toolip 1.0.7 → 2.0.1

package/dist/src/analyzers/git-history/analyzer.js

@@ -0,0 +1,202 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { historicalSecretPatterns } from './secret-patterns.js';
+function redact(value) {
+    if (value.length <= 12) {
+        return '[redacted]';
+    }
+    return (`${value.slice(0, 6)}` +
+        '...[redacted]...' +
+        `${value.slice(-4)}`);
+}
+function fingerprint(value) {
+    return createHash('sha256')
+        .update(value)
+        .digest('hex');
+}
+function isTestFile(file) {
+    if (!file) {
+        return false;
+    }
+    return (file.startsWith('tests/') ||
+        file.includes('/tests/') ||
+        file.includes('/__tests__/') ||
+        /\.(test|spec)\.[cm]?[jt]sx?$/.test(file));
+}
+async function gitLog(root, maxCommits, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', [
+            'log',
+            `--max-count=${maxCommits}`,
+            '--all',
+            '--no-renames',
+            '--format=__TOOLIP_COMMIT__%H%x09%an%x09%aI',
+            '--patch',
+            '--unified=0',
+            '--no-color'
+        ], {
+            cwd: root,
+            stdio: [
+                'ignore',
+                'pipe',
+                'pipe'
+            ]
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        const abort = () => {
+            child.kill('SIGTERM');
+        };
+        signal?.addEventListener('abort', abort, {
+            once: true
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            signal?.removeEventListener('abort', abort);
+            if (code !== 0) {
+                reject(new Error(stderr.trim() ||
+                    `git log exited with ${code}.`));
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+function sections(output) {
+    return output
+        .split('__TOOLIP_COMMIT__')
+        .filter(Boolean)
+        .map((section) => {
+        const newline = section.indexOf('\n');
+        const header = newline === -1
+            ? section
+            : section.slice(0, newline);
+        const body = newline === -1
+            ? ''
+            : section.slice(newline + 1);
+        const [commit, author, date] = header.split('\t');
+        return {
+            commit: commit ?? 'unknown',
+            author: author ?? 'unknown',
+            date: date ?? 'unknown',
+            body
+        };
+    });
+}
+function addedLines(body) {
+    const output = [];
+    let currentFile;
+    for (const line of body.split('\n')) {
+        if (line.startsWith('+++ b/')) {
+            currentFile = line.slice('+++ b/'.length);
+            continue;
+        }
+        if (line.startsWith('+++ /dev/null')) {
+            currentFile = undefined;
+            continue;
+        }
+        if (line.startsWith('+') &&
+            !line.startsWith('+++')) {
+            output.push({
+                file: currentFile,
+                content: line.slice(1)
+            });
+        }
+    }
+    return output;
+}
+export class GitHistorySecretAnalyzer {
+    maxCommits;
+    id = 'git-history-secrets';
+    version = '1.0.1';
+    constructor(maxCommits = 1000) {
+        this.maxCommits = maxCommits;
+    }
+    async analyze(context) {
+        const startedAt = performance.now();
+        const output = await gitLog(context.root, this.maxCommits, context.signal);
+        const findings = [];
+        const seen = new Set();
+        const commitSections = sections(output);
+        for (const section of commitSections) {
+            for (const line of addedLines(section.body)) {
+                for (const pattern of historicalSecretPatterns) {
+                    pattern.regex.lastIndex = 0;
+                    for (const match of line.content.matchAll(pattern.regex)) {
+                        const value = match[0];
+                        const secretFingerprint = fingerprint(value);
+                        const key = `${pattern.id}:${section.commit}:` +
+                            `${line.file ?? 'unknown'}:` +
+                            secretFingerprint;
+                        if (seen.has(key)) {
+                            continue;
+                        }
+                        seen.add(key);
+                        const testFixture = isTestFile(line.file);
+                        findings.push({
+                            id: key,
+                            ruleId: pattern.id,
+                            title: testFixture
+                                ? `Potential historical test fixture: ${pattern.title}`
+                                : pattern.title,
+                            category: 'git-history-secret',
+                            severity: testFixture
+                                ? 'low'
+                                : pattern.severity,
+                            confidence: testFixture
+                                ? 'medium'
+                                : 'high',
+                            message: testFixture
+                                ? `A secret-like value was introduced in test file ${line.file ?? 'unknown'} in commit ${section.commit}. Confirm that it is synthetic fixture data.`
+                                : `A secret-like value was introduced in commit ${section.commit}.`,
+                            source: 'git-history',
+                            location: line.file
+                                ? {
+                                    file: line.file
+                                }
+                                : undefined,
+                            evidence: [
