toolip 1.0.6 → 2.0.0

package/dist/src/commands/doctor.js

@@ -0,0 +1,42 @@
+import chalk from 'chalk';
+import { createScannerContext } from '../core/scanner-context.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary, printScannerContext } from '../utils/output.js';
+export function registerDoctorCommand(program) {
+    program
+        .command('doctor')
+        .description('Run a full project security hygiene audit.')
+        .option('-p, --path <path>', 'Project path to audit.', process.cwd())
+        .option('-o, --output <file>', 'Write doctor report to JSON or Markdown.')
+        .action(async (options) => {
+        console.log(chalk.bold('Toolip Doctor'));
+        console.log('');
+        const context = await createScannerContext(options.path);
+        printScannerContext(context);
+        const doctor = await runSecurityDoctor(context.root);
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'doctor',
+            root: context.root,
+            findings: doctor.findings
+        });
+        console.log('');
+        console.log(chalk.bold('Security Hygiene'));
+        console.log(`${chalk.dim('Files Scanned:')} ${doctor.summary.filesScanned}`);
+        console.log(`${chalk.dim('Secrets:')} ${doctor.summary.secrets}`);
+        console.log(`${chalk.dim('Dangerous Code:')} ${doctor.summary.dangerousCode}`);
+        console.log(`${chalk.dim('Configuration:')} ${doctor.summary.configuration}`);
+        console.log(`${chalk.dim('Security Headers:')} ${doctor.summary.headers}`);
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/src/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/git-audit.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerGitAuditCommand(program: Command): void;

package/dist/src/commands/git-audit.js

@@ -0,0 +1,37 @@
+import chalk from 'chalk';
+import { runGitAudit } from '../core/git-audit.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary } from '../utils/output.js';
+export function registerGitAuditCommand(program) {
+    program
+        .command('git-audit')
+        .description('Audit Git safety, ignored files, and dangerous committed-file patterns.')
+        .option('-p, --path <path>', 'Project path to audit.', process.cwd())
+        .option('-o, --output <file>', 'Write Git audit report to JSON or Markdown.')
+        .action(async (options) => {
+        const result = await runGitAudit(options.path);
+        console.log(chalk.bold('Toolip Git Audit'));
+        console.log('');
+        console.log(`${chalk.dim('Files Checked:')} ${result.summary.filesChecked}`);
+        console.log(`${chalk.dim('Dangerous Files:')} ${result.summary.dangerousFiles}`);
+        console.log(`${chalk.dim('.gitignore Present:')} ${result.summary.gitignorePresent ? 'yes' : 'no'}`);
+        console.log(`${chalk.dim('.env Ignored:')} ${result.summary.envIgnored ? 'yes' : 'no'}`);
+        console.log(`${chalk.dim('PEM Ignored:')} ${result.summary.pemIgnored ? 'yes' : 'no'}`);
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'git-audit',
+            root: options.path,
+            findings: result.findings
+        });
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=git-audit.js.map

package/dist/src/commands/git-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-audit.js","sourceRoot":"","sources":["../../../src/commands/git-audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,qBAAqB,EAAE,6CAA6C,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/git-history.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerGitHistoryCommand(program: Command): void;

package/dist/src/commands/git-history.js

@@ -0,0 +1,40 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { GitHistorySecretAnalyzer } from '../analyzers/git-history/analyzer.js';
+export function registerGitHistoryCommand(program) {
+    program
+        .command('git-history')
+        .description('Scan added lines across Git commit history for secret-like values.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--max-commits <number>', 'Maximum commits to scan.', '1000')
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const maxCommits = Math.max(1, Number.parseInt(options.maxCommits, 10) || 1000);
+        const [result] = await new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 120_000
+        }).run([
+            new GitHistorySecretAnalyzer(maxCommits)
+        ], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('Git-history analyzer returned no result.');
+        }
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Git History Secret Audit');
+        console.log('');
+        console.log(`Commits scanned: ${result.metadata?.commitsScanned ?? 0}`);
+        console.log(`Findings: ${result.findings.length}`);
+        console.log('');
+        for (const finding of result.findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(`Commit: ${finding.metadata?.commit}`);
+            console.log(`Evidence: ${finding.evidence?.[0]?.summary}`);
+            console.log('');
+        }
+    });
+}
+//# sourceMappingURL=git-history.js.map

