toolip 1.0.6 → 2.0.0

package/dist/src/commands/profile.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerProfileCommand(program: Command): void;

package/dist/src/commands/profile.js

@@ -0,0 +1,18 @@
+import { profileProject } from '../core/profile-project.js';
+import { printProfile } from '../utils/output.js';
+export function registerProfileCommand(program) {
+    program
+        .command('profile')
+        .description('Fingerprint the current project and detect frameworks, languages, and tooling.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print profile as JSON.')
+        .action(async (options) => {
+        const profile = await profileProject(options.path);
+        if (options.json) {
+            console.log(JSON.stringify(profile, null, 2));
+            return;
+        }
+        printProfile(profile);
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/src/commands/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/commands/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/publish.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPublishCommand(program: Command): void;

package/dist/src/commands/publish.js

@@ -0,0 +1,25 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { renderHtmlReport } from '../core/publish/html.js';
+export function registerPublishCommand(program) {
+    program
+        .command('publish')
+        .description('Generate a static HTML security report.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-o, --output <directory>', 'Output directory.', '.toolip-report')
+        .action(async (options) => {
+        const report = await runSecurityDoctor(options.path);
+        const directory = path.resolve(options.path, options.output);
+        await mkdir(directory, { recursive: true });
+        const html = renderHtmlReport({
+            project: path.basename(path.resolve(options.path)),
+            generatedAt: new Date().toISOString(),
+            findings: report.findings
+        });
+        await writeFile(path.join(directory, 'index.html'), html, 'utf8');
+        console.log(`Static report written to ${path.join(directory, 'index.html')}`);
+        console.log('Deploy this directory to GitHub Pages only after reviewing it for private data.');
+    });
+}
+//# sourceMappingURL=publish.js.map

package/dist/src/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,gBAAgB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/reachability.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerReachabilityCommand(program: Command): void;

package/dist/src/commands/reachability.js

@@ -0,0 +1,47 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { ReachabilityAnalyzer } from '../analyzers/reachability/reachability-analyzer.js';
+export function registerReachabilityCommand(program) {
+    program
+        .command('reachability')
+        .description('Show which npm packages are observed in JavaScript and TypeScript source imports.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependencies.')
+        .action(async (options) => {
+        const runner = new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        });
+        const [result] = await runner.run([new ReachabilityAnalyzer()], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('The reachability analyzer returned no result.');
+        }
+        const allPackages = (result.metadata?.packages ??
+            []);
+        const packages = options.includeDev
+            ? allPackages
+            : allPackages.filter((item) => !item.development);
+        if (options.json) {
+            console.log(JSON.stringify({
+                analyzer: result.analyzer,
+                durationMs: result.durationMs,
+                packages
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip Package Reachability');
+        console.log('');
+        for (const item of packages) {
+            console.log(`${item.state.padEnd(18)} ${item.packageName}`);
+            for (const reference of item.references.slice(0, 5)) {
+                console.log(`  ${reference.file}:${reference.line}:` +
+                    `${reference.column} (${reference.kind})`);
+            }
+        }
+        console.log('');
+        console.log('Reachability is static evidence, not proof that exploitation is impossible.');
+    });
+}
+//# sourceMappingURL=reachability.js.map

package/dist/src/commands/reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.js","sourceRoot":"","sources":["../../../src/commands/reachability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,oBAAoB,EAErB,MAAM,oDAAoD,CAAC;AAQ5D,MAAM,UAAU,2BAA2B,CACzC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CACV,mFAAmF,CACpF;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,eAAe,EACf,mCAAmC,CACpC;SACA,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,CAAC,IAAI,oBAAoB,EAAE,CAAC,EAC5B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ;YACxB,EAAE,CAA0B,CAAC;QAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAC5B,CAAC;QAEN,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ;aACT,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAC/C,CAAC;YAEF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,CAAC,EACD,CAAC,CACF,EAAE,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG;oBACtC,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,GAAG,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,6EAA6E,CAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sbom.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerSbomCommand(program: Command): void;

