toolip 1.0.6 → 2.0.0

package/dist/src/core/config/schema.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+export const toolipConfigSchema = z.object({
+    schemaVersion: z.literal('1.0').default('1.0'),
+    include: z.array(z.string()).default([]),
+    exclude: z.array(z.string()).default([]),
+    rules: z
+        .record(z.object({
+        enabled: z.boolean().optional(),
+        severity: z
+            .enum([
+            'critical',
+            'high',
+            'medium',
+            'low',
+            'info'
+        ])
+            .optional(),
+        paths: z
+            .array(z.object({
+            pattern: z.string(),
+            severity: z
+                .enum([
+                'critical',
+                'high',
+                'medium',
+                'low',
+                'info'
+            ])
+                .optional(),
+            enabled: z.boolean().optional()
+        }))
+            .optional()
+    }))
+        .default({}),
+    suppressions: z
+        .array(z.object({
+        ruleId: z.string(),
+        path: z.string().optional(),
+        reason: z.string().min(3),
+        expiresAt: z.string().datetime().optional()
+    }))
+        .default([]),
+    history: z
+        .object({
+        enabled: z.boolean().default(true),
+        maxEntries: z.number().int().positive().max(5000).default(500)
+    })
+        .default({
+        enabled: true,
+        maxEntries: 500
+    }),
+    providers: z
+        .object({
+        osv: z
+            .object({
+            enabled: z.boolean().default(true),
+            timeoutMs: z.number().int().positive().default(20000)
+        })
+            .default({
+            enabled: true,
+            timeoutMs: 20000
+        }),
+        depsDev: z
+            .object({
+            enabled: z.boolean().default(true),
+            timeoutMs: z.number().int().positive().default(20000)
+        })
+            .default({
+            enabled: true,
+            timeoutMs: 20000
+        })
+    })
+        .default({
+        osv: {
+            enabled: true,
+            timeoutMs: 20000
+        },
+        depsDev: {
+            enabled: true,
+            timeoutMs: 20000
+        }
+    })
+});
+//# sourceMappingURL=schema.js.map

package/dist/src/core/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/core/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC;SACL,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,UAAU;YACV,MAAM;YACN,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC;aACD,QAAQ,EAAE;QACb,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,MAAM;aACP,CAAC;iBACD,QAAQ,EAAE;YACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAChC,CAAC,CACH;aACA,QAAQ,EAAE;KACd,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAC/D,CAAC;SACD,OAAO,CAAC;QACP,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,GAAG;KAChB,CAAC;IACJ,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,GAAG,EAAE,CAAC;aACH,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACtD,CAAC;aACD,OAAO,CAAC;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;QACJ,OAAO,EAAE,CAAC;aACP,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACtD,CAAC;aACD,OAAO,CAAC;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;KACL,CAAC;SACD,OAAO,CAAC;QACP,GAAG,EAAE;YACH,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB;KACF,CAAC;CACL,CAAC,CAAC"}

package/dist/src/core/dependencies/inventory.d.ts

@@ -0,0 +1,9 @@
+export type DependencyIdentity = {
+    ecosystem: 'npm';
+    name: string;
+    version: string;
+    direct: boolean;
+    development: boolean;
+    source: 'package-lock';
+};
+export declare function readNpmDependencyInventory(root: string): Promise<DependencyIdentity[]>;

package/dist/src/core/dependencies/inventory.js

@@ -0,0 +1,43 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+function packageNameFromLockPath(lockPath) {
+    const marker = 'node_modules/';
+    const markerIndex = lockPath.lastIndexOf(marker);
+    if (markerIndex === -1)
+        return undefined;
+    return lockPath.slice(markerIndex + marker.length);
+}
+function isDirectPackagePath(lockPath) {
+    if (!lockPath.startsWith('node_modules/'))
+        return false;
+    const remainder = lockPath.slice('node_modules/'.length);
+    if (remainder.startsWith('@'))
+        return remainder.split('/').length === 2;
+    return !remainder.includes('/');
+}
+export async function readNpmDependencyInventory(root) {
+    const raw = await readFile(path.join(root, 'package-lock.json'), 'utf8');
+    const lockfile = JSON.parse(raw);
+    if (!lockfile.packages) {
+        throw new Error('Toolip requires package-lock.json lockfileVersion 2 or newer.');
+    }
+    const dependencies = new Map();
+    for (const [lockPath, entry] of Object.entries(lockfile.packages)) {
+        if (lockPath === '' || !entry.version)
+            continue;
+        const name = entry.name ?? packageNameFromLockPath(lockPath);
+        if (!name)
+            continue;
+        const identity = {
+            ecosystem: 'npm',
+            name,
+            version: entry.version,
+            direct: isDirectPackagePath(lockPath),
+            development: Boolean(entry.dev),
+            source: 'package-lock'
+        };
+        dependencies.set(`npm:${identity.name}@${identity.version}`, identity);
+    }
+    return [...dependencies.values()].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+}
+//# sourceMappingURL=inventory.js.map

