sublyzer-snapshot 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sublyzer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,306 @@
+<div align="center">
+
+# Sublyzer Snapshot
+
+<img src="./Sublyzer1.png" alt="Sublyzer" width="96" />
+
+**Turn any codebase into a live Sublyzer dashboard in 30 seconds.**
+
+Scan routes, dependencies, and vulnerabilities locally — get a health score — push everything to [Sublyzer](https://sublyzer.com). No SDK required for your first check.
+
+<br />
+
+[![npm version](https://img.shields.io/badge/npm-v0.3.0-2563eb?style=for-the-badge&logo=npm&logoColor=white)](https://www.npmjs.com/package/sublyzer-snapshot)
+[![License: MIT](https://img.shields.io/badge/License-MIT-22c55e?style=for-the-badge)](LICENSE)
+[![Node.js](https://img.shields.io/badge/Node.js-18%2B-339933?style=for-the-badge&logo=node.js&logoColor=white)](https://nodejs.org)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6?style=for-the-badge&logo=typescript&logoColor=white)](https://www.typescriptlang.org)
+[![Sublyzer](https://img.shields.io/badge/Powered%20by-Sublyzer-6366f1?style=for-the-badge)](https://sublyzer.com)
+
+<br />
+
+[`Quick Start`](#-quick-start) · [`How It Works`](#-how-it-works) · [`Commands`](#-commands) · [`CI/CD`](#-cicd) · [`Docs`](#-environment-variables) · [Sublyzer Dashboard](https://sublyzer.com/dashboard)
+
+<br />
+
+```
+  $ npx sublyzer-snapshot init && npx sublyzer-snapshot run
+
+  Project:         my-saas-app
+  Stack:           Next.js (high)
+  Health:          [████████░░] 82/100  grade B
+  Routes:          14
+  Vulnerabilities: 2 (critical 0, high 1)
+  ✓ Sent 6 events → dashboard updated
+```
+
+</div>
+
+---
+
+## ✨ Introduction
+
+**Sublyzer Snapshot** is an open-source CLI that answers one question every developer asks:
+
+> *"How healthy is my project right now?"*
+
+Instead of wiring up three separate tools (dependency scanner, route inventory, monitoring dashboard), you run **one command**. Snapshot scans your repo locally, computes a **health score (0–100)**, and pushes structured events to your **Sublyzer** integration — where you (or an AI agent like Hermes) can read them back.
+
+Built for **indie hackers**, **startup teams**, and **agencies** who want instant project visibility without a week of DevOps setup.
+
+---
+
+## 🎯 What is it for?
+
+| Use case | What you get |
+|----------|--------------|
+| **First-time project check** | Stack detection, route map, CVE summary in ~30s |
+| **Pre-deploy sanity check** | Health score + vulnerability gate before shipping |
+| **CI/CD pipeline** | `--fail-on high` blocks merges with critical CVEs |
+| **Client / team reports** | `report --out HEALTH.md` — shareable Markdown |
+| **Trend tracking** | `compare` shows what changed since last scan |
+| **Sublyzer onboarding** | Data in your dashboard before installing the browser SDK |
+
+### Before vs After
+
+| Before | After (Sublyzer Snapshot) |
+|--------|---------------------------|
+| Sentry + Dependabot + manual spreadsheet | One CLI, one dashboard |
+| 45+ min setup | ~30 seconds |
+| No unified health score | 0–100 score with grade A–F |
+| Hard to show clients "project status" | Export `report.md` in one command |
+
+---
+
+## ⚙️ How it works
+
+```mermaid
+flowchart LR
+  A[Your repo] --> B[sublyzer-snapshot run]
+  B --> C[Local scan]
+  C --> D[Routes · deps · audit · git]
+  D --> E[Health score 0-100]
+  E --> F[Sublyzer API]
+  F --> G[Dashboard]
+  G --> H[Hermes / agents / team]
+
+  style A fill:#1e293b,stroke:#475569,color:#f8fafc
+  style G fill:#2563eb,stroke:#1d4ed8,color:#fff
+  style E fill:#22c55e,stroke:#16a34a,color:#fff
+```
+
+1. **`init`** — Links your project folder to a Sublyzer integration (24-char code).
