toolip 1.0.6 → 1.0.7

package/dist/src/core/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/core/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEnD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,SAAS,CACb,QAAQ,EACR;;;CAGH,EACG,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE7B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/core/learn.d.ts

@@ -0,0 +1,11 @@
+export type LearnTopic = {
+    id: string;
+    title: string;
+    explanation: string;
+    risks: string[];
+    mistakes: string[];
+    secureExamples: string[];
+    bestPractices: string[];
+};
+export declare function listLearnTopics(): LearnTopic[];
+export declare function getLearnTopic(topic: string): LearnTopic | null;

package/dist/src/core/learn.js

@@ -0,0 +1,163 @@
+const topics = {
+    cors: {
+        id: 'cors',
+        title: 'CORS Security',
+        explanation: 'CORS controls which origins can access browser-protected resources from your API.',
+        risks: [
+            'Overly broad origins can expose APIs to untrusted frontends.',
+            'Credentials with wildcard origins can create serious access-control mistakes.'
+        ],
+        mistakes: [
+            'Using origin: "*" for authenticated APIs.',
+            'Using the same CORS policy in development and production.'
+        ],
+        secureExamples: [
+            'Allow only https://yourdomain.com in production.',
+            'Use environment-specific allowed origin lists.'
+        ],
+        bestPractices: [
+            'Avoid wildcard origins for sensitive APIs.',
+            'Review CORS together with cookies, credentials, and authentication.'
+        ]
+    },
+    jwt: {
+        id: 'jwt',
+        title: 'JWT Security',
+        explanation: 'JWTs are signed tokens used to represent claims, identity, and authorization context.',
+        risks: [
+            'Weak secrets allow token forgery.',
+            'Long-lived tokens increase impact after theft.'
+        ],
+        mistakes: [
+            'Using "secret" or "password" as the JWT secret.',
+            'Setting access tokens to last for months or years.'
+        ],
+        secureExamples: [
+            'Use a long random secret from a secret manager.',
+            'Use short access-token lifetimes with refresh-token rotation.'
+        ],
+        bestPractices: [
+            'Validate issuer, audience, signature, and expiry.',
+            'Never store JWT secrets in source code.'
+        ]
+    },
+    xss: {
+        id: 'xss',
+        title: 'Cross-Site Scripting',
+        explanation: 'XSS happens when untrusted input is rendered as executable browser code.',
+        risks: [
+            'Session theft.',
+            'Account takeover.',
+            'Malicious actions performed as the user.'
+        ],
+        mistakes: [
+            'Rendering raw HTML from users.',
+            'Trusting sanitized content without context-aware escaping.'
+        ],
+        secureExamples: [
+            'Escape output by default.',
+            'Use CSP to reduce script execution risk.'
+        ],
+        bestPractices: [
+            'Avoid dangerous HTML injection APIs.',
+            'Sanitize rich text with a trusted sanitizer.'
+        ]
+    },
+    csrf: {
+        id: 'csrf',
+        title: 'Cross-Site Request Forgery',
+        explanation: 'CSRF tricks a logged-in browser into sending unwanted authenticated requests.',
+        risks: [