package/dist/src/core/dependencies/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../../../src/core/dependencies/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAElD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,QAAQ,GAAuB;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,cAAc;SACvB,CAAC;QAEF,YAAY,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACjE,CAAC;AACJ,CAAC"}

package/dist/src/core/dependency-scan.d.ts

@@ -0,0 +1,17 @@
+import type { PackageHealth } from './dependency-types.js';
+import type { ToolipFinding } from './report.js';
+export type DependencyScanResult = {
+    packages: PackageHealth[];
+    findings: ToolipFinding[];
+    summary: {
+        totalDependencies: number;
+        outdated: number;
+        deprecated: number;
+        highRisk: number;
+        mediumRisk: number;
+        lowRisk: number;
+        averageRiskScore: number;
+    };
+};
+export declare function scanDependencies(root: string): Promise<DependencyScanResult>;
+export declare function packageToFindings(pkg: PackageHealth): ToolipFinding[];

package/dist/src/core/dependency-scan.js

@@ -0,0 +1,70 @@
+import { readDependencies } from './read-dependencies.js';
+import { analyzePackage } from './analyze-package.js';
+export async function scanDependencies(root) {
+    const dependencies = await readDependencies(root);
+    const packages = await Promise.all(dependencies.map((dependency) => analyzePackage(dependency)));
+    const findings = packages.flatMap(packageToFindings);
+    return {
+        packages,
+        findings,
+        summary: {
+            totalDependencies: packages.length,
+            outdated: packages.filter((pkg) => pkg.outdated).length,
+            deprecated: packages.filter((pkg) => pkg.deprecated).length,
+            highRisk: packages.filter((pkg) => pkg.riskScore >= 70).length,
+            mediumRisk: packages.filter((pkg) => pkg.riskScore >= 40 && pkg.riskScore < 70).length,
+            lowRisk: packages.filter((pkg) => pkg.riskScore > 0 && pkg.riskScore < 40).length,
+            averageRiskScore: packages.length === 0
+                ? 0
+                : Math.round(packages.reduce((total, pkg) => total + pkg.riskScore, 0) / packages.length)
+        }
+    };
+}
+export function packageToFindings(pkg) {
+    const findings = [];
+    if (pkg.deprecated) {
+        findings.push({
+            id: `TOOLIP-DEP-DEPRECATED-${pkg.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: `Deprecated package: ${pkg.name}`,
+            severity: 'high',
+            category: 'supply-chain',
+            message: `${pkg.name} is marked as deprecated on the npm registry.`,
+            recommendation: 'Replace deprecated packages with maintained alternatives and review migration notes.',
+            evidence: pkg.latestVersion ?? undefined
+        });
+    }
+    if (pkg.outdated) {
+        findings.push({
+            id: `TOOLIP-DEP-OUTDATED-${pkg.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: `Outdated package: ${pkg.name}`,
+            severity: 'medium',
+            category: 'supply-chain',
+            message: `${pkg.name} appears outdated. Installed: ${pkg.installedVersion}. Latest: ${pkg.latestVersion ?? 'unknown'}.`,
+            recommendation: 'Upgrade the package after checking changelogs, breaking changes, and test coverage.',
+            evidence: `${pkg.installedVersion} -> ${pkg.latestVersion ?? 'unknown'}`
+        });
+    }
+    if (pkg.maintainers === 0) {
+        findings.push({
+            id: `TOOLIP-DEP-NO-MAINTAINERS-${pkg.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: `No visible maintainers: ${pkg.name}`,
+            severity: 'medium',
+            category: 'supply-chain',
+            message: `${pkg.name} has no visible maintainer metadata from the registry response.`,
+            recommendation: 'Review package ownership, repository activity, and whether a better-maintained alternative exists.'
+        });
+    }
+    if (pkg.ageInDays !== null && pkg.ageInDays > 730) {
+        findings.push({
+            id: `TOOLIP-DEP-STALE-${pkg.name.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+            title: `Possibly stale package: ${pkg.name}`,
+            severity: 'low',
+            category: 'supply-chain',
+            message: `${pkg.name} has not had a detected latest publish in more than two years.`,
+            recommendation: 'Confirm whether the package is intentionally stable or abandoned before relying on it.',
+            evidence: `${pkg.ageInDays} days`
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=dependency-scan.js.map

