shipproof 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CalvaryBloom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.es.md

@@ -0,0 +1,107 @@
+<p align="center">
+  <img src="docs/shipproof.svg" alt="ShipProof — comprueba antes de publicar" width="620">
+</p>
+
+<p align="center">
+  Comprobaciones sin configuración para saber si un proyecto creado con ayuda de IA está listo para publicarse.
+</p>
+
+<p align="center">
+  <a href="README.md">English</a> · Español
+</p>
+
+ShipProof da a tu proyecto una puntuación clara y explica qué debes corregir antes de hacerlo público. Funciona localmente, ofrece resultados deterministas y busca esos detalles poco vistosos que suelen quedar pendientes en el código generado con IA.
+
+<p align="center">
+  <img src="docs/demo.svg" alt="Terminal de ShipProof mostrando una puntuación de preparación de 92 sobre 100" width="860">
+</p>
+
+## ¿Por qué ShipProof?
+
+La IA puede generar una aplicación convincente en pocos minutos. Eso no significa que esté lista para usuarios o colaboradores: las pruebas pueden ser simuladas, puede haber credenciales en un archivo de entorno, las instalaciones quizá no sean reproducibles y el repositorio puede carecer de licencia o política de seguridad.
+
+ShipProof convierte esa revisión final imprecisa en un comando repetible:
+
+```bash
+npx shipproof
+```
+
+Actualmente reconoce proyectos Node.js, Python, Rust y Go. Nunca ejecuta comandos del proyecto inspeccionado ni sube su código fuente.
+
+## Qué comprueba
+
+| Área | Ejemplos |
+| --- | --- |
+| Proyecto | Manifiestos reconocidos y metadatos válidos |
+| Calidad | Comandos de pruebas, lint, tipos y compilación |
+| Reproducibilidad | Archivos de bloqueo y dependencias fijadas |
+| Seguridad | Nombres de archivo sensibles y patrones conservadores de credenciales |
+| Documentación | README, licencia e instrucciones para colaborar |
+| Automatización | Flujos de GitHub Actions |
+| Comunidad | Normas de conducta, contribución y seguridad |
+
+El resultado indica dónde está el posible problema sin mostrar el valor de una credencial. ShipProof es una comprobación previa, no sustituye a un escáner de seguridad especializado ni a la revisión humana.
+
+## Uso
+
+Requiere Node.js 22.13 o posterior.
+
+```bash
+# Analizar el directorio actual
+npx shipproof
+
+# Analizar otro directorio
+npx shipproof ./mi-proyecto
+
+# Generar un informe JSON
+npx shipproof --json
+
+# Informar sin devolver un código de error
+npx shipproof --no-fail
+```
+
+Por defecto, ShipProof termina con código `1` si encuentra al menos un problema bloqueante y con código `2` cuando la entrada no es válida. Los avisos reducen la puntuación, pero no cambian el código de salida.
+
+## Puntuación
+
+Cada comprobación aplicable tiene un peso explícito. Un resultado correcto obtiene todo el peso, un aviso obtiene la mitad y un fallo no obtiene puntos.
+
+| Puntuación | Significado |
+| ---: | --- |
+| 90–100 | Listo para publicar |
+| 75–89 | Casi listo |
+| 50–74 | Necesita trabajo |
+| 0–49 | No está listo |
+
+La puntuación es explicable, pero no garantiza que el software sea correcto o seguro.
+
+## Desarrollo local
+
+```bash
+git clone https://github.com/CalvaryBloom/shipproof.git
+cd shipproof
+pnpm install
+pnpm test
+node dist/src/cli.js . --no-fail
+```
+
+ShipProof no tiene dependencias en tiempo de ejecución. TypeScript y las declaraciones de Node.js solo se usan durante el desarrollo.
+
+## Próximos objetivos
+
+- Acción de GitHub con un resumen compacto para cada pull request.
+- Umbrales configurables mediante `shipproof.config.json`.
+- Comprobaciones más profundas para Python, Rust y Go.
+- Salida SARIF compatible con el análisis de código de GitHub.
+- Catálogo público de comprobaciones y falsos positivos conocidos.
+- Publicación automatizada y con procedencia verificable para las próximas versiones.
+
+## Colaborar
+
+Las contribuciones son bienvenidas. Lee [CONTRIBUTING.md](CONTRIBUTING.md) antes de proponer una nueva comprobación. Los cambios deben ser deterministas, locales, seguros y transparentes acerca de sus posibles falsos positivos.
+
+Comunica cualquier vulnerabilidad mediante el [sistema privado de GitHub](https://github.com/CalvaryBloom/shipproof/security/advisories/new), nunca en una incidencia pública.
+
+## Licencia
+
+[MIT](LICENSE) © 2026 CalvaryBloom