package/dist/src/commands/git-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-history.js","sourceRoot":"","sources":["../../../src/commands/git-history.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,UAAU,yBAAyB,CACvC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CACV,oEAAoE,CACrE;SACA,MAAM,CACL,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,wBAAwB,EACxB,0BAA0B,EAC1B,MAAM,CACP;SACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CACL,KAAK,EACH,OAIC,EACD,EAAE;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,CAAC,EACD,MAAM,CAAC,QAAQ,CACb,OAAO,CAAC,UAAU,EAClB,EAAE,CACH,IAAI,IAAI,CACV,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,GACZ,MAAM,IAAI,cAAc,CAAC;YACvB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC,GAAG,CACJ;YACE,IAAI,wBAAwB,CAC1B,UAAU,CACX;SACF,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,iCAAiC,CAClC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,oBACE,MAAM,CAAC,QAAQ,EAAE,cAAc,IAAI,CACrC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,WACE,OAAO,CAAC,QAAQ,EAAE,MACpB,EAAE,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CACT,aACE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OACzB,EAAE,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/history.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerHistoryCommand(program: Command): void;

package/dist/src/commands/history.js

@@ -0,0 +1,69 @@
+import { clearHistory, readHistory } from '../core/history/store.js';
+export function registerHistoryCommand(program) {
+    const command = program
+        .command('history')
+        .description('Inspect locally stored Toolip scan history.');
+    command
+        .command('list')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-l, --limit <number>', 'Maximum entries.', '20')
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const history = await readHistory(options.path);
+        const limit = Math.max(1, Number.parseInt(options.limit, 10) || 20);
+        const entries = history.entries.slice(-limit);
+        if (options.json) {
+            console.log(JSON.stringify({
+                schemaVersion: history.schemaVersion,
+                entries
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip History');
+        console.log('');
+        if (entries.length === 0) {
+            console.log('No historical scan entries are available.');
+            return;
+        }
+        for (const entry of entries.reverse()) {
+            console.log(`${entry.createdAt} ${entry.command} ` +
+                `score=${entry.score ?? 'n/a'} ` +
+                `findings=${entry.summary.total}`);
+            if (entry.git?.branch ||
+                entry.git?.commit) {
+                console.log(`  ${entry.git.branch ?? 'detached'} ` +
+                    `${entry.git.commit?.slice(0, 12) ?? ''}`);
+            }
+        }
+    });
+    command
+        .command('trend')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-l, --limit <number>', 'Maximum entries.', '10')
+        .action(async (options) => {
+        const history = await readHistory(options.path);
+        const limit = Math.max(2, Number.parseInt(options.limit, 10) || 10);
+        const entries = history.entries
+            .filter((entry) => entry.score !== undefined)
+            .slice(-limit);
+        console.log('Toolip Security Trend');
+        console.log('');
+        if (entries.length < 2) {
+            console.log('At least two scored history entries are required.');
+            return;
+        }
+        const first = entries[0];
+        const last = entries[entries.length - 1];
+        console.log(`Score: ${first?.score} → ${last?.score}`);
+        console.log(`Change: ${(last?.score ?? 0) - (first?.score ?? 0)}`);
+        console.log(`Findings: ${first?.summary.total} → ${last?.summary.total}`);
+    });
+    command
+        .command('clear')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        await clearHistory(options.path);
+        console.log('Toolip history cleared.');
+    });
+}
+//# sourceMappingURL=history.js.map

