAW;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACnE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAC1D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/createScanCommand.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import type { CommandContext } from './CommandContext.js';
+export declare function createScanCommand(context: CommandContext): Command;
+//# sourceMappingURL=createScanCommand.d.ts.map

package/dist/commands/createScanCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createScanCommand.d.ts","sourceRoot":"","sources":["../../src/commands/createScanCommand.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAa5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAiFlE"}

package/dist/commands/createScanCommand.js

@@ -0,0 +1,65 @@
+import { Command, Option } from 'commander';
+import { mapPolicyToExitCode } from '../exit/mapPolicyToExitCode.js';
+import { readGlobalOptions } from '../options/readGlobalOptions.js';
+import { parseFindingPriority, parseFindingSeverity, parseMaximumFindings, } from '../options/parseFindingFilters.js';
+import { renderAnalysisReport } from '../output/renderAnalysisReport.js';
+import { renderMarkdownReport } from '../output/renderMarkdownReport.js';
+import { renderSarifReport } from '../output/renderSarifReport.js';
+import { renderStructuredResult } from '../output/renderStructuredResult.js';
+import { writeTextOutput } from '../output/writeTextOutput.js';
+export function createScanCommand(context) {
+    return new Command('scan')
+        .description('analyze a project dependency graph')
+        .argument('[path]', 'project path', '.')
+        .option('--workspace <name>', 'include a workspace (repeatable)', collect, [])
+        .addOption(new Option('--include-dev', 'include development dependencies').conflicts('production'))
+        .addOption(new Option('--production', 'analyze production dependencies only').conflicts('includeDev'))
+        .addOption(new Option('--severity <level>', 'minimum displayed severity').argParser(parseFindingSeverity))
+        .option('--rule <id>', 'run only a rule (repeatable)', collect, [])
+        .option('--remote', 'query OSV for every exact lockfile package coordinate', false)
+        .option('--include <group>', 'include a finding group (repeatable)', (value, values) => [...values, parseFindingPriority(value)], [])
+        .addOption(new Option('--max-findings <count>', 'limit terminal findings').argParser(parseMaximumFindings))
+        .action(async (path, local, command) => {
+        const global = readGlobalOptions(command);
+        const input = {
+            root: global.root ?? path,
+            signal: context.signal,
+            ...(global.config === undefined ? {} : { configFile: global.config }),
+            ...(local.workspace.length === 0 ? {} : { workspaces: local.workspace }),
+            ...(local.production === true
+                ? { includeDev: false }
+                : local.includeDev === true
+                    ? { includeDev: true }
+                    : {}),
+            ...(local.rule.length === 0 ? {} : { rules: local.rule }),
+            remote: local.remote,
+            offline: global.offline,
+            refresh: global.refresh,
+            cache: global.cache,
+            ...(global.cacheDir === undefined ? {} : { cacheDirectory: global.cacheDir }),
+            timeoutMs: global.timeout,
+            concurrency: global.concurrency,
+        };
+        const report = await context.client.analyzeProject(input);
+        const content = (() => {
+            if (global.format === 'terminal') {
+                return renderAnalysisReport(report, {
+                    ...(local.severity === undefined ? {} : { minimumSeverity: local.severity }),
+                    includePriorities: local.include,
+                    ...(local.maxFindings === undefined ? {} : { maximumFindings: local.maxFindings }),
+                });
+            }
+            if (global.format === 'markdown')
+                return renderMarkdownReport(report);
+            if (global.format === 'sarif')
+                return renderSarifReport(report);
+            return renderStructuredResult(report, global.format);
+        })();
+        await writeTextOutput(content, global.output, context.io);
+        context.setExitCode(mapPolicyToExitCode(report.policy));
+    });
+}
+function collect(value, values) {
+    return [...values, value];
+}
+//# sourceMappingURL=createScanCommand.js.map