+2. **`run`** — Scans locally: framework, routes, `npm audit`, outdated packages, git metadata.
+3. **Score** — Computes health grade from vulnerabilities, routes, env hygiene, and more.
+4. **Push** — Sends events to `POST /data-collection/collect-batch` on Sublyzer.
+5. **Dashboard** — Data appears under your integration; optional SDK for live telemetry later.
+
+Scan history is stored in `.sublyzer/` (gitignored automatically) so `compare` can show diffs over time.
+
+---
+
+## 🚀 Quick start
+
+### Prerequisites
+
+- **Node.js 18+**
+- **npm** (for audit/outdated; optional with `--skip-audit`)
+- A [Sublyzer](https://sublyzer.com) account + **integration code** (24 chars, from Dashboard → Integrations)
+
+### Install & run
+
+```bash
+# 1. Link your project
+npx sublyzer-snapshot init
+
+# 2. Scan and push
+npx sublyzer-snapshot run
+
+# 3. Open dashboard
+npx sublyzer-snapshot open
+```
+
+Non-interactive (CI / scripts):
+
+```bash
+export SUBLYZER_INTEGRATION_CODE="YOUR_24_CHAR_CODE"
+npx sublyzer-snapshot init -y
+npx sublyzer-snapshot run --fail-on high
+```
+
+### Development (this monorepo)
+
+```bash
+cd projects/sublyzer-snapshot
+npm install && npm run build
+node dist/cli.js init --code YOUR_CODE -y
+node dist/cli.js run --dry-run
+```
+
+---
+
+## 🧰 Commands
+
+| Command | Description |
+|---------|-------------|
+| `init` | Detect stack, validate code, write `.sublyzer/snapshot.json` |
+| `run` | Full scan + push to Sublyzer |
+| `report` | Generate Markdown health report (`--out report.md`) |
+| `compare` | Diff routes, vulns, and score vs previous scan |
+| `ci` | Print or write GitHub Actions workflow |
+| `status` | Show linked integration + last scan |
+| `doctor` | Verify config, API, integration code, read key |
+| `pull` | Fetch data back via public read API (needs `apiReadKey`) |
+| `open` | Open integration in browser |
+
+### Common flags
+
+```bash
+sublyzer-snapshot run --dry-run          # Local preview, no push
+sublyzer-snapshot run --skip-audit       # Faster scan
+sublyzer-snapshot run --fail-on high     # Exit 1 on high/critical CVEs
+sublyzer-snapshot run --json             # CI-friendly JSON output
+
+sublyzer-snapshot report --out HEALTH.md
+sublyzer-snapshot compare --rescan
+sublyzer-snapshot ci --out .github/workflows/sublyzer-snapshot.yml
+```
+
+---
+
+## 📊 Health score
+
+Every scan produces a **0–100 score** and letter grade (**A–F**):
+
+| Factor | Impact |
+|--------|--------|
+| Critical CVEs | −25 each (max −50) |
+| High CVEs | −10 each (max −30) |
+| Moderate CVEs | −3 each |
+| Web stack with 0 routes detected | −8 |
+| Dirty git working tree | −3 |
+| Missing `.env.example` | −2 |
+| Major outdated packages | −3 each |
+
+Example terminal output:
+
+```
+  Health:        [████████░░] 82/100  grade B
+```
+
+The score is also sent to Sublyzer as a `snapshot_health_score` performance metric.
