toolip 1.0.0

package/LICENSE

@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) 2026 Ashibuogwu Williams
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/src/commands/alternatives.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAlternativesCommand(program: Command): void;

package/dist/src/commands/alternatives.js

@@ -0,0 +1,17 @@
+import chalk from 'chalk';
+import { findAlternatives } from '../core/alternatives.js';
+export function registerAlternativesCommand(program) {
+    program
+        .command('alternatives <package>')
+        .description('Suggest safer or better-maintained package alternatives.')
+        .action((packageName) => {
+        const result = findAlternatives(packageName);
+        console.log(chalk.bold(`Alternatives for ${result.package}`));
+        console.log('');
+        for (const alternative of result.alternatives) {
+            console.log(`${chalk.green('✓')} ${chalk.bold(alternative.name)}`);
+            console.log(`  ${alternative.reason}`);
+        }
+    });
+}
+//# sourceMappingURL=alternatives.js.map

package/dist/src/commands/alternatives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alternatives.js","sourceRoot":"","sources":["../../../src/commands/alternatives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,OAAO;SACJ,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/compare.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerCompareCommand(program: Command): void;

package/dist/src/commands/compare.js

@@ -0,0 +1,19 @@
+import { comparePackages } from '../core/compare-packages.js';
+import { printPackageComparison } from '../utils/package-output.js';
+import { ToolipError } from '../errors/toolip-error.js';
+export function registerCompareCommand(program) {
+    program
+        .command('compare <packages...>')
+        .description('Compare npm packages by maintenance and risk signals.')
+        .action(async (packageNames) => {
+        if (packageNames.length < 2) {
+            throw new ToolipError('Please provide at least two packages to compare.', {
+                code: 'COMPARE_REQUIRES_TWO_PACKAGES',
+                exitCode: 1
+            });
+        }
+        const comparison = await comparePackages(packageNames);
+        printPackageComparison(comparison);
+    });
+}
+//# sourceMappingURL=compare.js.map

package/dist/src/commands/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../src/commands/compare.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,YAAsB,EAAE,EAAE;QACvC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,kDAAkD,EAAE;gBACxE,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;QACvD,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerDoctorCommand(program: Command): void;

package/dist/src/commands/doctor.js

@@ -0,0 +1,42 @@
+import chalk from 'chalk';
+import { createScannerContext } from '../core/scanner-context.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary, printScannerContext } from '../utils/output.js';
+export function registerDoctorCommand(program) {
+    program
+        .command('doctor')
+        .description('Run a full project security hygiene audit.')
+        .option('-p, --path <path>', 'Project path to audit.', process.cwd())
+        .option('-o, --output <file>', 'Write doctor report to JSON or Markdown.')
+        .action(async (options) => {
+        console.log(chalk.bold('Toolip Doctor'));
+        console.log('');
+        const context = await createScannerContext(options.path);
+        printScannerContext(context);
+        const doctor = await runSecurityDoctor(context.root);
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'doctor',
+            root: context.root,
+            findings: doctor.findings
+        });
+        console.log('');
+        console.log(chalk.bold('Security Hygiene'));
+        console.log(`${chalk.dim('Files Scanned:')} ${doctor.summary.filesScanned}`);
+        console.log(`${chalk.dim('Secrets:')} ${doctor.summary.secrets}`);
+        console.log(`${chalk.dim('Dangerous Code:')} ${doctor.summary.dangerousCode}`);
+        console.log(`${chalk.dim('Configuration:')} ${doctor.summary.configuration}`);
+        console.log(`${chalk.dim('Security Headers:')} ${doctor.summary.headers}`);
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/src/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/git-audit.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerGitAuditCommand(program: Command): void;

