toolip 1.0.6 → 2.0.0

package/dist/src/core/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/core/score.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,cAAc,CAAC,KAAuD;IACpF,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,EAAE,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC;IACzD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,EAAE,qBAAqB,IAAI,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CAAC,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,CAC3E,CAAC;IAEF,OAAO;QACL,gBAAgB;QAChB,aAAa;QACb,qBAAqB;QACrB,SAAS;QACT,OAAO;QACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAyB;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,CAAC,CAAC;QACjD,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/core/security-doctor.d.ts

@@ -0,0 +1,12 @@
+import type { ToolipFinding } from './report.js';
+export type SecurityDoctorResult = {
+    findings: ToolipFinding[];
+    summary: {
+        filesScanned: number;
+        secrets: number;
+        dangerousCode: number;
+        configuration: number;
+        headers: number;
+    };
+};
+export declare function runSecurityDoctor(root: string): Promise<SecurityDoctorResult>;

package/dist/src/core/security-doctor.js

@@ -0,0 +1,158 @@
+import { readFile } from 'node:fs/promises';
+import { analyzeAstSource } from '../analyzers/ast/source-analysis.js';
+import { createScannerContext } from './scanner-context.js';
+import { configSecurityPatterns, secretPatterns, securityHeaderNames } from './security-patterns.js';
+const secretScanExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs',
+    'json',
+    'yml',
+    'yaml',
+    'env',
+    'txt',
+    'pem',
+    'key'
+]);
+const codeExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs'
+]);
+export async function runSecurityDoctor(root) {
+    const context = await createScannerContext(root);
+    const findings = [];
+    for (const file of context.files) {
+        if (!shouldScanSecrets(file.relativePath, file.extension)) {
+            continue;
+        }
+        let content = '';
+        try {
+            content = await readFile(file.absolutePath, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        findings.push(...scanContent(file.relativePath, content, secretPatterns));
+        if (codeExtensions.has(file.extension)) {
+            findings.push(...analyzeAstSource(file.relativePath, content).map((finding) => ({
+                id: finding.id,
+                title: finding.title,
+                severity: finding.severity,
+                category: finding.category,
+                message: finding.message,
+                recommendation: finding.remediation?.summary ??
+                    'Review the resolved AST finding.',
+                file: finding.location?.file,
+                evidence: finding.evidence?.[0]?.summary
+            })));
+            findings.push(...scanContent(file.relativePath, content, configSecurityPatterns));
+        }
+    }
+    findings.push(...detectMissingSecurityHeaders(context.files.map((file) => file.relativePath)));
+    return {
+        findings,
+        summary: {
+            filesScanned: context.files.length,
+            secrets: findings.filter((finding) => finding.category === 'secrets').length,
+            dangerousCode: findings.filter((finding) => finding.category === 'dangerous-code').length,
+            configuration: findings.filter((finding) => finding.category === 'configuration').length,
+            headers: findings.filter((finding) => finding.category === 'security-headers').length
+        }
+    };
+}
+function shouldScanSecrets(relativePath, extension) {
+    if (relativePath.endsWith('.d.ts'))
+        return false;
+    if (relativePath.endsWith('.map'))
+        return false;
+    if (relativePath.startsWith('dist/'))
+        return false;
+    if (relativePath.endsWith('.env'))
+        return true;
+    if (relativePath.includes('.env.'))
+        return true;
+    return secretScanExtensions.has(extension);
+}
+function scanContent(relativePath, content, patterns) {
+    const findings = [];
+    for (const pattern of patterns) {
+        pattern.regex.lastIndex = 0;
+        const match = pattern.regex.exec(content);
+        pattern.regex.lastIndex = 0;
+        if (!match) {
+            continue;
+        }
+        findings.push({
+            id: `${pattern.id}-${relativePath
+                .toUpperCase()
+                .replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: formatTitle(pattern, relativePath),
+            severity: resolveSeverity(pattern, relativePath),
+            category: pattern.category,
+            message: formatMessage(pattern, relativePath),
+            recommendation: pattern.recommendation,
+            file: relativePath,
+            evidence: redactEvidence(match[0])
+        });
+    }
+    return findings;
+}
+function isTestFile(relativePath) {
+    return (relativePath.startsWith('tests/') ||
+        relativePath.includes('/tests/') ||
+        relativePath.includes('/__tests__/') ||
+        /\.(test|spec)\.[cm]?[jt]sx?$/.test(relativePath));
+}
+function resolveSeverity(pattern, relativePath) {
+    if (pattern.category === 'secrets' &&
+        isTestFile(relativePath)) {
+        return 'low';
+    }
+    return pattern.severity;
+}
+function formatTitle(pattern, relativePath) {
+    if (pattern.category === 'secrets' &&
+        isTestFile(relativePath)) {
+        return `Potential test fixture: ${pattern.title}`;
+    }
+    return pattern.title;
+}
+function formatMessage(pattern, relativePath) {
+    if (pattern.category === 'secrets' &&
+        isTestFile(relativePath)) {
+        return `${pattern.message} This match is inside a test file, so Toolip reduced its severity. Confirm that it is synthetic fixture data.`;
+    }
+    return pattern.message;
+}
+function redactEvidence(value) {
+    if (value.length <= 16) {
+        return value;
+    }
+    return `${value.slice(0, 8)}...[redacted]...${value.slice(-4)}`;
+}
+function detectMissingSecurityHeaders(relativePaths) {
+    const possibleServerFiles = relativePaths.filter((file) => !file.startsWith('dist/') &&
+        /server|app|main|index|middleware/i.test(file) &&
+        /\.(js|ts|jsx|tsx|mjs|cjs)$/.test(file));
+    if (possibleServerFiles.length === 0) {
+        return [];
+    }
+    return securityHeaderNames.map((header) => ({
+        id: `TOOLIP-HEADER-VERIFY-${header
+            .toUpperCase()
+            .replaceAll('-', '_')}`,
+        title: `Verify security header: ${header}`,
+        severity: 'info',
+        category: 'security-headers',
+        message: `Toolip found server-like files. Confirm that ${header} is configured in production responses.`,
+        recommendation: 'Use Helmet or equivalent framework middleware to set secure HTTP response headers.'
+    }));
+}
+//# sourceMappingURL=security-doctor.js.map