package/dist/src/core/dependency-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-scan.js","sourceRoot":"","sources":["../../../src/core/dependency-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAkBtD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE;YACP,iBAAiB,EAAE,QAAQ,CAAC,MAAM;YAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;YACvD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;YAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;YAC9D,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACtF,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACjF,gBAAgB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;SAC5F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,yBAAyB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACnF,KAAK,EAAE,uBAAuB,GAAG,CAAC,IAAI,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,+CAA+C;YACnE,cAAc,EAAE,sFAAsF;YACtG,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;SACzC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,uBAAuB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACjF,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,gBAAgB,aAAa,GAAG,CAAC,aAAa,IAAI,SAAS,GAAG;YACvH,cAAc,EAAE,qFAAqF;YACrG,QAAQ,EAAE,GAAG,GAAG,CAAC,gBAAgB,OAAO,GAAG,CAAC,aAAa,IAAI,SAAS,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,6BAA6B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACvF,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iEAAiE;YACrF,cAAc,EAAE,oGAAoG;SACrH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAC9E,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,gEAAgE;YACpF,cAAc,EAAE,wFAAwF;YACxG,QAAQ,EAAE,GAAG,GAAG,CAAC,SAAS,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/core/dependency-tree.d.ts

@@ -0,0 +1,16 @@
+export type DependencyTreeNode = {
+    name: string;
+    version: string;
+    type: 'dependency' | 'devDependency';
+    children: DependencyTreeNode[];
+};
+export type DependencyTree = {
+    root: string;
+    dependencies: DependencyTreeNode[];
+    summary: {
+        direct: number;
+        transitive: number;
+        maxDepth: number;
+    };
+};
+export declare function buildDependencyTree(root: string): Promise<DependencyTree>;

package/dist/src/core/dependency-tree.js

@@ -0,0 +1,19 @@
+import { readDependencies } from './read-dependencies.js';
+export async function buildDependencyTree(root) {
+    const dependencies = await readDependencies(root);
+    return {
+        root,
+        dependencies: dependencies.map((dependency) => ({
+            name: dependency.name,
+            version: dependency.version,
+            type: dependency.type,
+            children: []
+        })),
+        summary: {
+            direct: dependencies.length,
+            transitive: 0,
+            maxDepth: dependencies.length > 0 ? 1 : 0
+        }
+    };
+}
+//# sourceMappingURL=dependency-tree.js.map

package/dist/src/core/dependency-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-tree.js","sourceRoot":"","sources":["../../../src/core/dependency-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAmB1D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAElD,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,OAAO,EAAE;YACP,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC"}

package/dist/src/core/dependency-types.d.ts

@@ -0,0 +1,17 @@
+export type DependencyInfo = {
+    name: string;
+    version: string;
+    type: 'dependency' | 'devDependency';
+};
+export type PackageHealth = {
+    name: string;
+    latestVersion: string | null;
+    installedVersion: string;
+    outdated: boolean;
+    deprecated: boolean;
+    maintainers: number;
+    publishedAt: string | null;
+    ageInDays: number | null;
+    downloads: number | null;
+    riskScore: number;
+};

package/dist/src/core/dependency-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dependency-types.js.map

package/dist/src/core/dependency-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-types.js","sourceRoot":"","sources":["../../../src/core/dependency-types.ts"],"names":[],"mappings":""}

package/dist/src/core/diff/security-diff.d.ts

@@ -0,0 +1,10 @@
+export type SecurityDiffResult = {
+    base: string;
+    head: string;
+    files: string[];
+    packageManifestChanged: boolean;
+    lockfileChanged: boolean;
+    dockerfilesChanged: string[];
+    sourceFilesChanged: string[];
+};
+export declare function securityDiff(root: string, base: string, head: string): Promise<SecurityDiffResult>;