+            'Unauthorized state changes.',
+            'Account setting changes.',
+            'Financial or administrative actions triggered silently.'
+        ],
+        mistakes: [
+            'Relying only on cookies for authentication.',
+            'Not using SameSite cookie settings.'
+        ],
+        secureExamples: [
+            'Use SameSite=Lax or SameSite=Strict cookies.',
+            'Use CSRF tokens for sensitive state-changing requests.'
+        ],
+        bestPractices: [
+            'Require explicit anti-CSRF protection for cookie-authenticated apps.',
+            'Avoid GET requests for state-changing operations.'
+        ]
+    },
+    secrets: {
+        id: 'secrets',
+        title: 'Secrets Management',
+        explanation: 'Secrets are credentials such as API keys, tokens, passwords, and private keys.',
+        risks: [
+            'Committed secrets can be copied forever from Git history.',
+            'Leaked credentials can grant attackers access to production systems.'
+        ],
+        mistakes: [
+            'Storing secrets in .env files committed to Git.',
+            'Hardcoding API keys in source files.'
+        ],
+        secureExamples: [
+            'Use environment variables or encrypted local vaults.',
+            'Rotate credentials after exposure.'
+        ],
+        bestPractices: [
+            'Keep .env files ignored.',
+            'Commit only safe .env.example files.',
+            'Scan before committing.'
+        ]
+    },
+    auth: {
+        id: 'auth',
+        title: 'Authentication and Authorization',
+        explanation: 'Authentication verifies identity; authorization decides what that identity can access.',
+        risks: [
+            'Broken access control.',
+            'Privilege escalation.',
+            'Session compromise.'
+        ],
+        mistakes: [
+            'Checking only if a user is logged in.',
+            'Trusting client-side roles.'
+        ],
+        secureExamples: [
+            'Check permissions on the server for every protected action.',
+            'Use least privilege access rules.'
+        ],
+        bestPractices: [
+            'Separate authentication from authorization.',
+            'Log sensitive access and permission changes.'
+        ]
+    },
+    dependencies: {
+        id: 'dependencies',
+        title: 'Dependency Security',
+        explanation: 'Dependency security is about managing risk from third-party packages.',
+        risks: [
+            'Deprecated packages may stop receiving fixes.',
+            'Typosquatted packages can impersonate popular libraries.',
+            'Transitive dependencies can introduce hidden risk.'
+        ],
+        mistakes: [
+            'Installing packages without checking maintainers.',
+            'Ignoring deprecated package warnings.',
+            'Allowing dependency bloat.'
+        ],
+        secureExamples: [
+            'Inspect package health before adoption.',
+            'Prefer maintained packages with active releases.'
+        ],
+        bestPractices: [
+            'Review lockfile changes.',
+            'Use small dependency surfaces.',
+            'Replace abandoned packages early.'
+        ]
+    }
+};
+export function listLearnTopics() {
+    return Object.values(topics);
+}
+export function getLearnTopic(topic) {
+    return topics[topic.toLowerCase()] ?? null;
+}
+//# sourceMappingURL=learn.js.map

