toolip 1.0.6 → 1.0.7

package/dist/src/core/report-writer.js

@@ -0,0 +1,61 @@
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
+export function detectReportFormat(outputPath) {
+    const extension = path.extname(outputPath).toLowerCase();
+    if (extension === '.md' || extension === '.markdown') {
+        return 'md';
+    }
+    return 'json';
+}
+export async function writeReport(outputPath, report) {
+    const format = detectReportFormat(outputPath);
+    if (format === 'md') {
+        await writeFile(outputPath, renderMarkdownReport(report), 'utf8');
+        return;
+    }
+    await writeFile(outputPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+}
+export function renderMarkdownReport(report) {
+    const findings = report.findings.length
+        ? report.findings
+            .map((finding) => {
+            const fileLine = finding.file ? `\n- File: \`${finding.file}\`` : '';
+            const evidenceLine = finding.evidence ? `\n- Evidence: \`${finding.evidence}\`` : '';
+            return `### ${finding.title}
+
+- ID: \`${finding.id}\`
+- Severity: **${finding.severity.toUpperCase()}**
+- Category: ${finding.category}${fileLine}${evidenceLine}
+
+${finding.message}
+
+**Recommendation:** ${finding.recommendation}
+`;
+        })
+            .join('\n')
+        : 'No findings were detected.';
+    return `# Toolip Report
+
+Generated: ${report.generatedAt}
+
+Root: \`${report.root}\`
+
+Command: \`${report.command}\`
+
+## Summary
+
+| Severity | Count |
+|---|---:|
+| Critical | ${report.summary.critical} |
+| High | ${report.summary.high} |
+| Medium | ${report.summary.medium} |
+| Low | ${report.summary.low} |
+| Info | ${report.summary.info} |
+| Total | ${report.summary.totalFindings} |
+
+## Findings
+
+${findings}
+`;
+}
+//# sourceMappingURL=report-writer.js.map

package/dist/src/core/report-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-writer.js","sourceRoot":"","sources":["../../../src/core/report-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAAoB;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;QACrC,CAAC,CAAC,MAAM,CAAC,QAAQ;aACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAErF,OAAO,OAAO,OAAO,CAAC,KAAK;;UAE3B,OAAO,CAAC,EAAE;gBACJ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;cAChC,OAAO,CAAC,QAAQ,GAAG,QAAQ,GAAG,YAAY;;EAEtD,OAAO,CAAC,OAAO;;sBAEK,OAAO,CAAC,cAAc;CAC3C,CAAC;QACM,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,4BAA4B,CAAC;IAEjC,OAAO;;aAEI,MAAM,CAAC,WAAW;;UAErB,MAAM,CAAC,IAAI;;aAER,MAAM,CAAC,OAAO;;;;;;eAMZ,MAAM,CAAC,OAAO,CAAC,QAAQ;WAC3B,MAAM,CAAC,OAAO,CAAC,IAAI;aACjB,MAAM,CAAC,OAAO,CAAC,MAAM;UACxB,MAAM,CAAC,OAAO,CAAC,GAAG;WACjB,MAAM,CAAC,OAAO,CAAC,IAAI;YAClB,MAAM,CAAC,OAAO,CAAC,aAAa;;;;EAItC,QAAQ;CACT,CAAC;AACF,CAAC"}

package/dist/src/core/report.d.ts

@@ -0,0 +1,34 @@
+export type FindingSeverity = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export type ToolipFinding = {
+    id: string;
+    title: string;
+    severity: FindingSeverity;
+    category: string;
+    message: string;
+    recommendation: string;
+    file?: string;
+    evidence?: string;
+};
+export type ToolipReport = {
+    tool: 'toolip';
+    version: string;
+    command: string;
+    generatedAt: string;
+    root: string;
+    summary: {
+        totalFindings: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    findings: ToolipFinding[];
+};
+export declare function createReport(input: {
+    version: string;
+    command: string;
+    root: string;
+    findings: ToolipFinding[];
+}): ToolipReport;
+export declare function summarizeFindings(findings: ToolipFinding[]): ToolipReport['summary'];