package/dist/src/commands/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../../src/commands/history.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,MAAM,UAAU,sBAAsB,CACpC,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,6CAA6C,CAC9C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,sBAAsB,EACtB,kBAAkB,EAClB,IAAI,CACL;SACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CACzC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,aAAa,EACX,OAAO,CAAC,aAAa;gBACvB,OAAO;aACR,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CACT,2CAA2C,CAC5C,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG;gBACpC,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;gBAChC,YAAY,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CACpC,CAAC;YAEF,IACE,KAAK,CAAC,GAAG,EAAE,MAAM;gBACjB,KAAK,CAAC,GAAG,EAAE,MAAM,EACjB,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,UAAU,GAAG;oBACpC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,sBAAsB,EACtB,kBAAkB,EAClB,IAAI,CACL;SACA,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CACzC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;aAC5B,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CACrC;aACA,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,mDAAmD,CACpD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CACT,UAAU,KAAK,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAC1C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,CACtD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aAAa,KAAK,EAAE,OAAO,CAAC,KAAK,MAAM,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/hook.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerHookCommand(program: Command): void;

package/dist/src/commands/hook.js

@@ -0,0 +1,16 @@
+import chalk from 'chalk';
+import { installPreCommitHook } from '../core/hooks.js';
+export function registerHookCommand(program) {
+    const hook = program
+        .command('hook')
+        .description('Install Toolip Git hooks.');
+    hook
+        .command('install')
+        .description('Install Toolip pre-commit hook.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        const hookPath = await installPreCommitHook(options.path);
+        console.log(`${chalk.green('✓')} Installed pre-commit hook at ${hookPath}`);
+    });
+}
+//# sourceMappingURL=hook.js.map

package/dist/src/commands/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/commands/hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAE5C,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/inspect.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerInspectCommand(program: Command): void;

package/dist/src/commands/inspect.js

@@ -0,0 +1,24 @@
+import chalk from 'chalk';
+import { analyzePackage } from '../core/analyze-package.js';
+import { detectTyposquat } from '../core/typosquat.js';
+import { printPackageHealth } from '../utils/package-output.js';
+export function registerInspectCommand(program) {
+    program
+        .command('inspect <package>')
+        .description('Inspect a package from npm registry.')
+        .action(async (packageName) => {
+        const typo = detectTyposquat(packageName);
+        if (typo.suspected) {
+            console.log(chalk.yellow('Potential typosquatting signal detected.'));
+            console.log(`Did you mean: ${typo.suggestions.join(', ')}`);
+            console.log('');
+        }
+        const result = await analyzePackage({
+            name: packageName,
+            version: 'latest',
+            type: 'dependency'
+        });
+        printPackageHealth(result);
+    });
+}
+//# sourceMappingURL=inspect.js.map

package/dist/src/commands/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../../src/commands/inspect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/install-scripts.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerInstallScriptsCommand(program: Command): void;

package/dist/src/commands/install-scripts.js

@@ -0,0 +1,52 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { InstallScriptAnalyzer } from '../analyzers/install-scripts/install-script-analyzer.js';
+export function registerInstallScriptsCommand(program) {
+    program
+        .command('install-scripts')
+        .description('Inspect installed npm lifecycle scripts for suspicious behavior indicators.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependency findings.')
+        .action(async (options) => {
+        const runner = new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        });
+        const [result] = await runner.run([new InstallScriptAnalyzer()], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('Install-script analyzer returned no result.');
+        }
+        const findings = options.includeDev
+            ? result.findings
+            : result.findings.filter((finding) => finding.metadata?.development !== true);
+        if (options.json) {
+            console.log(JSON.stringify({
+                analyzer: result.analyzer,
+                durationMs: result.durationMs,
+                summary: result.metadata,
+                findings
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip Install-Script Analysis');
+        console.log('');
+        console.log(`Packages inspected: ${result.metadata?.packagesInspected ?? 0}`);
+        console.log(`Lifecycle scripts: ${result.metadata?.lifecycleScripts ?? 0}`);
+        console.log(`Findings: ${findings.length}`);
+        console.log('');
+        for (const finding of findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(`Package: ${finding.metadata?.package}@` +
+                `${finding.metadata?.version}`);
+            console.log(`Lifecycle: ${finding.metadata?.lifecycle}`);
+            console.log(`Message: ${finding.message}`);
+            console.log('');
+        }
+        if (findings.length === 0) {
+            console.log('No supported suspicious lifecycle-script indicators were found.');
+        }
+    });
+}
+//# sourceMappingURL=install-scripts.js.map