+                                {
+                                    summary: redact(value),
+                                    fingerprint: secretFingerprint
+                                }
+                            ],
+                            remediation: {
+                                summary: testFixture
+                                    ? 'Confirm that the value is synthetic test data. Replace realistic credential fixtures with clearly fake placeholders where possible.'
+                                    : 'Revoke or rotate the credential immediately, then remove it from repository history using an approved history-rewrite process.'
+                            },
+                            metadata: {
+                                commit: section.commit,
+                                author: section.author,
+                                date: section.date,
+                                file: line.file,
+                                testFixture
+                            }
+                        });
+                    }
+                }
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                commitsScanned: commitSections.length,
+                findings: findings.length,
+                testFixtures: findings.filter((finding) => finding.metadata?.testFixture === true).length,
+                maxCommits: this.maxCommits
+            }
+        };
+    }
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/src/analyzers/git-history/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/git-history/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EACL,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAc9B,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,CACL,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtB,kBAAkB;QAClB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5B,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,UAAkB,EAClB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL;YACE,KAAK;YACL,eAAe,UAAU,EAAE;YAC3B,OAAO;YACP,cAAc;YACd,4CAA4C;YAC5C,SAAS;YACT,aAAa;YACb,YAAY;SACb,EACD;YACE,GAAG,EAAE,IAAI;YACT,KAAK,EAAE;gBACL,QAAQ;gBACR,MAAM;gBACN,MAAM;aACP;SACF,CACF,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAEjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,EAAE,gBAAgB,CACtB,OAAO,EACP,KAAK,EACL;YACE,IAAI,EAAE,IAAI;SACX,CACF,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,EAAE,mBAAmB,CACzB,OAAO,EACP,KAAK,CACN,CAAC;YAEF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CACJ,IAAI,KAAK,CACP,MAAM,CAAC,IAAI,EAAE;oBACb,uBAAuB,IAAI,GAAG,CAC/B,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,MAAM;SACV,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,CAAC;YACZ,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEhC,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEjC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAErB,OAAO;YACL,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,IAAI,EAAE,IAAI,IAAI,SAAS;YACvB,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,WAA+B,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACrC,WAAW,GAAG,SAAS,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IACE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EACvB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,wBAAwB;IAOhB;IAJV,EAAE,GAAG,qBAAqB,CAAC;IAC3B,OAAO,GAAG,OAAO,CAAC;IAE3B,YACmB,aAAa,IAAI;QAAjB,eAAU,GAAV,UAAU,CAAO;IACjC,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,UAAU,EACf,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,KACE,MAAM,OAAO,IAAI,wBAAwB,EACzC,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBAE5B,KACE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAClC,OAAO,CAAC,KAAK,CACd,EACD,CAAC;wBACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;wBACvB,MAAM,iBAAiB,GACrB,WAAW,CAAC,KAAK,CAAC,CAAC;wBAErB,MAAM,GAAG,GACP,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG;4BAClC,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,GAAG;4BAC5B,iBAAiB,CAAC;wBAEpB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;4BAClB,SAAS;wBACX,CAAC;wBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAEd,MAAM,WAAW,GACf,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAExB,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,GAAG;4BACP,MAAM,EAAE,OAAO,CAAC,EAAE;4BAClB,KAAK,EAAE,WAAW;gCAChB,CAAC,CAAC,sCAAsC,OAAO,CAAC,KAAK,EAAE;gCACvD,CAAC,CAAC,OAAO,CAAC,KAAK;4BACjB,QAAQ,EAAE,oBAAoB;4BAC9B,QAAQ,EAAE,WAAW;gCACnB,CAAC,CAAC,KAAK;gCACP,CAAC,CAAC,OAAO,CAAC,QAAQ;4BACpB,UAAU,EAAE,WAAW;gCACrB,CAAC,CAAC,QAAQ;gCACV,CAAC,CAAC,MAAM;4BACV,OAAO,EAAE,WAAW;gCAClB,CAAC,CAAC,mDAAmD,IAAI,CAAC,IAAI,IAAI,SAAS,cAAc,OAAO,CAAC,MAAM,8CAA8C;gCACrJ,CAAC,CAAC,gDAAgD,OAAO,CAAC,MAAM,GAAG;4BACrE,MAAM,EAAE,aAAa;4BACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;gCACjB,CAAC,CAAC;oCACE,IAAI,EAAE,IAAI,CAAC,IAAI;iCAChB;gCACH,CAAC,CAAC,SAAS;4BACb,QAAQ,EAAE;gCACR;oCACE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;oCACtB,WAAW,EACT,iBAAiB;iCACpB;6BACF;4BACD,WAAW,EAAE;gCACX,OAAO,EAAE,WAAW;oCAClB,CAAC,CAAC,qIAAqI;oCACvI,CAAC,CAAC,gIAAgI;6BACrI;4BACD,QAAQ,EAAE;gCACR,MAAM,EAAE,OAAO,CAAC,MAAM;gCACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gCACtB,IAAI,EAAE,OAAO,CAAC,IAAI;gCAClB,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,WAAW;6BACZ;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,cAAc,EACZ,cAAc,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM;gBACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAC3B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CACzC,CAAC,MAAM;gBACR,UAAU,EACR,IAAI,CAAC,UAAU;aAClB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/git-history/secret-patterns.d.ts