package/dist/src/core/report.js

@@ -0,0 +1,26 @@
+export function createReport(input) {
+    return {
+        tool: 'toolip',
+        version: input.version,
+        command: input.command,
+        generatedAt: new Date().toISOString(),
+        root: input.root,
+        summary: summarizeFindings(input.findings),
+        findings: input.findings
+    };
+}
+export function summarizeFindings(findings) {
+    return findings.reduce((summary, finding) => {
+        summary.totalFindings += 1;
+        summary[finding.severity] += 1;
+        return summary;
+    }, {
+        totalFindings: 0,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0
+    });
+}
+//# sourceMappingURL=report.js.map

package/dist/src/core/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/report.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACnB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC,EACD;QACE,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CACF,CAAC;AACJ,CAAC"}

package/dist/src/core/risk-score.d.ts

@@ -0,0 +1,5 @@
+export declare function calculateRiskScore(input: {
+    deprecated: boolean;
+    maintainers: number;
+    ageInDays: number | null;
+}): number;

package/dist/src/core/risk-score.js

@@ -0,0 +1,14 @@
+export function calculateRiskScore(input) {
+    let score = 0;
+    if (input.deprecated)
+        score += 40;
+    if (input.maintainers === 0)
+        score += 30;
+    else if (input.maintainers === 1)
+        score += 15;
+    if (input.ageInDays !== null && input.ageInDays > 730) {
+        score += 20;
+    }
+    return Math.min(score, 100);
+}
+//# sourceMappingURL=risk-score.js.map

package/dist/src/core/risk-score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-score.js","sourceRoot":"","sources":["../../../src/core/risk-score.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,KAIlC;IACC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,IAAI,EAAE,CAAC;IAElC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SACpC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAE9C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACtD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/src/core/scanner-context.d.ts

@@ -0,0 +1,12 @@
+import { type ProjectFile } from './file-walker.js';
+import { type ProjectProfile } from './profile-project.js';
+export type ScannerContext = {
+    root: string;
+    profile: ProjectProfile;
+    files: ProjectFile[];
+    summary: {
+        totalFiles: number;
+        extensions: Record<string, number>;
+    };
+};
+export declare function createScannerContext(root: string): Promise<ScannerContext>;

package/dist/src/core/scanner-context.js

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { walkProjectFiles } from './file-walker.js';
+import { profileProject } from './profile-project.js';
+function summarizeExtensions(files) {
+    return files.reduce((summary, file) => {
+        const key = file.extension || 'none';
+        summary[key] = (summary[key] ?? 0) + 1;
+        return summary;
+    }, {});
+}
+export async function createScannerContext(root) {
+    const absoluteRoot = path.resolve(root);
+    const [profile, files] = await Promise.all([
+        profileProject(absoluteRoot),
+        walkProjectFiles(absoluteRoot)
+    ]);
+    return {
+        root: absoluteRoot,
+        profile,
+        files,
+        summary: {
+            totalFiles: files.length,
+            extensions: summarizeExtensions(files)
+        }
+    };
+}
+//# sourceMappingURL=scanner-context.js.map

package/dist/src/core/scanner-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-context.js","sourceRoot":"","sources":["../../../src/core/scanner-context.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAY3E,SAAS,mBAAmB,CAAC,KAAoB;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,cAAc,CAAC,YAAY,CAAC;QAC5B,gBAAgB,CAAC,YAAY,CAAC;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,OAAO;QACP,KAAK;QACL,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/score.d.ts