package/dist/src/commands/sbom.js

@@ -0,0 +1,33 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { generateSbom } from '../core/sbom/generate.js';
+function assertFormat(value) {
+    if (value !== 'cyclonedx' &&
+        value !== 'spdx') {
+        throw new Error('SBOM format must be cyclonedx or spdx.');
+    }
+}
+export function registerSbomCommand(program) {
+    program
+        .command('sbom')
+        .description('Generate a CycloneDX 1.5 or SPDX 2.3 software bill of materials.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('-f, --format <format>', 'cyclonedx or spdx.', 'cyclonedx')
+        .option('-o, --output <file>', 'Write JSON to a file instead of stdout.')
+        .action(async (options) => {
+        assertFormat(options.format);
+        const document = await generateSbom(options.path, options.format);
+        const output = `${JSON.stringify(document, null, 2)}\n`;
+        if (!options.output) {
+            process.stdout.write(output);
+            return;
+        }
+        const outputPath = path.resolve(options.path, options.output);
+        await mkdir(path.dirname(outputPath), {
+            recursive: true
+        });
+        await writeFile(outputPath, output, 'utf8');
+        console.log(`SBOM written to ${outputPath}`);
+    });
+}
+//# sourceMappingURL=sbom.js.map

package/dist/src/commands/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/commands/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,YAAY,EAEb,MAAM,0BAA0B,CAAC;AAQlC,SAAS,YAAY,CACnB,KAAa;IAEb,IACE,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,MAAM,EAChB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,kEAAkE,CACnE;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,uBAAuB,EACvB,oBAAoB,EACpB,WAAW,CACZ;SACA,MAAM,CACL,qBAAqB,EACrB,yCAAyC,CAC1C;SACA,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,MAAM,GACV,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAE3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YACpC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,SAAS,CACb,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/scan.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerScanCommand(program: Command): void;

package/dist/src/commands/scan.js

@@ -0,0 +1,48 @@
+import chalk from 'chalk';
+import { createScannerContext } from '../core/scanner-context.js';
+import { createReport } from '../core/report.js';
+import { writeReport } from '../core/report-writer.js';
+import { scanDependencies } from '../core/dependency-scan.js';
+import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+import { TOOLIP_VERSION } from '../config/version.js';
+import { printReportSummary, printScannerContext } from '../utils/output.js';
+export function registerScanCommand(program) {
+    program
+        .command('scan')
+        .description('Scan project dependencies and security hygiene indicators.')
+        .option('-p, --path <path>', 'Project path to scan.', process.cwd())
+        .option('-o, --output <file>', 'Write scan report to JSON or Markdown.')
+        .action(async (options) => {
+        console.log(chalk.bold('Toolip Scan'));
+        console.log('');
+        const context = await createScannerContext(options.path);
+        printScannerContext(context);
+        const dependencyScan = await scanDependencies(context.root);
+        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
+        const score = calculateScore({ dependencyHealth });
+        const report = createReport({
+            version: TOOLIP_VERSION,
+            command: 'scan',
+            root: context.root,
+            findings: dependencyScan.findings
+        });
+        console.log('');
+        console.log(chalk.bold('Dependency Intelligence'));
+        console.log(`${chalk.dim('Total Dependencies:')} ${dependencyScan.summary.totalDependencies}`);
+        console.log(`${chalk.dim('Outdated:')} ${dependencyScan.summary.outdated}`);
+        console.log(`${chalk.dim('Deprecated:')} ${dependencyScan.summary.deprecated}`);
+        console.log(`${chalk.dim('High Risk:')} ${dependencyScan.summary.highRisk}`);
+        console.log(`${chalk.dim('Medium Risk:')} ${dependencyScan.summary.mediumRisk}`);
+        console.log(`${chalk.dim('Average Risk:')} ${dependencyScan.summary.averageRiskScore}`);
+        console.log(`${chalk.dim('Dependency Health:')} ${dependencyHealth}`);
+        console.log(`${chalk.dim('Overall Grade:')} ${score.grade}`);
+        console.log('');
+        printReportSummary(report);
+        if (options.output) {
+            await writeReport(options.output, report);
+            console.log('');
+            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
+        }
+    });
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACnE,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/score.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerScoreCommand(program: Command): void;

package/dist/src/commands/score.js

@@ -0,0 +1,24 @@
+import chalk from 'chalk';
+import { scanDependencies } from '../core/dependency-scan.js';
+import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+export function registerScoreCommand(program) {
+    program
+        .command('score')
+        .description('Calculate a Toolip security scorecard for the current project.')
+        .option('-p, --path <path>', 'Project path to score.', process.cwd())
+        .action(async (options) => {
+        const dependencyScan = await scanDependencies(options.path);
+        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
+        const score = calculateScore({ dependencyHealth });
+        console.log(chalk.bold('Toolip Security Scorecard'));
+        console.log('');
+        console.log(`${chalk.dim('Dependency Health ....')} ${score.dependencyHealth}`);
+        console.log(`${chalk.dim('Secret Hygiene .......')} ${score.secretHygiene}`);
+        console.log(`${chalk.dim('Configuration ........')} ${score.configurationSecurity}`);
+        console.log(`${chalk.dim('Git Safety ...........')} ${score.gitSafety}`);
+        console.log('');
+        console.log(`${chalk.dim('Overall Score ........')} ${score.overall}`);
+        console.log(`${chalk.dim('Grade ................')} ${score.grade}`);
+    });
+}
+//# sourceMappingURL=score.js.map