package/dist/src/core/security-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-doctor.js","sourceRoot":"","sources":["../../../src/core/security-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EAEpB,MAAM,wBAAwB,CAAC;AAahC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IACE,CAAC,iBAAiB,CAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CACf,EACD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CACtB,IAAI,CAAC,YAAY,EACjB,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,cAAc,CACf,CACF,CAAC;QAEF,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CACjB,IAAI,CAAC,YAAY,EACjB,OAAO,CACR,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,cAAc,EACZ,OAAO,CAAC,WAAW,EAAE,OAAO;oBAC5B,kCAAkC;gBACpC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI;gBAC5B,QAAQ,EACN,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO;aACjC,CAAC,CAAC,CACJ,CAAC;YAEF,QAAQ,CAAC,IAAI,CACX,GAAG,WAAW,CACZ,IAAI,CAAC,YAAY,EACjB,OAAO,EACP,sBAAsB,CACvB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,GAAG,4BAA4B,CAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAC5B,CACF,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAClC,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,KAAK,SAAS,CACjC,CAAC,MAAM;YACR,aAAa,EAAE,QAAQ,CAAC,MAAM,CAC5B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,KAAK,gBAAgB,CACxC,CAAC,MAAM;YACR,aAAa,EAAE,QAAQ,CAAC,MAAM,CAC5B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,KAAK,eAAe,CACvC,CAAC,MAAM;YACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CACtB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,KAAK,kBAAkB,CAC1C,CAAC,MAAM;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAoB,EACpB,SAAiB;IAEjB,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAClB,YAAoB,EACpB,OAAe,EACf,QAA2B;IAE3B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAE5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY;iBAC9B,WAAW,EAAE;iBACb,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC;YACzC,QAAQ,EAAE,eAAe,CACvB,OAAO,EACP,YAAY,CACb;YACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,aAAa,CACpB,OAAO,EACP,YAAY,CACb;YACD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,CACL,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;QAChC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;QACpC,8BAA8B,CAAC,IAAI,CAAC,YAAY,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAwB,EACxB,YAAoB;IAEpB,IACE,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9B,UAAU,CAAC,YAAY,CAAC,EACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAClB,OAAwB,EACxB,YAAoB;IAEpB,IACE,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9B,UAAU,CAAC,YAAY,CAAC,EACxB,CAAC;QACD,OAAO,2BAA2B,OAAO,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,OAAwB,EACxB,YAAoB;IAEpB,IACE,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9B,UAAU,CAAC,YAAY,CAAC,EACxB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,+GAA+G,CAAC;IAC3I,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,4BAA4B,CACnC,aAAuB;IAEvB,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACzB,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;IAEF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,wBAAwB,MAAM;aAC/B,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,2BAA2B,MAAM,EAAE;QAC1C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,gDAAgD,MAAM,yCAAyC;QACxG,cAAc,EACZ,oFAAoF;KACvF,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/src/core/security-patterns.d.ts

