toolip 1.0.6 → 2.0.0

package/dist/src/core/profile-project.d.ts

@@ -0,0 +1,23 @@
+export type ProjectProfile = {
+    root: string;
+    name: string;
+    version: string;
+    description: string;
+    packageManager: 'npm' | 'pnpm' | 'yarn' | 'unknown';
+    hasTypeScript: boolean;
+    hasJavaScript: boolean;
+    hasReact: boolean;
+    hasExpress: boolean;
+    hasFastify: boolean;
+    hasPrisma: boolean;
+    hasDocker: boolean;
+    hasVitest: boolean;
+    hasJest: boolean;
+    hasESLint: boolean;
+    hasPrettier: boolean;
+    hasGitHubActions: boolean;
+    detected: string[];
+    languages: Record<string, number>;
+    packageScripts: string[];
+};
+export declare function profileProject(root: string): Promise<ProjectProfile>;

package/dist/src/core/profile-project.js

@@ -0,0 +1,119 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { walkProjectFiles } from './file-walker.js';
+async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function readPackageJson(root) {
+    const packagePath = path.join(root, 'package.json');
+    if (!(await fileExists(packagePath))) {
+        return {};
+    }
+    const raw = await readFile(packagePath, 'utf8');
+    return JSON.parse(raw);
+}
+function dependencyNames(packageJson) {
+    const dependencies = packageJson.dependencies;
+    const devDependencies = packageJson.devDependencies;
+    return [
+        ...Object.keys(dependencies ?? {}),
+        ...Object.keys(devDependencies ?? {})
+    ];
+}
+function packageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    return Object.keys(scripts ?? {});
+}
+async function detectPackageManager(root) {
+    if (await fileExists(path.join(root, 'pnpm-lock.yaml')))
+        return 'pnpm';
+    if (await fileExists(path.join(root, 'yarn.lock')))
+        return 'yarn';
+    if (await fileExists(path.join(root, 'package-lock.json')))
+        return 'npm';
+    return 'unknown';
+}
+function summarizeLanguages(files) {
+    const languageMap = {
+        ts: 'TypeScript',
+        tsx: 'TypeScript React',
+        js: 'JavaScript',
+        jsx: 'JavaScript React',
+        json: 'JSON',
+        yml: 'YAML',
+        yaml: 'YAML',
+        md: 'Markdown',
+        css: 'CSS',
+        html: 'HTML',
+        env: 'Environment',
+        dockerfile: 'Docker'
+    };
+    return files.reduce((summary, file) => {
+        const extension = file.extension || file.relativePath.toLowerCase();
+        const language = languageMap[extension] ?? extension.toUpperCase();
+        summary[language] = (summary[language] ?? 0) + 1;
+        return summary;
+    }, {});
+}
+export async function profileProject(root) {
+    const absoluteRoot = path.resolve(root);
+    const packageJson = await readPackageJson(absoluteRoot);
+    const deps = dependencyNames(packageJson);
+    const scripts = packageScripts(packageJson);
+    const files = await walkProjectFiles(absoluteRoot);
+    const packageManager = await detectPackageManager(absoluteRoot);
+    const profile = {
+        root: absoluteRoot,
+        name: typeof packageJson.name === 'string' ? packageJson.name : 'unknown',
+        version: typeof packageJson.version === 'string' ? packageJson.version : 'unknown',
+        description: typeof packageJson.description === 'string' ? packageJson.description : '',
+        packageManager,
+        hasTypeScript: deps.includes('typescript') || await fileExists(path.join(absoluteRoot, 'tsconfig.json')),
+        hasJavaScript: files.some((file) => ['js', 'jsx'].includes(file.extension)),
+        hasReact: deps.includes('react'),
+        hasExpress: deps.includes('express'),
+        hasFastify: deps.includes('fastify'),
+        hasPrisma: deps.includes('prisma') || deps.includes('@prisma/client'),
+        hasDocker: await fileExists(path.join(absoluteRoot, 'Dockerfile')) || await fileExists(path.join(absoluteRoot, 'docker-compose.yml')),
+        hasVitest: deps.includes('vitest'),
+        hasJest: deps.includes('jest'),
+        hasESLint: deps.includes('eslint'),
+        hasPrettier: deps.includes('prettier'),
+        hasGitHubActions: await fileExists(path.join(absoluteRoot, '.github', 'workflows')),
+        detected: [],
+        languages: summarizeLanguages(files),
+        packageScripts: scripts
+    };
+    if (profile.hasTypeScript)
+        profile.detected.push('TypeScript');
+    if (profile.hasJavaScript)
+        profile.detected.push('JavaScript');
+    if (profile.hasReact)
+        profile.detected.push('React');
+    if (profile.hasExpress)
+        profile.detected.push('Express');
+    if (profile.hasFastify)
+        profile.detected.push('Fastify');
+    if (profile.hasPrisma)
+        profile.detected.push('Prisma');
+    if (profile.hasDocker)
+        profile.detected.push('Docker');
+    if (profile.hasVitest)
+        profile.detected.push('Vitest');
+    if (profile.hasJest)
+        profile.detected.push('Jest');
+    if (profile.hasESLint)
+        profile.detected.push('ESLint');
+    if (profile.hasPrettier)
+        profile.detected.push('Prettier');
+    if (profile.hasGitHubActions)
+        profile.detected.push('GitHub Actions');
+    return profile;
+}
+//# sourceMappingURL=profile-project.js.map

