proof-of-commitment 1.12.0 → 1.13.0

package/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * proof-of-commitment CLI v1.12.0
+ * proof-of-commitment CLI v1.13.0
  * Scores npm/PyPI/Cargo/Go packages on behavioral commitment signals.
  * Usage: npx proof-of-commitment [packages...] [options]
  */
@@ -180,10 +180,23 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
 
   // Footer with web link + CI integration CTA
   const topPkgs = results.slice(0, 10).map(r => r.name).join(',');
-  console.log(clr(c.cyan, `\n  🔗 Full report: ${WEB}?packages=${encodeURIComponent(topPkgs)}`));
+  const utm = 'utm_source=cli&utm_medium=audit';
+  console.log(clr(c.cyan, `\n  🔗 Full report: ${WEB}?packages=${encodeURIComponent(topPkgs)}&${utm}`));
   console.log(clr(c.cyan, `  🤖 GitHub Action: github.com/piiiico/commit-action — block CRITICAL packages in CI`));
   console.log(clr(c.dim, `  📋 Add to this project: `) + clr(c.cyan, `poc init`) + clr(c.dim, ` — creates workflow + README badge`));
 
+  // Per-package profile URLs — drive traffic to permanent, indexable pages
+  const ecoPath = { npm: 'npm', pypi: 'pypi', cargo: 'cargo', golang: 'go' };
+  const profilePkgs = results.slice(0, 5).filter(r => r.name && ecoPath[r.ecosystem || 'npm']);
+  if (profilePkgs.length > 0) {
+    console.log(clr(c.dim, `\n  📄 Package profiles:`));
+    for (const r of profilePkgs) {
+      const eco = ecoPath[r.ecosystem || 'npm'];
+      const name = encodeURIComponent(r.name).replace(/%40/g, '@').replace(/%2F/g, '/');
+      console.log(clr(c.dim, `     getcommit.dev/${eco}/${name}`));
+    }
+  }
+
   // Contextual upsell — show when findings make monitoring relevant
   if (effectiveCritical > 0) {
     // Check for API key synchronously via env (fast path)
@@ -193,16 +206,85 @@ function printTable(results, { totalScanned, totalCritical, lockfile } = {}) {
         clr(c.cyan, `poc watch ${results.find(r => hasCritical(r.riskFlags))?.name || results[0]?.name}`));
     } else {
       console.log(clr(c.dim, `\n  📊 Monitor ${effectiveCritical === 1 ? 'this' : 'these ' + effectiveCritical} CRITICAL ${effectiveCritical === 1 ? 'package' : 'packages'} — get alerted when scores change.`));
-      console.log(clr(c.dim, '     Get a free API key: ') + clr(c.cyan, 'https://getcommit.dev/get-started'));
+      console.log(clr(c.dim, '     Get a free API key: ') + clr(c.cyan, 'https://getcommit.dev/get-started?utm_source=cli'));
       console.log(clr(c.dim, '     Then run: ') + clr(c.cyan, 'poc login'));
     }
   }
   console.log();
 }
 