@@ -0,0 +1,13 @@
+import type { ToolipFinding } from './report.js';
+export type ScoreGrade = 'A' | 'B' | 'C' | 'D' | 'F';
+export type ToolipScore = {
+    dependencyHealth: number;
+    secretHygiene: number;
+    configurationSecurity: number;
+    gitSafety: number;
+    overall: number;
+    grade: ScoreGrade;
+};
+export declare function calculateScore(input?: Partial<Omit<ToolipScore, 'overall' | 'grade'>>): ToolipScore;
+export declare function calculateDependencyHealth(findings: ToolipFinding[]): number;
+export declare function gradeScore(score: number): ScoreGrade;

package/dist/src/core/score.js

@@ -0,0 +1,44 @@
+export function calculateScore(input) {
+    const dependencyHealth = clamp(input?.dependencyHealth ?? 100);
+    const secretHygiene = clamp(input?.secretHygiene ?? 100);
+    const configurationSecurity = clamp(input?.configurationSecurity ?? 100);
+    const gitSafety = clamp(input?.gitSafety ?? 100);
+    const overall = Math.round((dependencyHealth + secretHygiene + configurationSecurity + gitSafety) / 4);
+    return {
+        dependencyHealth,
+        secretHygiene,
+        configurationSecurity,
+        gitSafety,
+        overall,
+        grade: gradeScore(overall)
+    };
+}
+export function calculateDependencyHealth(findings) {
+    const penalty = findings.reduce((total, finding) => {
+        if (finding.severity === 'critical')
+            return total + 35;
+        if (finding.severity === 'high')
+            return total + 25;
+        if (finding.severity === 'medium')
+            return total + 12;
+        if (finding.severity === 'low')
+            return total + 5;
+        return total + 0;
+    }, 0);
+    return clamp(100 - penalty);
+}
+function clamp(value) {
+    return Math.max(0, Math.min(100, Math.round(value)));
+}
+export function gradeScore(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 80)
+        return 'B';
+    if (score >= 70)
+        return 'C';
+    if (score >= 60)
+        return 'D';
+    return 'F';
+}
+//# sourceMappingURL=score.js.map

package/dist/src/core/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/core/score.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,cAAc,CAAC,KAAuD;IACpF,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,EAAE,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC;IACzD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,EAAE,qBAAqB,IAAI,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CAAC,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,CAC3E,CAAC;IAEF,OAAO;QACL,gBAAgB;QAChB,aAAa;QACb,qBAAqB;QACrB,SAAS;QACT,OAAO;QACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAyB;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,CAAC,CAAC;QACjD,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/core/security-doctor.d.ts

@@ -0,0 +1,12 @@
+import type { ToolipFinding } from './report.js';
+export type SecurityDoctorResult = {
+    findings: ToolipFinding[];
+    summary: {
+        filesScanned: number;
+        secrets: number;
+        dangerousCode: number;
+        configuration: number;
+        headers: number;
+    };
+};
+export declare function runSecurityDoctor(root: string): Promise<SecurityDoctorResult>;