package/dist/src/commands/install-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-scripts.js","sourceRoot":"","sources":["../../../src/commands/install-scripts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAQhG,MAAM,UAAU,6BAA6B,CAC3C,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,6EAA6E,CAC9E;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,eAAe,EACf,0CAA0C,CAC3C;SACA,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,CAAC,IAAI,qBAAqB,EAAE,CAAC,EAC7B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CACzC,CAAC;QAEN,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,QAAQ;aACT,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,uBACE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,IAAI,CACxC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,sBACE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,CACvC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,YAAY,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG;gBACtC,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CACjC,CAAC;YACF,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/learn.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLearnCommand(program: Command): void;

package/dist/src/commands/learn.js

@@ -0,0 +1,42 @@
+import chalk from 'chalk';
+import { getLearnTopic, listLearnTopics } from '../core/learn.js';
+import { ToolipError } from '../errors/toolip-error.js';
+export function registerLearnCommand(program) {
+    program
+        .command('learn [topic]')
+        .description('Learn secure development concepts while using Toolip.')
+        .option('--list', 'List available learning topics.')
+        .action((topic, options) => {
+        if (options.list || !topic) {
+            console.log(chalk.bold('Toolip Learning Topics'));
+            console.log('');
+            for (const item of listLearnTopics()) {
+                console.log(`${chalk.green('✓')} ${item.id} ${chalk.dim(`— ${item.title}`)}`);
+            }
+            return;
+        }
+        const lesson = getLearnTopic(topic);
+        if (!lesson) {
+            throw new ToolipError(`Unknown learning topic: ${topic}`, {
+                code: 'LEARN_TOPIC_NOT_FOUND',
+                exitCode: 1
+            });
+        }
+        console.log(chalk.bold(lesson.title));
+        console.log('');
+        console.log(lesson.explanation);
+        console.log('');
+        printSection('Risks', lesson.risks);
+        printSection('Common Mistakes', lesson.mistakes);
+        printSection('Secure Examples', lesson.secureExamples);
+        printSection('Best Practices', lesson.bestPractices);
+    });
+}
+function printSection(title, items) {
+    console.log(chalk.bold(title));
+    for (const item of items) {
+        console.log(`${chalk.green('•')} ${item}`);
+    }
+    console.log('');
+}
+//# sourceMappingURL=learn.js.map

package/dist/src/commands/learn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"learn.js","sourceRoot":"","sources":["../../../src/commands/learn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;SACnD,MAAM,CAAC,CAAC,KAAyB,EAAE,OAA2B,EAAE,EAAE;QACjE,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,2BAA2B,KAAK,EAAE,EAAE;gBACxD,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACvD,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAe;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/src/commands/licenses.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLicensesCommand(program: Command): void;

package/dist/src/commands/licenses.js

@@ -0,0 +1,40 @@
+import chalk from 'chalk';
+import { analyzeLicenses } from '../core/license-analysis.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary } from '../utils/output.js';
+export function registerLicensesCommand(program) {
+    program
+        .command('licenses')
+        .description('Analyze dependency license inventory and restrictive license signals.')
+        .option('-p, --path <path>', 'Project path to analyze.', process.cwd())
+        .option('-o, --output <file>', 'Write license report to JSON or Markdown.')
+        .action(async (options) => {
+        const result = await analyzeLicenses(options.path);
+        console.log(chalk.bold('Toolip License Analysis'));
+        console.log('');
+        console.log(`${chalk.dim('Total Packages:')} ${result.summary.total}`);
+        console.log(`${chalk.dim('Unknown Licenses:')} ${result.summary.unknown}`);
+        console.log(`${chalk.dim('Restrictive Licenses:')} ${result.summary.restrictive}`);
+        console.log('');
+        console.log(chalk.bold('License Distribution'));
+        for (const [license, count] of Object.entries(result.summary.distribution)) {
+            console.log(`${chalk.green('✓')} ${license}: ${count}`);
+        }
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'licenses',
+            root: options.path,
+            findings: result.findings
+        });
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=licenses.js.map