@@ -0,0 +1,7 @@
+export type HistoricalSecretPattern = {
+    id: string;
+    title: string;
+    severity: 'critical' | 'high' | 'medium';
+    regex: RegExp;
+};
+export declare const historicalSecretPatterns: HistoricalSecretPattern[];

package/dist/src/analyzers/git-history/secret-patterns.js

@@ -0,0 +1,33 @@
+export const historicalSecretPatterns = [
+    {
+        id: 'TLP-GIT-101',
+        title: 'GitHub token in Git history',
+        severity: 'critical',
+        regex: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g
+    },
+    {
+        id: 'TLP-GIT-102',
+        title: 'npm token in Git history',
+        severity: 'critical',
+        regex: /\bnpm_[A-Za-z0-9]{20,}\b/g
+    },
+    {
+        id: 'TLP-GIT-103',
+        title: 'AWS access key in Git history',
+        severity: 'critical',
+        regex: /\bAKIA[0-9A-Z]{16}\b/g
+    },
+    {
+        id: 'TLP-GIT-104',
+        title: 'Private key in Git history',
+        severity: 'critical',
+        regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g
+    },
+    {
+        id: 'TLP-GIT-105',
+        title: 'Password assignment in Git history',
+        severity: 'high',
+        regex: /\b(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi
+    }
+];
+//# sourceMappingURL=secret-patterns.js.map

package/dist/src/analyzers/git-history/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../../src/analyzers/git-history/secret-patterns.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,wBAAwB,GACP;IAC1B;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,kCAAkC;KACrC;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,2BAA2B;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,uBAAuB;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,UAAU;QACpB,KAAK,EACH,yDAAyD;KAC5D;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,wDAAwD;KAC3D;CACF,CAAC"}

package/dist/src/analyzers/install-scripts/install-script-analyzer.d.ts

@@ -0,0 +1,6 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+export declare class InstallScriptAnalyzer implements Analyzer {
+    readonly id = "install-script-behavior";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/install-scripts/install-script-analyzer.js