package/dist/src/core/learn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"learn.js","sourceRoot":"","sources":["../../../src/core/learn.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,GAA+B;IACzC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,mFAAmF;QAChG,KAAK,EAAE;YACL,8DAA8D;YAC9D,+EAA+E;SAChF;QACD,QAAQ,EAAE;YACR,2CAA2C;YAC3C,2DAA2D;SAC5D;QACD,cAAc,EAAE;YACd,kDAAkD;YAClD,gDAAgD;SACjD;QACD,aAAa,EAAE;YACb,4CAA4C;YAC5C,qEAAqE;SACtE;KACF;IACD,GAAG,EAAE;QACH,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,uFAAuF;QACpG,KAAK,EAAE;YACL,mCAAmC;YACnC,gDAAgD;SACjD;QACD,QAAQ,EAAE;YACR,iDAAiD;YACjD,oDAAoD;SACrD;QACD,cAAc,EAAE;YACd,iDAAiD;YACjD,+DAA+D;SAChE;QACD,aAAa,EAAE;YACb,mDAAmD;YACnD,yCAAyC;SAC1C;KACF;IACD,GAAG,EAAE;QACH,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,0EAA0E;QACvF,KAAK,EAAE;YACL,gBAAgB;YAChB,mBAAmB;YACnB,0CAA0C;SAC3C;QACD,QAAQ,EAAE;YACR,gCAAgC;YAChC,4DAA4D;SAC7D;QACD,cAAc,EAAE;YACd,2BAA2B;YAC3B,0CAA0C;SAC3C;QACD,aAAa,EAAE;YACb,sCAAsC;YACtC,8CAA8C;SAC/C;KACF;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,+EAA+E;QAC5F,KAAK,EAAE;YACL,6BAA6B;YAC7B,0BAA0B;YAC1B,yDAAyD;SAC1D;QACD,QAAQ,EAAE;YACR,6CAA6C;YAC7C,qCAAqC;SACtC;QACD,cAAc,EAAE;YACd,8CAA8C;YAC9C,wDAAwD;SACzD;QACD,aAAa,EAAE;YACb,sEAAsE;YACtE,mDAAmD;SACpD;KACF;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,gFAAgF;QAC7F,KAAK,EAAE;YACL,2DAA2D;YAC3D,sEAAsE;SACvE;QACD,QAAQ,EAAE;YACR,iDAAiD;YACjD,sCAAsC;SACvC;QACD,cAAc,EAAE;YACd,sDAAsD;YACtD,oCAAoC;SACrC;QACD,aAAa,EAAE;YACb,0BAA0B;YAC1B,sCAAsC;YACtC,yBAAyB;SAC1B;KACF;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,wFAAwF;QACrG,KAAK,EAAE;YACL,wBAAwB;YACxB,uBAAuB;YACvB,qBAAqB;SACtB;QACD,QAAQ,EAAE;YACR,uCAAuC;YACvC,6BAA6B;SAC9B;QACD,cAAc,EAAE;YACd,6DAA6D;YAC7D,mCAAmC;SACpC;QACD,aAAa,EAAE;YACb,6CAA6C;YAC7C,8CAA8C;SAC/C;KACF;IACD,YAAY,EAAE;QACZ,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,uEAAuE;QACpF,KAAK,EAAE;YACL,+CAA+C;YAC/C,0DAA0D;YAC1D,oDAAoD;SACrD;QACD,QAAQ,EAAE;YACR,mDAAmD;YACnD,uCAAuC;YACvC,4BAA4B;SAC7B;QACD,cAAc,EAAE;YACd,yCAAyC;YACzC,kDAAkD;SACnD;QACD,aAAa,EAAE;YACb,0BAA0B;YAC1B,gCAAgC;YAChC,mCAAmC;SACpC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AAC7C,CAAC"}