package/dist/src/core/profile-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-project.js","sourceRoot":"","sources":["../../../src/core/profile-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAyBpD,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAEpD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,WAAoC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,YAAkD,CAAC;IACpF,MAAM,eAAe,GAAG,WAAW,CAAC,eAAqD,CAAC;IAE1F,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QAClC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,WAAoC;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,OAA6C,CAAC;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmD;IAC7E,MAAM,WAAW,GAA2B;QAC1C,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,kBAAkB;QACvB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,UAAU;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,aAAa;QAClB,UAAU,EAAE,QAAQ;KACrB,CAAC;IAEF,OAAO,KAAK,CAAC,MAAM,CAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAEnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAmB;QAC9B,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzE,OAAO,EAAE,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClF,WAAW,EAAE,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACvF,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACxG,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrE,SAAS,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACrI,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtC,gBAAgB,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnF,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACpC,cAAc,EAAE,OAAO;KACxB,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,gBAAgB;QAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/core/publish/html.d.ts

@@ -0,0 +1,6 @@
+import type { ToolipFinding } from '../report.js';
+export declare function renderHtmlReport(input: {
+    project: string;
+    generatedAt: string;
+    findings: ToolipFinding[];
+}): string;

package/dist/src/core/publish/html.js

@@ -0,0 +1,44 @@
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#039;');
+}
+export function renderHtmlReport(input) {
+    const rows = input.findings.map((finding) => `
+    <tr>
+      <td>${escapeHtml(finding.severity)}</td>
+      <td>${escapeHtml(finding.title)}</td>
+      <td>${escapeHtml(finding.file ?? '')}</td>
+      <td>${escapeHtml(finding.recommendation)}</td>
+    </tr>
+  `).join('');
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Toolip Security Report</title>
+<style>
+body{font-family:system-ui,sans-serif;max-width:1100px;margin:40px auto;padding:0 20px;color:#111}
+table{width:100%;border-collapse:collapse}
+th,td{border:1px solid #ddd;padding:10px;text-align:left;vertical-align:top}
+th{background:#f5f5f5}
+code{font-family:ui-monospace,monospace}
+</style>
+</head>
+<body>
+<h1>Toolip Security Report</h1>
+<p><strong>Project:</strong> ${escapeHtml(input.project)}</p>
+<p><strong>Generated:</strong> ${escapeHtml(input.generatedAt)}</p>
+<p><strong>Findings:</strong> ${input.findings.length}</p>
+<table>
+<thead><tr><th>Severity</th><th>Finding</th><th>File</th><th>Recommendation</th></tr></thead>
+<tbody>${rows}</tbody>
+</table>
+</body>
+</html>`;
+}
+//# sourceMappingURL=html.js.map

package/dist/src/core/publish/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../../src/core/publish/html.ts"],"names":[],"mappings":"AAEA,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;;YAEnC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC5B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC;;GAE3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO;;;;;;;;;;;;;;;;+BAgBsB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;iCACvB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;gCAC9B,KAAK,CAAC,QAAQ,CAAC,MAAM;;;SAG5C,IAAI;;;QAGL,CAAC;AACT,CAAC"}

package/dist/src/core/read-dependencies.d.ts

@@ -0,0 +1,2 @@
+import type { DependencyInfo } from './dependency-types.js';
+export declare function readDependencies(root: string): Promise<DependencyInfo[]>;