@@ -0,0 +1,135 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { readNpmDependencyInventory } from '../../core/dependencies/inventory.js';
+const lifecycleNames = [
+    'preinstall',
+    'install',
+    'postinstall'
+];
+const signals = [
+    {
+        id: 'TLP-INSTALL-001',
+        title: 'Network access in lifecycle script',
+        severity: 'high',
+        regex: /\b(curl|wget|Invoke-WebRequest|fetch|axios|http\.get|https\.get)\b/i,
+        message: 'The lifecycle script appears to perform network access.',
+        remediation: 'Review the remote destination and downloaded content before installation.'
+    },
+    {
+        id: 'TLP-INSTALL-002',
+        title: 'Shell execution in lifecycle script',
+        severity: 'high',
+        regex: /\b(sh|bash|zsh|cmd|powershell|pwsh)\b|child_process|execSync?\s*\(/i,
+        message: 'The lifecycle script invokes a shell or child process.',
+        remediation: 'Confirm every command and argument is necessary and does not execute untrusted input.'
+    },
+    {
+        id: 'TLP-INSTALL-003',
+        title: 'Filesystem write or deletion in lifecycle script',
+        severity: 'medium',
+        regex: /\b(rm\s+-rf|del\s+\/|rmdir|chmod|chown|writeFile|appendFile|unlink|rename)\b/i,
+        message: 'The lifecycle script appears to modify or delete filesystem content.',
+        remediation: 'Confirm writes remain within the package boundary and cannot alter sensitive files.'
+    },
+    {
+        id: 'TLP-INSTALL-004',
+        title: 'Encoded or obfuscated lifecycle script',
+        severity: 'high',
+        regex: /\b(base64|atob|fromCharCode|Buffer\.from\([^)]*,\s*['"]base64['"]|eval\s*\()/i,
+        message: 'The lifecycle script contains encoding or dynamic execution indicators.',
+        remediation: 'Decode and review the complete payload before allowing the script to run.'
+    },
+    {
+        id: 'TLP-INSTALL-005',
+        title: 'Credential or environment inspection in lifecycle script',
+        severity: 'medium',
+        regex: /\b(process\.env|AWS_|GITHUB_TOKEN|NPM_TOKEN|HOME|USERPROFILE|SSH_AUTH_SOCK)\b/i,
+        message: 'The lifecycle script reads environment or credential-related values.',
+        remediation: 'Verify that the package does not exfiltrate or persist sensitive environment data.'
+    }
+];
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class InstallScriptAnalyzer {
+    id = 'install-script-behavior';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const dependencies = await readNpmDependencyInventory(context.root);
+        const findings = [];
+        let packagesInspected = 0;
+        let lifecycleScripts = 0;
+        for (const dependency of dependencies) {
+            if (context.signal?.aborted) {
+                throw new Error('Install-script analysis was cancelled.');
+            }
+            const manifestPath = path.join(context.root, 'node_modules', ...dependency.name.split('/'), 'package.json');
+            if (!(await exists(manifestPath))) {
+                continue;
+            }
+            const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+            packagesInspected += 1;
+            for (const lifecycleName of lifecycleNames) {
+                const command = manifest.scripts?.[lifecycleName];
+                if (!command) {
+                    continue;
+                }
+                lifecycleScripts += 1;
+                for (const signal of signals) {
+                    signal.regex.lastIndex = 0;
+                    if (!signal.regex.test(command)) {
+                        continue;
+                    }
+                    findings.push({
+                        id: `${signal.id}:${dependency.name}:` +
+                            `${dependency.version}:${lifecycleName}`,
+                        ruleId: signal.id,
+                        title: signal.title,
+                        category: 'install-script',
+                        severity: signal.severity,
+                        confidence: 'medium',
+                        message: `${dependency.name}@${dependency.version} ` +
+                            `defines ${lifecycleName}: ${signal.message}`,
+                        source: 'package-manifest',
+                        evidence: [
+                            {
+                                summary: `${lifecycleName}: ${command.slice(0, 240)}`,
+                                fingerprint: `${dependency.name}@${dependency.version}:` +
+                                    `${lifecycleName}:${signal.id}`
+                            }
+                        ],
+                        remediation: {
+                            summary: signal.remediation
+                        },
+                        metadata: {
+                            package: dependency.name,
+                            version: dependency.version,
+                            direct: dependency.direct,
+                            development: dependency.development,
+                            lifecycle: lifecycleName,
+                            command
+                        }
+                    });
+                }
+            }
+        }
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                packagesInspected,
+                lifecycleScripts,
+                findings: findings.length
+            }
+        };
+    }
+}
+//# sourceMappingURL=install-script-analyzer.js.map