package/dist/src/core/diff/security-diff.js

@@ -0,0 +1,20 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export async function securityDiff(root, base, head) {
+    const { stdout } = await execFileAsync('git', ['diff', '--name-only', `${base}..${head}`], {
+        cwd: root,
+        encoding: 'utf8'
+    });
+    const files = stdout.split(/\r?\n/).filter(Boolean);
+    return {
+        base,
+        head,
+        files,
+        packageManifestChanged: files.some((file) => /(^|\/)package\.json$/.test(file)),
+        lockfileChanged: files.some((file) => /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(file)),
+        dockerfilesChanged: files.filter((file) => /(^|\/)Dockerfile(?:\..+)?$/.test(file)),
+        sourceFilesChanged: files.filter((file) => /\.(js|jsx|ts|tsx|mjs|cjs)$/.test(file))
+    };
+}
+//# sourceMappingURL=security-diff.js.map

package/dist/src/core/diff/security-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-diff.js","sourceRoot":"","sources":["../../../../src/core/diff/security-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAY,EACZ,IAAY;IAEZ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,EAC3C;QACE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;KACjB,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,KAAK;QACL,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1G,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACpF,CAAC;AACJ,CAAC"}

package/dist/src/core/file-walker.d.ts

@@ -0,0 +1,6 @@
+export type ProjectFile = {
+    absolutePath: string;
+    relativePath: string;
+    extension: string;
+};
+export declare function walkProjectFiles(root: string): Promise<ProjectFile[]>;

package/dist/src/core/file-walker.js

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import fg from 'fast-glob';
+import { loadToolipIgnore } from './load-toolip-ignore.js';
+export async function walkProjectFiles(root) {
+    const absoluteRoot = path.resolve(root);
+    const toolipIgnore = await loadToolipIgnore(absoluteRoot);
+    const entries = await fg(['**/*'], {
+        cwd: absoluteRoot,
+        dot: true,
+        onlyFiles: true,
+        unique: true,
+        followSymbolicLinks: false,
+        ignore: toolipIgnore.patterns
+    });
+    return entries
+        .map((entry) => {
+        const absolutePath = path.join(absoluteRoot, entry);
+        return {
+            absolutePath,
+            relativePath: entry.replaceAll('\\', '/'),
+            extension: path.extname(entry).replace('.', '').toLowerCase()
+        };
+    })
+        .filter((file) => !toolipIgnore.ignores(file.absolutePath))
+        .sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+//# sourceMappingURL=file-walker.js.map

package/dist/src/core/file-walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-walker.js","sourceRoot":"","sources":["../../../src/core/file-walker.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;QACjC,GAAG,EAAE,YAAY;QACjB,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI;QACZ,mBAAmB,EAAE,KAAK;QAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ;KAC9B,CAAC,CAAC;IAEH,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,YAAY;YACZ,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;SAC9D,CAAC;IACJ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/src/core/git-audit.d.ts

@@ -0,0 +1,12 @@
+import type { ToolipFinding } from './report.js';
+export type GitAuditResult = {
+    findings: ToolipFinding[];
+    summary: {
+        filesChecked: number;
+        dangerousFiles: number;
+        gitignorePresent: boolean;
+        envIgnored: boolean;
+        pemIgnored: boolean;
+    };
+};
+export declare function runGitAudit(root: string): Promise<GitAuditResult>;