package/dist/src/commands/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/commands/score.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE7E,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/self-test.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerSelfTestCommand(program: Command): void;

package/dist/src/commands/self-test.js

@@ -0,0 +1,63 @@
+import chalk from 'chalk';
+import { access } from 'node:fs/promises';
+import path from 'node:path';
+import { TOOLIP_VERSION } from '../config/version.js';
+async function canAccess(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function registerSelfTestCommand(program) {
+    program
+        .command('self-test')
+        .description('Run Toolip internal diagnostics.')
+        .action(async () => {
+        const checks = [
+            {
+                label: 'CLI Loaded',
+                passed: true
+            },
+            {
+                label: 'Command Router Ready',
+                passed: true
+            },
+            {
+                label: 'Package Manifest Found',
+                passed: await canAccess(path.join(process.cwd(), 'package.json'))
+            },
+            {
+                label: 'Scanner Foundation Ready',
+                passed: true
+            },
+            {
+                label: 'Report Engine Ready',
+                passed: true
+            }
+        ];
+        console.log(chalk.bold('Toolip Self-Test'));
+        console.log(chalk.dim(`Version: ${TOOLIP_VERSION}`));
+        console.log('');
+        let failed = 0;
+        for (const check of checks) {
+            if (check.passed) {
+                console.log(`${chalk.green('✓')} ${check.label}`);
+            }
+            else {
+                failed += 1;
+                console.log(`${chalk.red('✖')} ${check.label}`);
+            }
+        }
+        console.log('');
+        if (failed > 0) {
+            console.log(chalk.red(`Toolip found ${failed} failed diagnostic check(s).`));
+            process.exitCode = 1;
+            return;
+        }
+        console.log(chalk.green('Toolip is healthy.'));
+    });
+}
+//# sourceMappingURL=self-test.js.map

package/dist/src/commands/self-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-test.js","sourceRoot":"","sources":["../../../src/commands/self-test.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG;YACb;gBACE,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;aAClE;YACD;gBACE,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,IAAI;aACb;YACD;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,IAAI;aACb;SACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,cAAc,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,MAAM,8BAA8B,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/tree.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerTreeCommand(program: Command): void;

package/dist/src/commands/tree.js

@@ -0,0 +1,21 @@
+import chalk from 'chalk';
+import { buildDependencyTree } from '../core/dependency-tree.js';
+export function registerTreeCommand(program) {
+    program
+        .command('tree')
+        .description('Display a dependency tree summary.')
+        .option('-p, --path <path>', 'Project path to analyze.', process.cwd())
+        .action(async (options) => {
+        const tree = await buildDependencyTree(options.path);
+        console.log(chalk.bold('Toolip Dependency Tree'));
+        console.log('');
+        console.log(`${chalk.dim('Direct Dependencies:')} ${tree.summary.direct}`);
+        console.log(`${chalk.dim('Transitive Dependencies:')} ${tree.summary.transitive}`);
+        console.log(`${chalk.dim('Max Depth:')} ${tree.summary.maxDepth}`);
+        console.log('');
+        for (const dependency of tree.dependencies) {
+            console.log(`${chalk.green('├─')} ${dependency.name}@${dependency.version} ${chalk.dim(`(${dependency.type})`)}`);
+        }
+    });
+}
+//# sourceMappingURL=tree.js.map

package/dist/src/commands/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../../src/commands/tree.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oCAAoC,CAAC;SACjD,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/upgrade-pr.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerUpgradePrCommand(program: Command): void;

package/dist/src/commands/upgrade-pr.js

@@ -0,0 +1,15 @@
+import { createUpgradePullRequest } from '../core/github/upgrade-pr.js';
+export function registerUpgradePrCommand(program) {
+    program
+        .command('upgrade-pr <package> <version>')
+        .description('Create a tested dependency-upgrade pull request through gh.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--dry-run', 'Validate the request without changing Git.')
+        .action(async (packageName, version, options) => {
+        const result = await createUpgradePullRequest(options.path, packageName, version, Boolean(options.dryRun));
+        console.log(options.dryRun
+            ? `Dry run passed. Proposed branch: ${result.branch}`
+            : `Pull request created from ${result.branch}`);
+    });
+}
+//# sourceMappingURL=upgrade-pr.js.map