package/dist/src/analyzers/install-scripts/install-script-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-script-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/install-scripts/install-script-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,SAAS;IACT,aAAa;CACL,CAAC;AAiBX,MAAM,OAAO,GAAuB;IAClC;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,qEAAqE;QACvE,OAAO,EACL,yDAAyD;QAC3D,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,qEAAqE;QACvE,OAAO,EACL,wDAAwD;QAC1D,WAAW,EACT,uFAAuF;KAC1F;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,kDAAkD;QACzD,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,+EAA+E;QACjF,OAAO,EACL,sEAAsE;QACxE,WAAW,EACT,qFAAqF;KACxF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,wCAAwC;QAC/C,QAAQ,EAAE,MAAM;QAChB,KAAK,EACH,+EAA+E;QACjF,OAAO,EACL,yEAAyE;QAC3E,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,0DAA0D;QACjE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EACH,gFAAgF;QAClF,OAAO,EACL,sEAAsE;QACxE,WAAW,EACT,oFAAoF;KACvF;CACF,CAAC;AAEF,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,qBAAqB;IACvB,EAAE,GAAG,yBAAyB,CAAC;IAC/B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,YAAY,GAChB,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,OAAO,CAAC,IAAI,EACZ,cAAc,EACd,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAC7B,cAAc,CACf,CAAC;YAEF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAClB,CAAC;YAErB,iBAAiB,IAAI,CAAC,CAAC;YAEvB,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;gBAElD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,SAAS;gBACX,CAAC;gBAED,gBAAgB,IAAI,CAAC,CAAC;gBAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;oBAE3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAChC,SAAS;oBACX,CAAC;oBAED,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EACA,GAAG,MAAM,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,GAAG;4BAClC,GAAG,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE;wBAC1C,MAAM,EAAE,MAAM,CAAC,EAAE;wBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,QAAQ,EAAE,gBAAgB;wBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EACL,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG;4BAC3C,WAAW,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE;wBAC/C,MAAM,EAAE,kBAAkB;wBAC1B,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,GAAG,aAAa,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gCAC9C,WAAW,EACT,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG;oCAC3C,GAAG,aAAa,IAAI,MAAM,CAAC,EAAE,EAAE;6BAClC;yBACF;wBACD,WAAW,EAAE;4BACX,OAAO,EAAE,MAAM,CAAC,WAAW;yBAC5B;wBACD,QAAQ,EAAE;4BACR,OAAO,EAAE,UAAU,CAAC,IAAI;4BACxB,OAAO,EAAE,UAAU,CAAC,OAAO;4BAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;4BACzB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,SAAS,EAAE,aAAa;4BACxB,OAAO;yBACR;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,gBAAgB;gBAChB,QAAQ,EAAE,QAAQ,CAAC,MAAM;aAC1B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/reachability/import-graph.d.ts

@@ -0,0 +1,9 @@
+export type ImportReference = {
+    packageName: string;
+    importedSymbols: string[];
+    localSymbols: string[];
+    kind: 'default' | 'named' | 'namespace' | 'side-effect' | 'require' | 'dynamic-import';
+    line: number;
+    column: number;
+};
+export declare function extractPackageImports(filePath: string, content: string): ImportReference[];

