toolip 1.0.6 → 2.0.0

package/dist/src/config/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/config/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAOzC,SAAS,qBAAqB;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAExC,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAChB,CAAC;YAErB,IACE,QAAQ,CAAC,IAAI,KAAK,QAAQ;gBAC1B,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EACpC,CAAC;gBACD,OAAO,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;AAEtD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,qBAAqB;IAC3B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,2BAA2B;CACpC,CAAC"}

package/dist/src/contracts/analyzer.d.ts

@@ -0,0 +1,23 @@
+import type { Finding } from './finding.js';
+export type AnalyzerContext = {
+    root: string;
+    signal?: AbortSignal;
+    cache?: AnalyzerCache;
+    options?: Record<string, unknown>;
+};
+export type AnalyzerCache = {
+    get<T>(key: string): Promise<T | undefined>;
+    set<T>(key: string, value: T, ttlMs?: number): Promise<void>;
+};
+export type AnalyzerResult = {
+    analyzer: string;
+    durationMs: number;
+    findings: Finding[];
+    warnings?: string[];
+    metadata?: Record<string, unknown>;
+};
+export interface Analyzer {
+    readonly id: string;
+    readonly version: string;
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/contracts/analyzer.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=analyzer.js.map

package/dist/src/contracts/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../src/contracts/analyzer.ts"],"names":[],"mappings":""}

package/dist/src/contracts/finding.d.ts

@@ -0,0 +1,35 @@
+export declare const findingSeverities: readonly ["critical", "high", "medium", "low", "info"];
+export type FindingSeverity = (typeof findingSeverities)[number];
+export declare const findingConfidences: readonly ["high", "medium", "low"];
+export type FindingConfidence = (typeof findingConfidences)[number];
+export type FindingLocation = {
+    file: string;
+    line?: number;
+    column?: number;
+    endLine?: number;
+    endColumn?: number;
+};
+export type FindingEvidence = {
+    summary: string;
+    excerpt?: string;
+    fingerprint?: string;
+};
+export type FindingRemediation = {
+    summary: string;
+    fixedVersion?: string;
+    references?: string[];
+};
+export type Finding = {
+    id: string;
+    ruleId: string;
+    title: string;
+    category: string;
+    severity: FindingSeverity;
+    confidence: FindingConfidence;
+    message: string;
+    source: string;
+    location?: FindingLocation;
+    evidence?: FindingEvidence[];
+    remediation?: FindingRemediation;
+    metadata?: Record<string, unknown>;
+};

package/dist/src/contracts/finding.js

@@ -0,0 +1,13 @@
+export const findingSeverities = [
+    'critical',
+    'high',
+    'medium',
+    'low',
+    'info'
+];
+export const findingConfidences = [
+    'high',
+    'medium',
+    'low'
+];
+//# sourceMappingURL=finding.js.map

package/dist/src/contracts/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../../src/contracts/finding.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,QAAQ;IACR,KAAK;CACG,CAAC"}

package/dist/src/contracts/report.d.ts

@@ -0,0 +1,30 @@
+import type { Finding } from './finding.js';
+export declare const TOOLIP_REPORT_SCHEMA_VERSION = "2.0";
+export type ReportSummary = {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+    total: number;
+};
+export type ToolipReportV2 = {
+    schemaVersion: typeof TOOLIP_REPORT_SCHEMA_VERSION;
+    generatedAt: string;
+    toolipVersion: string;
+    project: {
+        root: string;
+        name?: string;
+        packageManager?: string;
+    };
+    summary: ReportSummary;
+    findings: Finding[];
+    analyzers: Array<{
+        id: string;
+        version: string;
+        durationMs: number;
+        findingCount: number;
+        warnings?: string[];
+    }>;
+    metadata?: Record<string, unknown>;
+};

package/dist/src/contracts/report.js

@@ -0,0 +1,2 @@
+export const TOOLIP_REPORT_SCHEMA_VERSION = '2.0';
+//# sourceMappingURL=report.js.map

