toolip 1.0.6 → 2.0.0

package/dist/src/analyzers/git-history/analyzer.js

@@ -0,0 +1,157 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { historicalSecretPatterns } from './secret-patterns.js';
+function redact(value) {
+    if (value.length <= 12) {
+        return '[redacted]';
+    }
+    return (`${value.slice(0, 6)}` +
+        '...[redacted]...' +
+        `${value.slice(-4)}`);
+}
+function fingerprint(value) {
+    return createHash('sha256')
+        .update(value)
+        .digest('hex');
+}
+async function gitLog(root, maxCommits, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', [
+            'log',
+            `--max-count=${maxCommits}`,
+            '--all',
+            '--no-renames',
+            '--format=__TOOLIP_COMMIT__%H%x09%an%x09%aI',
+            '--patch',
+            '--unified=0',
+            '--no-color'
+        ], {
+            cwd: root,
+            stdio: [
+                'ignore',
+                'pipe',
+                'pipe'
+            ]
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        const abort = () => {
+            child.kill('SIGTERM');
+        };
+        signal?.addEventListener('abort', abort, {
+            once: true
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            signal?.removeEventListener('abort', abort);
+            if (code !== 0) {
+                reject(new Error(stderr.trim() ||
+                    `git log exited with ${code}.`));
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+function sections(output) {
+    const rawSections = output
+        .split('__TOOLIP_COMMIT__')
+        .filter(Boolean);
+    return rawSections.map((section) => {
+        const newline = section.indexOf('\n');
+        const header = newline === -1
+            ? section
+            : section.slice(0, newline);
+        const body = newline === -1
+            ? ''
+            : section.slice(newline + 1);
+        const [commit, author, date] = header.split('\t');
+        return {
+            commit: commit ?? 'unknown',
+            author: author ?? 'unknown',
+            date: date ?? 'unknown',
+            body
+        };
+    });
+}
+function addedLines(body) {
+    return body
+        .split('\n')
+        .filter((line) => line.startsWith('+') &&
+        !line.startsWith('+++'))
+        .map((line) => line.slice(1));
+}
+export class GitHistorySecretAnalyzer {
+    maxCommits;
+    id = 'git-history-secrets';
+    version = '1.0.0';
+    constructor(maxCommits = 1000) {
+        this.maxCommits = maxCommits;
+    }
+    async analyze(context) {
+        const startedAt = performance.now();
+        const output = await gitLog(context.root, this.maxCommits, context.signal);
+        const findings = [];
+        const seen = new Set();
+        const commitSections = sections(output);
+        for (const section of commitSections) {
+            const content = addedLines(section.body).join('\n');
+            for (const pattern of historicalSecretPatterns) {
+                pattern.regex.lastIndex = 0;
+                for (const match of content.matchAll(pattern.regex)) {
+                    const value = match[0];
+                    const secretFingerprint = fingerprint(value);
+                    const key = `${pattern.id}:${section.commit}:` +
+                        secretFingerprint;
+                    if (seen.has(key)) {
+                        continue;
+                    }
+                    seen.add(key);
+                    findings.push({
+                        id: key,
+                        ruleId: pattern.id,
+                        title: pattern.title,
+                        category: 'git-history-secret',
+                        severity: pattern.severity,
+                        confidence: 'high',
+                        message: `A secret-like value was introduced in commit ${section.commit}.`,
+                        source: 'git-history',
+                        evidence: [
+                            {
+                                summary: redact(value),
+                                fingerprint: secretFingerprint
+                            }
+                        ],
+                        remediation: {
+                            summary: 'Revoke or rotate the credential immediately, then remove it from repository history using an approved history-rewrite process.'
+                        },
+                        metadata: {
+                            commit: section.commit,
+                            author: section.author,
+                            date: section.date
+                        }
+                    });
+                }
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                commitsScanned: commitSections.length,
+                findings: findings.length,
+                maxCommits: this.maxCommits
+            }
+        };
+    }
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/src/analyzers/git-history/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/git-history/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EACL,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAS9B,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,CACL,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtB,kBAAkB;QAClB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,UAAkB,EAClB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL;YACE,KAAK;YACL,eAAe,UAAU,EAAE;YAC3B,OAAO;YACP,cAAc;YACd,4CAA4C;YAC5C,SAAS;YACT,aAAa;YACb,YAAY;SACb,EACD;YACE,GAAG,EAAE,IAAI;YACT,KAAK,EAAE;gBACL,QAAQ;gBACR,MAAM;gBACN,MAAM;aACP;SACF,CACF,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAEjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,EAAE,gBAAgB,CACtB,OAAO,EACP,KAAK,EACL;YACE,IAAI,EAAE,IAAI;SACX,CACF,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,EAAE,mBAAmB,CACzB,OAAO,EACP,KAAK,CACN,CAAC;YAEF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CACJ,IAAI,KAAK,CACP,MAAM,CAAC,IAAI,EAAE;oBACb,uBAAuB,IAAI,GAAG,CAC/B,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,WAAW,GAAG,MAAM;SACvB,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,CAAC;YACZ,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEjC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAErB,OAAO;YACL,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,IAAI,EAAE,IAAI,IAAI,SAAS;YACvB,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAC1B;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,wBAAwB;IAOhB;IAJV,EAAE,GAAG,qBAAqB,CAAC;IAC3B,OAAO,GAAG,OAAO,CAAC;IAE3B,YACmB,aAAa,IAAI;QAAjB,eAAU,GAAV,UAAU,CAAO;IACjC,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,UAAU,EACf,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,CAAC,IAAI,CACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,KACE,MAAM,OAAO,IAAI,wBAAwB,EACzC,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAE5B,KACE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAC7B,OAAO,CAAC,KAAK,CACd,EACD,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACvB,MAAM,iBAAiB,GACrB,WAAW,CAAC,KAAK,CAAC,CAAC;oBAErB,MAAM,GAAG,GACP,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG;wBAClC,iBAAiB,CAAC;oBAEpB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClB,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAEd,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG;wBACP,MAAM,EAAE,OAAO,CAAC,EAAE;wBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,QAAQ,EAAE,oBAAoB;wBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,MAAM;wBAClB,OAAO,EACL,gDAAgD,OAAO,CAAC,MAAM,GAAG;wBACnE,MAAM,EAAE,aAAa;wBACrB,QAAQ,EAAE;4BACR;gCACE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;gCACtB,WAAW,EACT,iBAAiB;6BACpB;yBACF;wBACD,WAAW,EAAE;4BACX,OAAO,EACL,gIAAgI;yBACnI;wBACD,QAAQ,EAAE;4BACR,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,IAAI,EAAE,OAAO,CAAC,IAAI;yBACnB;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,cAAc,EACZ,cAAc,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM;gBACzB,UAAU,EACR,IAAI,CAAC,UAAU;aAClB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/git-history/secret-patterns.d.ts