package/dist/src/core/read-dependencies.js

@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+export async function readDependencies(root) {
+    const packageJsonPath = path.join(root, 'package.json');
+    const raw = await readFile(packageJsonPath, 'utf8');
+    const pkg = JSON.parse(raw);
+    const results = [];
+    for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
+        results.push({
+            name,
+            version,
+            type: 'dependency'
+        });
+    }
+    for (const [name, version] of Object.entries(pkg.devDependencies ?? {})) {
+        results.push({
+            name,
+            version,
+            type: 'devDependency'
+        });
+    }
+    return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+//# sourceMappingURL=read-dependencies.js.map

package/dist/src/core/read-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-dependencies.js","sourceRoot":"","sources":["../../../src/core/read-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;IAEF,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/src/core/report-writer.d.ts

@@ -0,0 +1,5 @@
+import type { ToolipReport } from './report.js';
+export type ReportFormat = 'json' | 'md';
+export declare function detectReportFormat(outputPath: string): ReportFormat;
+export declare function writeReport(outputPath: string, report: ToolipReport): Promise<void>;
+export declare function renderMarkdownReport(report: ToolipReport): string;

package/dist/src/core/report-writer.js

@@ -0,0 +1,61 @@
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
+export function detectReportFormat(outputPath) {
+    const extension = path.extname(outputPath).toLowerCase();
+    if (extension === '.md' || extension === '.markdown') {
+        return 'md';
+    }
+    return 'json';
+}
+export async function writeReport(outputPath, report) {
+    const format = detectReportFormat(outputPath);
+    if (format === 'md') {
+        await writeFile(outputPath, renderMarkdownReport(report), 'utf8');
+        return;
+    }
+    await writeFile(outputPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+}
+export function renderMarkdownReport(report) {
+    const findings = report.findings.length
+        ? report.findings
+            .map((finding) => {
+            const fileLine = finding.file ? `\n- File: \`${finding.file}\`` : '';
+            const evidenceLine = finding.evidence ? `\n- Evidence: \`${finding.evidence}\`` : '';
+            return `### ${finding.title}
+
+- ID: \`${finding.id}\`
+- Severity: **${finding.severity.toUpperCase()}**
+- Category: ${finding.category}${fileLine}${evidenceLine}
+
+${finding.message}
+
+**Recommendation:** ${finding.recommendation}
+`;
+        })
+            .join('\n')
+        : 'No findings were detected.';
+    return `# Toolip Report
+
+Generated: ${report.generatedAt}
+
+Root: \`${report.root}\`
+
+Command: \`${report.command}\`
+
+## Summary
+
+| Severity | Count |
+|---|---:|
+| Critical | ${report.summary.critical} |
+| High | ${report.summary.high} |
+| Medium | ${report.summary.medium} |
+| Low | ${report.summary.low} |
+| Info | ${report.summary.info} |
+| Total | ${report.summary.totalFindings} |
+
+## Findings
+
+${findings}
+`;
+}
+//# sourceMappingURL=report-writer.js.map

package/dist/src/core/report-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-writer.js","sourceRoot":"","sources":["../../../src/core/report-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAAoB;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;QACrC,CAAC,CAAC,MAAM,CAAC,QAAQ;aACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAErF,OAAO,OAAO,OAAO,CAAC,KAAK;;UAE3B,OAAO,CAAC,EAAE;gBACJ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;cAChC,OAAO,CAAC,QAAQ,GAAG,QAAQ,GAAG,YAAY;;EAEtD,OAAO,CAAC,OAAO;;sBAEK,OAAO,CAAC,cAAc;CAC3C,CAAC;QACM,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,4BAA4B,CAAC;IAEjC,OAAO;;aAEI,MAAM,CAAC,WAAW;;UAErB,MAAM,CAAC,IAAI;;aAER,MAAM,CAAC,OAAO;;;;;;eAMZ,MAAM,CAAC,OAAO,CAAC,QAAQ;WAC3B,MAAM,CAAC,OAAO,CAAC,IAAI;aACjB,MAAM,CAAC,OAAO,CAAC,MAAM;UACxB,MAAM,CAAC,OAAO,CAAC,GAAG;WACjB,MAAM,CAAC,OAAO,CAAC,IAAI;YAClB,MAAM,CAAC,OAAO,CAAC,aAAa;;;;EAItC,QAAQ;CACT,CAAC;AACF,CAAC"}