package/dist/src/commands/git-audit.js

@@ -0,0 +1,37 @@
+import chalk from 'chalk';
+import { runGitAudit } from '../core/git-audit.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary } from '../utils/output.js';
+export function registerGitAuditCommand(program) {
+    program
+        .command('git-audit')
+        .description('Audit Git safety, ignored files, and dangerous committed-file patterns.')
+        .option('-p, --path <path>', 'Project path to audit.', process.cwd())
+        .option('-o, --output <file>', 'Write Git audit report to JSON or Markdown.')
+        .action(async (options) => {
+        const result = await runGitAudit(options.path);
+        console.log(chalk.bold('Toolip Git Audit'));
+        console.log('');
+        console.log(`${chalk.dim('Files Checked:')} ${result.summary.filesChecked}`);
+        console.log(`${chalk.dim('Dangerous Files:')} ${result.summary.dangerousFiles}`);
+        console.log(`${chalk.dim('.gitignore Present:')} ${result.summary.gitignorePresent ? 'yes' : 'no'}`);
+        console.log(`${chalk.dim('.env Ignored:')} ${result.summary.envIgnored ? 'yes' : 'no'}`);
+        console.log(`${chalk.dim('PEM Ignored:')} ${result.summary.pemIgnored ? 'yes' : 'no'}`);
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'git-audit',
+            root: options.path,
+            findings: result.findings
+        });
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=git-audit.js.map

package/dist/src/commands/git-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-audit.js","sourceRoot":"","sources":["../../../src/commands/git-audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,qBAAqB,EAAE,6CAA6C,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/hook.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerHookCommand(program: Command): void;

package/dist/src/commands/hook.js

@@ -0,0 +1,16 @@
+import chalk from 'chalk';
+import { installPreCommitHook } from '../core/hooks.js';
+export function registerHookCommand(program) {
+    const hook = program
+        .command('hook')
+        .description('Install Toolip Git hooks.');
+    hook
+        .command('install')
+        .description('Install Toolip pre-commit hook.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        const hookPath = await installPreCommitHook(options.path);
+        console.log(`${chalk.green('✓')} Installed pre-commit hook at ${hookPath}`);
+    });
+}
+//# sourceMappingURL=hook.js.map

package/dist/src/commands/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/commands/hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAE5C,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/inspect.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerInspectCommand(program: Command): void;

package/dist/src/commands/inspect.js

@@ -0,0 +1,24 @@
+import chalk from 'chalk';
+import { analyzePackage } from '../core/analyze-package.js';
+import { detectTyposquat } from '../core/typosquat.js';
+import { printPackageHealth } from '../utils/package-output.js';
+export function registerInspectCommand(program) {
+    program
+        .command('inspect <package>')
+        .description('Inspect a package from npm registry.')
+        .action(async (packageName) => {
+        const typo = detectTyposquat(packageName);
+        if (typo.suspected) {
+            console.log(chalk.yellow('Potential typosquatting signal detected.'));
+            console.log(`Did you mean: ${typo.suggestions.join(', ')}`);
+            console.log('');
+        }
+        const result = await analyzePackage({
+            name: packageName,
+            version: 'latest',
+            type: 'dependency'
+        });
+        printPackageHealth(result);
+    });
+}
+//# sourceMappingURL=inspect.js.map

package/dist/src/commands/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../../src/commands/inspect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/learn.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLearnCommand(program: Command): void;

package/dist/src/commands/learn.js

@@ -0,0 +1,42 @@
+import chalk from 'chalk';
+import { getLearnTopic, listLearnTopics } from '../core/learn.js';
+import { ToolipError } from '../errors/toolip-error.js';
+export function registerLearnCommand(program) {
+    program
+        .command('learn [topic]')
+        .description('Learn secure development concepts while using Toolip.')
+        .option('--list', 'List available learning topics.')
+        .action((topic, options) => {
+        if (options.list || !topic) {
+            console.log(chalk.bold('Toolip Learning Topics'));
+            console.log('');
+            for (const item of listLearnTopics()) {
+                console.log(`${chalk.green('✓')} ${item.id} ${chalk.dim(`— ${item.title}`)}`);
+            }
+            return;
+        }
+        const lesson = getLearnTopic(topic);
+        if (!lesson) {
+            throw new ToolipError(`Unknown learning topic: ${topic}`, {
+                code: 'LEARN_TOPIC_NOT_FOUND',
+                exitCode: 1
+            });
+        }
+        console.log(chalk.bold(lesson.title));
+        console.log('');
+        console.log(lesson.explanation);
+        console.log('');
+        printSection('Risks', lesson.risks);
+        printSection('Common Mistakes', lesson.mistakes);
+        printSection('Secure Examples', lesson.secureExamples);
+        printSection('Best Practices', lesson.bestPractices);
+    });
+}
+function printSection(title, items) {
+    console.log(chalk.bold(title));
+    for (const item of items) {
+        console.log(`${chalk.green('•')} ${item}`);
+    }
+    console.log('');
+}
+//# sourceMappingURL=learn.js.map