package/dist/commands/createScanCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createScanCommand.js","sourceRoot":"","sources":["../../src/commands/createScanCommand.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAG/D,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,oCAAoC,CAAC;SACjD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC;SACvC,MAAM,CAAC,oBAAoB,EAAE,kCAAkC,EAAE,OAAO,EAAE,EAAE,CAAC;SAC7E,SAAS,CACR,IAAI,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CACxF;SACA,SAAS,CACR,IAAI,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAC3F;SACA,SAAS,CACR,IAAI,MAAM,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC,SAAS,CACtE,oBAAoB,CACrB,CACF;SACA,MAAM,CAAC,aAAa,EAAE,8BAA8B,EAAE,OAAO,EAAE,EAAE,CAAC;SAClE,MAAM,CAAC,UAAU,EAAE,uDAAuD,EAAE,KAAK,CAAC;SAClF,MAAM,CACL,mBAAmB,EACnB,sCAAsC,EACtC,CAAC,KAAa,EAAE,MAAgB,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAC7E,EAAE,CACH;SACA,SAAS,CACR,IAAI,MAAM,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC,SAAS,CACvE,oBAAoB,CACrB,CACF;SACA,MAAM,CACL,KAAK,EACH,IAAY,EACZ,KASC,EACD,OAAO,EACP,EAAE;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;gBAC3B,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;gBACvB,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;oBACzB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE;oBACtB,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,MAAM,GAAmB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;YACpB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,oBAAoB,CAAC,MAAM,EAAE;oBAClC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC5E,iBAAiB,EAAE,KAAK,CAAC,OAAO;oBAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC,CACF,CAAC;AACN,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAgB;IAC9C,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/createCli.d.ts

@@ -0,0 +1,12 @@
+import type { PkgWiseClient } from '@lovlydev/pkgwise-core';
+import { Command } from 'commander';
+import type { CliIo } from './io/CliIo.js';
+export interface CreateCliOptions {
+    readonly client: PkgWiseClient;
+    readonly io: CliIo;
+    readonly signal: AbortSignal;
+    readonly version: string;
+    setExitCode(code: number): void;
+}
+export declare function createCli(options: CreateCliOptions): Command;
+//# sourceMappingURL=createCli.d.ts.map

package/dist/createCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCli.d.ts","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAG3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CA2B5D"}

package/dist/createCli.js

@@ -0,0 +1,41 @@
+import { Command } from 'commander';
+import { createCacheCommand } from './commands/createCacheCommand.js';
+import { createCompareCommand } from './commands/createCompareCommand.js';
+import { createDoctorCommand } from './commands/createDoctorCommand.js';
+import { createExplainCommand } from './commands/createExplainCommand.js';
+import { createInspectCommand } from './commands/createInspectCommand.js';
+import { createScanCommand } from './commands/createScanCommand.js';
+import { createGlobalOptions } from './options/createGlobalOptions.js';
+export function createCli(options) {
+    const context = {
+        client: options.client,
+        io: options.io,
+        signal: options.signal,
+        setExitCode: options.setExitCode,
+    };
+    const program = createGlobalOptions(new Command()
+        .name('pkgwise')
+        .description('Explainable dependency analysis for JavaScript and TypeScript projects')
+        .version(options.version)
+        .showSuggestionAfterError()
+        .showHelpAfterError('(run pkgwise --help for usage)'));
+    program.addCommand(createScanCommand(context));
+    program.addCommand(createInspectCommand(context));
+    program.addCommand(createCompareCommand(context));
+    program.addCommand(createExplainCommand(context));
+    program.addCommand(createDoctorCommand(context));
+    program.addCommand(createCacheCommand(context));
+    configureCommandTree(program, options.io);
+    return program;
+}
+function configureCommandTree(command, io) {
+    command.configureOutput({
+        writeOut: (text) => io.stdout.write(text),
+        writeErr: (text) => io.stderr.write(text),
+    });
+    command.exitOverride();
+    for (const child of command.commands) {
+        configureCommandTree(child, io);
+    }
+}
+//# sourceMappingURL=createCli.js.map

package/dist/createCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCli.js","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAUvE,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,OAAO,GAAmB;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IAEF,MAAM,OAAO,GAAG,mBAAmB,CACjC,IAAI,OAAO,EAAE;SACV,IAAI,CAAC,SAAS,CAAC;SACf,WAAW,CAAC,wEAAwE,CAAC;SACrF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACxB,wBAAwB,EAAE;SAC1B,kBAAkB,CAAC,gCAAgC,CAAC,CACxD,CAAC;IAEF,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAE1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,EAAS;IACvD,OAAO,CAAC,eAAe,CAAC;QACtB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACzC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/exit/mapErrorToExitCode.d.ts