package/dist/src/core/security-doctor.js

@@ -0,0 +1,144 @@
+import { readFile } from 'node:fs/promises';
+import { createScannerContext } from './scanner-context.js';
+import { configSecurityPatterns, dangerousCodePatterns, secretPatterns, securityHeaderNames } from './security-patterns.js';
+const secretScanExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs',
+    'json',
+    'yml',
+    'yaml',
+    'env',
+    'txt',
+    'pem',
+    'key'
+]);
+const codeExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs'
+]);
+export async function runSecurityDoctor(root) {
+    const context = await createScannerContext(root);
+    const findings = [];
+    for (const file of context.files) {
+        if (!shouldScanSecrets(file.relativePath, file.extension)) {
+            continue;
+        }
+        let content = '';
+        try {
+            content = await readFile(file.absolutePath, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        findings.push(...scanContent(file.relativePath, content, secretPatterns));
+        if (codeExtensions.has(file.extension)) {
+            findings.push(...scanContent(file.relativePath, content, dangerousCodePatterns));
+            findings.push(...scanContent(file.relativePath, content, configSecurityPatterns));
+        }
+    }
+    findings.push(...detectMissingSecurityHeaders(context.files.map((file) => file.relativePath)));
+    return {
+        findings,
+        summary: {
+            filesScanned: context.files.length,
+            secrets: findings.filter((finding) => finding.category === 'secrets').length,
+            dangerousCode: findings.filter((finding) => finding.category === 'dangerous-code').length,
+            configuration: findings.filter((finding) => finding.category === 'configuration').length,
+            headers: findings.filter((finding) => finding.category === 'security-headers').length
+        }
+    };
+}
+function shouldScanSecrets(relativePath, extension) {
+    if (relativePath.endsWith('.d.ts'))
+        return false;
+    if (relativePath.endsWith('.map'))
+        return false;
+    if (relativePath.startsWith('dist/'))
+        return false;
+    if (relativePath.endsWith('.env'))
+        return true;
+    if (relativePath.includes('.env.'))
+        return true;
+    return secretScanExtensions.has(extension);
+}
+function scanContent(relativePath, content, patterns) {
+    const findings = [];
+    for (const pattern of patterns) {
+        pattern.regex.lastIndex = 0;
+        const match = pattern.regex.exec(content);
+        pattern.regex.lastIndex = 0;
+        if (!match) {
+            continue;
+        }
+        findings.push({
+            id: `${pattern.id}-${relativePath
+                .toUpperCase()
+                .replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: formatTitle(pattern, relativePath),
+            severity: resolveSeverity(pattern, relativePath),
+            category: pattern.category,
+            message: formatMessage(pattern, relativePath),
+            recommendation: pattern.recommendation,
+            file: relativePath,
+            evidence: redactEvidence(match[0])
+        });
+    }
+    return findings;
+}
+function isTestFile(relativePath) {
+    return (relativePath.startsWith('tests/') ||
+        relativePath.includes('/tests/') ||
+        relativePath.includes('/__tests__/') ||
+        /\.(test|spec)\.[cm]?[jt]sx?$/.test(relativePath));
+}
+function resolveSeverity(pattern, relativePath) {
+    if (pattern.category === 'secrets' && isTestFile(relativePath)) {
+        return 'low';
+    }
+    return pattern.severity;
+}
+function formatTitle(pattern, relativePath) {
+    if (pattern.category === 'secrets' && isTestFile(relativePath)) {
+        return `Potential test fixture: ${pattern.title}`;
+    }
+    return pattern.title;
+}
+function formatMessage(pattern, relativePath) {
+    if (pattern.category === 'secrets' && isTestFile(relativePath)) {
+        return `${pattern.message} This match is inside a test file, so Toolip reduced its severity. Confirm that it is synthetic fixture data.`;
+    }
+    return pattern.message;
+}
+function redactEvidence(value) {
+    if (value.length <= 16) {
+        return value;
+    }
+    return `${value.slice(0, 8)}...[redacted]...${value.slice(-4)}`;
+}
+function detectMissingSecurityHeaders(relativePaths) {
+    const possibleServerFiles = relativePaths.filter((file) => !file.startsWith('dist/') &&
+        /server|app|main|index|middleware/i.test(file) &&
+        /\.(js|ts|jsx|tsx|mjs|cjs)$/.test(file));
+    if (possibleServerFiles.length === 0) {
+        return [];
+    }
+    return securityHeaderNames.map((header) => ({
+        id: `TOOLIP-HEADER-VERIFY-${header
+            .toUpperCase()
+            .replaceAll('-', '_')}`,
+        title: `Verify security header: ${header}`,
+        severity: 'info',
+        category: 'security-headers',
+        message: `Toolip found server-like files. Confirm that ${header} is configured in production responses.`,
+        recommendation: 'Use Helmet or equivalent framework middleware to set secure HTTP response headers.'
+    }));
+}
+//# sourceMappingURL=security-doctor.js.map