+
+---
+
+## 🔍 What gets detected
+
+| Stack | Signals |
+|-------|---------|
+| **Next.js** | `next` in package.json, `app/` & `pages/` routes |
+| **NestJS** | `@nestjs/core`, decorator routes |
+| **Express / Fastify** | Route patterns in source |
+| **Remix / Nuxt / SvelteKit** | package.json dependencies |
+| **React / Vue / Node** | Fallback detection |
+| **Monorepos** | npm & pnpm workspaces |
+
+Each `run` sends:
+
+- `custom_event` → `project_snapshot` (stack, routes, git, audit summary)
+- `vulnerability` → top npm audit findings
+- `performance` → health score + route count
+
+---
+
+## 🔄 CI/CD
+
+### Fail the build on vulnerabilities
+
+```bash
+sublyzer-snapshot run --fail-on high --json > snapshot-result.json
+```
+
+Levels: `critical` · `high` · `moderate` · `any`
+
+### Generate GitHub Actions workflow
+
+```bash
+sublyzer-snapshot ci --out .github/workflows/sublyzer-snapshot.yml
+```
+
+Add repository secret: **`SUBLYZER_INTEGRATION_CODE`**
+
+The generated workflow runs on push, PR, and weekly schedule — uploads JSON + Markdown report as artifacts.
+
+---
+
+## 🤖 Read data back (agents & API)
+
+Push uses the **integration code**. To **read** snapshot data programmatically (e.g. Hermes):
+
+```bash
+# Get read key (authenticated)
+curl "https://api.sublyzer.com/integrations/{id}/read-access" \
+  -H "Authorization: Bearer YOUR_JWT"
+
+# Or via CLI
+sublyzer-snapshot pull --read-key YOUR_READ_KEY
+```
+
+Set `SUBLYZER_READ_KEY` in env or save during `init --read-key ...`.
+
+---
+
+## 🔐 Environment variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `SUBLYZER_INTEGRATION_CODE` | For `init` | 24-character integration code |
+| `SUBLYZER_READ_KEY` | For `pull` | Public read API key |
+| `SUBLYZER_API_URL` | No | Default: `https://api.sublyzer.com` |
+| `SUBLYZER_DASHBOARD_URL` | No | Default: `https://sublyzer.com` |
+
+> **Security:** `.sublyzer/snapshot.json` contains your integration code. It is auto-added to `.gitignore` on `init` — never commit it to public repos.
+
+---
+
+## 📁 Project structure (local)
+
+```
+your-project/
+├── .sublyzer/
+│   ├── snapshot.json       # Linked integration config
+│   ├── last-snapshot.json  # Latest scan cache
+│   └── history/            # Previous scans (for compare)
+├── src/
+└── package.json
+```
+
+---
+
+## 🛣️ Roadmap
+
+- [ ] npm publish (`npx sublyzer-snapshot`)
+- [ ] `login` flow (no manual code paste)
+- [ ] Bundle size analysis
+- [ ] PR comment bot (GitHub App)
+
+---
+
+## 📄 License
+
+MIT © [Sublyzer](https://sublyzer.com) — see [LICENSE](./LICENSE).
+
+---
+
+<div align="center">
+
+**[Sublyzer](https://sublyzer.com)** · **[Documentation](https://sublyzer.com/docs)** · **[Dashboard](https://sublyzer.com/dashboard)**
+
+<br />
+
+If this saved you time, ⭐ star the repo — it helps other devs find it.