package/README.md

@@ -0,0 +1,128 @@
+<p align="center">
+  <img src="docs/shipproof.svg" alt="ShipProof — know before you ship" width="620">
+</p>
+
+<p align="center">
+  Zero-config release readiness checks for AI-assisted projects.
+</p>
+
+<p align="center">
+  <a href="https://github.com/CalvaryBloom/shipproof/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/CalvaryBloom/shipproof/actions/workflows/ci.yml/badge.svg"></a>
+  <a href="LICENSE"><img alt="MIT License" src="https://img.shields.io/badge/license-MIT-22c55e"></a>
+  <img alt="Node 22.13+" src="https://img.shields.io/badge/node-%3E%3D22.13-339933">
+</p>
+
+<p align="center">
+  English · <a href="README.es.md">Español</a>
+</p>
+
+ShipProof gives a project one clear readiness score and explains what to fix before it becomes public. It is fast, local, deterministic, and designed to catch the unglamorous gaps that AI-generated code often leaves behind.
+
+<p align="center">
+  <img src="docs/demo.svg" alt="ShipProof terminal output showing a 92 out of 100 readiness score" width="860">
+</p>
+
+## Why ShipProof?
+
+AI can create a convincing application in minutes. That does not mean the result is ready for users or contributors. Tests may be placeholders, credentials may be sitting in an environment file, builds may not be reproducible, and the repository may have no license or security policy.
+
+ShipProof turns that vague final review into a repeatable command:
+
+```bash
+npx shipproof
+```
+
+It currently recognizes Node.js, Python, Rust, and Go projects. It never executes commands from the project being inspected and never uploads source code.
+
+## What it checks
+
+| Area | Examples |
+| --- | --- |
+| Project | Recognized manifests and valid package metadata |
+| Quality | Test, lint, type-check, and build commands |
+| Reproducibility | Lockfiles and pinned dependency manifests |
+| Security | Sensitive filenames and conservative credential patterns |
+| Documentation | README depth, license, and contribution guidance |
+| Automation | GitHub Actions workflows |
+| Community | Conduct, contribution, and security policies |
+
+The output includes suggestions rather than exposing any matched secret value. ShipProof is a preflight assistant, not a replacement for dedicated security scanners or human review.
+
+## Usage
+
+Requires Node.js 22.13 or newer.
+
+```bash
+# Inspect the current directory
+npx shipproof
+
+# Inspect another directory
+npx shipproof ./my-project
+
+# Produce machine-readable output
+npx shipproof --json
+
+# Report findings without a failing exit code
+npx shipproof --no-fail
+```
+
+### Options
+
+```text
+shipproof [path] [options]
+
+--json       Print machine-readable JSON
+--no-color   Disable ANSI colors
+--no-fail    Exit with code 0 even when blocking issues are found
+-h, --help   Show help
+-v, --version
+             Show the version
+```
+
+By default, ShipProof exits with code `1` when at least one blocking issue is found and `2` for invalid input. This makes it useful in continuous integration. Warnings lower the score but do not change the exit code.
+
+## Scoring
+
+Each applicable check has an explicit weight. Passing earns the full weight, a warning earns half, and a failure earns none.
+
+| Score | Meaning |
+| ---: | --- |
+| 90–100 | Ready to ship |
+| 75–89 | Almost ready |
+| 50–74 | Needs work |
+| 0–49 | Not ready |
+
+The score is intentionally explainable. It is not a promise that software is correct or secure.
+
+## Local development
+
+```bash
+git clone https://github.com/CalvaryBloom/shipproof.git
+cd shipproof
+pnpm install
+pnpm test
+node dist/src/cli.js . --no-fail
+```
+
+ShipProof has no runtime dependencies. TypeScript and its Node.js declarations are development-only dependencies.
+
+## Roadmap
+
+- GitHub Action with a compact pull-request summary.
+- Configurable thresholds through `shipproof.config.json`.
+- Deeper Python, Rust, and Go checks.
+- SARIF output for GitHub code scanning.
+- A public check catalog with evidence and false-positive guidance.
+- Automated trusted publishing with provenance for future releases.
+
+The best roadmap item is the one backed by a real repository and a reproducible failure. Please use the feature request template to share one.
+
+## Contributing
+
+Contributions are welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) before proposing a check. New checks should remain deterministic, local, safe, and clear about false positives.
+
+Please report vulnerabilities through [private vulnerability reporting](https://github.com/CalvaryBloom/shipproof/security/advisories/new), not a public issue.
+
+## License
+
+[MIT](LICENSE) © 2026 CalvaryBloom

package/dist/src/analyze.d.ts

@@ -0,0 +1,4 @@
+import type { AnalysisResult } from "./types.js";
+export declare const SHIPPROOF_VERSION = "0.1.0";
+export declare function analyzeProject(target: string): AnalysisResult;
+//# sourceMappingURL=analyze.d.ts.map

package/dist/src/analyze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../src/analyze.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAA0B,MAAM,YAAY,CAAC;AAEzE,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAgBzC,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CA2B7D"}

package/dist/src/analyze.js

@@ -0,0 +1,43 @@
+import { resolve } from "node:path";
+import { runReadinessChecks } from "./checks/readiness.js";
+export const SHIPPROOF_VERSION = "0.1.0";
+const scoreFactors = {
+    pass: 1,
+    warn: 0.5,
+    fail: 0,
+    info: 1,
+};
+function readinessFor(score) {
+    if (score >= 90)
+        return "ready";
+    if (score >= 75)
+        return "close";
+    if (score >= 50)
+        return "work-needed";
+    return "not-ready";
+}
+export function analyzeProject(target) {
+    const startedAt = Date.now();
+    const root = resolve(target);
+    const { project, checks } = runReadinessChecks(root);
+    const scorable = checks.filter((check) => check.weight > 0);
+    const totalWeight = scorable.reduce((total, check) => total + check.weight, 0);
+    const earnedWeight = scorable.reduce((total, check) => total + check.weight * scoreFactors[check.status], 0);
+    const score = totalWeight === 0 ? 0 : Math.round((earnedWeight / totalWeight) * 100);
+    return {
+        version: SHIPPROOF_VERSION,
+        analyzedAt: new Date().toISOString(),
+        durationMs: Date.now() - startedAt,
+        project,
+        score,
+        readiness: readinessFor(score),
+        summary: {
+            passed: checks.filter((check) => check.status === "pass").length,
+            warnings: checks.filter((check) => check.status === "warn").length,
+            failed: checks.filter((check) => check.status === "fail").length,
+            informational: checks.filter((check) => check.status === "info").length,
+        },
+        checks,
+    };
+}
+//# sourceMappingURL=analyze.js.map

package/dist/src/analyze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../../src/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,MAAM,YAAY,GAAgC;IAChD,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,aAAa,CAAC;IACtC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EACnE,CAAC,CACF,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC;IAErF,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,OAAO;QACP,KAAK;QACL,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC;QAC9B,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;YAChE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;YAClE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;YAChE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;SACxE;QACD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/src/checks/readiness.d.ts