package/dist/src/core/report.d.ts

@@ -0,0 +1,34 @@
+export type FindingSeverity = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export type ToolipFinding = {
+    id: string;
+    title: string;
+    severity: FindingSeverity;
+    category: string;
+    message: string;
+    recommendation: string;
+    file?: string;
+    evidence?: string;
+};
+export type ToolipReport = {
+    tool: 'toolip';
+    version: string;
+    command: string;
+    generatedAt: string;
+    root: string;
+    summary: {
+        totalFindings: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    findings: ToolipFinding[];
+};
+export declare function createReport(input: {
+    version: string;
+    command: string;
+    root: string;
+    findings: ToolipFinding[];
+}): ToolipReport;
+export declare function summarizeFindings(findings: ToolipFinding[]): ToolipReport['summary'];

package/dist/src/core/report.js

@@ -0,0 +1,26 @@
+export function createReport(input) {
+    return {
+        tool: 'toolip',
+        version: input.version,
+        command: input.command,
+        generatedAt: new Date().toISOString(),
+        root: input.root,
+        summary: summarizeFindings(input.findings),
+        findings: input.findings
+    };
+}
+export function summarizeFindings(findings) {
+    return findings.reduce((summary, finding) => {
+        summary.totalFindings += 1;
+        summary[finding.severity] += 1;
+        return summary;
+    }, {
+        totalFindings: 0,
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0
+    });
+}
+//# sourceMappingURL=report.js.map

package/dist/src/core/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/report.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACnB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC,EACD;QACE,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CACF,CAAC;AACJ,CAAC"}

package/dist/src/core/risk-score.d.ts

@@ -0,0 +1,5 @@
+export declare function calculateRiskScore(input: {
+    deprecated: boolean;
+    maintainers: number;
+    ageInDays: number | null;
+}): number;

package/dist/src/core/risk-score.js

@@ -0,0 +1,14 @@
+export function calculateRiskScore(input) {
+    let score = 0;
+    if (input.deprecated)
+        score += 40;
+    if (input.maintainers === 0)
+        score += 30;
+    else if (input.maintainers === 1)
+        score += 15;
+    if (input.ageInDays !== null && input.ageInDays > 730) {
+        score += 20;
+    }
+    return Math.min(score, 100);
+}
+//# sourceMappingURL=risk-score.js.map

package/dist/src/core/risk-score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-score.js","sourceRoot":"","sources":["../../../src/core/risk-score.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,KAIlC;IACC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,IAAI,EAAE,CAAC;IAElC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;SACpC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAE9C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACtD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/src/core/sbom/generate.d.ts

@@ -0,0 +1,2 @@
+export type SbomFormat = 'cyclonedx' | 'spdx';
+export declare function generateSbom(root: string, format: SbomFormat): Promise<Record<string, unknown>>;