+
+<br />
+
+<sub>Built with TypeScript · Powered by <a href="https://sublyzer.com">Sublyzer</a> observability platform</sub>
+
+</div>

package/dist/api/sublyzer.d.ts

@@ -0,0 +1,29 @@
+import type { CollectItem } from '../scan/snapshot.js';
+export type ValidateResult = {
+    success: boolean;
+    valid: boolean;
+    integration?: {
+        id: string;
+        name: string;
+        status: string;
+    };
+    message?: string;
+};
+export type PublicReadOptions = {
+    limit?: number;
+    windowDays?: number;
+    include?: string[];
+};
+export declare function validateIntegrationCode(apiUrl: string, integrationCode: string): Promise<ValidateResult>;
+export declare function pushSnapshot(apiUrl: string, integrationCode: string, items: CollectItem[]): Promise<{
+    success: boolean;
+    processed?: number;
+    error?: string;
+}>;
+export declare function fetchPublicSnapshot(apiUrl: string, integrationCode: string, readKey: string, opts?: PublicReadOptions): Promise<{
+    ok: boolean;
+    status: number;
+    data?: unknown;
+    error?: string;
+}>;
+//# sourceMappingURL=sublyzer.d.ts.map

package/dist/api/sublyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sublyzer.d.ts","sourceRoot":"","sources":["../../src/api/sublyzer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAI9G;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,WAAW,EAAE,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BnE;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB1E"}

package/dist/api/sublyzer.js

@@ -0,0 +1,61 @@
+import { SDK_NAME, SDK_VERSION } from '../constants.js';
+export async function validateIntegrationCode(apiUrl, integrationCode) {
+    const base = apiUrl.replace(/\/$/, '');
+    const res = await fetch(`${base}/data-collection/integration/${integrationCode}/validate`);
+    return (await res.json());
+}
+export async function pushSnapshot(apiUrl, integrationCode, items) {
+    const base = apiUrl.replace(/\/$/, '');
+    const res = await fetch(`${base}/data-collection/collect-batch`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            integrationCode,
+            sdkName: SDK_NAME,
+            sdkVersion: SDK_VERSION,
+            data: items,
+        }),
+    });
+    let body = {};
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = {};
+    }
+    if (!res.ok) {
+        return { success: false, error: body?.message || body?.error || `HTTP ${res.status}` };
+    }
+    return {
+        success: body?.success !== false,
+        processed: body?.processed ?? items.length,
+        error: body?.error,
+    };
+}
+export async function fetchPublicSnapshot(apiUrl, integrationCode, readKey, opts = {}) {
+    const base = apiUrl.replace(/\/$/, '');
+    const url = new URL(`${base}/data-collection/integration/${integrationCode}/data`);
+    url.searchParams.set('key', readKey);
+    if (opts.limit != null)
+        url.searchParams.set('limit', String(opts.limit));
+    if (opts.windowDays != null)
+        url.searchParams.set('windowDays', String(opts.windowDays));
+    if (opts.include?.length)
+        url.searchParams.set('include', opts.include.join(','));
+    const res = await fetch(url.toString());
+    let data;
+    try {
+        data = await res.json();
+    }
+    catch {
+        data = null;
+    }
+    if (!res.ok) {
+        const errMsg = data?.message ||
+            data?.error ||
+            (typeof data === 'object' && data && 'statusCode' in data ? JSON.stringify(data) : `HTTP ${res.status}`);
+        return { ok: false, status: res.status, error: String(errMsg) };
+    }
+    return { ok: true, status: res.status, data };
+}
+//# sourceMappingURL=sublyzer.js.map

package/dist/api/sublyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sublyzer.js","sourceRoot":"","sources":["../../src/api/sublyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoBxD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAc,EAAE,eAAuB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,gCAAgC,eAAe,WAAW,CAAC,CAAC;IAC3F,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,eAAuB,EACvB,KAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,gCAAgC,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,eAAe;YACf,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,WAAW;YACvB,IAAI,EAAE,KAAK;SACZ,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,IAAI,GAAQ,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,KAAK;QAChC,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM;QAC1C,KAAK,EAAE,IAAI,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,eAAuB,EACvB,OAAe,EACf,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,gCAAgC,eAAe,OAAO,CAAC,CAAC;IACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GACT,IAAY,EAAE,OAAO;YACrB,IAAY,EAAE,KAAK;YACpB,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,YAAY,IAAK,IAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { SDK_NAME, SDK_VERSION } from './constants.js';