@@ -0,0 +1,8 @@
+import type { CheckResult, ProjectInfo } from "../types.js";
+interface ReadinessChecks {
+    project: ProjectInfo;
+    checks: CheckResult[];
+}
+export declare function runReadinessChecks(root: string): ReadinessChecks;
+export {};
+//# sourceMappingURL=readiness.d.ts.map

package/dist/src/checks/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../src/checks/readiness.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW5D,UAAU,eAAe;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AA+ID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CA6HhE"}

package/dist/src/checks/readiness.js

@@ -0,0 +1,147 @@
+import { basename, join } from "node:path";
+import { listFiles, pathExists, readJson, readUtf8 } from "../files.js";
+import { findPotentialSecrets } from "./secrets.js";
+function result(id, title, status, message, weight, suggestion) {
+    return suggestion === undefined
+        ? { id, title, status, message, weight }
+        : { id, title, status, message, weight, suggestion };
+}
+function findRootFile(files, names) {
+    const wanted = new Set(names.map((name) => name.toLowerCase()));
+    return files.find((file) => !file.includes("/") && wanted.has(file.toLowerCase()));
+}
+function detectEcosystems(root) {
+    const ecosystems = [];
+    if (pathExists(root, "package.json"))
+        ecosystems.push("Node.js");
+    if (pathExists(root, "pyproject.toml") ||
+        pathExists(root, "requirements.txt") ||
+        pathExists(root, "Pipfile")) {
+        ecosystems.push("Python");
+    }
+    if (pathExists(root, "Cargo.toml"))
+        ecosystems.push("Rust");
+    if (pathExists(root, "go.mod"))
+        ecosystems.push("Go");
+    return ecosystems;
+}
+function hasUsefulScript(scripts, names) {
+    if (!scripts)
+        return false;
+    return names.some((name) => {
+        const command = scripts[name]?.trim();
+        return command !== undefined && command.length > 0 && !/no tests?|not implemented/i.test(command);
+    });
+}
+function lockfileCheck(root, ecosystems) {
+    const expected = new Map([
+        ["Node.js", ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lock", "bun.lockb"]],
+        ["Python", ["uv.lock", "poetry.lock", "Pipfile.lock", "requirements.txt"]],
+        ["Rust", ["Cargo.lock"]],
+        ["Go", ["go.sum"]],
+    ]);
+    if (ecosystems.length === 0) {
+        return result("lockfile", "Reproducible dependencies", "info", "No supported dependency ecosystem was detected.", 0);
+    }
+    const missing = ecosystems.filter((ecosystem) => {
+        const candidates = expected.get(ecosystem) ?? [];
+        return !candidates.some((file) => pathExists(root, file));
+    });
+    if (missing.length === 0) {
+        return result("lockfile", "Reproducible dependencies", "pass", "A dependency lock or pinned manifest is present.", 8);
+    }
+    return result("lockfile", "Reproducible dependencies", "warn", `Missing reproducibility files for: ${missing.join(", ")}.`, 8, "Commit the lockfile produced by your package manager.");
+}
+function scriptChecks(root, ecosystems, packageJson) {
+    if (!ecosystems.includes("Node.js")) {
+        if (ecosystems.includes("Rust") || ecosystems.includes("Go")) {
+            return [
+                result("test-command", "Test command", "pass", "The ecosystem provides a conventional test command.", 8),
+                result("quality-command", "Quality command", "pass", "The ecosystem provides conventional formatting and analysis commands.", 7),
+            ];
+        }
+        if (ecosystems.includes("Python")) {
+            const pyproject = readUtf8(join(root, "pyproject.toml")) ?? "";
+            const hasTest = /pytest|unittest/i.test(pyproject) || pathExists(root, "tests") || pathExists(root, "test");
+            const hasQuality = /ruff|mypy|pyright|flake8|black/i.test(pyproject);
+            return [
+                result("test-command", "Test setup", hasTest ? "pass" : "warn", hasTest ? "A Python test setup was detected." : "No Python test setup was detected.", 8, hasTest ? undefined : "Add a tests/ directory and configure pytest or unittest."),
+                result("quality-command", "Quality setup", hasQuality ? "pass" : "warn", hasQuality ? "A Python quality tool was detected." : "No Python formatter, linter, or type checker was detected.", 7, hasQuality ? undefined : "Configure a tool such as Ruff, mypy, or Pyright."),
+            ];
+        }
+        return [result("commands", "Project commands", "info", "Command checks are not available for this project type yet.", 0)];
+    }
+    const scripts = packageJson?.scripts;
+    const test = hasUsefulScript(scripts, ["test"]);
+    const quality = hasUsefulScript(scripts, ["lint", "check", "typecheck", "type-check"]);
+    const build = hasUsefulScript(scripts, ["build"]);
+    return [
+        result("test-command", "Test command", test ? "pass" : "fail", test ? "package.json defines a usable test script." : "package.json has no usable test script.", 8, test ? undefined : "Add a test script that runs your automated test suite."),
+        result("quality-command", "Quality command", quality ? "pass" : "warn", quality ? "A lint, check, or type-check script is available." : "No lint, check, or type-check script is available.", 7, quality ? undefined : "Add a lint or type-check script so contributors can verify changes."),