@@ -0,0 +1,14 @@
+import type { ToolipFinding } from './report.js';
+export type SecurityPattern = {
+    id: string;
+    title: string;
+    category: string;
+    severity: ToolipFinding['severity'];
+    regex: RegExp;
+    message: string;
+    recommendation: string;
+};
+export declare const secretPatterns: SecurityPattern[];
+export declare const dangerousCodePatterns: SecurityPattern[];
+export declare const configSecurityPatterns: SecurityPattern[];
+export declare const securityHeaderNames: string[];

package/dist/src/core/security-patterns.js

@@ -0,0 +1,139 @@
+export const secretPatterns = [
+    {
+        id: 'TOOLIP-SECRET-GITHUB-TOKEN',
+        title: 'GitHub token detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g,
+        message: 'A GitHub token-like secret was found.',
+        recommendation: 'Revoke the token, remove it from Git history, and store its replacement securely.'
+    },
+    {
+        id: 'TOOLIP-SECRET-AWS-ACCESS-KEY',
+        title: 'AWS access key detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bAKIA[0-9A-Z]{16}\b/g,
+        message: 'An AWS access key-like value was found.',
+        recommendation: 'Rotate the credential immediately and audit its usage.'
+    },
+    {
+        id: 'TOOLIP-SECRET-PRIVATE-KEY',
+        title: 'Private key detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g,
+        message: 'Private key material was found.',
+        recommendation: 'Remove the key from the repository and rotate affected credentials.'
+    },
+    {
+        id: 'TOOLIP-SECRET-NPM-TOKEN',
+        title: 'npm token detected',
+        category: 'secrets',
+        severity: 'critical',
+        regex: /\bnpm_[A-Za-z0-9]{20,}\b/g,
+        message: 'An npm token-like value was found.',
+        recommendation: 'Rotate the token and store its replacement securely.'
+    },
+    {
+        id: 'TOOLIP-SECRET-HARDCODED-PASSWORD',
+        title: 'Hardcoded password detected',
+        category: 'secrets',
+        severity: 'high',
+        regex: /\b(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        message: 'A hardcoded password-like assignment was found.',
+        recommendation: 'Move passwords into environment variables or an encrypted secret manager.'
+    },
+    {
+        id: 'TOOLIP-SECRET-JWT-SECRET',
+        title: 'Hardcoded JWT secret detected',
+        category: 'secrets',
+        severity: 'high',
+        regex: /\b(jwtSecret|JWT_SECRET|jwt_secret)\s*[:=]\s*['"][^'"]{8,}['"]/g,
+        message: 'A hardcoded JWT secret was found.',
+        recommendation: 'Load a strong random secret from a secure runtime source.'
+    },
+    {
+        id: 'TOOLIP-SECRET-GENERIC-API-KEY',
+        title: 'Generic API key detected',
+        category: 'secrets',
+        severity: 'medium',
+        regex: /\b(apiKey|API_KEY|api_key)\s*[:=]\s*['"][A-Za-z0-9_-]{16,}['"]/g,
+        message: 'A hardcoded API key-like value was found.',
+        recommendation: 'Remove API keys from source code and rotate exposed credentials.'
+    }
+];
+export const dangerousCodePatterns = [
+    {
+        id: 'TOOLIP-DANGEROUS-EVAL',
+        title: 'Dangerous eval usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /\beval\s*\(/g,
+        message: 'eval() can execute arbitrary code and introduce injection risk.',
+        recommendation: 'Replace eval() with explicit parsing or safe control flow.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-NEW-FUNCTION',
+        title: 'Dangerous Function constructor usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /\bnew\s+Function\s*\(/g,
+        message: 'The Function constructor executes dynamic code.',
+        recommendation: 'Avoid runtime code generation and use explicit functions.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-CHILD-PROCESS-EXEC',
+        title: 'Unsafe child_process exec usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /(?:\bchild_process\s*\.\s*exec|(?<![\w.])exec)\s*\(/g,