@@ -0,0 +1,7 @@
+export type HistoricalSecretPattern = {
+    id: string;
+    title: string;
+    severity: 'critical' | 'high' | 'medium';
+    regex: RegExp;
+};
+export declare const historicalSecretPatterns: HistoricalSecretPattern[];

package/dist/src/analyzers/git-history/secret-patterns.js

@@ -0,0 +1,33 @@
+export const historicalSecretPatterns = [
+    {
+        id: 'TLP-GIT-101',
+        title: 'GitHub token in Git history',
+        severity: 'critical',
+        regex: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g
+    },
+    {
+        id: 'TLP-GIT-102',
+        title: 'npm token in Git history',
+        severity: 'critical',
+        regex: /\bnpm_[A-Za-z0-9]{20,}\b/g
+    },
+    {
+        id: 'TLP-GIT-103',
+        title: 'AWS access key in Git history',
+        severity: 'critical',
+        regex: /\bAKIA[0-9A-Z]{16}\b/g
+    },
+    {
+        id: 'TLP-GIT-104',
+        title: 'Private key in Git history',
+        severity: 'critical',
+        regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g
+    },
+    {
+        id: 'TLP-GIT-105',
+        title: 'Password assignment in Git history',
+        severity: 'high',
+        regex: /\b(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi
+    }
+];
+//# sourceMappingURL=secret-patterns.js.map