package/dist/src/analyzers/reachability/import-graph.js

@@ -0,0 +1,110 @@
+import ts from 'typescript';
+function packageRoot(specifier) {
+    if (specifier.startsWith('.') ||
+        specifier.startsWith('/') ||
+        specifier.startsWith('node:')) {
+        return undefined;
+    }
+    if (specifier.startsWith('@')) {
+        const [scope, name] = specifier.split('/');
+        return scope && name ? `${scope}/${name}` : undefined;
+    }
+    return specifier.split('/')[0];
+}
+function location(sourceFile, node) {
+    const value = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+    return {
+        line: value.line + 1,
+        column: value.character + 1
+    };
+}
+export function extractPackageImports(filePath, content) {
+    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, filePath.endsWith('.tsx')
+        ? ts.ScriptKind.TSX
+        : filePath.endsWith('.jsx')
+            ? ts.ScriptKind.JSX
+            : filePath.endsWith('.js') ||
+                filePath.endsWith('.mjs') ||
+                filePath.endsWith('.cjs')
+                ? ts.ScriptKind.JS
+                : ts.ScriptKind.TS);
+    const references = [];
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) &&
+            ts.isStringLiteral(node.moduleSpecifier)) {
+            const root = packageRoot(node.moduleSpecifier.text);
+            if (root) {
+                const importedSymbols = [];
+                const localSymbols = [];
+                let kind = 'side-effect';
+                const clause = node.importClause;
+                if (clause?.name) {
+                    kind = 'default';
+                    importedSymbols.push('default');
+                    localSymbols.push(clause.name.text);
+                }
+                if (clause?.namedBindings) {
+                    if (ts.isNamespaceImport(clause.namedBindings)) {
+                        kind = 'namespace';
+                        importedSymbols.push('*');
+                        localSymbols.push(clause.namedBindings.name.text);
+                    }
+                    else {
+                        kind = 'named';
+                        for (const element of clause.namedBindings.elements) {
+                            importedSymbols.push(element.propertyName?.text ??
+                                element.name.text);
+                            localSymbols.push(element.name.text);
+                        }
+                    }
+                }
+                references.push({
+                    packageName: root,
+                    importedSymbols,
+                    localSymbols,
+                    kind,
+                    ...location(sourceFile, node)
+                });
+            }
+        }
+        if (ts.isCallExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === 'require' &&
+            node.arguments.length === 1) {
+            const [argument] = node.arguments;
+            if (argument && ts.isStringLiteral(argument)) {
+                const root = packageRoot(argument.text);
+                if (root) {
+                    references.push({
+                        packageName: root,
+                        importedSymbols: ['*'],
+                        localSymbols: [],
+                        kind: 'require',
+                        ...location(sourceFile, node)
+                    });
+                }
+            }
+        }
+        if (ts.isCallExpression(node) &&
+            node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+            node.arguments.length === 1) {
+            const [argument] = node.arguments;
+            if (argument && ts.isStringLiteral(argument)) {
+                const root = packageRoot(argument.text);
+                if (root) {
+                    references.push({
+                        packageName: root,
+                        importedSymbols: ['*'],
+                        localSymbols: [],
+                        kind: 'dynamic-import',
+                        ...location(sourceFile, node)
+                    });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return references;
+}
+//# sourceMappingURL=import-graph.js.map

package/dist/src/analyzers/reachability/import-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-graph.js","sourceRoot":"","sources":["../../../../src/analyzers/reachability/import-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAiB5B,SAAS,WAAW,CAAC,SAAiB;IACpC,IACE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CACf,UAAyB,EACzB,IAAa;IAEb,MAAM,KAAK,GAAG,UAAU,CAAC,6BAA6B,CACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAAe;IAEf,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,OAAO,EACP,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;QACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;YACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;gBAClB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC5B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAEpD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,eAAe,GAAa,EAAE,CAAC;gBACrC,MAAM,YAAY,GAAa,EAAE,CAAC;gBAClC,IAAI,IAAI,GAA4B,aAAa,CAAC;gBAElD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;gBAEjC,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;oBACjB,IAAI,GAAG,SAAS,CAAC;oBACjB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;gBAED,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC1B,IAAI,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC/C,IAAI,GAAG,WAAW,CAAC;wBACnB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC1B,YAAY,CAAC,IAAI,CACf,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAC/B,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,OAAO,CAAC;wBAEf,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;4BACpD,eAAe,CAAC,IAAI,CAClB,OAAO,CAAC,YAAY,EAAE,IAAI;gCACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CACpB,CAAC;4BACF,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACvC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC;oBACd,WAAW,EAAE,IAAI;oBACjB,eAAe;oBACf,YAAY;oBACZ,IAAI;oBACJ,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;YAClC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,IAAI,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAExC,IAAI,IAAI,EAAE,CAAC;oBACT,UAAU,CAAC,IAAI,CAAC;wBACd,WAAW,EAAE,IAAI;wBACjB,eAAe,EAAE,CAAC,GAAG,CAAC;wBACtB,YAAY,EAAE,EAAE;wBAChB,IAAI,EAAE,SAAS;wBACf,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;YACpD,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,IAAI,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAExC,IAAI,IAAI,EAAE,CAAC;oBACT,UAAU,CAAC,IAAI,CAAC;wBACd,WAAW,EAAE,IAAI;wBACjB,eAAe,EAAE,CAAC,GAAG,CAAC;wBACtB,YAAY,EAAE,EAAE;wBAChB,IAAI,EAAE,gBAAgB;wBACtB,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/analyzers/reachability/reachability-analyzer.d.ts