+        result("build-command", "Build command", build ? "pass" : "warn", build ? "package.json defines a build script." : "package.json has no build script.", 5, build ? undefined : "Add a build script when the project produces compiled output."),
+    ];
+}
+export function runReadinessChecks(root) {
+    const files = listFiles(root);
+    const ecosystems = detectEcosystems(root);
+    const packagePath = join(root, "package.json");
+    const hasPackageJson = pathExists(root, "package.json");
+    const packageJson = hasPackageJson ? readJson(packagePath) : undefined;
+    const project = {
+        name: packageJson?.name ?? basename(root),
+        path: root,
+        ecosystems,
+    };
+    const checks = [];
+    checks.push(ecosystems.length > 0
+        ? result("project-detected", "Project detected", "pass", `Detected: ${ecosystems.join(", ")}.`, 8)
+        : result("project-detected", "Project detected", "fail", "No supported project manifest was found.", 8, "Add package.json, pyproject.toml, Cargo.toml, or go.mod."));
+    if (hasPackageJson && packageJson === undefined) {
+        checks.push(result("package-json", "Valid package.json", "fail", "package.json could not be parsed as JSON.", 8, "Fix the JSON syntax before publishing."));
+    }
+    const readme = findRootFile(files, ["README.md", "README.mdx", "README.rst"]);
+    const readmeContent = readme ? readUtf8(join(root, readme)) ?? "" : "";
+    checks.push(!readme
+        ? result("readme", "README", "fail", "No root README was found.", 10, "Explain the problem, installation, usage, and contribution path.")
+        : readmeContent.trim().length < 400
+            ? result("readme", "README", "warn", `${readme} exists but is very short.`, 10, "Add installation, examples, limitations, and a roadmap.")
+            : result("readme", "README", "pass", `${readme} gives the project a useful front page.`, 10));
+    const license = findRootFile(files, ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING"]);
+    checks.push(license
+        ? result("license", "License", "pass", `${license} is present.`, 7)
+        : result("license", "License", "fail", "No license file was found.", 7, "Choose an open-source license and add it at the repository root."));
+    checks.push(pathExists(root, ".gitignore")
+        ? result("gitignore", ".gitignore", "pass", "Generated files can be kept out of version control.", 5)
+        : result("gitignore", ".gitignore", "warn", "No .gitignore file was found.", 5, "Add ignores for dependencies, builds, secrets, and editor files."));
+    checks.push(lockfileCheck(root, ecosystems));
+    checks.push(...scriptChecks(root, ecosystems, packageJson));
+    const workflows = files.filter((file) => /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(file));
+    checks.push(workflows.length > 0
+        ? result("ci", "Continuous integration", "pass", `Found ${workflows.length} GitHub Actions workflow${workflows.length === 1 ? "" : "s"}.`, 10)
+        : result("ci", "Continuous integration", "warn", "No GitHub Actions workflow was found.", 10, "Run tests and quality checks on pushes and pull requests."));
+    if (packageJson) {
+        const missingMetadata = [
+            packageJson.description?.trim() ? undefined : "description",
+            packageJson.license?.trim() ? undefined : "license",
+            packageJson.repository ? undefined : "repository",
+        ].filter((field) => field !== undefined);
+        checks.push(missingMetadata.length === 0
+            ? result("package-metadata", "Package metadata", "pass", "Description, license, and repository metadata are set.", 5)
+            : result("package-metadata", "Package metadata", "warn", `Missing package metadata: ${missingMetadata.join(", ")}.`, 5, "Complete the metadata so registries and tools can describe the project."));
+    }
+    const communityFiles = ["CONTRIBUTING.md", "CODE_OF_CONDUCT.md", "SECURITY.md"];
+    const missingCommunityFiles = communityFiles.filter((file) => !pathExists(root, file));
+    checks.push(missingCommunityFiles.length === 0
+        ? result("community", "Community health", "pass", "Contribution, conduct, and security guidance are present.", 5)
+        : result("community", "Community health", "warn", `Missing: ${missingCommunityFiles.join(", ")}.`, 5, "Add lightweight guidance before inviting contributors."));
+    const secretFindings = findPotentialSecrets(root);
+    if (secretFindings.length === 0) {
+        checks.push(result("secrets", "Secret exposure", "pass", "No common secret patterns or sensitive filenames were detected.", 14));
+    }
+    else {
+        const paths = [...new Set(secretFindings.map((finding) => finding.path))];
+        checks.push(result("secrets", "Secret exposure", "fail", `Potential secrets found in ${paths.length} file${paths.length === 1 ? "" : "s"}: ${paths.slice(0, 4).join(", ")}${paths.length > 4 ? ", …" : ""}.`, 14, "Remove the files from version control, rotate exposed credentials, and provide redacted examples instead."));
+    }
+    return { project, checks };
+}
+//# sourceMappingURL=readiness.js.map