+        message: 'Shell execution may become unsafe when untrusted input reaches the command.',
+        recommendation: 'Prefer execFile() or spawn() with argument arrays and strict validation.'
+    },
+    {
+        id: 'TOOLIP-DANGEROUS-EXECSYNC',
+        title: 'Unsafe execSync usage',
+        category: 'dangerous-code',
+        severity: 'high',
+        regex: /(?:\bchild_process\s*\.\s*execSync|(?<![\w.])execSync)\s*\(/g,
+        message: 'Synchronous shell execution can introduce injection and blocking risks.',
+        recommendation: 'Avoid shell execution or use safer process APIs with validated arguments.'
+    }
+];
+export const configSecurityPatterns = [
+    {
+        id: 'TOOLIP-CONFIG-OPEN-CORS',
+        title: 'Open CORS policy detected',
+        category: 'configuration',
+        severity: 'medium',
+        regex: /\borigin\s*:\s*['"]\*['"]/g,
+        message: 'CORS origin is configured as "*".',
+        recommendation: 'Restrict allowed origins to trusted domains.'
+    },
+    {
+        id: 'TOOLIP-CONFIG-WEAK-JWT-SECRET',
+        title: 'Weak JWT secret detected',
+        category: 'configuration',
+        severity: 'high',
+        regex: /\b(jwtSecret|JWT_SECRET|jwt_secret)\s*[:=]\s*['"](secret|changeme|password|123456|devsecret)['"]/gi,
+        message: 'A weak JWT secret was detected.',
+        recommendation: 'Use a long, random, high-entropy secret.'
+    },
+    {
+        id: 'TOOLIP-CONFIG-LONG-JWT-EXPIRY',
+        title: 'Long-lived JWT expiry detected',
+        category: 'configuration',
+        severity: 'medium',
+        regex: /\b(expiresIn|JWT_EXPIRES_IN)\s*[:=]\s*['"](?:365d|999d|1000d|never|10y)['"]/gi,
+        message: 'A long-lived JWT expiry was detected.',
+        recommendation: 'Use short-lived access tokens and refresh-token rotation.'
+    }
+];
+export const securityHeaderNames = [
+    'content-security-policy',
+    'strict-transport-security',
+    'x-frame-options',
+    'x-content-type-options'
+];
+//# sourceMappingURL=security-patterns.js.map

package/dist/src/core/security-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-patterns.js","sourceRoot":"","sources":["../../../src/core/security-patterns.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,OAAO,EAAE,uCAAuC;QAChD,cAAc,EACZ,mFAAmF;KACtF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,yCAAyC;QAClD,cAAc,EACZ,wDAAwD;KAC3D;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,uDAAuD;QAC9D,OAAO,EAAE,iCAAiC;QAC1C,cAAc,EACZ,qEAAqE;KACxE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,oCAAoC;QAC7C,cAAc,EACZ,sDAAsD;KACzD;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,sDAAsD;QAC7D,OAAO,EAAE,iDAAiD;QAC1D,cAAc,EACZ,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,iEAAiE;QACxE,OAAO,EAAE,mCAAmC;QAC5C,cAAc,EACZ,2DAA2D;KAC9D;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iEAAiE;QACxE,OAAO,EAAE,2CAA2C;QACpD,cAAc,EACZ,kEAAkE;KACrE;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,cAAc;QACrB,OAAO,EACL,iEAAiE;QACnE,cAAc,EACZ,4DAA4D;KAC/D;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,sCAAsC;QAC7C,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EACL,iDAAiD;QACnD,cAAc,EACZ,2DAA2D;KAC9D;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,KAAK,EAAE,iCAAiC;QACxC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,sDAAsD;QACxD,OAAO,EACL,6EAA6E;QAC/E,cAAc,EACZ,0EAA0E;KAC7E;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,8DAA8D;QAChE,OAAO,EACL,yEAAyE;QAC3E,cAAc,EACZ,2EAA2E;KAC9E;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,4BAA4B;QACnC,OAAO,EAAE,mCAAmC;QAC5C,cAAc,EACZ,8CAA8C;KACjD;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,oGAAoG;QACtG,OAAO,EAAE,iCAAiC;QAC1C,cAAc,EACZ,0CAA0C;KAC7C;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,+EAA+E;QACjF,OAAO,EAAE,uCAAuC;QAChD,cAAc,EACZ,2DAA2D;KAC9D;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,yBAAyB;IACzB,2BAA2B;IAC3B,iBAAiB;IACjB,wBAAwB;CACzB,CAAC"}