@@ -0,0 +1,2 @@
+export declare function mapErrorToExitCode(error: unknown): number;
+//# sourceMappingURL=mapErrorToExitCode.d.ts.map

package/dist/exit/mapErrorToExitCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapErrorToExitCode.d.ts","sourceRoot":"","sources":["../../src/exit/mapErrorToExitCode.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CA6BzD"}

package/dist/exit/mapErrorToExitCode.js

@@ -0,0 +1,31 @@
+import { PkgWiseError } from '@lovlydev/pkgwise-core';
+export function mapErrorToExitCode(error) {
+    if (!(error instanceof PkgWiseError)) {
+        return 5;
+    }
+    switch (error.code) {
+        case 'PW_CLI_INVALID_ARGUMENT':
+        case 'PW_CONFIG_INVALID':
+        case 'PW_CACHE_UNSAFE':
+        case 'PW_FINDING_NOT_FOUND':
+        case 'PW_FINDING_SELECTOR_AMBIGUOUS':
+        case 'PW_PACKAGE_NOT_FOUND':
+        case 'PW_PACKAGE_SELECTOR_AMBIGUOUS':
+        case 'PW_PACKAGE_SPEC_INVALID':
+            return 2;
+        case 'PW_PROJECT_NOT_FOUND':
+        case 'PW_PROJECT_AMBIGUOUS_MANAGER':
+        case 'PW_MANIFEST_PARSE_FAILED':
+        case 'PW_LOCKFILE_PARSE_FAILED':
+        case 'PW_LOCKFILE_VERSION_UNSUPPORTED':
+            return 3;
+        case 'PW_CANCELLED':
+            return 130;
+        case 'PW_PROVIDER_UNAVAILABLE':
+            return 4;
+        case 'PW_FEATURE_NOT_IMPLEMENTED':
+        case 'PW_INTERNAL_ERROR':
+            return 5;
+    }
+}
+//# sourceMappingURL=mapErrorToExitCode.js.map

package/dist/exit/mapErrorToExitCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapErrorToExitCode.js","sourceRoot":"","sources":["../../src/exit/mapErrorToExitCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,mBAAmB,CAAC;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,+BAA+B,CAAC;QACrC,KAAK,sBAAsB,CAAC;QAC5B,KAAK,+BAA+B,CAAC;QACrC,KAAK,yBAAyB;YAC5B,OAAO,CAAC,CAAC;QACX,KAAK,sBAAsB,CAAC;QAC5B,KAAK,8BAA8B,CAAC;QACpC,KAAK,0BAA0B,CAAC;QAChC,KAAK,0BAA0B,CAAC;QAChC,KAAK,iCAAiC;YACpC,OAAO,CAAC,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC;QACb,KAAK,yBAAyB;YAC5B,OAAO,CAAC,CAAC;QACX,KAAK,4BAA4B,CAAC;QAClC,KAAK,mBAAmB;YACtB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/exit/mapPolicyToExitCode.d.ts

@@ -0,0 +1,3 @@
+import type { PolicyDecisionSummary } from '@lovlydev/pkgwise-core';
+export declare function mapPolicyToExitCode(policy: PolicyDecisionSummary): number;
+//# sourceMappingURL=mapPolicyToExitCode.d.ts.map

package/dist/exit/mapPolicyToExitCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapPolicyToExitCode.d.ts","sourceRoot":"","sources":["../../src/exit/mapPolicyToExitCode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAEzE"}

package/dist/exit/mapPolicyToExitCode.js

@@ -0,0 +1,4 @@
+export function mapPolicyToExitCode(policy) {
+    return policy.status === 'failed' ? 1 : 0;
+}
+//# sourceMappingURL=mapPolicyToExitCode.js.map

package/dist/exit/mapPolicyToExitCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapPolicyToExitCode.js","sourceRoot":"","sources":["../../src/exit/mapPolicyToExitCode.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createCli, type CreateCliOptions } from './createCli.js';
+export { runCli, type RunCliOptions } from './runCli.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createCli } from './createCli.js';
+export { runCli } from './runCli.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAsB,MAAM,aAAa,CAAC"}