package/dist/src/checks/readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../../src/checks/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAepD,SAAS,MAAM,CACb,EAAU,EACV,KAAa,EACb,MAA6B,EAC7B,OAAe,EACf,MAAc,EACd,UAAmB;IAEnB,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;QACxC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,KAAe,EAAE,KAAe;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,IACE,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAClC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACpC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAC3B,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,OAA2C,EAAE,KAAe;IACnF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACtC,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,UAAoB;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAmB;QACzC,CAAC,SAAS,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC1E,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QACxB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;KACnB,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,UAAU,EAAE,2BAA2B,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,EAAE,2BAA2B,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC;IAED,OAAO,MAAM,CACX,UAAU,EACV,2BAA2B,EAC3B,MAAM,EACN,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC3D,CAAC,EACD,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,UAAoB,EAAE,WAAoC;IAC5F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,MAAM,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;gBACxG,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC,CAAC;aACjI,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5G,MAAM,UAAU,GAAG,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrE,OAAO;gBACL,MAAM,CACJ,cAAc,EACd,YAAY,EACZ,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACzB,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,oCAAoC,EACpF,CAAC,EACD,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0DAA0D,CACjF;gBACD,MAAM,CACJ,iBAAiB,EACjB,eAAe,EACf,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC5B,UAAU,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,4DAA4D,EACjH,CAAC,EACD,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAC5E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAElD,OAAO;QACL,MAAM,CACJ,cAAc,EACd,cAAc,EACd,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACtB,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yCAAyC,EAC/F,CAAC,EACD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wDAAwD,CAC5E;QACD,MAAM,CACJ,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACzB,OAAO,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,oDAAoD,EACpH,CAAC,EACD,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qEAAqE,CAC5F;QACD,MAAM,CACJ,eAAe,EACf,eAAe,EACf,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACvB,KAAK,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,mCAAmC,EACpF,CAAC,EACD,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+DAA+D,CACpF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAc,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,OAAO,GAAgB;QAC3B,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,EAAE,IAAI;QACV,UAAU;KACX,CAAC;IACF,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC,MAAM,CACJ,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,0CAA0C,EAC1C,CAAC,EACD,0DAA0D,CAC3D,CACN,CAAC;IAEF,IAAI,cAAc,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CACT,MAAM,CACJ,cAAc,EACd,oBAAoB,EACpB,MAAM,EACN,2CAA2C,EAC3C,CAAC,EACD,wCAAwC,CACzC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,CAAC,IAAI,CACT,CAAC,MAAM;QACL,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAAE,kEAAkE,CAAC;QACzI,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,4BAA4B,EAAE,EAAE,EAAE,yDAAyD,CAAC;YAC1I,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,yCAAyC,EAAE,EAAE,CAAC,CACjG,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,IAAI,CACT,OAAO;QACL,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,cAAc,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,EAAE,kEAAkE,CAAC,CAC9I,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;QACrG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,EAAE,kEAAkE,CAAC,CACtJ,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,SAAS,SAAS,CAAC,MAAM,2BAA2B,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;QAC9I,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,uCAAuC,EAAE,EAAE,EAAE,2DAA2D,CAAC,CAC7J,CAAC;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG;YACtB,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;YAC3D,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACnD,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;SAClD,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CACT,eAAe,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC,CAAC;YACrH,CAAC,CAAC,MAAM,CACJ,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC1D,CAAC,EACD,yEAAyE,CAC1E,CACN,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAChF,MAAM,qBAAqB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,CACT,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC,CAAC;QACjH,CAAC,CAAC,MAAM,CACJ,WAAW,EACX,kBAAkB,EAClB,MAAM,EACN,YAAY,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC/C,CAAC,EACD,wDAAwD,CACzD,CACN,CAAC;IAEF,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,iEAAiE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnI,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CACT,MAAM,CACJ,SAAS,EACT,iBAAiB,EACjB,MAAM,EACN,8BAA8B,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EACnJ,EAAE,EACF,2GAA2G,CAC5G,CACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/src/checks/secrets.d.ts

@@ -0,0 +1,6 @@
+export interface SecretFinding {
+    path: string;
+    kind: string;
+}
+export declare function findPotentialSecrets(root: string): SecretFinding[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/src/checks/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/checks/secrets.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAoCD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAqBlE"}

package/dist/src/checks/secrets.js

@@ -0,0 +1,49 @@
+import { basename, join } from "node:path";
+import { isSmallTextFile, listFiles, readUtf8 } from "../files.js";
+const safeEnvironmentSuffixes = [".example", ".sample", ".template"];
+function sensitiveFilename(path) {
+    const name = basename(path).toLowerCase();
+    if (name === ".env" ||
+        (name.startsWith(".env.") &&
+            !safeEnvironmentSuffixes.some((suffix) => name.endsWith(suffix)))) {
+        return "environment file";
+    }
+    if (["id_rsa", "id_ed25519", "credentials.json", "service-account.json"].includes(name)) {
+        return "credential file";
+    }
+    if ([".pem", ".p12", ".pfx"].some((extension) => name.endsWith(extension))) {
+        return "key or certificate file";
+    }
+    return undefined;
+}
+const contentPatterns = [
+    { kind: "GitHub token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/ },
+    { kind: "OpenAI-style key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+    { kind: "AWS access key", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+    {
+        kind: "private key",
+        pattern: new RegExp(["-----BEGIN", "(?:RSA |EC |OPENSSH )?PRIVATE KEY-----"].join(" ")),
+    },
+];
+export function findPotentialSecrets(root) {
+    const files = listFiles(root);
+    const findings = [];
+    for (const path of files) {
+        const fileKind = sensitiveFilename(path);
+        if (fileKind)
+            findings.push({ path, kind: fileKind });
+        if (!isSmallTextFile(root, path))
+            continue;
+        const content = readUtf8(join(root, path));
+        if (content === undefined)
+            continue;
+        for (const { kind, pattern } of contentPatterns) {
+            if (pattern.test(content)) {
+                findings.push({ path, kind });
+                break;
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/src/checks/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/checks/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOnE,MAAM,uBAAuB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAErE,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAE1C,IACE,IAAI,KAAK,MAAM;QACf,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAA6C;IAChE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC5E,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC3D;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI,MAAM,CAAC,CAAC,YAAY,EAAE,wCAAwC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACxF;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QAEpC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":""}