package/dist/src/core/license-analysis.d.ts

@@ -0,0 +1,18 @@
+import type { ToolipFinding } from './report.js';
+export type LicenseEntry = {
+    name: string;
+    version: string;
+    license: string;
+    type: 'dependency' | 'devDependency';
+};
+export type LicenseAnalysisResult = {
+    licenses: LicenseEntry[];
+    findings: ToolipFinding[];
+    summary: {
+        total: number;
+        unknown: number;
+        restrictive: number;
+        distribution: Record<string, number>;
+    };
+};
+export declare function analyzeLicenses(root: string): Promise<LicenseAnalysisResult>;

package/dist/src/core/license-analysis.js

@@ -0,0 +1,98 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+const restrictiveLicenses = new Set([
+    'GPL',
+    'GPL-2.0',
+    'GPL-3.0',
+    'AGPL',
+    'AGPL-3.0',
+    'LGPL',
+    'LGPL-2.1',
+    'LGPL-3.0'
+]);
+export async function analyzeLicenses(root) {
+    const packageJsonPath = path.join(root, 'package.json');
+    const raw = await readFile(packageJsonPath, 'utf8');
+    const pkg = JSON.parse(raw);
+    const entries = [
+        ...Object.entries(pkg.dependencies ?? {}).map(([name, version]) => ({
+            name,
+            version,
+            license: inferLicense(name),
+            type: 'dependency'
+        })),
+        ...Object.entries(pkg.devDependencies ?? {}).map(([name, version]) => ({
+            name,
+            version,
+            license: inferLicense(name),
+            type: 'devDependency'
+        }))
+    ].sort((a, b) => a.name.localeCompare(b.name));
+    const findings = entries.flatMap(licenseToFindings);
+    const distribution = entries.reduce((summary, entry) => {
+        summary[entry.license] = (summary[entry.license] ?? 0) + 1;
+        return summary;
+    }, {});
+    return {
+        licenses: entries,
+        findings,
+        summary: {
+            total: entries.length,
+            unknown: entries.filter((entry) => entry.license === 'UNKNOWN').length,
+            restrictive: entries.filter((entry) => restrictiveLicenses.has(entry.license)).length,
+            distribution
+        }
+    };
+}
+function inferLicense(packageName) {
+    const known = {
+        '@types/node': 'MIT',
+        '@types/semver': 'MIT',
+        axios: 'MIT',
+        chalk: 'MIT',
+        commander: 'MIT',
+        express: 'MIT',
+        'fast-glob': 'MIT',
+        ignore: 'MIT',
+        ora: 'MIT',
+        pacote: 'ISC',
+        react: 'MIT',
+        request: 'Apache-2.0',
+        semver: 'ISC',
+        tsx: 'MIT',
+        typescript: 'Apache-2.0',
+        vitest: 'MIT',
+        zod: 'MIT'
+    };
+    return known[packageName] ?? 'UNKNOWN';
+}
+function licenseToFindings(entry) {
+    if (entry.license === 'UNKNOWN') {
+        return [
+            {
+                id: `TOOLIP-LICENSE-UNKNOWN-${entry.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+                title: `Unknown license: ${entry.name}`,
+                severity: 'medium',
+                category: 'license',
+                message: `${entry.name} does not have a known license in Toolip's local license intelligence map.`,
+                recommendation: 'Manually verify the package license before using it in commercial or distributed software.',
+                evidence: entry.version
+            }
+        ];
+    }
+    if (restrictiveLicenses.has(entry.license)) {
+        return [
+            {
+                id: `TOOLIP-LICENSE-RESTRICTIVE-${entry.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+                title: `Restrictive license detected: ${entry.name}`,
+                severity: 'high',
+                category: 'license',
+                message: `${entry.name} appears to use ${entry.license}, which may introduce redistribution obligations.`,
+                recommendation: 'Review the license terms with care before using this package in proprietary software.',
+                evidence: entry.license
+            }
+        ];
+    }
+    return [];
+}
+//# sourceMappingURL=license-analysis.js.map

package/dist/src/core/license-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-analysis.js","sourceRoot":"","sources":["../../../src/core/license-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAqB7B,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,SAAS;IACT,SAAS;IACT,MAAM;IACN,UAAU;IACV,MAAM;IACN,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;IAEF,MAAM,OAAO,GAAmB;QAC9B,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI;YACJ,OAAO;YACP,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,YAAqB;SAC5B,CAAC,CAAC;QACH,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrE,IAAI;YACJ,OAAO;YACP,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,eAAwB;SAC/B,CAAC,CAAC;KACJ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,QAAQ;QACR,OAAO,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,MAAM;YACtE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACrF,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,MAAM,KAAK,GAA2B;QACpC,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,KAAK;QACV,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAmB;IAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL;gBACE,EAAE,EAAE,0BAA0B,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBACtF,KAAK,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;gBACvC,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,4EAA4E;gBAClG,cAAc,EAAE,4FAA4F;gBAC5G,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL;gBACE,EAAE,EAAE,8BAA8B,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBAC1F,KAAK,EAAE,iCAAiC,KAAK,CAAC,IAAI,EAAE;gBACpD,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,mBAAmB,KAAK,CAAC,OAAO,mDAAmD;gBACzG,cAAc,EAAE,uFAAuF;gBACvG,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/src/core/load-toolip-ignore.d.ts