package/dist/src/analyzers/git-history/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../../src/analyzers/git-history/secret-patterns.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,wBAAwB,GACP;IAC1B;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,kCAAkC;KACrC;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,2BAA2B;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,uBAAuB;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,yDAAyD;KAC5D;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,wDAAwD;KAC3D;CACF,CAAC"}

package/dist/src/analyzers/install-scripts/install-script-analyzer.d.ts

@@ -0,0 +1,6 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export declare class InstallScriptAnalyzer implements Analyzer {
+    readonly id = "install-script-behavior";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/install-scripts/install-script-analyzer.js

@@ -0,0 +1,135 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { readNpmDependencyInventory } from '../../core/dependencies/inventory.js';
+const lifecycleNames = [
+    'preinstall',
+    'install',
+    'postinstall'
+];
+const signals = [
+    {
+        id: 'TLP-INSTALL-001',
+        title: 'Network access in lifecycle script',
+        severity: 'high',
+        regex: /\b(curl|wget|Invoke-WebRequest|fetch|axios|http\.get|https\.get)\b/i,
+        message: 'The lifecycle script appears to perform network access.',
+        remediation: 'Review the remote destination and downloaded content before installation.'
+    },
+    {
+        id: 'TLP-INSTALL-002',
+        title: 'Shell execution in lifecycle script',
+        severity: 'high',
+        regex: /\b(sh|bash|zsh|cmd|powershell|pwsh)\b|child_process|execSync?\s*\(/i,
+        message: 'The lifecycle script invokes a shell or child process.',
+        remediation: 'Confirm every command and argument is necessary and does not execute untrusted input.'
+    },
+    {
+        id: 'TLP-INSTALL-003',
+        title: 'Filesystem write or deletion in lifecycle script',
+        severity: 'medium',
+        regex: /\b(rm\s+-rf|del\s+\/|rmdir|chmod|chown|writeFile|appendFile|unlink|rename)\b/i,
+        message: 'The lifecycle script appears to modify or delete filesystem content.',
+        remediation: 'Confirm writes remain within the package boundary and cannot alter sensitive files.'
+    },
+    {
+        id: 'TLP-INSTALL-004',
+        title: 'Encoded or obfuscated lifecycle script',
+        severity: 'high',
+        regex: /\b(base64|atob|fromCharCode|Buffer\.from\([^)]*,\s*['"]base64['"]|eval\s*\()/i,
+        message: 'The lifecycle script contains encoding or dynamic execution indicators.',
+        remediation: 'Decode and review the complete payload before allowing the script to run.'
+    },
+    {
+        id: 'TLP-INSTALL-005',
+        title: 'Credential or environment inspection in lifecycle script',
+        severity: 'medium',
+        regex: /\b(process\.env|AWS_|GITHUB_TOKEN|NPM_TOKEN|HOME|USERPROFILE|SSH_AUTH_SOCK)\b/i,
+        message: 'The lifecycle script reads environment or credential-related values.',
+        remediation: 'Verify that the package does not exfiltrate or persist sensitive environment data.'
+    }
+];
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class InstallScriptAnalyzer {
+    id = 'install-script-behavior';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const dependencies = await readNpmDependencyInventory(context.root);
+        const findings = [];
+        let packagesInspected = 0;
+        let lifecycleScripts = 0;
+        for (const dependency of dependencies) {
+            if (context.signal?.aborted) {
+                throw new Error('Install-script analysis was cancelled.');
+            }
+            const manifestPath = path.join(context.root, 'node_modules', ...dependency.name.split('/'), 'package.json');
+            if (!(await exists(manifestPath))) {
+                continue;
+            }
+            const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+            packagesInspected += 1;
+            for (const lifecycleName of lifecycleNames) {
+                const command = manifest.scripts?.[lifecycleName];
+                if (!command) {
+                    continue;
+                }
+                lifecycleScripts += 1;
+                for (const signal of signals) {
+                    signal.regex.lastIndex = 0;
+                    if (!signal.regex.test(command)) {
+                        continue;
+                    }
+                    findings.push({
+                        id: `${signal.id}:${dependency.name}:` +
+                            `${dependency.version}:${lifecycleName}`,
+                        ruleId: signal.id,
+                        title: signal.title,
+                        category: 'install-script',
+                        severity: signal.severity,
+                        confidence: 'medium',
+                        message: `${dependency.name}@${dependency.version} ` +
+                            `defines ${lifecycleName}: ${signal.message}`,
+                        source: 'package-manifest',
+                        evidence: [
+                            {
+                                summary: `${lifecycleName}: ${command.slice(0, 240)}`,
+                                fingerprint: `${dependency.name}@${dependency.version}:` +
+                                    `${lifecycleName}:${signal.id}`
+                            }
+                        ],
+                        remediation: {
+                            summary: signal.remediation
+                        },
+                        metadata: {
+                            package: dependency.name,
+                            version: dependency.version,
+                            direct: dependency.direct,
+                            development: dependency.development,
+                            lifecycle: lifecycleName,
+                            command
+                        }
+                    });
+                }
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                packagesInspected,
+                lifecycleScripts,
+                findings: findings.length
+            }
+        };
+    }
+}
+//# sourceMappingURL=install-script-analyzer.js.map