package/dist/src/commands/upgrade-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-pr.js","sourceRoot":"","sources":["../../../src/commands/upgrade-pr.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,gCAAgC,CAAC;SACzC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;SACjE,MAAM,CAAC,KAAK,EACX,WAAmB,EACnB,OAAe,EACf,OAA2C,EAC3C,EAAE;QACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,OAAO,CAAC,IAAI,EACZ,WAAW,EACX,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CACxB,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,MAAM;YACZ,CAAC,CAAC,oCAAoC,MAAM,CAAC,MAAM,EAAE;YACrD,CAAC,CAAC,6BAA6B,MAAM,CAAC,MAAM,EAAE,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/vault.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerVaultCommand(program: Command): void;

package/dist/src/commands/vault.js

@@ -0,0 +1,86 @@
+import chalk from 'chalk';
+import { deleteSecret, exportEnv, getSecret, initVault, listSecrets, setSecret } from '../core/vault.js';
+export function registerVaultCommand(program) {
+    const vault = program
+        .command('vault')
+        .description('Manage encrypted local secrets with Toolip Vault.');
+    vault
+        .command('init')
+        .description('Initialize an encrypted local vault.')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (options) => {
+        await initVault(options.password);
+        console.log(`${chalk.green('✓')} Toolip Vault initialized.`);
+    });
+    vault
+        .command('set <key> <value>')
+        .description('Store or update a secret.')
+        .option('--env <env>', 'Secret environment.', 'development')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (key, value, options) => {
+        await setSecret({
+            key,
+            value,
+            env: options.env,
+            masterPassword: options.password
+        });
+        console.log(`${chalk.green('✓')} Stored ${key} for ${options.env}.`);
+    });
+    vault
+        .command('get <key>')
+        .description('Retrieve a secret value.')
+        .option('--env <env>', 'Secret environment.', 'development')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (key, options) => {
+        const secret = await getSecret({
+            key,
+            env: options.env,
+            masterPassword: options.password
+        });
+        console.log(secret.value);
+    });
+    vault
+        .command('list')
+        .description('List secret names without revealing values.')
+        .option('--env <env>', 'Filter by environment.')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (options) => {
+        const secrets = await listSecrets({
+            env: options.env,
+            masterPassword: options.password
+        });
+        if (secrets.length === 0) {
+            console.log(chalk.yellow('No secrets found.'));
+            return;
+        }
+        for (const secret of secrets) {
+            console.log(`${chalk.green('✓')} ${secret.key} ${chalk.dim(`(${secret.env})`)}`);
+        }
+    });
+    vault
+        .command('delete <key>')
+        .description('Delete a secret.')
+        .option('--env <env>', 'Secret environment.', 'development')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (key, options) => {
+        const deleted = await deleteSecret({
+            key,
+            env: options.env,
+            masterPassword: options.password
+        });
+        console.log(deleted ? `${chalk.green('✓')} Deleted ${key}.` : chalk.yellow(`No secret found for ${key}.`));
+    });
+    vault
+        .command('export')
+        .description('Export secrets as shell-compatible environment lines.')
+        .option('--env <env>', 'Filter by environment.')
+        .requiredOption('--password <password>', 'Master password.')
+        .action(async (options) => {
+        const output = await exportEnv({
+            env: options.env,
+            masterPassword: options.password
+        });
+        console.log(output);
+    });
+}
+//# sourceMappingURL=vault.js.map

package/dist/src/commands/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/commands/vault.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,SAAS,EACV,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mDAAmD,CAAC,CAAC;IAEpE,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sCAAsC,CAAC;SACnD,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE,aAAa,CAAC;SAC3D,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,OAA0C,EAAE,EAAE;QACvF,MAAM,SAAS,CAAC;YACd,GAAG;YACH,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE,aAAa,CAAC;SAC3D,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,OAA0C,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,OAA2C,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,aAAa,EAAE,qBAAqB,EAAE,aAAa,CAAC;SAC3D,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,OAA0C,EAAE,EAAE;QACxE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;YACjC,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,GAAG,GAAG,CAAC,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,OAA2C,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/vulnerabilities.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerVulnerabilitiesCommand(program: Command): void;