package/dist/src/core/git-audit.js

@@ -0,0 +1,111 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { walkProjectFiles } from './file-walker.js';
+const dangerousFilePatterns = [
+    {
+        id: 'ENV-FILE',
+        regex: /(^|\/)\.env(\.|$|\/)?/i,
+        title: '.env file present',
+        severity: 'high',
+        message: 'A .env-style file exists in the project tree.',
+        recommendation: 'Keep .env files local, ensure they are ignored, and never commit real secrets.'
+    },
+    {
+        id: 'PEM-FILE',
+        regex: /\.pem$/i,
+        title: 'PEM file present',
+        severity: 'critical',
+        message: 'A PEM key file exists in the project tree.',
+        recommendation: 'Remove private key files from the repository and rotate affected credentials.'
+    },
+    {
+        id: 'KEY-FILE',
+        regex: /\.(key|p12|pfx)$/i,
+        title: 'Key/certificate file present',
+        severity: 'critical',
+        message: 'A key or certificate-like file exists in the project tree.',
+        recommendation: 'Do not store key material in source repositories.'
+    }
+];
+export async function runGitAudit(root) {
+    const files = await walkProjectFiles(root);
+    const relativePaths = files.map((file) => file.relativePath);
+    const gitignorePath = path.join(root, '.gitignore');
+    const gitignorePresent = await exists(gitignorePath);
+    const gitignoreContent = gitignorePresent ? await readFile(gitignorePath, 'utf8') : '';
+    const findings = [];
+    for (const file of relativePaths) {
+        for (const pattern of dangerousFilePatterns) {
+            if (!pattern.regex.test(file))
+                continue;
+            findings.push({
+                id: `TOOLIP-GIT-${pattern.id}-${file.toUpperCase().replaceAll(/[^A-Z0-9]/g, '-')}`,
+                title: pattern.title,
+                severity: pattern.severity,
+                category: 'git-security',
+                message: pattern.message,
+                recommendation: pattern.recommendation,
+                file
+            });
+        }
+    }
+    const envIgnored = ignoresPattern(gitignoreContent, '.env') || ignoresPattern(gitignoreContent, '.env.*');
+    const pemIgnored = ignoresPattern(gitignoreContent, '*.pem') || ignoresPattern(gitignoreContent, '.pem');
+    if (!gitignorePresent) {
+        findings.push({
+            id: 'TOOLIP-GIT-MISSING-GITIGNORE',
+            title: 'Missing .gitignore',
+            severity: 'medium',
+            category: 'git-security',
+            message: 'No .gitignore file was found.',
+            recommendation: 'Add a .gitignore file that excludes secrets, build output, dependencies, and local machine files.'
+        });
+    }
+    if (gitignorePresent && !envIgnored) {
+        findings.push({
+            id: 'TOOLIP-GIT-ENV-NOT-IGNORED',
+            title: '.env files may not be ignored',
+            severity: 'high',
+            category: 'git-security',
+            message: '.gitignore does not appear to ignore .env files.',
+            recommendation: 'Add .env and .env.* to .gitignore while allowing a safe .env.example.'
+        });
+    }
+    if (gitignorePresent && !pemIgnored) {
+        findings.push({
+            id: 'TOOLIP-GIT-PEM-NOT-IGNORED',
+            title: 'PEM files may not be ignored',
+            severity: 'medium',
+            category: 'git-security',
+            message: '.gitignore does not appear to ignore PEM files.',
+            recommendation: 'Add *.pem and other key material patterns to .gitignore.'
+        });
+    }
+    return {
+        findings,
+        summary: {
+            filesChecked: files.length,
+            dangerousFiles: findings.filter((finding) => finding.file).length,
+            gitignorePresent,
+            envIgnored,
+            pemIgnored
+        }
+    };
+}
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function ignoresPattern(gitignore, pattern) {
+    return gitignore
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .some((line) => line === pattern || line.includes(pattern));
+}
+//# sourceMappingURL=git-audit.js.map

package/dist/src/core/git-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-audit.js","sourceRoot":"","sources":["../../../src/core/git-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAcpD,MAAM,qBAAqB,GAAG;IAC5B;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,+CAA+C;QACxD,cAAc,EAAE,gFAAgF;KACjG;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,UAAmB;QAC7B,OAAO,EAAE,4CAA4C;QACrD,cAAc,EAAE,+EAA+E;KAChG;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,UAAmB;QAC7B,OAAO,EAAE,4DAA4D;QACrE,cAAc,EAAE,mDAAmD;KACpE;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAExC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,cAAc,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;gBAClF,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,cAAc;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAEzG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,8BAA8B;YAClC,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,+BAA+B;YACxC,cAAc,EAAE,mGAAmG;SACpH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,+BAA+B;YACtC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kDAAkD;YAC3D,cAAc,EAAE,uEAAuE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,8BAA8B;YACrC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,iDAAiD;YAC1D,cAAc,EAAE,0DAA0D;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO,EAAE;YACP,YAAY,EAAE,KAAK,CAAC,MAAM;YAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM;YACjE,gBAAgB;YAChB,UAAU;YACV,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAe;IACxD,OAAO,SAAS;SACb,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/src/core/github/remote-audit.d.ts