package/dist/src/core/typosquat.d.ts

@@ -0,0 +1,6 @@
+export type TyposquatResult = {
+    input: string;
+    suspected: boolean;
+    suggestions: string[];
+};
+export declare function detectTyposquat(input: string): TyposquatResult;

package/dist/src/core/typosquat.js

@@ -0,0 +1,50 @@
+const popularPackages = [
+    'express',
+    'fastify',
+    'react',
+    'vue',
+    'axios',
+    'got',
+    'lodash',
+    'typescript',
+    'commander',
+    'chalk',
+    'zod',
+    'prisma',
+    'vite',
+    'next',
+    'nestjs'
+];
+export function detectTyposquat(input) {
+    const normalized = input.trim().toLowerCase();
+    const suggestions = popularPackages
+        .map((candidate) => ({
+        candidate,
+        distance: levenshtein(normalized, candidate)
+    }))
+        .filter((item) => item.distance > 0 && item.distance <= 2)
+        .sort((a, b) => a.distance - b.distance)
+        .map((item) => item.candidate);
+    return {
+        input,
+        suspected: suggestions.length > 0,
+        suggestions
+    };
+}
+function levenshtein(a, b) {
+    const matrix = Array.from({ length: a.length + 1 }, (_, row) => Array.from({ length: b.length + 1 }, (_, col) => {
+        if (row === 0)
+            return col;
+        if (col === 0)
+            return row;
+        return 0;
+    }));
+    for (let row = 1; row <= a.length; row += 1) {
+        for (let col = 1; col <= b.length; col += 1) {
+            const cost = a[row - 1] === b[col - 1] ? 0 : 1;
+            matrix[row][col] = Math.min(matrix[row - 1][col] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col - 1] + cost);
+        }
+    }
+    return matrix[a.length][b.length];
+}
+//# sourceMappingURL=typosquat.js.map

package/dist/src/core/typosquat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat.js","sourceRoot":"","sources":["../../../src/core/typosquat.ts"],"names":[],"mappings":"AAMA,MAAM,eAAe,GAAG;IACtB,SAAS;IACT,SAAS;IACT,OAAO;IACP,KAAK;IACL,OAAO;IACP,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,MAAM,WAAW,GAAG,eAAe;SAChC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnB,SAAS;QACT,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;SACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEjC,OAAO;QACL,KAAK;QACL,SAAS,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;QACjC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1B,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CACH,CAAC;IAEF,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC5C,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CACzB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EACxB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,EACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/src/core/vault.d.ts

@@ -0,0 +1,48 @@
+export type VaultRecord = {
+    key: string;
+    value: string;
+    env: string;
+    updatedAt: string;
+};
+export type VaultFile = {
+    version: 1;
+    salt: string;
+    iv: string;
+    authTag: string;
+    data: string;
+};
+export type VaultData = {
+    secrets: VaultRecord[];
+};
+export declare function defaultVaultPath(): string;
+export declare function initVault(masterPassword: string, vaultPath?: string): Promise<void>;
+export declare function setSecret(input: {
+    key: string;
+    value: string;
+    env?: string;
+    masterPassword: string;
+    vaultPath?: string;
+}): Promise<void>;
+export declare function getSecret(input: {
+    key: string;
+    env?: string;
+    masterPassword: string;
+    vaultPath?: string;
+}): Promise<VaultRecord>;
+export declare function listSecrets(input: {
+    env?: string;
+    masterPassword: string;
+    vaultPath?: string;
+}): Promise<VaultRecord[]>;
+export declare function deleteSecret(input: {
+    key: string;
+    env?: string;
+    masterPassword: string;
+    vaultPath?: string;
+}): Promise<boolean>;
+export declare function exportEnv(input: {
+    env?: string;
+    masterPassword: string;
+    vaultPath?: string;
+}): Promise<string>;
+export declare function destroyVault(vaultPath?: string): Promise<void>;