+import { runCi } from './commands/ci.js';
+import { runCompare } from './commands/compare.js';
+import { runDoctor } from './commands/doctor.js';
+import { runInit } from './commands/init.js';
+import { runOpen } from './commands/open.js';
+import { runPull } from './commands/pull.js';
+import { runReport } from './commands/report.js';
+import { runScan } from './commands/run.js';
+import { runStatus } from './commands/status.js';
+const program = new Command();
+function handleError(e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`\x1b[31m✗\x1b[0m ${msg}`);
+    process.exit(1);
+}
+const FAIL_ON_LEVELS = ['critical', 'high', 'moderate', 'any'];
+program
+    .name('sublyzer-snapshot')
+    .description('Scan any project and push a health snapshot to Sublyzer')
+    .version(SDK_VERSION);
+program
+    .command('init')
+    .description('Detect stack and link this project to your Sublyzer integration')
+    .option('--code <code>', 'Integration code (24 chars); or SUBLYZER_INTEGRATION_CODE')
+    .option('--read-key <key>', 'Optional apiReadKey for pull; or SUBLYZER_READ_KEY')
+    .option('--api-url <url>', 'Sublyzer API base URL')
+    .option('--dashboard-url <url>', 'Dashboard base URL')
+    .option('-y, --yes', 'Non-interactive when code is provided')
+    .option('--skip-gitignore', 'Do not update .gitignore')
+    .action(async (opts) => {
+    try {
+        await runInit({
+            code: opts.code,
+            readKey: opts.readKey,
+            apiUrl: opts.apiUrl,
+            dashboardUrl: opts.dashboardUrl,
+            yes: opts.yes,
+            skipGitignore: opts.skipGitignore,
+        });
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('run')
+    .description('Scan routes, dependencies, vulnerabilities and push to Sublyzer')
+    .option('--dry-run', 'Scan locally without sending data')
+    .option('--skip-audit', 'Skip npm audit (faster)')
+    .option('--skip-outdated', 'Skip npm outdated check')
+    .option('--json', 'Output machine-readable JSON (CI friendly)')
+    .option('--fail-on <level>', 'Exit 1 if vulns at level: critical|high|moderate|any')
+    .action(async (opts) => {
+    try {
+        const failOn = FAIL_ON_LEVELS.includes(opts.failOn) ? opts.failOn : undefined;
+        const result = await runScan({
+            dryRun: opts.dryRun,
+            skipAudit: opts.skipAudit,
+            skipOutdated: opts.skipOutdated,
+            json: opts.json,
+            failOn,
+        });
+        if (opts.json)
+            console.log(JSON.stringify(result, null, 2));
+        if (result.policyFailed)
+            process.exit(1);
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('status')
+    .description('Show linked integration and last scan summary')
+    .option('--json', 'Output machine-readable JSON')
+    .action(async (opts) => {
+    try {
+        const data = await runStatus({ json: opts.json });
+        if (opts.json)
+            console.log(JSON.stringify(data, null, 2));
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('doctor')
+    .description('Verify config, API connectivity, integration code and read key')
+    .option('--json', 'Output machine-readable JSON')
+    .action(async (opts) => {
+    try {
+        const result = await runDoctor({ json: opts.json });
+        if (opts.json)
+            console.log(JSON.stringify(result, null, 2));
+        if (!result.ok)
+            process.exit(1);
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('compare')
+    .description('Diff current vs previous scan (routes, vulns, health score)')
+    .option('--json', 'Output machine-readable JSON')
+    .option('--rescan', 'Run a fresh scan before comparing')
+    .option('--skip-audit', 'Skip audit when using --rescan')
+    .action(async (opts) => {
+    try {
+        const data = await runCompare({
+            json: opts.json,
+            rescan: opts.rescan,
+            skipAudit: opts.skipAudit,
+        });
+        if (opts.json)