package/dist/src/cli.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import { statSync } from "node:fs";
+import { resolve } from "node:path";
+import { analyzeProject, SHIPPROOF_VERSION } from "./analyze.js";
+import { renderJson } from "./reporters/json.js";
+import { renderTerminal } from "./reporters/terminal.js";
+const help = `ShipProof ${SHIPPROOF_VERSION}
+
+Zero-config release readiness checks for AI-assisted projects.
+
+Usage:
+  shipproof [path] [options]
+
+Options:
+  --json       Print machine-readable JSON
+  --no-color   Disable ANSI colors
+  --no-fail    Exit with code 0 even when blocking issues are found
+  -h, --help   Show help
+  -v, --version
+               Show the version
+
+Examples:
+  shipproof
+  shipproof ./my-project
+  shipproof --json > shipproof-report.json
+`;
+function parseArguments(arguments_) {
+    let target = ".";
+    let targetWasSet = false;
+    let json = false;
+    let color = process.stdout.isTTY && process.env.NO_COLOR === undefined;
+    let failOnIssues = true;
+    let showHelp = false;
+    let showVersion = false;
+    for (const argument of arguments_) {
+        if (argument === "--json")
+            json = true;
+        else if (argument === "--no-color")
+            color = false;
+        else if (argument === "--no-fail")
+            failOnIssues = false;
+        else if (argument === "--help" || argument === "-h")
+            showHelp = true;
+        else if (argument === "--version" || argument === "-v")
+            showVersion = true;
+        else if (argument.startsWith("-"))
+            throw new Error(`Unknown option: ${argument}`);
+        else if (targetWasSet)
+            throw new Error("Only one project path can be analyzed at a time.");
+        else {
+            target = argument;
+            targetWasSet = true;
+        }
+    }
+    return { target, json, color, failOnIssues, help: showHelp, version: showVersion };
+}
+function main() {
+    let options;
+    try {
+        options = parseArguments(process.argv.slice(2));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Invalid arguments.";
+        process.stderr.write(`shipproof: ${message}\nTry 'shipproof --help'.\n`);
+        process.exitCode = 2;
+        return;
+    }
+    if (options.help) {
+        process.stdout.write(help);
+        return;
+    }
+    if (options.version) {
+        process.stdout.write(`${SHIPPROOF_VERSION}\n`);
+        return;
+    }
+    const target = resolve(options.target);
+    try {
+        if (!statSync(target).isDirectory())
+            throw new Error("The target is not a directory.");
+    }
+    catch {
+        process.stderr.write(`shipproof: Cannot analyze '${options.target}': directory not found.\n`);
+        process.exitCode = 2;
+        return;
+    }
+    const result = analyzeProject(target);
+    process.stdout.write(options.json ? `${renderJson(result)}\n` : renderTerminal(result, options.color));
+    if (options.failOnIssues && result.summary.failed > 0)
+        process.exitCode = 1;
+}
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+main();
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAWzD,MAAM,IAAI,GAAG,aAAa,iBAAiB;;;;;;;;;;;;;;;;;;;CAmB1C,CAAC;AAEF,SAAS,cAAc,CAAC,UAAoB;IAC1C,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;IACvE,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC;aAClC,IAAI,QAAQ,KAAK,YAAY;YAAE,KAAK,GAAG,KAAK,CAAC;aAC7C,IAAI,QAAQ,KAAK,WAAW;YAAE,YAAY,GAAG,KAAK,CAAC;aACnD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,GAAG,IAAI,CAAC;aAChE,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,IAAI;YAAE,WAAW,GAAG,IAAI,CAAC;aACtE,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;aAC7E,IAAI,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;aACtF,CAAC;YACJ,MAAM,GAAG,QAAQ,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACrF,CAAC;AAED,SAAS,IAAI;IACX,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,6BAA6B,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,iBAAiB,IAAI,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAC9F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEvG,IAAI,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;IAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,IAAI,EAAE,CAAC"}

package/dist/src/files.d.ts

@@ -0,0 +1,9 @@
+export declare function pathExists(root: string, ...parts: string[]): boolean;
+export declare function readUtf8(path: string): string | undefined;
+export declare function readJson<T>(path: string): T | undefined;
+export declare function listFiles(root: string, options?: {
+    maxFiles?: number;
+    maxDepth?: number;
+}): string[];
+export declare function isSmallTextFile(root: string, relativePath: string): boolean;
+//# sourceMappingURL=files.d.ts.map

package/dist/src/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/files.ts"],"names":[],"mappings":"AA4DA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMzD;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CASvD;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,MAAM,EAAE,CA+BV;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAY3E"}