package/dist/src/commands/learn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"learn.js","sourceRoot":"","sources":["../../../src/commands/learn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;SACnD,MAAM,CAAC,CAAC,KAAyB,EAAE,OAA2B,EAAE,EAAE;QACjE,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,2BAA2B,KAAK,EAAE,EAAE;gBACxD,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACvD,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAe;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/src/commands/licenses.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLicensesCommand(program: Command): void;

package/dist/src/commands/licenses.js

@@ -0,0 +1,40 @@
+import chalk from 'chalk';
+import { analyzeLicenses } from '../core/license-analysis.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary } from '../utils/output.js';
+export function registerLicensesCommand(program) {
+    program
+        .command('licenses')
+        .description('Analyze dependency license inventory and restrictive license signals.')
+        .option('-p, --path <path>', 'Project path to analyze.', process.cwd())
+        .option('-o, --output <file>', 'Write license report to JSON or Markdown.')
+        .action(async (options) => {
+        const result = await analyzeLicenses(options.path);
+        console.log(chalk.bold('Toolip License Analysis'));
+        console.log('');
+        console.log(`${chalk.dim('Total Packages:')} ${result.summary.total}`);
+        console.log(`${chalk.dim('Unknown Licenses:')} ${result.summary.unknown}`);
+        console.log(`${chalk.dim('Restrictive Licenses:')} ${result.summary.restrictive}`);
+        console.log('');
+        console.log(chalk.bold('License Distribution'));
+        for (const [license, count] of Object.entries(result.summary.distribution)) {
+            console.log(`${chalk.green('✓')} ${license}: ${count}`);
+        }
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'licenses',
+            root: options.path,
+            findings: result.findings
+        });
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=licenses.js.map

package/dist/src/commands/licenses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenses.js","sourceRoot":"","sources":["../../../src/commands/licenses.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;SAC1E,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/pre-commit.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPreCommitCommand(program: Command): void;

package/dist/src/commands/pre-commit.js

@@ -0,0 +1,37 @@
+import chalk from 'chalk';
+import { runPreCommit } from '../core/pre-commit.js';
+export function registerPreCommitCommand(program) {
+    program
+        .command('pre-commit')
+        .description('Run blocking checks before a Git commit.')
+        .option('-p, --path <path>', 'Project path to check.', process.cwd())
+        .option('--show-findings', 'Print blocking findings.')
+        .action(async (options) => {
+        const result = await runPreCommit(options.path);
+        console.log(chalk.bold('Toolip Pre-Commit'));
+        console.log('');
+        console.log(`${chalk.dim('Critical:')} ${result.summary.critical}`);
+        console.log(`${chalk.dim('High:')} ${result.summary.high}`);
+        console.log(`${chalk.dim('Blocking Findings:')} ${result.summary.blocking}`);
+        if (options.showFindings && result.findings.length > 0) {
+            console.log('');
+            console.log(chalk.bold('Blocking Findings'));
+            for (const finding of result.findings.filter((item) => item.severity === 'critical' || item.severity === 'high')) {
+                console.log(`${chalk.red('✖')} ${finding.title}`);
+                if (finding.file)
+                    console.log(`  ${chalk.dim('File:')} ${finding.file}`);
+                if (finding.evidence)
+                    console.log(`  ${chalk.dim('Evidence:')} ${finding.evidence}`);
+            }
+        }
+        if (!result.passed) {
+            console.log('');
+            console.log(chalk.red('Pre-commit checks failed. Fix critical/high findings before committing.'));
+            process.exitCode = 1;
+            return;
+        }
+        console.log('');
+        console.log(chalk.green('Pre-commit checks passed.'));
+    });
+}
+//# sourceMappingURL=pre-commit.js.map