+/**
+ * Inline signup: after CRITICAL findings, offer one-step email→key flow.
+ * Collapses 6-step funnel (visit site → email → check inbox → copy key → login → watch)
+ * into a single CLI prompt.
+ */
+async function inlineSignup(results) {
+  // Only prompt in interactive TTY when CRITICAL packages found and no key saved
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return;
+  const hasKey = !!process.env.COMMIT_API_KEY || _cachedHasKey;
+  if (hasKey) return;
+  const critPkgs = results.filter(r => hasCritical(r.riskFlags));
+  if (critPkgs.length === 0) return;
+
+  console.log(clr(c.dim, '  ─────────────────────────────────────────────'));
+  console.log(clr(c.bold, '  🔔 Get alerts when these scores change?'));
+  console.log(clr(c.dim, '     Free API key — no credit card, 10 seconds.\n'));
+
+  const { createInterface } = await import('readline');
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+
+  const email = await new Promise(resolve => {
+    rl.question(clr(c.dim, '  Your email (Enter to skip): '), answer => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+
+  if (!email) return;
+
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    console.log(clr(c.red, '  Invalid email. Skipped.'));
+    return;
+  }
+
+  process.stdout.write(clr(c.dim, '  Creating key...'));
+
+  try {
+    const res = await fetch('https://poc-backend.amdal-dev.workers.dev/api/keys/create', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, source: 'cli' }),
+    });
+
+    const data = await res.json();
+
+    if (data.key) {
+      await writeApiKey(data.key);
+      _cachedHasKey = true;
+      console.log(clr(c.green, ' ✓ Saved to ~/.commit/config'));
+      console.log(clr(c.dim, `     Backup sent to ${email}`));
+      console.log();
+      console.log(clr(c.bold, '  Next steps:'));
+      console.log(clr(c.dim, '    • ') + clr(c.cyan, 'poc status') + clr(c.dim, '       — check your account'));
+      if (critPkgs.length > 0) {
+        console.log(clr(c.dim, '    • ') + clr(c.cyan, `poc watch ${critPkgs[0].name}`) + clr(c.dim, '  — start monitoring (Pro)'));
+      }
+      console.log(clr(c.dim, '    • ') + clr(c.cyan, 'poc init') + clr(c.dim, '          — add CI gate to this project'));
+    } else if (data.message) {
+      console.log(clr(c.green, ` ✓ ${data.message}`));
+    } else {
+      console.log(clr(c.red, ` Failed: ${JSON.stringify(data)}`));
+    }
+  } catch (err) {
+    console.log(clr(c.red, ` Error: ${err.message}`));
+  }
+
+  console.log();
+}
+
 function printHelp() {
   console.log(`
-${clr(c.bold, 'proof-of-commitment')} v1.12.0 — supply chain risk scorer
+${clr(c.bold, 'proof-of-commitment')} v1.13.0 — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
   npx proof-of-commitment                            Auto-detect manifest in current dir
@@ -785,7 +867,7 @@ async function cmdLogin(keyArg) {
     console.log(clr(c.dim, '    poc watchlist          View monitored packages'));
     console.log(clr(c.dim, '    poc unwatch <package>  Remove from monitoring'));
   } else {
-    console.log(clr(c.dim, '  Upgrade to Pro for monitoring + alerts: https://getcommit.dev/pricing'));
+    console.log(clr(c.dim, '  Upgrade to Pro for monitoring + alerts: https://getcommit.dev/pricing?utm_source=cli'));
   }
   console.log();
 }
@@ -864,7 +946,7 @@ async function cmdWatch(pkg, ecosystem) {
   const key = await readApiKey();
   if (!key) {
     console.error(clr(c.red, 'No API key found. Set COMMIT_API_KEY or add api_key=<key> to ~/.commit/config'));
-    console.error(clr(c.dim, 'Get a key at https://getcommit.dev/pricing'));
+    console.error(clr(c.dim, 'Get a key at https://getcommit.dev/pricing?utm_source=cli'));
     process.exit(1);
   }
 
@@ -1129,7 +1211,7 @@ ${rows}
 <div class="footer">
   <span>Generated by <a href="${WEB}" target="_blank">proof-of-commitment</a></span>
   <span><a href="https://github.com/piiiico/commit-action" target="_blank">GitHub Action</a></span>
-  <span><a href="https://getcommit.dev/pricing" target="_blank">Commit Pro</a></span>
+  <span><a href="https://getcommit.dev/pricing?utm_source=cli&amp;utm_medium=report" target="_blank">Commit Pro</a></span>
 </div>
 <script>
 function copyMd() {
@@ -1385,7 +1467,7 @@ jobs:
     console.log(clr(c.white, '  2. Push to trigger the existing workflow'));
   }
   console.log(clr(c.dim, `\n  Want daily monitoring + alerts? Get a free key:`));
-  console.log(clr(c.cyan, '  https://getcommit.dev/get-started'));
+  console.log(clr(c.cyan, '  https://getcommit.dev/get-started?utm_source=cli'));
   console.log(clr(c.dim, '  Then run: ') + clr(c.cyan, 'poc login') + clr(c.dim, ' + ') + clr(c.cyan, 'poc watch <package>\n'));
 }
 
@@ -1654,6 +1736,7 @@ async function main() {
     const displayed = allResults.slice(0, MAX_DISPLAY);
     const criticalTotal = allResults.filter(r => hasCritical(r.riskFlags)).length;
     printTable(displayed, { totalScanned: allResults.length, totalCritical: criticalTotal, lockfile: true });
+    await inlineSignup(displayed);
     if (shouldFail(allResults, failOn)) {
       console.error(clr(c.red + c.bold, `\n✗ --fail-on=${failOn} threshold met. Exit 1.`));
       process.exit(1);
@@ -1684,6 +1767,7 @@ async function main() {
   }
 
   printTable(allResults);
+  await inlineSignup(allResults);
   if (shouldFail(allResults, failOn)) {
     console.error(clr(c.red + c.bold, `✗ --fail-on=${failOn} threshold met. Exit 1.`));
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",
   "bin": {