package/dist/src/analyzers/install-scripts/install-script-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-script-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/install-scripts/install-script-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,SAAS;IACT,aAAa;CACL,CAAC;AAiBX,MAAM,OAAO,GAAuB;IAClC;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,qEAAqE;QACvE,OAAO,EACL,yDAAyD;QAC3D,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,qEAAqE;QACvE,OAAO,EACL,wDAAwD;QAC1D,WAAW,EACT,uFAAuF;KAC1F;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,kDAAkD;QACzD,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,+EAA+E;QACjF,OAAO,EACL,sEAAsE;QACxE,WAAW,EACT,qFAAqF;KACxF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,wCAAwC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,+EAA+E;QACjF,OAAO,EACL,yEAAyE;QAC3E,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,0DAA0D;QACjE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,gFAAgF;QAClF,OAAO,EACL,sEAAsE;QACxE,WAAW,EACT,oFAAoF;KACvF;CACF,CAAC;AAEF,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,qBAAqB;IACvB,EAAE,GAAG,yBAAyB,CAAC;IAC/B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,YAAY,GAChB,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,OAAO,CAAC,IAAI,EACZ,cAAc,EACd,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAC7B,cAAc,CACf,CAAC;YAEF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAClB,CAAC;YAErB,iBAAiB,IAAI,CAAC,CAAC;YAEvB,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;gBAElD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,SAAS;gBACX,CAAC;gBAED,gBAAgB,IAAI,CAAC,CAAC;gBAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBAE3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAChC,SAAS;oBACX,CAAC;oBAED,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EACA,GAAG,MAAM,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,GAAG;4BAClC,GAAG,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE;wBAC1C,MAAM,EAAE,MAAM,CAAC,EAAE;wBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,QAAQ,EAAE,gBAAgB;wBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EACL,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG;4BAC3C,WAAW,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE;wBAC/C,MAAM,EAAE,kBAAkB;wBAC1B,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,GAAG,aAAa,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gCAC9C,WAAW,EACT,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG;oCAC3C,GAAG,aAAa,IAAI,MAAM,CAAC,EAAE,EAAE;6BAClC;yBACF;wBACD,WAAW,EAAE;4BACX,OAAO,EAAE,MAAM,CAAC,WAAW;yBAC5B;wBACD,QAAQ,EAAE;4BACR,OAAO,EAAE,UAAU,CAAC,IAAI;4BACxB,OAAO,EAAE,UAAU,CAAC,OAAO;4BAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,SAAS,EAAE,aAAa;4BACxB,OAAO;yBACR;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,gBAAgB;gBAChB,QAAQ,EAAE,QAAQ,CAAC,MAAM;aAC1B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/reachability/import-graph.d.ts