package/dist/src/commands/pre-commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-commit.js","sourceRoot":"","sources":["../../../src/commands/pre-commit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,OAAiD,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7E,IAAI,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CACnE,EAAE,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClD,IAAI,OAAO,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;YAClG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/profile.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerProfileCommand(program: Command): void;

package/dist/src/commands/profile.js

@@ -0,0 +1,18 @@
+import { profileProject } from '../core/profile-project.js';
+import { printProfile } from '../utils/output.js';
+export function registerProfileCommand(program) {
+    program
+        .command('profile')
+        .description('Fingerprint the current project and detect frameworks, languages, and tooling.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print profile as JSON.')
+        .action(async (options) => {
+        const profile = await profileProject(options.path);
+        if (options.json) {
+            console.log(JSON.stringify(profile, null, 2));
+            return;
+        }
+        printProfile(profile);
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/src/commands/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/commands/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/scan.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerScanCommand(program: Command): void;

package/dist/src/commands/scan.js

@@ -0,0 +1,48 @@
+import chalk from 'chalk';
+import { createScannerContext } from '../core/scanner-context.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { scanDependencies } from '../core/dependency-scan.js';
+import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary, printScannerContext } from '../utils/output.js';
+export function registerScanCommand(program) {
+    program
+        .command('scan')
+        .description('Scan project dependencies and security hygiene indicators.')
+        .option('-p, --path <path>', 'Project path to scan.', process.cwd())
+        .option('-o, --output <file>', 'Write scan report to JSON or Markdown.')
+        .action(async (options) => {
+        console.log(chalk.bold('Toolip Scan'));
+        console.log('');
+        const context = await createScannerContext(options.path);
+        printScannerContext(context);
+        const dependencyScan = await scanDependencies(context.root);
+        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
+        const score = calculateScore({ dependencyHealth });
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'scan',
+            root: context.root,
+            findings: dependencyScan.findings
+        });
+        console.log('');
+        console.log(chalk.bold('Dependency Intelligence'));
+        console.log(`${chalk.dim('Total Dependencies:')} ${dependencyScan.summary.totalDependencies}`);
+        console.log(`${chalk.dim('Outdated:')} ${dependencyScan.summary.outdated}`);
+        console.log(`${chalk.dim('Deprecated:')} ${dependencyScan.summary.deprecated}`);
+        console.log(`${chalk.dim('High Risk:')} ${dependencyScan.summary.highRisk}`);
+        console.log(`${chalk.dim('Medium Risk:')} ${dependencyScan.summary.mediumRisk}`);
+        console.log(`${chalk.dim('Average Risk:')} ${dependencyScan.summary.averageRiskScore}`);
+        console.log(`${chalk.dim('Dependency Health:')} ${dependencyHealth}`);
+        console.log(`${chalk.dim('Overall Grade:')} ${score.grade}`);
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACnE,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/score.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerScoreCommand(program: Command): void;