package/dist/src/core/security-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-doctor.js","sourceRoot":"","sources":["../../../src/core/security-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EAEpB,MAAM,wBAAwB,CAAC;AAahC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAC3D,CAAC;QAEF,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,qBAAqB,CACtB,CACF,CAAC;YAEF,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,sBAAsB,CACvB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,GAAG,4BAA4B,CAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAC/C,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAClC,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAC5C,CAAC,MAAM;YACR,aAAa,EAAE,QAAQ,CAAC,MAAM,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,gBAAgB,CACnD,CAAC,MAAM;YACR,aAAa,EAAE,QAAQ,CAAC,MAAM,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,eAAe,CAClD,CAAC,MAAM;YACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,kBAAkB,CACrD,CAAC,MAAM;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAoB,EACpB,SAAiB;IAEjB,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAClB,YAAoB,EACpB,OAAe,EACf,QAA2B;IAE3B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAE5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY;iBAC9B,WAAW,EAAE;iBACb,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC;YACzC,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC;YAC7C,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,CACL,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;QAChC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpC,8BAA8B,CAAC,IAAI,CAAC,YAAY,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAwB,EACxB,YAAoB;IAEpB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAClB,OAAwB,EACxB,YAAoB;IAEpB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,2BAA2B,OAAO,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,OAAwB,EACxB,YAAoB;IAEpB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,+GAA+G,CAAC;IAC3I,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,4BAA4B,CACnC,aAAuB;IAEvB,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACzB,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;IAEF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,wBAAwB,MAAM;aAC/B,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,2BAA2B,MAAM,EAAE;QAC1C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,gDAAgD,MAAM,yCAAyC;QACxG,cAAc,EACZ,oFAAoF;KACvF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/src/core/security-patterns.d.ts

@@ -0,0 +1,14 @@
+import type { ToolipFinding } from './report.js';
+export type SecurityPattern = {
+    id: string;
+    title: string;
+    category: string;
+    severity: ToolipFinding['severity'];
+    regex: RegExp;
+    message: string;
+    recommendation: string;
+};
+export declare const secretPatterns: SecurityPattern[];
+export declare const dangerousCodePatterns: SecurityPattern[];
+export declare const configSecurityPatterns: SecurityPattern[];
+export declare const securityHeaderNames: string[];