@@ -0,0 +1,9 @@
+export type ImportReference = {
+    packageName: string;
+    importedSymbols: string[];
+    localSymbols: string[];
+    kind: 'default' | 'named' | 'namespace' | 'side-effect' | 'require' | 'dynamic-import';
+    line: number;
+    column: number;
+};
+export declare function extractPackageImports(filePath: string, content: string): ImportReference[];

package/dist/src/analyzers/reachability/import-graph.js

@@ -0,0 +1,110 @@
+import ts from 'typescript';
+function packageRoot(specifier) {
+    if (specifier.startsWith('.') ||
+        specifier.startsWith('/') ||
+        specifier.startsWith('node:')) {
+        return undefined;
+    }
+    if (specifier.startsWith('@')) {
+        const [scope, name] = specifier.split('/');
+        return scope && name ? `${scope}/${name}` : undefined;
+    }
+    return specifier.split('/')[0];
+}
+function location(sourceFile, node) {
+    const value = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+    return {
+        line: value.line + 1,
+        column: value.character + 1
+    };
+}
+export function extractPackageImports(filePath, content) {
+    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, filePath.endsWith('.tsx')
+        ? ts.ScriptKind.TSX
+        : filePath.endsWith('.jsx')
+            ? ts.ScriptKind.JSX
+            : filePath.endsWith('.js') ||
+                filePath.endsWith('.mjs') ||
+                filePath.endsWith('.cjs')
+                ? ts.ScriptKind.JS
+                : ts.ScriptKind.TS);
+    const references = [];
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) &&
+            ts.isStringLiteral(node.moduleSpecifier)) {
+            const root = packageRoot(node.moduleSpecifier.text);
+            if (root) {
+                const importedSymbols = [];
+                const localSymbols = [];
+                let kind = 'side-effect';
+                const clause = node.importClause;
+                if (clause?.name) {
+                    kind = 'default';
+                    importedSymbols.push('default');
+                    localSymbols.push(clause.name.text);
+                }
+                if (clause?.namedBindings) {
+                    if (ts.isNamespaceImport(clause.namedBindings)) {
+                        kind = 'namespace';
+                        importedSymbols.push('*');
+                        localSymbols.push(clause.namedBindings.name.text);
+                    }
+                    else {
+                        kind = 'named';
+                        for (const element of clause.namedBindings.elements) {
+                            importedSymbols.push(element.propertyName?.text ??
+                                element.name.text);
+                            localSymbols.push(element.name.text);
+                        }
+                    }
+                }
+                references.push({
+                    packageName: root,
+                    importedSymbols,
+                    localSymbols,
+                    kind,
+                    ...location(sourceFile, node)
+                });
+            }
+        }
+        if (ts.isCallExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === 'require' &&
+            node.arguments.length === 1) {
+            const [argument] = node.arguments;
+            if (argument && ts.isStringLiteral(argument)) {
+                const root = packageRoot(argument.text);
+                if (root) {
+                    references.push({
+                        packageName: root,
+                        importedSymbols: ['*'],
+                        localSymbols: [],
+                        kind: 'require',
+                        ...location(sourceFile, node)
+                    });
+                }
+            }
+        }
+        if (ts.isCallExpression(node) &&
+            node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+            node.arguments.length === 1) {
+            const [argument] = node.arguments;
+            if (argument && ts.isStringLiteral(argument)) {
+                const root = packageRoot(argument.text);
+                if (root) {
+                    references.push({
+                        packageName: root,
+                        importedSymbols: ['*'],
+                        localSymbols: [],
+                        kind: 'dynamic-import',
+                        ...location(sourceFile, node)
+                    });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return references;
+}
+//# sourceMappingURL=import-graph.js.map