package/dist/src/contracts/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/contracts/report.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC"}

package/dist/src/contracts/rule.d.ts

@@ -0,0 +1,12 @@
+import type { FindingConfidence, FindingSeverity } from './finding.js';
+export type RuleDefinition = {
+    id: string;
+    title: string;
+    category: string;
+    defaultSeverity: FindingSeverity;
+    defaultConfidence: FindingConfidence;
+    description: string;
+    remediation: string;
+    references?: string[];
+};
+export declare function assertValidRuleId(ruleId: string): void;

package/dist/src/contracts/rule.js

@@ -0,0 +1,7 @@
+const RULE_ID_PATTERN = /^TLP-[A-Z]+-\d{3}$/;
+export function assertValidRuleId(ruleId) {
+    if (!RULE_ID_PATTERN.test(ruleId)) {
+        throw new Error(`Invalid Toolip rule ID "${ruleId}". Expected format: TLP-CATEGORY-001.`);
+    }
+}
+//# sourceMappingURL=rule.js.map

package/dist/src/contracts/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../../src/contracts/rule.ts"],"names":[],"mappings":"AAgBA,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,uCAAuC,CACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/core/alternatives.d.ts

@@ -0,0 +1,8 @@
+export type PackageAlternative = {
+    package: string;
+    alternatives: Array<{
+        name: string;
+        reason: string;
+    }>;
+};
+export declare function findAlternatives(packageName: string): PackageAlternative;

package/dist/src/core/alternatives.js

@@ -0,0 +1,35 @@
+const alternativeMap = {
+    request: [
+        { name: 'got', reason: 'Modern HTTP client with active maintenance and strong Node.js support.' },
+        { name: 'undici', reason: 'Fast official Node.js HTTP client maintained under the Node.js project.' },
+        { name: 'axios', reason: 'Popular promise-based HTTP client with broad ecosystem adoption.' }
+    ],
+    'node-fetch': [
+        { name: 'undici', reason: 'Native fetch-compatible HTTP client for modern Node.js.' },
+        { name: 'ky', reason: 'Small fetch-based client for browser and modern JavaScript workflows.' }
+    ],
+    moment: [
+        { name: 'dayjs', reason: 'Small Moment-compatible API with lower bundle size.' },
+        { name: 'date-fns', reason: 'Modular date utilities with tree-shaking support.' },
+        { name: 'luxon', reason: 'Modern date-time library from the Moment maintainers.' }
+    ],
+    lodash: [
+        { name: 'lodash-es', reason: 'ES module build with better tree-shaking.' },
+        { name: 'radash', reason: 'Modern utility library with TypeScript-friendly APIs.' }
+    ],
+    uuid: [
+        { name: 'crypto.randomUUID', reason: 'Built into modern Node.js and avoids an extra dependency where suitable.' }
+    ]
+};
+export function findAlternatives(packageName) {
+    return {
+        package: packageName,
+        alternatives: alternativeMap[packageName] ?? [
+            {
+                name: 'No curated alternative yet',
+                reason: 'Toolip does not have a curated replacement for this package yet. Inspect maintenance, license, downloads, and dependency count manually.'
+            }
+        ]
+    };
+}
+//# sourceMappingURL=alternatives.js.map

package/dist/src/core/alternatives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alternatives.js","sourceRoot":"","sources":["../../../src/core/alternatives.ts"],"names":[],"mappings":"AAQA,MAAM,cAAc,GAAuD;IACzE,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wEAAwE,EAAE;QACjG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yEAAyE,EAAE;QACrG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kEAAkE,EAAE;KAC9F;IACD,YAAY,EAAE;QACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yDAAyD,EAAE;QACrF,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,uEAAuE,EAAE;KAChG;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,qDAAqD,EAAE;QAChF,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACjF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,uDAAuD,EAAE;KACnF;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,2CAA2C,EAAE;QAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE;KACpF;IACD,IAAI,EAAE;QACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,0EAA0E,EAAE;KAClH;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,IAAI;YAC3C;gBACE,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,0IAA0I;aACnJ;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/analyze-package.d.ts