@@ -0,0 +1,5 @@
+export type ToolipIgnore = {
+    ignores(filePath: string): boolean;
+    patterns: string[];
+};
+export declare function loadToolipIgnore(root: string): Promise<ToolipIgnore>;

package/dist/src/core/load-toolip-ignore.js

@@ -0,0 +1,35 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import ignore from 'ignore';
+const defaultPatterns = [
+    'node_modules',
+    'dist',
+    'coverage',
+    'build',
+    '.git',
+    '.toolip-vault.json'
+];
+export async function loadToolipIgnore(root) {
+    const ignoreFile = path.join(root, '.toolipignore');
+    let customPatterns = [];
+    try {
+        const raw = await readFile(ignoreFile, 'utf8');
+        customPatterns = raw
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0 && !line.startsWith('#'));
+    }
+    catch {
+        customPatterns = [];
+    }
+    const patterns = [...defaultPatterns, ...customPatterns];
+    const ig = ignore().add(patterns);
+    return {
+        patterns,
+        ignores(filePath) {
+            const relativePath = path.relative(root, filePath).replaceAll('\\', '/');
+            return relativePath.length > 0 && ig.ignores(relativePath);
+        }
+    };
+}
+//# sourceMappingURL=load-toolip-ignore.js.map

package/dist/src/core/load-toolip-ignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-toolip-ignore.js","sourceRoot":"","sources":["../../../src/core/load-toolip-ignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAO5B,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,MAAM;IACN,UAAU;IACV,OAAO;IACP,MAAM;IACN,oBAAoB;CACrB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,cAAc,GAAa,EAAE,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,cAAc,GAAG,GAAG;aACjB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO;QACL,QAAQ;QACR,OAAO,CAAC,QAAgB;YACtB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/npm-registry.d.ts

@@ -0,0 +1,3 @@
+import { type PackageManifest } from 'pacote';
+export type NpmPackageManifest = PackageManifest;
+export declare function fetchPackageManifest(packageName: string): Promise<NpmPackageManifest>;

package/dist/src/core/npm-registry.js

@@ -0,0 +1,5 @@
+import pacote from 'pacote';
+export async function fetchPackageManifest(packageName) {
+    return pacote.manifest(packageName);
+}
+//# sourceMappingURL=npm-registry.js.map

package/dist/src/core/npm-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.js","sourceRoot":"","sources":["../../../src/core/npm-registry.ts"],"names":[],"mappings":"AAAA,OAAO,MAAgC,MAAM,QAAQ,CAAC;AAItD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/core/pre-commit.d.ts

@@ -0,0 +1,11 @@
+import type { ToolipFinding } from './report.js';
+export type PreCommitResult = {
+    passed: boolean;
+    findings: ToolipFinding[];
+    summary: {
+        critical: number;
+        high: number;
+        blocking: number;
+    };
+};
+export declare function runPreCommit(root: string): Promise<PreCommitResult>;

package/dist/src/core/pre-commit.js

@@ -0,0 +1,22 @@
+import { runGitAudit } from './git-audit.js';
+import { runSecurityDoctor } from './security-doctor.js';
+export async function runPreCommit(root) {
+    const [doctor, gitAudit] = await Promise.all([
+        runSecurityDoctor(root),
+        runGitAudit(root)
+    ]);
+    const findings = [...doctor.findings, ...gitAudit.findings];
+    const critical = findings.filter((finding) => finding.severity === 'critical').length;
+    const high = findings.filter((finding) => finding.severity === 'high').length;
+    const blocking = critical + high;
+    return {
+        passed: blocking === 0,
+        findings,
+        summary: {
+            critical,
+            high,
+            blocking
+        }
+    };
+}
+//# sourceMappingURL=pre-commit.js.map

package/dist/src/core/pre-commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-commit.js","sourceRoot":"","sources":["../../../src/core/pre-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAazD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,iBAAiB,CAAC,IAAI,CAAC;QACvB,WAAW,CAAC,IAAI,CAAC;KAClB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAEjC,OAAO;QACL,MAAM,EAAE,QAAQ,KAAK,CAAC;QACtB,QAAQ;QACR,OAAO,EAAE;YACP,QAAQ;YACR,IAAI;YACJ,QAAQ;SACT;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/profile-project.d.ts