package/dist/src/core/sbom/generate.js

@@ -0,0 +1,120 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { readNpmDependencyInventory } from '../dependencies/inventory.js';
+function purl(dependency) {
+    return (`pkg:npm/${encodeURIComponent(dependency.name)}@${encodeURIComponent(dependency.version)}`);
+}
+function bomRef(dependency) {
+    return purl(dependency);
+}
+function spdxId(value) {
+    return ('SPDXRef-' +
+        value.replaceAll(/[^A-Za-z0-9.-]/g, '-'));
+}
+function namespace(name, version) {
+    const digest = createHash('sha256')
+        .update(`${name}@${version}:${Date.now()}`)
+        .digest('hex')
+        .slice(0, 24);
+    return `https://toolip.dev/spdx/${encodeURIComponent(name)}/${version}/${digest}`;
+}
+export async function generateSbom(root, format) {
+    const manifest = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+    const dependencies = await readNpmDependencyInventory(root);
+    const rootName = manifest.name ?? 'unknown-project';
+    const rootVersion = manifest.version ?? '0.0.0';
+    if (format === 'cyclonedx') {
+        return {
+            bomFormat: 'CycloneDX',
+            specVersion: '1.5',
+            serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+            version: 1,
+            metadata: {
+                timestamp: new Date().toISOString(),
+                tools: [
+                    {
+                        vendor: 'Toolip',
+                        name: 'toolip'
+                    }
+                ],
+                component: {
+                    type: 'application',
+                    name: rootName,
+                    version: rootVersion,
+                    description: manifest.description
+                }
+            },
+            components: dependencies.map((dependency) => ({
+                type: 'library',
+                'bom-ref': bomRef(dependency),
+                name: dependency.name,
+                version: dependency.version,
+                scope: dependency.development
+                    ? 'optional'
+                    : 'required',
+                purl: purl(dependency),
+                properties: [
+                    {
+                        name: 'toolip:direct',
+                        value: String(dependency.direct)
+                    },
+                    {
+                        name: 'toolip:development',
+                        value: String(dependency.development)
+                    }
+                ]
+            })),
+            dependencies: dependencies.map((dependency) => ({
+                ref: bomRef(dependency),
+                dependsOn: []
+            }))
+        };
+    }
+    const documentId = 'SPDXRef-DOCUMENT';
+    const rootId = spdxId(`${rootName}-${rootVersion}`);
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: documentId,
+        name: `${rootName}-${rootVersion}`,
+        documentNamespace: namespace(rootName, rootVersion),
+        creationInfo: {
+            created: new Date().toISOString(),
+            creators: ['Tool: Toolip']
+        },
+        packages: [
+            {
+                name: rootName,
+                SPDXID: rootId,
+                versionInfo: rootVersion,
+                downloadLocation: 'NOASSERTION',
+                filesAnalyzed: false,
+                licenseConcluded: manifest.license ?? 'NOASSERTION',
+                licenseDeclared: manifest.license ?? 'NOASSERTION'
+            },
+            ...dependencies.map((dependency) => ({
+                name: dependency.name,
+                SPDXID: spdxId(`${dependency.name}-${dependency.version}`),
+                versionInfo: dependency.version,
+                downloadLocation: 'NOASSERTION',
+                filesAnalyzed: false,
+                licenseConcluded: 'NOASSERTION',
+                licenseDeclared: 'NOASSERTION',
+                externalRefs: [
+                    {
+                        referenceCategory: 'PACKAGE-MANAGER',
+                        referenceType: 'purl',
+                        referenceLocator: purl(dependency)
+                    }
+                ]
+            }))
+        ],
+        relationships: dependencies.map((dependency) => ({
+            spdxElementId: rootId,
+            relationshipType: 'DEPENDS_ON',
+            relatedSpdxElement: spdxId(`${dependency.name}-${dependency.version}`)
+        }))
+    };
+}
+//# sourceMappingURL=generate.js.map

package/dist/src/core/sbom/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../../src/core/sbom/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAE3B,MAAM,8BAA8B,CAAC;AAatC,SAAS,IAAI,CACX,UAA8B;IAE9B,OAAO,CACL,WAAW,kBAAkB,CAC3B,UAAU,CAAC,IAAI,CAChB,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,UAA8B;IAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,CACL,UAAU;QACV,KAAK,CAAC,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC1C,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,OAAO,2BAA2B,kBAAkB,CAClD,IAAI,CACL,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,MAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAC/B,MAAM,CACP,CACc,CAAC;IAElB,MAAM,YAAY,GAChB,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,IAAI,iBAAiB,CAAC;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;IAEhD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;YAC/C,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE;gBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE;oBACL;wBACE,MAAM,EAAE,QAAQ;wBAChB,IAAI,EAAE,QAAQ;qBACf;iBACF;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,WAAW;oBACpB,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC;aACF;YACD,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,KAAK,EAAE,UAAU,CAAC,WAAW;oBAC3B,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,UAAU;gBACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC;gBACtB,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,eAAe;wBACrB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;qBACjC;oBACD;wBACE,IAAI,EAAE,oBAAoB;wBAC1B,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;qBACtC;iBACF;aACF,CAAC,CAAC;YACH,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9C,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;gBACvB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CACnB,GAAG,QAAQ,IAAI,WAAW,EAAE,CAC7B,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,GAAG,QAAQ,IAAI,WAAW,EAAE;QAClC,iBAAiB,EAAE,SAAS,CAC1B,QAAQ,EACR,WAAW,CACZ;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,QAAQ,EAAE,CAAC,cAAc,CAAC;SAC3B;QACD,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,aAAa;gBAC/B,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EACd,QAAQ,CAAC,OAAO,IAAI,aAAa;gBACnC,eAAe,EACb,QAAQ,CAAC,OAAO,IAAI,aAAa;aACpC;YACD,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,MAAM,EAAE,MAAM,CACZ,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAC3C;gBACD,WAAW,EAAE,UAAU,CAAC,OAAO;gBAC/B,gBAAgB,EAAE,aAAa;gBAC/B,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,aAAa;gBAC/B,eAAe,EAAE,aAAa;gBAC9B,YAAY,EAAE;oBACZ;wBACE,iBAAiB,EAAE,iBAAiB;wBACpC,aAAa,EAAE,MAAM;wBACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC;qBACnC;iBACF;aACF,CAAC,CAAC;SACJ;QACD,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC/C,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,YAAY;YAC9B,kBAAkB,EAChB,MAAM,CACJ,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAC3C;SACJ,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/src/core/scanner-context.d.ts