package/dist/src/core/vault.js

@@ -0,0 +1,127 @@
+import { mkdir, readFile, writeFile, rm } from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import { ToolipError } from '../errors/toolip-error.js';
+const algorithm = 'aes-256-gcm';
+export function defaultVaultPath() {
+    return path.join(os.homedir(), '.toolip', 'vault.json');
+}
+export async function initVault(masterPassword, vaultPath = defaultVaultPath()) {
+    await writeEncryptedVault({ secrets: [] }, masterPassword, vaultPath);
+}
+export async function setSecret(input) {
+    const vaultPath = input.vaultPath ?? defaultVaultPath();
+    let data;
+    try {
+        data = await readEncryptedVault(input.masterPassword, vaultPath);
+    }
+    catch {
+        data = { secrets: [] };
+    }
+    const env = input.env ?? 'development';
+    const existing = data.secrets.find((secret) => secret.key === input.key && secret.env === env);
+    if (existing) {
+        existing.value = input.value;
+        existing.updatedAt = new Date().toISOString();
+    }
+    else {
+        data.secrets.push({
+            key: input.key,
+            value: input.value,
+            env,
+            updatedAt: new Date().toISOString()
+        });
+    }
+    await writeEncryptedVault(data, input.masterPassword, vaultPath);
+}
+export async function getSecret(input) {
+    const data = await readEncryptedVault(input.masterPassword, input.vaultPath ?? defaultVaultPath());
+    const env = input.env ?? 'development';
+    const secret = data.secrets.find((item) => item.key === input.key && item.env === env);
+    if (!secret) {
+        throw new ToolipError(`Secret not found: ${input.key}`, {
+            code: 'VAULT_SECRET_NOT_FOUND',
+            exitCode: 1
+        });
+    }
+    return secret;
+}
+export async function listSecrets(input) {
+    const data = await readEncryptedVault(input.masterPassword, input.vaultPath ?? defaultVaultPath());
+    const env = input.env;
+    return data.secrets
+        .filter((secret) => !env || secret.env === env)
+        .sort((a, b) => a.key.localeCompare(b.key));
+}
+export async function deleteSecret(input) {
+    const vaultPath = input.vaultPath ?? defaultVaultPath();
+    const data = await readEncryptedVault(input.masterPassword, vaultPath);
+    const env = input.env ?? 'development';
+    const before = data.secrets.length;
+    data.secrets = data.secrets.filter((secret) => !(secret.key === input.key && secret.env === env));
+    await writeEncryptedVault(data, input.masterPassword, vaultPath);
+    return data.secrets.length < before;
+}
+export async function exportEnv(input) {
+    const secrets = await listSecrets(input);
+    return secrets.map((secret) => `${secret.key}="${escapeEnv(secret.value)}"`).join('\n');
+}
+export async function destroyVault(vaultPath = defaultVaultPath()) {
+    await rm(vaultPath, { force: true });
+}
+async function readEncryptedVault(masterPassword, vaultPath) {
+    let raw = '';
+    try {
+        raw = await readFile(vaultPath, 'utf8');
+    }
+    catch {
+        throw new ToolipError('Vault not initialized. Run toolip vault init first.', {
+            code: 'VAULT_NOT_INITIALIZED',
+            exitCode: 1
+        });
+    }
+    const parsed = JSON.parse(raw);
+    try {
+        const key = deriveKey(masterPassword, Buffer.from(parsed.salt, 'base64'));
+        const decipher = crypto.createDecipheriv(algorithm, key, Buffer.from(parsed.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(parsed.authTag, 'base64'));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(parsed.data, 'base64')),
+            decipher.final()
+        ]);
+        return JSON.parse(decrypted.toString('utf8'));
+    }
+    catch {
+        throw new ToolipError('Invalid vault password or corrupted vault.', {
+            code: 'VAULT_DECRYPT_FAILED',
+            exitCode: 1
+        });
+    }
+}
+async function writeEncryptedVault(data, masterPassword, vaultPath) {
+    await mkdir(path.dirname(vaultPath), { recursive: true });
+    const salt = crypto.randomBytes(16);
+    const iv = crypto.randomBytes(12);
+    const key = deriveKey(masterPassword, salt);
+    const cipher = crypto.createCipheriv(algorithm, key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(JSON.stringify(data), 'utf8'),
+        cipher.final()
+    ]);
+    const file = {
+        version: 1,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: cipher.getAuthTag().toString('base64'),
+        data: encrypted.toString('base64')
+    };
+    await writeFile(vaultPath, `${JSON.stringify(file, null, 2)}\n`, 'utf8');
+}
+function deriveKey(masterPassword, salt) {
+    return crypto.scryptSync(masterPassword, salt, 32);
+}
+function escapeEnv(value) {
+    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+}
+//# sourceMappingURL=vault.js.map