@@ -0,0 +1,2 @@
+import type { DependencyInfo, PackageHealth } from './dependency-types.js';
+export declare function analyzePackage(dependency: DependencyInfo): Promise<PackageHealth>;

package/dist/src/core/analyze-package.js

@@ -0,0 +1,49 @@
+import semver from 'semver';
+import { fetchPackageManifest } from './npm-registry.js';
+import { calculateRiskScore } from './risk-score.js';
+function cleanInstalledVersion(version) {
+    if (version === 'latest')
+        return null;
+    return semver.coerce(version)?.version ?? null;
+}
+function isOutdated(installedVersion, latestVersion) {
+    const cleanedInstalledVersion = cleanInstalledVersion(installedVersion);
+    if (!cleanedInstalledVersion || !latestVersion) {
+        return false;
+    }
+    const cleanedLatestVersion = semver.coerce(latestVersion)?.version;
+    if (!cleanedLatestVersion) {
+        return false;
+    }
+    return semver.lt(cleanedInstalledVersion, cleanedLatestVersion);
+}
+export async function analyzePackage(dependency) {
+    const manifest = await fetchPackageManifest(dependency.name);
+    const latestVersion = typeof manifest.version === 'string' ? manifest.version : null;
+    const publishedDate = manifest.time && latestVersion ? manifest.time[latestVersion] ?? null : null;
+    const ageInDays = publishedDate
+        ? Math.floor((Date.now() - new Date(publishedDate).getTime()) /
+            (1000 * 60 * 60 * 24))
+        : null;
+    const maintainers = Array.isArray(manifest.maintainers)
+        ? manifest.maintainers.length
+        : 0;
+    const deprecated = Boolean(manifest.deprecated);
+    return {
+        name: dependency.name,
+        installedVersion: dependency.version,
+        latestVersion,
+        outdated: isOutdated(dependency.version, latestVersion),
+        deprecated,
+        maintainers,
+        publishedAt: publishedDate,
+        ageInDays,
+        downloads: null,
+        riskScore: calculateRiskScore({
+            deprecated,
+            maintainers,
+            ageInDays
+        })
+    };
+}
+//# sourceMappingURL=analyze-package.js.map

package/dist/src/core/analyze-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-package.js","sourceRoot":"","sources":["../../../src/core/analyze-package.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,gBAAwB,EAAE,aAA4B;IACxE,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAExE,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAEnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,MAAM,aAAa,GACjB,QAAQ,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/E,MAAM,SAAS,GAAG,aAAa;QAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CACR,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACxB;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC7B,CAAC,CAAC,CAAC,CAAC;IAEN,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEhD,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,gBAAgB,EAAE,UAAU,CAAC,OAAO;QACpC,aAAa;QACb,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;QACvD,UAAU;QACV,WAAW;QACX,WAAW,EAAE,aAAa;QAC1B,SAAS;QACT,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,kBAAkB,CAAC;YAC5B,UAAU;YACV,WAAW;YACX,SAAS;SACV,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/core/announce/generate.d.ts

@@ -0,0 +1,9 @@
+export type AnnouncementInput = {
+    version?: string;
+    fixed: number;
+    added: number;
+    removed: number;
+    scoreBefore?: number;
+    scoreAfter?: number;
+};
+export declare function generateAnnouncement(input: AnnouncementInput): string;

package/dist/src/core/announce/generate.js

@@ -0,0 +1,19 @@
+export function generateAnnouncement(input) {
+    const title = input.version
+        ? `Toolip ${input.version} security update`
+        : 'Toolip security update';
+    const lines = [
+        title,
+        '',
+        `Fixed findings: ${input.fixed}`,
+        `New findings: ${input.added}`,
+        `Removed findings: ${input.removed}`
+    ];
+    if (input.scoreBefore !== undefined &&
+        input.scoreAfter !== undefined) {
+        lines.push(`Security score: ${input.scoreBefore} → ${input.scoreAfter}`);
+    }
+    lines.push('', 'This summary was generated locally from structured Toolip scan differences.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=generate.js.map