package/dist/src/analyzers/reachability/import-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-graph.js","sourceRoot":"","sources":["../../../../src/analyzers/reachability/import-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAiB5B,SAAS,WAAW,CAAC,SAAiB;IACpC,IACE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CACf,UAAyB,EACzB,IAAa;IAEb,MAAM,KAAK,GAAG,UAAU,CAAC,6BAA6B,CACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAAe;IAEf,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,OAAO,EACP,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;QACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;YACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;gBAClB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC5B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,eAAe,GAAa,EAAE,CAAC;gBACrC,MAAM,YAAY,GAAa,EAAE,CAAC;gBAClC,IAAI,IAAI,GAA4B,aAAa,CAAC;gBAElD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;gBAEjC,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;oBACjB,IAAI,GAAG,SAAS,CAAC;oBACjB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;gBAED,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC1B,IAAI,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC/C,IAAI,GAAG,WAAW,CAAC;wBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC1B,YAAY,CAAC,IAAI,CACf,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAC/B,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,OAAO,CAAC;wBAEf,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;4BACpD,eAAe,CAAC,IAAI,CAClB,OAAO,CAAC,YAAY,EAAE,IAAI;gCACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CACpB,CAAC;4BACF,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACvC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,eAAe;oBACf,YAAY;oBACZ,IAAI;oBACJ,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;YAClC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,IAAI,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAExC,IAAI,IAAI,EAAE,CAAC;oBACT,UAAU,CAAC,IAAI,CAAC;wBACd,WAAW,EAAE,IAAI;wBACjB,eAAe,EAAE,CAAC,GAAG,CAAC;wBACtB,YAAY,EAAE,EAAE;wBAChB,IAAI,EAAE,SAAS;wBACf,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;YACpD,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,IAAI,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAExC,IAAI,IAAI,EAAE,CAAC;oBACT,UAAU,CAAC,IAAI,CAAC;wBACd,WAAW,EAAE,IAAI;wBACjB,eAAe,EAAE,CAAC,GAAG,CAAC;wBACtB,YAAY,EAAE,EAAE;wBAChB,IAAI,EAAE,gBAAgB;wBACtB,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/analyzers/reachability/reachability-analyzer.d.ts

@@ -0,0 +1,16 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+import { type ImportReference } from './import-graph.js';
+export type PackageReachability = {
+    packageName: string;
+    state: 'reachable' | 'possibly-reachable' | 'not-observed';
+    direct: boolean;
+    development: boolean;
+    references: Array<ImportReference & {
+        file: string;
+    }>;
+};
+export declare class ReachabilityAnalyzer implements Analyzer {
+    readonly id = "package-reachability";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/reachability/reachability-analyzer.js

@@ -0,0 +1,95 @@
+import { readFile } from 'node:fs/promises';
+import { createScannerContext } from '../../core/scanner-context.js';
+import { readNpmDependencyInventory } from '../../core/dependencies/inventory.js';
+import { extractPackageImports } from './import-graph.js';
+const codeExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs'
+]);
+export class ReachabilityAnalyzer {
+    id = 'package-reachability';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const dependencies = await readNpmDependencyInventory(context.root);
+        const scannerContext = await createScannerContext(context.root);
+        const references = new Map();
+        for (const file of scannerContext.files) {
+            if (!codeExtensions.has(file.extension) ||
+                file.relativePath.endsWith('.d.ts') ||
+                file.relativePath.startsWith('dist/')) {
+                continue;
+            }
+            if (context.signal?.aborted) {
+                throw new Error('Reachability analysis was cancelled.');
+            }
+            const content = await readFile(file.absolutePath, 'utf8');
+            for (const reference of extractPackageImports(file.relativePath, content)) {
+                const current = references.get(reference.packageName) ?? [];
+                current.push({
+                    ...reference,
+                    file: file.relativePath
+                });
+                references.set(reference.packageName, current);
+            }
+        }
+        const packageStates = dependencies.map((dependency) => {
+            const packageReferences = references.get(dependency.name) ?? [];
+            return {
+                packageName: dependency.name,
+                state: packageReferences.length > 0
+                    ? 'reachable'
+                    : dependency.direct
+                        ? 'possibly-reachable'
+                        : 'not-observed',
+                direct: dependency.direct,
+                development: dependency.development,
+                references: packageReferences
+            };
+        });
+        const findings = packageStates
+            .filter((item) => item.state === 'reachable')
+            .map((item) => ({
+            id: `TLP-REACH-${item.packageName
+                .toUpperCase()
+                .replaceAll(/[^A-Z0-9]/g, '-')}`,
+            ruleId: 'TLP-REACH-001',
+            title: `Package usage observed: ${item.packageName}`,
+            category: 'reachability',
+            severity: 'info',
+            confidence: 'high',
+            message: `${item.packageName} is imported or required by project source files.`,
+            source: 'typescript-ast',
+            evidence: item.references.slice(0, 20).map((reference) => ({
+                summary: `${reference.file}:${reference.line}:${reference.column} ` +
+                    `${reference.kind} import`,
+                fingerprint: `${item.packageName}:${reference.file}:` +
+                    `${reference.line}:${reference.column}`
+            })),
+            metadata: {
+                package: item.packageName,
+                state: item.state,
+                direct: item.direct,
+                development: item.development,
+                references: item.references
+            }
+        }));
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                dependencies: packageStates.length,
+                reachable: packageStates.filter((item) => item.state === 'reachable').length,
+                possiblyReachable: packageStates.filter((item) => item.state === 'possibly-reachable').length,
+                notObserved: packageStates.filter((item) => item.state === 'not-observed').length,
+                packages: packageStates
+            }
+        };
+    }
+}
+//# sourceMappingURL=reachability-analyzer.js.map