+            console.log(JSON.stringify(data, null, 2));
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('report')
+    .description('Generate a Markdown health report (stdout or --out file)')
+    .option('--out <file>', 'Write report to file (e.g. sublyzer-report.md)')
+    .option('--rescan', 'Run a fresh scan instead of using last cached scan')
+    .option('--skip-audit', 'Skip audit when using --rescan')
+    .option('--json', 'Output JSON wrapper with markdown body')
+    .action(async (opts) => {
+    try {
+        const out = await runReport({
+            out: opts.out,
+            rescan: opts.rescan,
+            skipAudit: opts.skipAudit,
+            json: opts.json,
+        });
+        if (opts.json)
+            console.log(out);
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('ci')
+    .description('Print or write a GitHub Actions workflow for automated snapshots')
+    .option('--out <path>', 'Write workflow file (default: .github/workflows/sublyzer-snapshot.yml)')
+    .option('--print', 'Print template to stdout only')
+    .action(async (opts) => {
+    try {
+        await runCi({ out: opts.out, print: opts.print ?? !opts.out });
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('pull')
+    .description('Fetch integration data from Sublyzer (requires apiReadKey)')
+    .option('--read-key <key>', 'apiReadKey; or SUBLYZER_READ_KEY in env/config')
+    .option('--limit <n>', 'Max events', (v) => parseInt(v, 10))
+    .option('--window-days <n>', 'Lookback window in days', (v) => parseInt(v, 10))
+    .option('--include <csv>', 'stats,events,telemetry,performance,sdkStatus,activeErrors')
+    .option('--json', 'Output raw API JSON only')
+    .action(async (opts) => {
+    try {
+        const data = await runPull({
+            readKey: opts.readKey,
+            limit: opts.limit,
+            windowDays: opts.windowDays,
+            include: opts.include,
+            json: opts.json,
+        });
+        if (opts.json)
+            console.log(JSON.stringify(data, null, 2));
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program
+    .command('open')
+    .description('Open the Sublyzer dashboard for this integration')
+    .action(async () => {
+    try {
+        await runOpen();
+    }
+    catch (e) {
+        handleError(e);
+    }
+});
+program.parseAsync(process.argv).catch((e) => {
+    console.error(`[${SDK_NAME}]`, e);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,cAAc,GAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;AAE9E,OAAO;KACJ,IAAI,CAAC,mBAAmB,CAAC;KACzB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC;KACpF,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;KAChF,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;KACrD,MAAM,CAAC,WAAW,EAAE,uCAAuC,CAAC;KAC5D,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;KACxD,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;KACjD,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,QAAQ,EAAE,4CAA4C,CAAC;KAC9D,MAAM,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;SACP,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,6DAA6D,CAAC;KAC1E,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;KAChD,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;KACvD,MAAM,CAAC,cAAc,EAAE,gCAAgC,CAAC;KACxD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,cAAc,EAAE,gDAAgD,CAAC;KACxE,MAAM,CAAC,UAAU,EAAE,oDAAoD,CAAC;KACxE,MAAM,CAAC,cAAc,EAAE,gCAAgC,CAAC;KACxD,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,IAAI,CAAC;KACb,WAAW,CAAC,kEAAkE,CAAC;KAC/E,MAAM,CAAC,cAAc,EAAE,wEAAwE,CAAC;KAChG,MAAM,CAAC,SAAS,EAAE,+BAA+B,CAAC;KAClD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,kBAAkB,EAAE,gDAAgD,CAAC;KAC5E,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KAC3D,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KAC9E,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,CAAC;KACtF,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,WAAW,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/ci.d.ts

@@ -0,0 +1,9 @@
+export type CiOptions = {
+    out?: string;
+    print?: boolean;
+};
+export declare function runCi(opts?: CiOptions): Promise<{
+    path: string;
+    content: string;
+}>;
+//# sourceMappingURL=ci.d.ts.map

package/dist/commands/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/commands/ci.ts"],"names":[],"mappings":"AAgDA,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,wBAAsB,KAAK,CAAC,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB5F"}