@@ -0,0 +1,16 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+import { type ImportReference } from './import-graph.js';
+export type PackageReachability = {
+    packageName: string;
+    state: 'reachable' | 'possibly-reachable' | 'not-observed';
+    direct: boolean;
+    development: boolean;
+    references: Array<ImportReference & {
+        file: string;
+    }>;
+};
+export declare class ReachabilityAnalyzer implements Analyzer {
+    readonly id = "package-reachability";
+    readonly version = "1.0.0";
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/reachability/reachability-analyzer.js

@@ -0,0 +1,95 @@
+import { readFile } from 'node:fs/promises';
+import { createScannerContext } from '../../core/scanner-context.js';
+import { readNpmDependencyInventory } from '../../core/dependencies/inventory.js';
+import { extractPackageImports } from './import-graph.js';
+const codeExtensions = new Set([
+    'js',
+    'jsx',
+    'ts',
+    'tsx',
+    'mjs',
+    'cjs'
+]);
+export class ReachabilityAnalyzer {
+    id = 'package-reachability';
+    version = '1.0.0';
+    async analyze(context) {
+        const startedAt = performance.now();
+        const dependencies = await readNpmDependencyInventory(context.root);
+        const scannerContext = await createScannerContext(context.root);
+        const references = new Map();
+        for (const file of scannerContext.files) {
+            if (!codeExtensions.has(file.extension) ||
+                file.relativePath.endsWith('.d.ts') ||
+                file.relativePath.startsWith('dist/')) {
+                continue;
+            }
+            if (context.signal?.aborted) {
+                throw new Error('Reachability analysis was cancelled.');
+            }
+            const content = await readFile(file.absolutePath, 'utf8');
+            for (const reference of extractPackageImports(file.relativePath, content)) {
+                const current = references.get(reference.packageName) ?? [];
+                current.push({
+                    ...reference,
+                    file: file.relativePath
+                });
+                references.set(reference.packageName, current);
+            }
+        }
+        const packageStates = dependencies.map((dependency) => {
+            const packageReferences = references.get(dependency.name) ?? [];
+            return {
+                packageName: dependency.name,
+                state: packageReferences.length > 0
+                    ? 'reachable'
+                    : dependency.direct
+                        ? 'possibly-reachable'
+                        : 'not-observed',
+                direct: dependency.direct,
+                development: dependency.development,
+                references: packageReferences
+            };
+        });
+        const findings = packageStates
+            .filter((item) => item.state === 'reachable')
+            .map((item) => ({
+            id: `TLP-REACH-${item.packageName
+                .toUpperCase()
+                .replaceAll(/[^A-Z0-9]/g, '-')}`,
+            ruleId: 'TLP-REACH-001',
+            title: `Package usage observed: ${item.packageName}`,
+            category: 'reachability',
+            severity: 'info',
+            confidence: 'high',
+            message: `${item.packageName} is imported or required by project source files.`,
+            source: 'typescript-ast',
+            evidence: item.references.slice(0, 20).map((reference) => ({
+                summary: `${reference.file}:${reference.line}:${reference.column} ` +
+                    `${reference.kind} import`,
+                fingerprint: `${item.packageName}:${reference.file}:` +
+                    `${reference.line}:${reference.column}`
+            })),
+            metadata: {
+                package: item.packageName,
+                state: item.state,
+                direct: item.direct,
+                development: item.development,
+                references: item.references
+            }
+        }));
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                dependencies: packageStates.length,
+                reachable: packageStates.filter((item) => item.state === 'reachable').length,
+                possiblyReachable: packageStates.filter((item) => item.state === 'possibly-reachable').length,
+                notObserved: packageStates.filter((item) => item.state === 'not-observed').length,
+                packages: packageStates
+            }
+        };
+    }
+}
+//# sourceMappingURL=reachability-analyzer.js.map