package/dist/src/analyzers/reachability/reachability-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/reachability/reachability-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAO5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACL,qBAAqB,EAEtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAiBH,MAAM,OAAO,oBAAoB;IACtB,EAAE,GAAG,sBAAsB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,YAAY,GAChB,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACxC,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EACrC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,sCAAsC,CACvC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,YAAY,EACjB,MAAM,CACP,CAAC;YAEF,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAC3C,IAAI,CAAC,YAAY,EACjB,OAAO,CACR,EAAE,CAAC;gBACF,MAAM,OAAO,GACX,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAE9C,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,SAAS;oBACZ,IAAI,EAAE,IAAI,CAAC,YAAY;iBACxB,CAAC,CAAC;gBAEH,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CACpC,CAAC,UAAU,EAAuB,EAAE;YAClC,MAAM,iBAAiB,GACrB,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAExC,OAAO;gBACL,WAAW,EAAE,UAAU,CAAC,IAAI;gBAC5B,KAAK,EACH,iBAAiB,CAAC,MAAM,GAAG,CAAC;oBAC1B,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,UAAU,CAAC,MAAM;wBACjB,CAAC,CAAC,oBAAoB;wBACtB,CAAC,CAAC,cAAc;gBACtB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,UAAU,EAAE,iBAAiB;aAC9B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,QAAQ,GAAc,aAAa;aACtC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;aAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,EAAE,EAAE,aAAa,IAAI,CAAC,WAAW;iBAC9B,WAAW,EAAE;iBACb,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAClC,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,2BAA2B,IAAI,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,OAAO,EACL,GAAG,IAAI,CAAC,WAAW,mDAAmD;YACxE,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACd,OAAO,EACL,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,GAAG;oBAC1D,GAAG,SAAS,CAAC,IAAI,SAAS;gBAC5B,WAAW,EACT,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,GAAG;oBACxC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE;aAC1C,CAAC,CACH;YACD,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI,CAAC,WAAW;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC,CAAC;QAEN,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,YAAY,EAAE,aAAa,CAAC,MAAM;gBAClC,SAAS,EAAE,aAAa,CAAC,MAAM,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CACrC,CAAC,MAAM;gBACR,iBAAiB,EAAE,aAAa,CAAC,MAAM,CACrC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,KAAK,KAAK,oBAAoB,CACtC,CAAC,MAAM;gBACR,WAAW,EAAE,aAAa,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,cAAc,CACxC,CAAC,MAAM;gBACR,QAAQ,EAAE,aAAa;aACxB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/vulnerability/osv-analyzer.d.ts

@@ -0,0 +1,9 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+import { OsvClient } from '../../providers/osv/client.js';
+export declare class OsvVulnerabilityAnalyzer implements Analyzer {
+    private readonly client;
+    readonly id = "osv-vulnerability";
+    readonly version = "1.0.0";
+    constructor(client?: OsvClient);
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}