package/dist/src/files.js

@@ -0,0 +1,120 @@
+import { existsSync, readFileSync, readdirSync, statSync, } from "node:fs";
+import { basename, extname, join, relative } from "node:path";
+const ignoredDirectories = new Set([
+    ".git",
+    ".next",
+    ".turbo",
+    ".venv",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "target",
+    "vendor",
+]);
+const textExtensions = new Set([
+    ".c",
+    ".cc",
+    ".conf",
+    ".cpp",
+    ".cs",
+    ".css",
+    ".env",
+    ".go",
+    ".h",
+    ".hpp",
+    ".html",
+    ".ini",
+    ".java",
+    ".js",
+    ".json",
+    ".jsx",
+    ".kt",
+    ".md",
+    ".mjs",
+    ".php",
+    ".properties",
+    ".py",
+    ".rb",
+    ".rs",
+    ".sh",
+    ".sql",
+    ".svelte",
+    ".swift",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".txt",
+    ".vue",
+    ".xml",
+    ".yaml",
+    ".yml",
+]);
+export function pathExists(root, ...parts) {
+    return existsSync(join(root, ...parts));
+}
+export function readUtf8(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readJson(path) {
+    const content = readUtf8(path);
+    if (content === undefined)
+        return undefined;
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function listFiles(root, options = {}) {
+    const maxFiles = options.maxFiles ?? 400;
+    const maxDepth = options.maxDepth ?? 7;
+    const files = [];
+    function visit(directory, depth) {
+        if (files.length >= maxFiles || depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (files.length >= maxFiles)
+                return;
+            if (entry.isSymbolicLink())
+                continue;
+            const absolute = join(directory, entry.name);
+            if (entry.isDirectory()) {
+                if (!ignoredDirectories.has(entry.name))
+                    visit(absolute, depth + 1);
+                continue;
+            }
+            if (entry.isFile())
+                files.push(relative(root, absolute).replaceAll("\\", "/"));
+        }
+    }
+    visit(root, 0);
+    return files;
+}
+export function isSmallTextFile(root, relativePath) {
+    const absolute = join(root, relativePath);
+    const name = basename(relativePath).toLowerCase();
+    const extension = extname(name);
+    if (!textExtensions.has(extension) && !name.startsWith(".env"))
+        return false;
+    try {
+        return statSync(absolute).size <= 1_000_000;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=files.js.map

package/dist/src/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,cAAc;IACd,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,aAAa;IACb,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAG,KAAe;IACzD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAI,IAAY;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,OAAO,GAA6C,EAAE;IAEtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,KAAK,CAAC,SAAiB,EAAE,KAAa;QAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAEzD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;gBAAE,OAAO;YACrC,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,YAAoB;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,5 @@
+export { analyzeProject, SHIPPROOF_VERSION } from "./analyze.js";
+export { renderJson } from "./reporters/json.js";
+export { renderTerminal } from "./reporters/terminal.js";
+export type { AnalysisResult, AnalysisSummary, CheckResult, CheckStatus, ProjectInfo, Readiness, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EACV,cAAc,EACd,eAAe,EACf,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,4 @@
+export { analyzeProject, SHIPPROOF_VERSION } from "./analyze.js";
+export { renderJson } from "./reporters/json.js";
+export { renderTerminal } from "./reporters/terminal.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/src/reporters/json.d.ts

@@ -0,0 +1,3 @@
+import type { AnalysisResult } from "../types.js";
+export declare function renderJson(result: AnalysisResult): string;
+//# sourceMappingURL=json.d.ts.map

package/dist/src/reporters/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/reporters/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEzD"}

package/dist/src/reporters/json.js

@@ -0,0 +1,4 @@
+export function renderJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+//# sourceMappingURL=json.js.map

package/dist/src/reporters/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/reporters/json.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/reporters/terminal.d.ts

@@ -0,0 +1,3 @@
+import type { AnalysisResult } from "../types.js";
+export declare function renderTerminal(result: AnalysisResult, color?: boolean): string;
+//# sourceMappingURL=terminal.d.ts.map

package/dist/src/reporters/terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../../src/reporters/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAA0B,MAAM,aAAa,CAAC;AAmC1E,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,UAAO,GAAG,MAAM,CA8B3E"}

package/dist/src/reporters/terminal.js

@@ -0,0 +1,50 @@
+const symbols = {
+    pass: "✓",
+    warn: "!",
+    fail: "×",
+    info: "·",
+};
+const readinessLabels = {
+    ready: "Ready to ship",
+    close: "Almost ready",
+    "work-needed": "Needs work",
+    "not-ready": "Not ready",
+};
+function painter(enabled) {
+    const wrap = (code) => (value) => enabled ? `\u001B[${code}m${value}\u001B[0m` : value;
+    return {
+        pass: wrap(32),
+        warn: wrap(33),
+        fail: wrap(31),
+        info: wrap(36),
+        accent: wrap(35),
+        muted: wrap(90),
+    };
+}
+function scoreBar(score) {
+    const filled = Math.round(score / 5);
+    return `${"█".repeat(filled)}${"░".repeat(20 - filled)}`;
+}
+export function renderTerminal(result, color = true) {
+    const paint = painter(color);
+    const scoreStatus = result.score >= 90 ? "pass" : result.score >= 70 ? "warn" : "fail";
+    const ecosystem = result.project.ecosystems.length > 0 ? result.project.ecosystems.join(", ") : "unknown stack";
+    const lines = [
+        "",
+        paint.accent("  SHIPPROOF"),
+        paint.muted(`  ${result.project.name} · ${ecosystem}`),
+        "",
+        `  ${paint[scoreStatus](`${result.score}/100`)}  ${scoreBar(result.score)}  ${readinessLabels[result.readiness]}`,
+        "",
+    ];
+    for (const check of result.checks) {
+        const marker = paint[check.status](symbols[check.status]);
+        lines.push(`  ${marker} ${check.title}: ${check.message}`);
+        if (check.suggestion && check.status !== "pass") {
+            lines.push(paint.muted(`    → ${check.suggestion}`));
+        }
+    }
+    lines.push("", paint.muted(`  ${result.summary.passed} passed · ${result.summary.warnings} warnings · ${result.summary.failed} failed · ${result.durationMs}ms`), "");
+    return lines.join("\n");
+}
+//# sourceMappingURL=terminal.js.map