package/dist/src/core/announce/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../../src/core/announce/generate.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;QACzB,CAAC,CAAC,UAAU,KAAK,CAAC,OAAO,kBAAkB;QAC3C,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,KAAK,GAAG;QACZ,KAAK;QACL,EAAE;QACF,mBAAmB,KAAK,CAAC,KAAK,EAAE;QAChC,iBAAiB,KAAK,CAAC,KAAK,EAAE;QAC9B,qBAAqB,KAAK,CAAC,OAAO,EAAE;KACrC,CAAC;IAEF,IACE,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,KAAK,CAAC,UAAU,KAAK,SAAS,EAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CACR,mBAAmB,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,UAAU,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,6EAA6E,CAC9E,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/core/compare-packages.d.ts

@@ -0,0 +1,7 @@
+import type { PackageHealth } from './dependency-types.js';
+export type PackageComparison = {
+    packages: PackageHealth[];
+    safest: PackageHealth | null;
+    riskiest: PackageHealth | null;
+};
+export declare function comparePackages(packageNames: string[]): Promise<PackageComparison>;

package/dist/src/core/compare-packages.js

@@ -0,0 +1,19 @@
+import { analyzePackage } from './analyze-package.js';
+function asDependency(packageName) {
+    return {
+        name: packageName,
+        version: 'latest',
+        type: 'dependency'
+    };
+}
+export async function comparePackages(packageNames) {
+    const uniqueNames = [...new Set(packageNames.map((name) => name.trim()).filter(Boolean))];
+    const packages = await Promise.all(uniqueNames.map((packageName) => analyzePackage(asDependency(packageName))));
+    const sortedByRisk = [...packages].sort((a, b) => a.riskScore - b.riskScore);
+    return {
+        packages,
+        safest: sortedByRisk[0] ?? null,
+        riskiest: sortedByRisk.at(-1) ?? null
+    };
+}
+//# sourceMappingURL=compare-packages.js.map

package/dist/src/core/compare-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare-packages.js","sourceRoot":"","sources":["../../../src/core/compare-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAAsB;IAC1D,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE1F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAC5E,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAE7E,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI;QAC/B,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KACtC,CAAC;AACJ,CAAC"}

package/dist/src/core/config/load.d.ts

@@ -0,0 +1,3 @@
+import { type ToolipConfig } from './schema.js';
+export declare const TOOLIP_CONFIG_FILE = "toolip.config.json";
+export declare function loadToolipConfig(root: string): Promise<ToolipConfig>;

package/dist/src/core/config/load.js

@@ -0,0 +1,21 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { toolipConfigSchema } from './schema.js';
+export const TOOLIP_CONFIG_FILE = 'toolip.config.json';
+export async function loadToolipConfig(root) {
+    const filePath = path.join(root, TOOLIP_CONFIG_FILE);
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return toolipConfigSchema.parse(parsed);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            'code' in error &&
+            error.code === 'ENOENT') {
+            return toolipConfigSchema.parse({});
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=load.js.map

package/dist/src/core/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/core/config/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,kBAAkB,GAC7B,oBAAoB,CAAC;AAEvB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,IAAI,EACJ,kBAAkB,CACnB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAE1C,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/core/config/policy.d.ts

@@ -0,0 +1,3 @@
+import type { Finding } from '../../contracts/finding.js';
+import type { ToolipConfig } from './schema.js';
+export declare function applyFindingPolicy(findings: Finding[], config: ToolipConfig): Finding[];