@@ -0,0 +1,23 @@
+export type ProjectProfile = {
+    root: string;
+    name: string;
+    version: string;
+    description: string;
+    packageManager: 'npm' | 'pnpm' | 'yarn' | 'unknown';
+    hasTypeScript: boolean;
+    hasJavaScript: boolean;
+    hasReact: boolean;
+    hasExpress: boolean;
+    hasFastify: boolean;
+    hasPrisma: boolean;
+    hasDocker: boolean;
+    hasVitest: boolean;
+    hasJest: boolean;
+    hasESLint: boolean;
+    hasPrettier: boolean;
+    hasGitHubActions: boolean;
+    detected: string[];
+    languages: Record<string, number>;
+    packageScripts: string[];
+};
+export declare function profileProject(root: string): Promise<ProjectProfile>;

package/dist/src/core/profile-project.js

@@ -0,0 +1,119 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { walkProjectFiles } from './file-walker.js';
+async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function readPackageJson(root) {
+    const packagePath = path.join(root, 'package.json');
+    if (!(await fileExists(packagePath))) {
+        return {};
+    }
+    const raw = await readFile(packagePath, 'utf8');
+    return JSON.parse(raw);
+}
+function dependencyNames(packageJson) {
+    const dependencies = packageJson.dependencies;
+    const devDependencies = packageJson.devDependencies;
+    return [
+        ...Object.keys(dependencies ?? {}),
+        ...Object.keys(devDependencies ?? {})
+    ];
+}
+function packageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    return Object.keys(scripts ?? {});
+}
+async function detectPackageManager(root) {
+    if (await fileExists(path.join(root, 'pnpm-lock.yaml')))
+        return 'pnpm';
+    if (await fileExists(path.join(root, 'yarn.lock')))
+        return 'yarn';
+    if (await fileExists(path.join(root, 'package-lock.json')))
+        return 'npm';
+    return 'unknown';
+}
+function summarizeLanguages(files) {
+    const languageMap = {
+        ts: 'TypeScript',
+        tsx: 'TypeScript React',
+        js: 'JavaScript',
+        jsx: 'JavaScript React',
+        json: 'JSON',
+        yml: 'YAML',
+        yaml: 'YAML',
+        md: 'Markdown',
+        css: 'CSS',
+        html: 'HTML',
+        env: 'Environment',
+        dockerfile: 'Docker'
+    };
+    return files.reduce((summary, file) => {
+        const extension = file.extension || file.relativePath.toLowerCase();
+        const language = languageMap[extension] ?? extension.toUpperCase();
+        summary[language] = (summary[language] ?? 0) + 1;
+        return summary;
+    }, {});
+}
+export async function profileProject(root) {
+    const absoluteRoot = path.resolve(root);
+    const packageJson = await readPackageJson(absoluteRoot);
+    const deps = dependencyNames(packageJson);
+    const scripts = packageScripts(packageJson);
+    const files = await walkProjectFiles(absoluteRoot);
+    const packageManager = await detectPackageManager(absoluteRoot);
+    const profile = {
+        root: absoluteRoot,
+        name: typeof packageJson.name === 'string' ? packageJson.name : 'unknown',
+        version: typeof packageJson.version === 'string' ? packageJson.version : 'unknown',
+        description: typeof packageJson.description === 'string' ? packageJson.description : '',
+        packageManager,
+        hasTypeScript: deps.includes('typescript') || await fileExists(path.join(absoluteRoot, 'tsconfig.json')),
+        hasJavaScript: files.some((file) => ['js', 'jsx'].includes(file.extension)),
+        hasReact: deps.includes('react'),
+        hasExpress: deps.includes('express'),
+        hasFastify: deps.includes('fastify'),
+        hasPrisma: deps.includes('prisma') || deps.includes('@prisma/client'),
+        hasDocker: await fileExists(path.join(absoluteRoot, 'Dockerfile')) || await fileExists(path.join(absoluteRoot, 'docker-compose.yml')),
+        hasVitest: deps.includes('vitest'),
+        hasJest: deps.includes('jest'),
+        hasESLint: deps.includes('eslint'),
+        hasPrettier: deps.includes('prettier'),
+        hasGitHubActions: await fileExists(path.join(absoluteRoot, '.github', 'workflows')),
+        detected: [],
+        languages: summarizeLanguages(files),
+        packageScripts: scripts
+    };
+    if (profile.hasTypeScript)
+        profile.detected.push('TypeScript');
+    if (profile.hasJavaScript)
+        profile.detected.push('JavaScript');
+    if (profile.hasReact)
+        profile.detected.push('React');
+    if (profile.hasExpress)
+        profile.detected.push('Express');
+    if (profile.hasFastify)
+        profile.detected.push('Fastify');
+    if (profile.hasPrisma)
+        profile.detected.push('Prisma');
+    if (profile.hasDocker)
+        profile.detected.push('Docker');
+    if (profile.hasVitest)
+        profile.detected.push('Vitest');
+    if (profile.hasJest)
+        profile.detected.push('Jest');
+    if (profile.hasESLint)
+        profile.detected.push('ESLint');
+    if (profile.hasPrettier)
+        profile.detected.push('Prettier');
+    if (profile.hasGitHubActions)
+        profile.detected.push('GitHub Actions');
+    return profile;
+}
+//# sourceMappingURL=profile-project.js.map