@@ -0,0 +1,12 @@
+import { type ProjectFile } from './file-walker.js';
+import { type ProjectProfile } from './profile-project.js';
+export type ScannerContext = {
+    root: string;
+    profile: ProjectProfile;
+    files: ProjectFile[];
+    summary: {
+        totalFiles: number;
+        extensions: Record<string, number>;
+    };
+};
+export declare function createScannerContext(root: string): Promise<ScannerContext>;

package/dist/src/core/scanner-context.js

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { walkProjectFiles } from './file-walker.js';
+import { profileProject } from './profile-project.js';
+function summarizeExtensions(files) {
+    return files.reduce((summary, file) => {
+        const key = file.extension || 'none';
+        summary[key] = (summary[key] ?? 0) + 1;
+        return summary;
+    }, {});
+}
+export async function createScannerContext(root) {
+    const absoluteRoot = path.resolve(root);
+    const [profile, files] = await Promise.all([
+        profileProject(absoluteRoot),
+        walkProjectFiles(absoluteRoot)
+    ]);
+    return {
+        root: absoluteRoot,
+        profile,
+        files,
+        summary: {
+            totalFiles: files.length,
+            extensions: summarizeExtensions(files)
+        }
+    };
+}
+//# sourceMappingURL=scanner-context.js.map

package/dist/src/core/scanner-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-context.js","sourceRoot":"","sources":["../../../src/core/scanner-context.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAY3E,SAAS,mBAAmB,CAAC,KAAoB;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,cAAc,CAAC,YAAY,CAAC;QAC5B,gBAAgB,CAAC,YAAY,CAAC;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,OAAO;QACP,KAAK;QACL,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/score.d.ts

@@ -0,0 +1,13 @@
+import type { ToolipFinding } from './report.js';
+export type ScoreGrade = 'A' | 'B' | 'C' | 'D' | 'F';
+export type ToolipScore = {
+    dependencyHealth: number;
+    secretHygiene: number;
+    configurationSecurity: number;
+    gitSafety: number;
+    overall: number;
+    grade: ScoreGrade;
+};
+export declare function calculateScore(input?: Partial<Omit<ToolipScore, 'overall' | 'grade'>>): ToolipScore;
+export declare function calculateDependencyHealth(findings: ToolipFinding[]): number;
+export declare function gradeScore(score: number): ScoreGrade;

package/dist/src/core/score.js

@@ -0,0 +1,44 @@
+export function calculateScore(input) {
+    const dependencyHealth = clamp(input?.dependencyHealth ?? 100);
+    const secretHygiene = clamp(input?.secretHygiene ?? 100);
+    const configurationSecurity = clamp(input?.configurationSecurity ?? 100);
+    const gitSafety = clamp(input?.gitSafety ?? 100);
+    const overall = Math.round((dependencyHealth + secretHygiene + configurationSecurity + gitSafety) / 4);
+    return {
+        dependencyHealth,
+        secretHygiene,
+        configurationSecurity,
+        gitSafety,
+        overall,
+        grade: gradeScore(overall)
+    };
+}
+export function calculateDependencyHealth(findings) {
+    const penalty = findings.reduce((total, finding) => {
+        if (finding.severity === 'critical')
+            return total + 35;
+        if (finding.severity === 'high')
+            return total + 25;
+        if (finding.severity === 'medium')
+            return total + 12;
+        if (finding.severity === 'low')
+            return total + 5;
+        return total + 0;
+    }, 0);
+    return clamp(100 - penalty);
+}
+function clamp(value) {
+    return Math.max(0, Math.min(100, Math.round(value)));
+}
+export function gradeScore(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 80)
+        return 'B';
+    if (score >= 70)
+        return 'C';
+    if (score >= 60)
+        return 'D';
+    return 'F';
+}
+//# sourceMappingURL=score.js.map