package/dist/src/commands/licenses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenses.js","sourceRoot":"","sources":["../../../src/commands/licenses.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;SAC1E,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/mcp.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMcpCommand(program: Command): void;

package/dist/src/commands/mcp.js

@@ -0,0 +1,10 @@
+import { startMcpServer } from '../mcp/server.js';
+export function registerMcpCommand(program) {
+    program
+        .command('mcp')
+        .description('Start the Toolip MCP server over stdio.')
+        .action(async () => {
+        await startMcpServer();
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/src/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/commands/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/monorepo.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMonorepoCommand(program: Command): void;

package/dist/src/commands/monorepo.js

@@ -0,0 +1,21 @@
+import { discoverWorkspaces } from '../core/monorepo/discover.js';
+export function registerMonorepoCommand(program) {
+    program
+        .command('monorepo')
+        .description('Discover and summarize workspace packages.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const workspaces = await discoverWorkspaces(options.path);
+        if (options.json) {
+            console.log(JSON.stringify({ workspaces }, null, 2));
+            return;
+        }
+        console.log('Toolip Monorepo Discovery');
+        console.log('');
+        for (const workspace of workspaces) {
+            console.log(`${workspace.relativePath} ${workspace.name ?? ''}`.trim());
+        }
+    });
+}
+//# sourceMappingURL=monorepo.js.map

package/dist/src/commands/monorepo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monorepo.js","sourceRoot":"","sources":["../../../src/commands/monorepo.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/package-health.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPackageHealthCommand(program: Command): void;

package/dist/src/commands/package-health.js

@@ -0,0 +1,50 @@
+import { DepsDevClient } from '../providers/depsdev/client.js';
+export function registerPackageHealthCommand(program) {
+    program
+        .command('package-health <package> [version]')
+        .description('Inspect npm package health and provenance through deps.dev.')
+        .option('--json', 'Print structured JSON.')
+        .action(async (packageName, version, options) => {
+        if (!version) {
+            throw new Error('A resolved package version is required.');
+        }
+        const client = new DepsDevClient();
+        const [metadata, dependencies] = await Promise.all([
+            client.getVersion(packageName, version),
+            client.getDependencies(packageName, version)
+        ]);
+        const result = {
+            package: packageName,
+            version,
+            publishedAt: metadata.publishedAt,
+            deprecated: metadata.isDeprecated ?? false,
+            deprecatedReason: metadata.deprecatedReason,
+            licenses: metadata.licenses ?? [],
+            advisories: metadata.advisoryKeys
+                ?.map((item) => item.id)
+                .filter((value) => Boolean(value)) ?? [],
+            verifiedProvenance: (metadata.slsaProvenances ?? [])
+                .filter((item) => item.verified === true).length,
+            verifiedAttestations: (metadata.attestations ?? [])
+                .filter((item) => item.verified === true).length,
+            relatedProjects: metadata.relatedProjects ?? [],
+            dependencyNodes: dependencies.nodes?.length ?? 0,
+            dependencyEdges: dependencies.edges?.length ?? 0
+        };
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Package Health');
+        console.log('');
+        console.log(`Package: ${packageName}@${version}`);
+        console.log(`Published: ${result.publishedAt ?? 'unknown'}`);
+        console.log(`Deprecated: ${result.deprecated}`);
+        console.log(`Licenses: ${result.licenses.join(', ') || 'unknown'}`);
+        console.log(`Advisories: ${result.advisories.length}`);
+        console.log(`Dependency nodes: ${result.dependencyNodes}`);
+        console.log(`Verified provenance: ${result.verifiedProvenance}`);
+        console.log(`Verified attestations: ${result.verifiedAttestations}`);
+    });
+}
+//# sourceMappingURL=package-health.js.map