package/dist/src/reporters/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../../src/reporters/terminal.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAgC;IAC3C,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,MAAM,eAAe,GAA8B;IACjD,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,cAAc;IACrB,aAAa,EAAE,YAAY;IAC3B,WAAW,EAAE,WAAW;CACzB,CAAC;AAEF,SAAS,OAAO,CAAC,OAAgB;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAa,EAAU,EAAE,CACvD,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAEvD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAChB,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,KAAK,GAAG,IAAI;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAgB,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACpG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAChH,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC;QACtD,EAAE;QACF,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACjH,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,KAAK,CAAC,KAAK,CACT,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,UAAU,IAAI,CACrI,EACD,EAAE,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,32 @@
+export type CheckStatus = "pass" | "warn" | "fail" | "info";
+export interface CheckResult {
+    id: string;
+    title: string;
+    status: CheckStatus;
+    message: string;
+    suggestion?: string;
+    weight: number;
+}
+export interface ProjectInfo {
+    name: string;
+    path: string;
+    ecosystems: string[];
+}
+export interface AnalysisSummary {
+    passed: number;
+    warnings: number;
+    failed: number;
+    informational: number;
+}
+export type Readiness = "ready" | "close" | "work-needed" | "not-ready";
+export interface AnalysisResult {
+    version: string;
+    analyzedAt: string;
+    durationMs: number;
+    project: ProjectInfo;
+    score: number;
+    readiness: Readiness;
+    summary: AnalysisSummary;
+    checks: CheckResult[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,WAAW,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB"}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/docs/demo.svg

@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 920 500" role="img" aria-labelledby="title description">
+  <title id="title">ShipProof terminal demo</title>
+  <description id="description">A terminal showing a ShipProof project readiness score and checks.</description>
+  <rect width="920" height="500" rx="18" fill="#0f172a"/>
+  <circle cx="30" cy="28" r="7" fill="#fb7185"/>
+  <circle cx="54" cy="28" r="7" fill="#fbbf24"/>
+  <circle cx="78" cy="28" r="7" fill="#4ade80"/>
+  <g font-family="ui-monospace,SFMono-Regular,Consolas,monospace" font-size="18">
+    <text x="28" y="78" fill="#94a3b8">$ npx shipproof</text>
+    <text x="28" y="126" fill="#c084fc" font-weight="700">SHIPPROOF</text>
+    <text x="28" y="156" fill="#64748b">acme-app · Node.js</text>
+    <text x="28" y="204" fill="#4ade80" font-weight="700">92/100</text>
+    <text x="138" y="204" fill="#4ade80">██████████████████</text>
+    <text x="354" y="204" fill="#334155">██</text>
+    <text x="392" y="204" fill="#e2e8f0">Ready to ship</text>
+    <text x="28" y="252" fill="#4ade80">✓</text><text x="54" y="252" fill="#e2e8f0">README: Clear installation and usage guide.</text>
+    <text x="28" y="286" fill="#4ade80">✓</text><text x="54" y="286" fill="#e2e8f0">Secret exposure: No common patterns detected.</text>
+    <text x="28" y="320" fill="#4ade80">✓</text><text x="54" y="320" fill="#e2e8f0">Continuous integration: Found 1 workflow.</text>
+    <text x="28" y="354" fill="#fbbf24">!</text><text x="54" y="354" fill="#e2e8f0">Community health: Missing SECURITY.md.</text>
+    <text x="54" y="384" fill="#64748b">→ Add lightweight guidance before inviting contributors.</text>
+    <text x="28" y="438" fill="#64748b">10 passed · 1 warning · 0 failed · 31ms</text>
+  </g>
+</svg>

package/docs/shipproof.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 190" role="img" aria-labelledby="title description">
+  <title id="title">ShipProof</title>
+  <description id="description">A ship inside a shield beside the ShipProof wordmark.</description>
+  <defs>
+    <linearGradient id="shield" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#8b5cf6"/>
+      <stop offset="1" stop-color="#06b6d4"/>
+    </linearGradient>
+  </defs>
+  <path fill="url(#shield)" d="M96 10 169 36v52c0 49-28 78-73 94-45-16-73-45-73-94V36z"/>
+  <path fill="#fff" d="m53 99 9 27c21 10 47 10 68 0l9-27-43 13zm29-47h28v46L96 93 82 98zm-20 55 34-16 34 16-7 11c-17 7-37 7-54 0z"/>
+  <path fill="#22d3ee" d="M56 132c26 11 54 11 80 0-7 15-20 26-40 35-20-9-33-20-40-35z"/>
+  <text x="205" y="112" fill="#111827" font-family="Inter,Segoe UI,Arial,sans-serif" font-size="72" font-weight="800" letter-spacing="-3">ShipProof</text>
+  <text x="210" y="150" fill="#64748b" font-family="Inter,Segoe UI,Arial,sans-serif" font-size="20" letter-spacing="2">KNOW BEFORE YOU SHIP</text>
+</svg>

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "shipproof",
+  "version": "0.1.0",
+  "description": "Zero-config release readiness checks for AI-assisted projects.",
+  "type": "module",
+  "bin": {
+    "shipproof": "dist/src/cli.js"
+  },
+  "files": [
+    "dist/src",
+    "docs/*.svg",
+    "README.md",
+    "README.es.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "ai",
+    "cli",
+    "code-quality",
+    "developer-tools",
+    "release-readiness",
+    "security"
+  ],
+  "author": "CalvaryBloom",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CalvaryBloom/shipproof.git"
+  },
+  "bugs": {
+    "url": "https://github.com/CalvaryBloom/shipproof/issues"
+  },
+  "homepage": "https://github.com/CalvaryBloom/shipproof#readme",
+  "engines": {
+    "node": ">=22.13"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^7.0.2"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm build && node --test dist/test/analyze.test.js",
+    "start": "node dist/src/cli.js"
+  }
+}