package/dist/src/core/security-patterns.js

@@ -0,0 +1,139 @@
+export const secretPatterns = [
+    {
+        id: 'TOOLIP-SECRET-GITHUB-TOKEN',
+        title: 'GitHub token detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g,
+        message: 'A GitHub token-like secret was found.',
+        recommendation: 'Revoke the token, remove it from Git history, and store its replacement securely.'
+    },
+    {
+        id: 'TOOLIP-SECRET-AWS-ACCESS-KEY',
+        title: 'AWS access key detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bAKIA[0-9A-Z]{16}\b/g,
+        message: 'An AWS access key-like value was found.',
+        recommendation: 'Rotate the credential immediately and audit its usage.'
+    },
+    {
+        id: 'TOOLIP-SECRET-PRIVATE-KEY',
+        title: 'Private key detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g,
+        message: 'Private key material was found.',
+        recommendation: 'Remove the key from the repository and rotate affected credentials.'
+    },
+    {
+        id: 'TOOLIP-SECRET-NPM-TOKEN',
+        title: 'npm token detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bnpm_[A-Za-z0-9]{20,}\b/g,
+        message: 'An npm token-like value was found.',
+        recommendation: 'Rotate the token and store its replacement securely.'
+    },
+    {
+        id: 'TOOLIP-SECRET-HARDCODED-PASSWORD',
+        title: 'Hardcoded password detected',
+        category: 'secrets',
+        severity: 'high',
+        regex: /\b(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        message: 'A hardcoded password-like assignment was found.',
+        recommendation: 'Move passwords into environment variables or an encrypted secret manager.'
+    },
+    {
+        id: 'TOOLIP-SECRET-JWT-SECRET',
+        title: 'Hardcoded JWT secret detected',
+        category: 'secrets',
+        severity: 'high',
+        regex: /\b(jwtSecret|JWT_SECRET|jwt_secret)\s*[:=]\s*['"][^'"]{8,}['"]/g,
+        message: 'A hardcoded JWT secret was found.',
+        recommendation: 'Load a strong random secret from a secure runtime source.'
+    },
+    {
+        id: 'TOOLIP-SECRET-GENERIC-API-KEY',
+        title: 'Generic API key detected',
+        category: 'secrets',
+        severity: 'medium',
+        regex: /\b(apiKey|API_KEY|api_key)\s*[:=]\s*['"][A-Za-z0-9_-]{16,}['"]/g,
+        message: 'A hardcoded API key-like value was found.',
+        recommendation: 'Remove API keys from source code and rotate exposed credentials.'
+    }
+];
+export const dangerousCodePatterns = [
+    {
+        id: 'TOOLIP-DANGEROUS-EVAL',
+        title: 'Dangerous eval usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /\beval\s*\(/g,
+        message: 'eval() can execute arbitrary code and introduce injection risk.',
+        recommendation: 'Replace eval() with explicit parsing or safe control flow.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-NEW-FUNCTION',
+        title: 'Dangerous Function constructor usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /\bnew\s+Function\s*\(/g,
+        message: 'The Function constructor executes dynamic code.',
+        recommendation: 'Avoid runtime code generation and use explicit functions.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-CHILD-PROCESS-EXEC',
+        title: 'Unsafe child_process exec usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /(?:\bchild_process\s*\.\s*exec|(?<![\w.])exec)\s*\(/g,
+        message: 'Shell execution may become unsafe when untrusted input reaches the command.',
+        recommendation: 'Prefer execFile() or spawn() with argument arrays and strict validation.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-EXECSYNC',
+        title: 'Unsafe execSync usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /(?:\bchild_process\s*\.\s*execSync|(?<![\w.])execSync)\s*\(/g,
+        message: 'Synchronous shell execution can introduce injection and blocking risks.',
+        recommendation: 'Avoid shell execution or use safer process APIs with validated arguments.'
+    }
+];
+export const configSecurityPatterns = [
+    {
+        id: 'TOOLIP-CONFIG-OPEN-CORS',
+        title: 'Open CORS policy detected',
+        category: 'configuration',
+        severity: 'medium',
+        regex: /\borigin\s*:\s*['"]\*['"]/g,
+        message: 'CORS origin is configured as "*".',
+        recommendation: 'Restrict allowed origins to trusted domains.'
+    },
+    {
+        id: 'TOOLIP-CONFIG-WEAK-JWT-SECRET',
+        title: 'Weak JWT secret detected',
+        category: 'configuration',
+        severity: 'high',
+        regex: /\b(jwtSecret|JWT_SECRET|jwt_secret)\s*[:=]\s*['"](secret|changeme|password|123456|devsecret)['"]/gi,
+        message: 'A weak JWT secret was detected.',
+        recommendation: 'Use a long, random, high-entropy secret.'
+    },
+    {
+        id: 'TOOLIP-CONFIG-LONG-JWT-EXPIRY',
+        title: 'Long-lived JWT expiry detected',
+        category: 'configuration',
+        severity: 'medium',
+        regex: /\b(expiresIn|JWT_EXPIRES_IN)\s*[:=]\s*['"](?:365d|999d|1000d|never|10y)['"]/gi,
+        message: 'A long-lived JWT expiry was detected.',
+        recommendation: 'Use short-lived access tokens and refresh-token rotation.'
+    }
+];
+export const securityHeaderNames = [
+    'content-security-policy',
+    'strict-transport-security',
+    'x-frame-options',
+    'x-content-type-options'
+];
+//# sourceMappingURL=security-patterns.js.map

