preship 2.0.0 → 2.0.2

package/dist/cli.js

@@ -497,35 +497,82 @@ function formatPolicyResultsIndented(results, lines, colorFn) {
   }
 }
 function formatSecurityFindings(findings, lines, heading) {
+  const MAX_FINDINGS = 15;
+  const sorted = [...findings].sort((a, b) => severityRank(a.severity) - severityRank(b.severity));
   lines.push(import_chalk.default.dim(`   ${heading}:`));
-  for (let i = 0; i < findings.length; i++) {
-    const f = findings[i];
-    const isLast = i === findings.length - 1;
+  const showCount = Math.min(sorted.length, MAX_FINDINGS);
+  for (let i = 0; i < showCount; i++) {
+    const f = sorted[i];
+    const isLast = i === showCount - 1 && sorted.length <= MAX_FINDINGS;
     const prefix = isLast ? "      \u2514\u2500\u2500 " : "      \u251C\u2500\u2500 ";
     const severityColor = getSeverityColor(f.severity);
     const severityBadge = severityColor(`[${f.severity.toUpperCase()}]`);
     lines.push(`${prefix}${severityBadge} ${f.package}@${f.version}`);
     lines.push(import_chalk.default.dim(`${isLast ? "          " : "      \u2502   "}${f.message}`));
   }
+  if (sorted.length > MAX_FINDINGS) {
+    const remaining = sorted.length - MAX_FINDINGS;
+    lines.push(import_chalk.default.dim(`      \u2514\u2500\u2500 ... and ${remaining} more ${heading.toLowerCase()}`));
+    lines.push(import_chalk.default.dim("          Run with --format json for full details"));
+  }
 }
 function formatSecretFindings(findings, lines) {
+  const MAX_FINDINGS_PER_FILE = 5;
+  const MAX_FILES = 10;
   const byFile = /* @__PURE__ */ new Map();
   for (const f of findings) {
     const existing = byFile.get(f.file) || [];
     existing.push(f);
     byFile.set(f.file, existing);
   }
-  for (const [file, fileFindings] of byFile) {
+  const sortedFiles = [...byFile.entries()].sort((a, b) => {
+    const aSeverity = Math.min(...a[1].map((f) => severityRank(f.severity)));
+    const bSeverity = Math.min(...b[1].map((f) => severityRank(f.severity)));
+    return aSeverity - bSeverity;
+  });
+  let filesShown = 0;
+  let totalHidden = 0;
+  for (const [file, fileFindings] of sortedFiles) {
+    if (filesShown >= MAX_FILES) {
+      totalHidden += fileFindings.length;
+      continue;
+    }
+    filesShown++;
     lines.push(import_chalk.default.dim(`   ${file}:`));
-    for (let i = 0; i < fileFindings.length; i++) {
+    const showCount = Math.min(fileFindings.length, MAX_FINDINGS_PER_FILE);
+    for (let i = 0; i < showCount; i++) {
       const f = fileFindings[i];
-      const isLast = i === fileFindings.length - 1;
+      const isLast = i === showCount - 1 && fileFindings.length <= MAX_FINDINGS_PER_FILE;
       const prefix = isLast ? "      \u2514\u2500\u2500 " : "      \u251C\u2500\u2500 ";
       const severityColor = getSeverityColor(f.severity);
       const severityBadge = severityColor(`[${f.severity.toUpperCase()}]`);
       lines.push(`${prefix}${severityBadge} Line ${f.line}: ${f.description}`);
       lines.push(import_chalk.default.dim(`${isLast ? "          " : "      \u2502   "}Match: ${f.match}`));
     }
+    if (fileFindings.length > MAX_FINDINGS_PER_FILE) {
+      const remaining = fileFindings.length - MAX_FINDINGS_PER_FILE;
+      lines.push(import_chalk.default.dim(`      \u2514\u2500\u2500 ... and ${remaining} more finding${remaining > 1 ? "s" : ""} in this file`));
+    }
+  }
+  if (totalHidden > 0) {
+    const hiddenFiles = sortedFiles.length - MAX_FILES;
+    lines.push("");
+    lines.push(import_chalk.default.dim(`   ... and ${totalHidden} more finding${totalHidden > 1 ? "s" : ""} in ${hiddenFiles} more file${hiddenFiles > 1 ? "s" : ""}`));
+    lines.push(import_chalk.default.dim("   Run with --format json for full details"));
+  }
+}
+function severityRank(severity) {
+  switch (severity) {
+    case "critical":
+      return 0;
+    case "high":
+      return 1;
+    case "medium":
+      return 2;
+    case "low":
+      return 3;
+    default:
+      return 4;
   }
 }
 function getSeverityColor(severity) {
@@ -723,7 +770,7 @@ function escapeCsv(value) {
 