package/dist/src/commands/package-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-health.js","sourceRoot":"","sources":["../../../src/commands/package-health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAM/D,MAAM,UAAU,4BAA4B,CAC1C,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CACV,6DAA6D,CAC9D;SACA,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,OAA2B,EAC3B,OAA6B,EAC7B,EAAE;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAEnC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,UAAU,CACf,WAAW,EACX,OAAO,CACR;YACD,MAAM,CAAC,eAAe,CACpB,WAAW,EACX,OAAO,CACR;SACF,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EACR,QAAQ,CAAC,YAAY,IAAI,KAAK;YAChC,gBAAgB,EACd,QAAQ,CAAC,gBAAgB;YAC3B,QAAQ,EACN,QAAQ,CAAC,QAAQ,IAAI,EAAE;YACzB,UAAU,EACR,QAAQ,CAAC,YAAY;gBACnB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;iBACvB,MAAM,CACL,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,CAAC,KAAK,CAAC,CACjB,IAAI,EAAE;YACX,kBAAkB,EAChB,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;iBAC7B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,KAAK,IAAI,CACzB,CAAC,MAAM;YACZ,oBAAoB,EAClB,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;iBAC1B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,KAAK,IAAI,CACzB,CAAC,MAAM;YACZ,eAAe,EACb,QAAQ,CAAC,eAAe,IAAI,EAAE;YAChC,eAAe,EACb,YAAY,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;YACjC,eAAe,EACb,YAAY,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;SAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,YAAY,WAAW,IAAI,OAAO,EAAE,CACrC,CAAC;QACF,OAAO,CAAC,GAAG,CACT,cAAc,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE,CAChD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,eAAe,MAAM,CAAC,UAAU,EAAE,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAChC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,eAAe,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAC1C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,qBAAqB,MAAM,CAAC,eAAe,EAAE,CAC9C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,kBAAkB,EAAE,CACpD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,0BAA0B,MAAM,CAAC,oBAAoB,EAAE,CACxD,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/pre-commit.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPreCommitCommand(program: Command): void;

package/dist/src/commands/pre-commit.js

@@ -0,0 +1,37 @@
+import chalk from 'chalk';
+import { runPreCommit } from '../core/pre-commit.js';
+export function registerPreCommitCommand(program) {
+    program
+        .command('pre-commit')
+        .description('Run blocking checks before a Git commit.')
+        .option('-p, --path <path>', 'Project path to check.', process.cwd())
+        .option('--show-findings', 'Print blocking findings.')
+        .action(async (options) => {
+        const result = await runPreCommit(options.path);
+        console.log(chalk.bold('Toolip Pre-Commit'));
+        console.log('');
+        console.log(`${chalk.dim('Critical:')} ${result.summary.critical}`);
+        console.log(`${chalk.dim('High:')} ${result.summary.high}`);
+        console.log(`${chalk.dim('Blocking Findings:')} ${result.summary.blocking}`);
+        if (options.showFindings && result.findings.length > 0) {
+            console.log('');
+            console.log(chalk.bold('Blocking Findings'));
+            for (const finding of result.findings.filter((item) => item.severity === 'critical' || item.severity === 'high')) {
+                console.log(`${chalk.red('✖')} ${finding.title}`);
+                if (finding.file)
+                    console.log(`  ${chalk.dim('File:')} ${finding.file}`);
+                if (finding.evidence)
+                    console.log(`  ${chalk.dim('Evidence:')} ${finding.evidence}`);
+            }
+        }
+        if (!result.passed) {
+            console.log('');
+            console.log(chalk.red('Pre-commit checks failed. Fix critical/high findings before committing.'));
+            process.exitCode = 1;
+            return;
+        }
+        console.log('');
+        console.log(chalk.green('Pre-commit checks passed.'));
+    });
+}
+//# sourceMappingURL=pre-commit.js.map

package/dist/src/commands/pre-commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-commit.js","sourceRoot":"","sources":["../../../src/commands/pre-commit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,OAAiD,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE7E,IAAI,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CACnE,EAAE,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClD,IAAI,OAAO,CAAC,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;YAClG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACP,CAAC"}