package/dist/src/core/profile-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-project.js","sourceRoot":"","sources":["../../../src/core/profile-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAyBpD,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAEpD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,WAAoC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,YAAkD,CAAC;IACpF,MAAM,eAAe,GAAG,WAAW,CAAC,eAAqD,CAAC;IAE1F,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QAClC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,WAAoC;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,OAA6C,CAAC;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmD;IAC7E,MAAM,WAAW,GAA2B;QAC1C,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,kBAAkB;QACvB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,UAAU;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,aAAa;QAClB,UAAU,EAAE,QAAQ;KACrB,CAAC;IAEF,OAAO,KAAK,CAAC,MAAM,CAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAEnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAmB;QAC9B,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzE,OAAO,EAAE,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClF,WAAW,EAAE,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACvF,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACxG,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrE,SAAS,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACrI,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtC,gBAAgB,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnF,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACpC,cAAc,EAAE,OAAO;KACxB,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,gBAAgB;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/core/read-dependencies.d.ts

@@ -0,0 +1,2 @@
+import type { DependencyInfo } from './dependency-types.js';
+export declare function readDependencies(root: string): Promise<DependencyInfo[]>;

package/dist/src/core/read-dependencies.js

@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+export async function readDependencies(root) {
+    const packageJsonPath = path.join(root, 'package.json');
+    const raw = await readFile(packageJsonPath, 'utf8');
+    const pkg = JSON.parse(raw);
+    const results = [];
+    for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+        results.push({
+            name,
+            version,
+            type: 'dependency'
+        });
+    }
+    for (const [name, version] of Object.entries(pkg.devDependencies ?? {})) {
+        results.push({
+            name,
+            version,
+            type: 'devDependency'
+        });
+    }
+    return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+//# sourceMappingURL=read-dependencies.js.map

package/dist/src/core/read-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-dependencies.js","sourceRoot":"","sources":["../../../src/core/read-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;IAEF,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/src/core/report-writer.d.ts

@@ -0,0 +1,5 @@
+import type { ToolipReport } from './report.js';
+export type ReportFormat = 'json' | 'md';
+export declare function detectReportFormat(outputPath: string): ReportFormat;
+export declare function writeReport(outputPath: string, report: ToolipReport): Promise<void>;
+export declare function renderMarkdownReport(report: ToolipReport): string;