@@ -0,0 +1,5 @@
+import { runSecurityDoctor } from '../security-doctor.js';
+export declare function auditRemoteRepository(url: string): Promise<{
+    repository: string;
+    report: Awaited<ReturnType<typeof runSecurityDoctor>>;
+}>;

package/dist/src/core/github/remote-audit.js

@@ -0,0 +1,28 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import os from 'node:os';
+import path from 'node:path';
+import { runSecurityDoctor } from '../security-doctor.js';
+const execFileAsync = promisify(execFile);
+export async function auditRemoteRepository(url) {
+    if (!/^https:\/\/github\.com\/[^/]+\/[^/]+(?:\.git)?$/.test(url)) {
+        throw new Error('Only public GitHub repository URLs are supported.');
+    }
+    const temporaryRoot = await mkdtemp(path.join(os.tmpdir(), 'toolip-remote-audit-'));
+    const target = path.join(temporaryRoot, 'repository');
+    try {
+        await execFileAsync('gh', ['repo', 'clone', url, target, '--', '--depth=1'], {
+            encoding: 'utf8'
+        });
+        const report = await runSecurityDoctor(target);
+        return {
+            repository: url,
+            report
+        };
+    }
+    finally {
+        await rm(temporaryRoot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=remote-audit.js.map

package/dist/src/core/github/remote-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-audit.js","sourceRoot":"","sources":["../../../../src/core/github/remote-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAIrD,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO;YACL,UAAU,EAAE,GAAG;YACf,MAAM;SACP,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/src/core/github/upgrade-pr.d.ts

@@ -0,0 +1,4 @@
+export declare function createUpgradePullRequest(root: string, packageName: string, targetVersion: string, dryRun: boolean): Promise<{
+    branch: string;
+    changed: boolean;
+}>;

package/dist/src/core/github/upgrade-pr.js

@@ -0,0 +1,41 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+const execFileAsync = promisify(execFile);
+export async function createUpgradePullRequest(root, packageName, targetVersion, dryRun) {
+    const manifestPath = path.join(root, 'package.json');
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+    const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+    let changed = false;
+    for (const section of sections) {
+        if (manifest[section]?.[packageName]) {
+            manifest[section][packageName] = targetVersion;
+            changed = true;
+        }
+    }
+    if (!changed) {
+        throw new Error(`${packageName} is not declared in package.json.`);
+    }
+    const branch = `toolip/upgrade-${packageName.replaceAll(/[^A-Za-z0-9]/g, '-')}-${targetVersion}`;
+    if (dryRun) {
+        return { branch, changed: true };
+    }
+    await execFileAsync('git', ['switch', '-c', branch], { cwd: root });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    await execFileAsync('npm', ['install', '--package-lock-only'], { cwd: root });
+    await execFileAsync('npm', ['test'], { cwd: root });
+    await execFileAsync('git', ['add', 'package.json', 'package-lock.json'], { cwd: root });
+    await execFileAsync('git', ['commit', '-m', `chore: upgrade ${packageName} to ${targetVersion}`], { cwd: root });
+    await execFileAsync('git', ['push', '-u', 'origin', branch], { cwd: root });
+    await execFileAsync('gh', [
+        'pr',
+        'create',
+        '--title',
+        `chore: upgrade ${packageName} to ${targetVersion}`,
+        '--body',
+        `Toolip generated this dependency upgrade after updating the lockfile and running the project test suite.`
+    ], { cwd: root });
+    return { branch, changed: true };
+}
+//# sourceMappingURL=upgrade-pr.js.map

package/dist/src/core/github/upgrade-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-pr.js","sourceRoot":"","sources":["../../../../src/core/github/upgrade-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,WAAmB,EACnB,aAAqB,EACrB,MAAe;IAEf,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAwB,CAAC;IACzF,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;IACjG,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,mCAAmC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,WAAW,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;IAEjG,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,kBAAkB,WAAW,OAAO,aAAa,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,aAAa,CACjB,IAAI,EACJ;QACE,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,kBAAkB,WAAW,OAAO,aAAa,EAAE;QACnD,QAAQ;QACR,0GAA0G;KAC3G,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/core/history/git-metadata.d.ts

@@ -0,0 +1,5 @@
+export declare function readGitMetadata(root: string): Promise<{
+    branch?: string;
+    commit?: string;
+    dirty?: boolean;
+}>;