package/dist/src/core/security-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-patterns.js","sourceRoot":"","sources":["../../../src/core/security-patterns.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,OAAO,EAAE,uCAAuC;QAChD,cAAc,EACZ,mFAAmF;KACtF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,yCAAyC;QAClD,cAAc,EACZ,wDAAwD;KAC3D;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,uDAAuD;QAC9D,OAAO,EAAE,iCAAiC;QAC1C,cAAc,EACZ,qEAAqE;KACxE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,oCAAoC;QAC7C,cAAc,EACZ,sDAAsD;KACzD;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,sDAAsD;QAC7D,OAAO,EAAE,iDAAiD;QAC1D,cAAc,EACZ,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,iEAAiE;QACxE,OAAO,EAAE,mCAAmC;QAC5C,cAAc,EACZ,2DAA2D;KAC9D;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iEAAiE;QACxE,OAAO,EAAE,2CAA2C;QACpD,cAAc,EACZ,kEAAkE;KACrE;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,cAAc;QACrB,OAAO,EACL,iEAAiE;QACnE,cAAc,EACZ,4DAA4D;KAC/D;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,sCAAsC;QAC7C,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EACL,iDAAiD;QACnD,cAAc,EACZ,2DAA2D;KAC9D;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,KAAK,EAAE,iCAAiC;QACxC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,sDAAsD;QACxD,OAAO,EACL,6EAA6E;QAC/E,cAAc,EACZ,0EAA0E;KAC7E;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,8DAA8D;QAChE,OAAO,EACL,yEAAyE;QAC3E,cAAc,EACZ,2EAA2E;KAC9E;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,4BAA4B;QACnC,OAAO,EAAE,mCAAmC;QAC5C,cAAc,EACZ,8CAA8C;KACjD;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,oGAAoG;QACtG,OAAO,EAAE,iCAAiC;QAC1C,cAAc,EACZ,0CAA0C;KAC7C;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,+EAA+E;QACjF,OAAO,EAAE,uCAAuC;QAChD,cAAc,EACZ,2DAA2D;KAC9D;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,iBAAiB;IACjB,wBAAwB;CACzB,CAAC"}

package/dist/src/core/typosquat.d.ts

@@ -0,0 +1,6 @@
+export type TyposquatResult = {
+    input: string;
+    suspected: boolean;
+    suggestions: string[];
+};
+export declare function detectTyposquat(input: string): TyposquatResult;

package/dist/src/core/typosquat.js

@@ -0,0 +1,50 @@
+const popularPackages = [
+    'express',
+    'fastify',
+    'react',
+    'vue',
+    'axios',
+    'got',
+    'lodash',
+    'typescript',
+    'commander',
+    'chalk',
+    'zod',
+    'prisma',
+    'vite',
+    'next',
+    'nestjs'
+];
+export function detectTyposquat(input) {
+    const normalized = input.trim().toLowerCase();
+    const suggestions = popularPackages
+        .map((candidate) => ({
+        candidate,
+        distance: levenshtein(normalized, candidate)
+    }))
+        .filter((item) => item.distance > 0 && item.distance <= 2)
+        .sort((a, b) => a.distance - b.distance)
+        .map((item) => item.candidate);
+    return {
+        input,
+        suspected: suggestions.length > 0,
+        suggestions
+    };
+}
+function levenshtein(a, b) {
+    const matrix = Array.from({ length: a.length + 1 }, (_, row) => Array.from({ length: b.length + 1 }, (_, col) => {
+        if (row === 0)
+            return col;
+        if (col === 0)
+            return row;
+        return 0;
+    }));
+    for (let row = 1; row <= a.length; row += 1) {
+        for (let col = 1; col <= b.length; col += 1) {
+            const cost = a[row - 1] === b[col - 1] ? 0 : 1;
+            matrix[row][col] = Math.min(matrix[row - 1][col] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col - 1] + cost);
+        }
+    }
+    return matrix[a.length][b.length];
+}
+//# sourceMappingURL=typosquat.js.map