package/dist/src/core/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/core/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAqBxD,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,cAAsB,EAAE,SAAS,GAAG,gBAAgB,EAAE;IACpF,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAM/B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAExD,IAAI,IAAe,CAAC;IAEpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAE/F,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG;YACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAK/B;IACC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAEvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,WAAW,CAAC,qBAAqB,KAAK,CAAC,GAAG,EAAE,EAAE;YACtD,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAIjC;IACC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAEtB,OAAO,IAAI,CAAC,OAAO;SAChB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;IAElG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEjE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAI/B;IACC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAS,GAAG,gBAAgB,EAAE;IAC/D,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,cAAsB,EAAE,SAAiB;IACzE,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,qDAAqD,EAAE;YAC3E,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,4CAA4C,EAAE;YAClE,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAe,EAAE,cAAsB,EAAE,SAAiB;IAC3F,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC3C,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,GAAc;QACtB,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnC,CAAC;IAEF,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,cAAsB,EAAE,IAAY;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/dist/src/core/watch/watch.d.ts

@@ -0,0 +1,5 @@
+export type WatchOptions = {
+    debounceMs?: number;
+    ignored?: RegExp[];
+};
+export declare function watchProject(root: string, onChange: () => Promise<void>, options?: WatchOptions): () => void;

package/dist/src/core/watch/watch.js

@@ -0,0 +1,49 @@
+import { watch } from 'node:fs';
+import path from 'node:path';
+export function watchProject(root, onChange, options = {}) {
+    const debounceMs = options.debounceMs ?? 500;
+    const ignored = options.ignored ?? [
+        /(^|\/)node_modules(\/|$)/,
+        /(^|\/)\.git(\/|$)/,
+        /(^|\/)dist(\/|$)/,
+        /(^|\/)\.toolip-report(\/|$)/
+    ];
+    let timer;
+    let running = false;
+    let queued = false;
+    const run = async () => {
+        if (running) {
+            queued = true;
+            return;
+        }
+        running = true;
+        try {
+            await onChange();
+        }
+        finally {
+            running = false;
+            if (queued) {
+                queued = false;
+                await run();
+            }
+        }
+    };
+    const watcher = watch(root, { recursive: true }, (_event, filename) => {
+        if (!filename)
+            return;
+        const normalized = filename.toString().replaceAll(path.sep, '/');
+        if (ignored.some((pattern) => pattern.test(normalized)))
+            return;
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => {
+            void run();
+        }, debounceMs);
+    });
+    return () => {
+        if (timer)
+            clearTimeout(timer);
+        watcher.close();
+    };
+}
+//# sourceMappingURL=watch.js.map

package/dist/src/core/watch/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../../../src/core/watch/watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,QAA6B,EAC7B,UAAwB,EAAE;IAE1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI;QACjC,0BAA0B;QAC1B,mBAAmB;QACnB,kBAAkB;QAClB,6BAA6B;KAC9B,CAAC;IAEF,IAAI,KAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,CAAC;YACd,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;YAEhB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QACpE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO;QAEhE,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,GAAG,EAAE,CAAC;QACb,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}