package/dist/src/commands/score.js

@@ -0,0 +1,24 @@
+import chalk from 'chalk';
+import { scanDependencies } from '../core/dependency-scan.js';
+import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+export function registerScoreCommand(program) {
+    program
+        .command('score')
+        .description('Calculate a Toolip security scorecard for the current project.')
+        .option('-p, --path <path>', 'Project path to score.', process.cwd())
+        .action(async (options) => {
+        const dependencyScan = await scanDependencies(options.path);
+        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
+        const score = calculateScore({ dependencyHealth });
+        console.log(chalk.bold('Toolip Security Scorecard'));
+        console.log('');
+        console.log(`${chalk.dim('Dependency Health ....')} ${score.dependencyHealth}`);
+        console.log(`${chalk.dim('Secret Hygiene .......')} ${score.secretHygiene}`);
+        console.log(`${chalk.dim('Configuration ........')} ${score.configurationSecurity}`);
+        console.log(`${chalk.dim('Git Safety ...........')} ${score.gitSafety}`);
+        console.log('');
+        console.log(`${chalk.dim('Overall Score ........')} ${score.overall}`);
+        console.log(`${chalk.dim('Grade ................')} ${score.grade}`);
+    });
+}
+//# sourceMappingURL=score.js.map

package/dist/src/commands/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/commands/score.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE7E,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/self-test.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerSelfTestCommand(program: Command): void;

package/dist/src/commands/self-test.js

@@ -0,0 +1,63 @@
+import chalk from 'chalk';
+import { access } from 'node:fs/promises';
+import path from 'node:path';
+import { TOOLIP_VERSION } from '../config/version.js';
+async function canAccess(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function registerSelfTestCommand(program) {
+    program
+        .command('self-test')
+        .description('Run Toolip internal diagnostics.')
+        .action(async () => {
+        const checks = [
+            {
+                label: 'CLI Loaded',
+                passed: true
+            },
+            {
+                label: 'Command Router Ready',
+                passed: true
+            },
+            {
+                label: 'Package Manifest Found',
+                passed: await canAccess(path.join(process.cwd(), 'package.json'))
+            },
+            {
+                label: 'Scanner Foundation Ready',
+                passed: true
+            },
+            {
+                label: 'Report Engine Ready',
+                passed: true
+            }
+        ];
+        console.log(chalk.bold('Toolip Self-Test'));
+        console.log(chalk.dim(`Version: ${TOOLIP_VERSION}`));
+        console.log('');
+        let failed = 0;
+        for (const check of checks) {
+            if (check.passed) {
+                console.log(`${chalk.green('✓')} ${check.label}`);
+            }
+            else {
+                failed += 1;
+                console.log(`${chalk.red('✖')} ${check.label}`);
+            }
+        }
+        console.log('');
+        if (failed > 0) {
+            console.log(chalk.red(`Toolip found ${failed} failed diagnostic check(s).`));
+            process.exitCode = 1;
+            return;
+        }
+        console.log(chalk.green('Toolip is healthy.'));
+    });
+}
+//# sourceMappingURL=self-test.js.map

package/dist/src/commands/self-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-test.js","sourceRoot":"","sources":["../../../src/commands/self-test.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG;YACb;gBACE,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;aAClE;YACD;gBACE,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,IAAI;aACb;SACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,cAAc,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,MAAM,8BAA8B,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/tree.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerTreeCommand(program: Command): void;

package/dist/src/commands/tree.js

@@ -0,0 +1,21 @@
+import chalk from 'chalk';
+import { buildDependencyTree } from '../core/dependency-tree.js';
+export function registerTreeCommand(program) {
+    program
+        .command('tree')
+        .description('Display a dependency tree summary.')
+        .option('-p, --path <path>', 'Project path to analyze.', process.cwd())
+        .action(async (options) => {
+        const tree = await buildDependencyTree(options.path);
+        console.log(chalk.bold('Toolip Dependency Tree'));
+        console.log('');
+        console.log(`${chalk.dim('Direct Dependencies:')} ${tree.summary.direct}`);
+        console.log(`${chalk.dim('Transitive Dependencies:')} ${tree.summary.transitive}`);
+        console.log(`${chalk.dim('Max Depth:')} ${tree.summary.maxDepth}`);
+        console.log('');
+        for (const dependency of tree.dependencies) {
+            console.log(`${chalk.green('├─')} ${dependency.name}@${dependency.version} ${chalk.dim(`(${dependency.type})`)}`);
+        }
+    });
+}
+//# sourceMappingURL=tree.js.map