 // src/commands/scan.ts
 function registerScanCommand(program2) {
-  program2.command("scan").description("Scan the current project for license, security, and secret issues").option("--format <type>", "Output format: table, json, csv", "table").option("--strict", "Exit code 1 on warnings too (not just rejections)").option("--dev", "Include devDependencies in scan").option("--project <path>", "Path to project root", process.cwd()).option("--config <path>", "Path to config file").option("--warn-only", "Never exit with error (for postinstall hook usage)").option("--silent", "No output, only exit code").option("--mode <type>", "Resolution mode: auto (online+local fallback), online (registry only), local (offline only)", "auto").option("--no-cache", "Disable license cache (.preship-cache.json)").option("--cache-ttl <seconds>", "Cache TTL in seconds (default: 604800 = 7 days)", parseInt).option("--scan-timeout <ms>", "Total scan timeout in milliseconds (default: 60000, 0 = disabled)", parseInt).option("--license-only", "Run license scan only (legacy mode)").option("--no-license", "Disable license scanning").option("--no-security", "Disable security vulnerability scanning").option("--no-secrets", "Disable secret detection scanning").option("--security-severity <level>", "Security policy level: default, strict, lenient").option("--security-fail-on <severity>", "Minimum severity to fail: critical, high, medium, low").action(async (options) => {
+  program2.command("scan").description("Scan the current project for license, security, and secret issues").option("--format <type>", "Output format: table, json, csv", "table").option("--strict", "Exit code 1 on warnings too (not just rejections)").option("--dev", "Include devDependencies in scan").option("--project <path>", "Path to project root", process.cwd()).option("--config <path>", "Path to config file").option("--warn-only", "Never exit with error (for postinstall hook usage)").option("--silent", "No output, only exit code").option("--mode <type>", "Resolution mode: auto (online+local fallback), online (registry only), local (offline only)", "auto").option("--no-cache", "Disable license cache (.preship-cache.json)").option("--cache-ttl <seconds>", "Cache TTL in seconds (default: 604800 = 7 days)", parseInt).option("--scan-timeout <ms>", "Total scan timeout in milliseconds (default: 60000, 0 = disabled)", parseInt).option("--license-only", "Run license scan only (legacy mode)").option("--no-license", "Disable license scanning").option("--no-security", "Disable security vulnerability scanning").option("--no-secrets", "Disable secret detection scanning").option("--security-severity <level>", "Security policy level: default, strict, lenient").option("--security-fail-on <severity>", "Minimum severity to fail: critical, high, medium, low").option("--no-outdated", "Disable outdated package checks").option("--no-deprecated", "Disable deprecated package checks").option("--no-unmaintained", "Disable unmaintained package checks").action(async (options) => {
     try {
       if (options.licenseOnly) {
         const result2 = await scan({
@@ -781,7 +828,10 @@ function registerScanCommand(program2) {
           // Security config from CLI flags
           security: {
             severity: options.securitySeverity || void 0,
-            failOn: options.securityFailOn || void 0
+            failOn: options.securityFailOn || void 0,
+            checkOutdated: options.outdated !== void 0 ? options.outdated : void 0,
+            checkDeprecated: options.deprecated !== void 0 ? options.deprecated : void 0,
+            checkUnmaintained: options.unmaintained !== void 0 ? options.unmaintained : void 0
           }
         }
       });
@@ -911,8 +961,8 @@ policy: ${policy}
 #   checkOutdated: true      # Flag outdated packages
 #   checkDeprecated: true    # Flag deprecated packages
 #   checkUnmaintained: true  # Flag unmaintained packages
-#   outdatedMajorThreshold: 3  # Major versions behind to flag
-#   unmaintainedYears: 2       # Years without publish to flag
+#   outdatedMajorThreshold: 5  # Major versions behind to flag (direct deps only)
+#   unmaintainedYears: 4       # Years without publish to flag
 
 # ===== Secret Detection =====
 # secrets:
@@ -3864,7 +3914,7 @@ function registerAllowCommand(program2) {
 
 // src/cli.ts
 var program = new import_commander.Command();
-program.name("preship").description("Pre-ship verification: license compliance, security scanning, and secret detection \u2014 all before you ship.").version("2.0.0");
+program.name("preship").description("Pre-ship verification: license compliance, security scanning, and secret detection \u2014 all before you ship.").version("2.0.2");
 registerScanCommand(program);
 registerInitCommand(program);
 registerListCommand(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "preship",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Pre-ship verification for modern dev teams. License compliance, security vulnerability scanning, and secret detection — all in one CLI. Zero config. Fully offline. Free forever.",
   "keywords": [
     "license",
@@ -55,10 +55,10 @@
     "lint": "tsc --noEmit"
   },
   "dependencies": {
-    "@preship/core": "2.0.0",
+    "@preship/core": "2.0.1",
     "@preship/license": "2.0.0",
-    "@preship/security": "1.0.0",
-    "@preship/secrets": "1.0.0",
+    "@preship/security": "1.0.1",
+    "@preship/secrets": "1.0.2",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.5",
     "commander": "^12.1.0"