package/dist/src/commands/vulnerabilities.js

@@ -0,0 +1,42 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { OsvVulnerabilityAnalyzer } from '../analyzers/vulnerability/osv-analyzer.js';
+import { MemoryCache } from '../storage/memory-cache.js';
+export function registerVulnerabilitiesCommand(program) {
+    program
+        .command('vulnerabilities')
+        .alias('vulns')
+        .description('Match resolved npm dependencies against OSV.dev.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependency findings.')
+        .action(async (options) => {
+        const [result] = await new AnalyzerRunner({ concurrency: 1, timeoutMs: 60000 }).run([new OsvVulnerabilityAnalyzer()], { root: options.path, cache: new MemoryCache() });
+        if (!result)
+            throw new Error('OSV analyzer returned no result.');
+        const findings = options.includeDev
+            ? result.findings
+            : result.findings.filter((finding) => finding.metadata?.development !== true);
+        if (options.json) {
+            console.log(JSON.stringify({ ...result, findings }, null, 2));
+        }
+        else {
+            console.log('Toolip Vulnerability Intelligence');
+            console.log('');
+            console.log(`Dependencies checked: ${result.metadata?.dependenciesChecked ?? 0}`);
+            console.log(`Known vulnerabilities: ${findings.length}`);
+            console.log('');
+            for (const finding of findings) {
+                console.log(`[${finding.severity.toUpperCase()}] ${finding.metadata?.vulnerabilityId}`);
+                console.log(`Package: ${finding.metadata?.package}@${finding.metadata?.installedVersion}`);
+                console.log(`Summary: ${finding.title}`);
+                if (finding.remediation?.summary)
+                    console.log(`Fix: ${finding.remediation.summary}`);
+                console.log('');
+            }
+            if (findings.length === 0) {
+                console.log('No disclosed vulnerabilities matched the resolved npm dependency versions.');
+            }
+        }
+    });
+}
+//# sourceMappingURL=vulnerabilities.js.map

package/dist/src/commands/vulnerabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerabilities.js","sourceRoot":"","sources":["../../../src/commands/vulnerabilities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,KAAK,CAAC,OAAO,CAAC;SACd,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,OAA+D,EAAE,EAAE;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,IAAI,wBAAwB,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,EAAE,CACjD,CAAC;QAEF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,QAAQ,EAAE,mBAAmB,IAAI,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;gBACxF,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/watch.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerWatchCommand(program: Command): void;

package/dist/src/commands/watch.js

@@ -0,0 +1,34 @@
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { watchProject } from '../core/watch/watch.js';
+export function registerWatchCommand(program) {
+    program
+        .command('watch')
+        .description('Continuously rerun Toolip security checks as files change.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('--once', 'Run once without watching.')
+        .action(async (options) => {
+        const render = async () => {
+            const result = await runSecurityDoctor(options.path);
+            console.clear();
+            console.log('Toolip Watch');
+            console.log('');
+            console.log(`Updated: ${new Date().toISOString()}`);
+            console.log(`Critical/secrets: ${result.summary.secrets}`);
+            console.log(`Dangerous code: ${result.summary.dangerousCode}`);
+            console.log(`Configuration: ${result.summary.configuration}`);
+            console.log(`Total findings: ${result.findings.length}`);
+        };
+        await render();
+        if (options.once)
+            return;
+        console.log('');
+        console.log('Watching for changes. Press Ctrl+C to stop.');
+        const close = watchProject(options.path, render);
+        process.once('SIGINT', () => {
+            close();
+            process.exit(0);
+        });
+        await new Promise(() => undefined);
+    });
+}
+//# sourceMappingURL=watch.js.map

package/dist/src/commands/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../../src/commands/watch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC;QAEF,MAAM,MAAM,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO;QAEzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEjD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC1B,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/config/version.d.ts

@@ -0,0 +1,6 @@
+export declare const TOOLIP_VERSION: string;
+export declare const TOOLIP_AUTHOR: {
+    name: string;
+    handle: string;
+    github: string;
+};

package/dist/src/config/version.js

@@ -0,0 +1,29 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+function resolvePackageVersion() {
+    let directory = path.dirname(fileURLToPath(import.meta.url));
+    const root = path.parse(directory).root;
+    while (directory !== root) {
+        const manifestPath = path.join(directory, 'package.json');
+        try {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            if (manifest.name === 'toolip' &&
+                typeof manifest.version === 'string') {
+                return manifest.version;
+            }
+        }
+        catch {
+            // Continue searching parent directories.
+        }
+        directory = path.dirname(directory);
+    }
+    throw new Error('Unable to resolve Toolip version from package.json.');
+}
+export const TOOLIP_VERSION = resolvePackageVersion();
+export const TOOLIP_AUTHOR = {
+    name: 'Ashibuogwu Williams',
+    handle: 'wbizmo',
+    github: 'https://github.com/wbizmo'
+};
+//# sourceMappingURL=version.js.map