package/dist/src/core/config/policy.js

@@ -0,0 +1,48 @@
+function wildcardMatch(value, pattern) {
+    const escaped = pattern
+        .replaceAll(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replaceAll('**', '___DOUBLE_STAR___')
+        .replaceAll('*', '[^/]*')
+        .replaceAll('___DOUBLE_STAR___', '.*');
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function suppressionActive(expiresAt) {
+    return (expiresAt === undefined ||
+        new Date(expiresAt).getTime() > Date.now());
+}
+export function applyFindingPolicy(findings, config) {
+    const output = [];
+    for (const finding of findings) {
+        const rule = config.rules[finding.ruleId];
+        const file = finding.location?.file ?? '';
+        if (rule?.enabled === false) {
+            continue;
+        }
+        let severity = rule?.severity ?? finding.severity;
+        for (const pathRule of rule?.paths ?? []) {
+            if (file &&
+                wildcardMatch(file, pathRule.pattern)) {
+                if (pathRule.enabled === false) {
+                    severity = finding.severity;
+                    break;
+                }
+                severity =
+                    pathRule.severity ?? severity;
+            }
+        }
+        const suppressed = config.suppressions.some((suppression) => suppression.ruleId === finding.ruleId &&
+            suppressionActive(suppression.expiresAt) &&
+            (suppression.path === undefined ||
+                (file &&
+                    wildcardMatch(file, suppression.path))));
+        if (suppressed) {
+            continue;
+        }
+        output.push({
+            ...finding,
+            severity
+        });
+    }
+    return output;
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/core/config/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/core/config/policy.ts"],"names":[],"mappings":"AAGA,SAAS,aAAa,CACpB,KAAa,EACb,OAAe;IAEf,MAAM,OAAO,GAAG,OAAO;SACpB,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACvC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;SACrC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzC,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAkB;IAElB,OAAO,CACL,SAAS,KAAK,SAAS;QACvB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAE1C,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,GACV,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IACE,IAAI;gBACJ,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EACrC,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;oBAC/B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;oBAC5B,MAAM;gBACR,CAAC;gBAED,QAAQ;oBACN,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CACzC,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACrC,iBAAiB,CACf,WAAW,CAAC,SAAS,CACtB;YACD,CACE,WAAW,CAAC,IAAI,KAAK,SAAS;gBAC9B,CACE,IAAI;oBACJ,aAAa,CACX,IAAI,EACJ,WAAW,CAAC,IAAI,CACjB,CACF,CACF,CACJ,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,OAAO;YACV,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/core/config/schema.d.ts

@@ -0,0 +1,172 @@
+import { z } from 'zod';
+export declare const toolipConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<"1.0">>;
+    include: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    exclude: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        severity: z.ZodOptional<z.ZodEnum<["critical", "high", "medium", "low", "info"]>>;
+        paths: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodString;
+            severity: z.ZodOptional<z.ZodEnum<["critical", "high", "medium", "low", "info"]>>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }, {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }>>>;
+    suppressions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }, {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }>, "many">>;
+    history: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxEntries: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        maxEntries: number;
+    }, {
+        enabled?: boolean | undefined;
+        maxEntries?: number | undefined;
+    }>>;
+    providers: z.ZodDefault<z.ZodObject<{
+        osv: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            timeoutMs: number;
+            enabled: boolean;
+        }, {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        }>>;
+        depsDev: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            timeoutMs: number;
+            enabled: boolean;
+        }, {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        osv: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+        depsDev: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+    }, {
+        osv?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+        depsDev?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    schemaVersion: "1.0";
+    history: {
+        enabled: boolean;
+        maxEntries: number;
+    };
+    include: string[];
+    exclude: string[];
+    rules: Record<string, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }>;
+    suppressions: {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }[];
+    providers: {
+        osv: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+        depsDev: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+    };
+}, {
+    schemaVersion?: "1.0" | undefined;
+    history?: {
+        enabled?: boolean | undefined;
+        maxEntries?: number | undefined;
+    } | undefined;
+    include?: string[] | undefined;
+    exclude?: string[] | undefined;
+    rules?: Record<string, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }> | undefined;
+    suppressions?: {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }[] | undefined;
+    providers?: {
+        osv?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+        depsDev?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    } | undefined;
+}>;
+export type ToolipConfig = z.infer<typeof toolipConfigSchema>;