toolip 1.0.7 → 2.0.1

package/dist/src/analyzers/reachability/reachability-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/reachability/reachability-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAO5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACL,qBAAqB,EAEtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAiBH,MAAM,OAAO,oBAAoB;IACtB,EAAE,GAAG,sBAAsB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAE3B,KAAK,CAAC,OAAO,CACX,OAAwB;QAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,YAAY,GAChB,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACxC,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EACrC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,sCAAsC,CACvC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC5B,IAAI,CAAC,YAAY,EACjB,MAAM,CACP,CAAC;YAEF,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAC3C,IAAI,CAAC,YAAY,EACjB,OAAO,CACR,EAAE,CAAC;gBACF,MAAM,OAAO,GACX,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBAE9C,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,SAAS;oBACZ,IAAI,EAAE,IAAI,CAAC,YAAY;iBACxB,CAAC,CAAC;gBAEH,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CACpC,CAAC,UAAU,EAAuB,EAAE;YAClC,MAAM,iBAAiB,GACrB,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAExC,OAAO;gBACL,WAAW,EAAE,UAAU,CAAC,IAAI;gBAC5B,KAAK,EACH,iBAAiB,CAAC,MAAM,GAAG,CAAC;oBAC1B,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,UAAU,CAAC,MAAM;wBACjB,CAAC,CAAC,oBAAoB;wBACtB,CAAC,CAAC,cAAc;gBACtB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,UAAU,EAAE,iBAAiB;aAC9B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,QAAQ,GAAc,aAAa;aACtC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;aAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,EAAE,EAAE,aAAa,IAAI,CAAC,WAAW;iBAC9B,WAAW,EAAE;iBACb,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAClC,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,2BAA2B,IAAI,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,OAAO,EACL,GAAG,IAAI,CAAC,WAAW,mDAAmD;YACxE,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACd,OAAO,EACL,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,GAAG;oBAC1D,GAAG,SAAS,CAAC,IAAI,SAAS;gBAC5B,WAAW,EACT,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,GAAG;oBACxC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE;aAC1C,CAAC,CACH;YACD,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI,CAAC,WAAW;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC,CAAC;QAEN,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAC9B;YACD,QAAQ;YACR,QAAQ,EAAE;gBACR,YAAY,EAAE,aAAa,CAAC,MAAM;gBAClC,SAAS,EAAE,aAAa,CAAC,MAAM,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CACrC,CAAC,MAAM;gBACR,iBAAiB,EAAE,aAAa,CAAC,MAAM,CACrC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,KAAK,KAAK,oBAAoB,CACtC,CAAC,MAAM;gBACR,WAAW,EAAE,aAAa,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,cAAc,CACxC,CAAC,MAAM;gBACR,QAAQ,EAAE,aAAa;aACxB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/vulnerability/osv-analyzer.d.ts

@@ -0,0 +1,9 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../../contracts/analyzer.js';
+import { OsvClient } from '../../providers/osv/client.js';
+export declare class OsvVulnerabilityAnalyzer implements Analyzer {
+    private readonly client;
+    readonly id = "osv-vulnerability";
+    readonly version = "1.0.0";
+    constructor(client?: OsvClient);
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/analyzers/vulnerability/osv-analyzer.js

@@ -0,0 +1,94 @@
+import { performance } from 'node:perf_hooks';
+import { readNpmDependencyInventory } from '../../core/dependencies/inventory.js';
+import { OsvClient } from '../../providers/osv/client.js';
+import { mapOsvSeverity } from './severity.js';
+function fixedVersions(vulnerability) {
+    const versions = new Set();
+    for (const affected of vulnerability.affected ?? []) {
+        for (const range of affected.ranges ?? []) {
+            for (const event of range.events ?? [])
+                if (event.fixed)
+                    versions.add(event.fixed);
+        }
+    }
+    return [...versions];
+}
+function toFinding(dependency, vulnerability) {
+    const fixes = fixedVersions(vulnerability);
+    return {
+        id: `TLP-CVE-${dependency.name}-${vulnerability.id}`.toUpperCase().replaceAll(/[^A-Z0-9-]/g, '-'),
+        ruleId: 'TLP-CVE-001',
+        title: vulnerability.summary ?? `Known vulnerability in ${dependency.name}`,
+        category: 'vulnerability',
+        severity: mapOsvSeverity(vulnerability),
+        confidence: 'high',
+        message: `${dependency.name}@${dependency.version} matches ${vulnerability.id} in OSV.`,
+        source: 'osv',
+        evidence: [{
+                summary: `${dependency.name}@${dependency.version} is resolved in package-lock.json.`,
+                fingerprint: `npm:${dependency.name}@${dependency.version}:${vulnerability.id}`
+            }],
+        remediation: {
+            summary: fixes.length > 0
+                ? `Upgrade ${dependency.name} to a fixed version: ${fixes.join(', ')}.`
+                : `Review ${vulnerability.id} and upgrade or replace ${dependency.name} when a fix is available.`,
+            fixedVersion: fixes[0],
+            references: (vulnerability.references ?? [])
+                .map((reference) => reference.url)
+                .filter((url) => Boolean(url))
+                .slice(0, 10)
+        },
+        metadata: {
+            package: dependency.name,
+            installedVersion: dependency.version,
+            direct: dependency.direct,
+            development: dependency.development,
+            vulnerabilityId: vulnerability.id,
+            aliases: vulnerability.aliases ?? []
+        }
+    };
+}
+export class OsvVulnerabilityAnalyzer {
+    client;
+    id = 'osv-vulnerability';
+    version = '1.0.0';
+    constructor(client = new OsvClient()) {
+        this.client = client;
+    }
+    async analyze(context) {
+        const startedAt = performance.now();
+        const dependencies = await readNpmDependencyInventory(context.root);
+        const cachedResults = [];
+        const uncached = [];
+        for (const dependency of dependencies) {
+            const key = `osv:v1:npm:${dependency.name}@${dependency.version}`;
+            const cached = await context.cache?.get(key);
+            if (cached)
+                cachedResults.push(cached);
+            else
+                uncached.push(dependency);
+        }
+        const freshResults = uncached.length === 0 ? [] : await this.client.queryBatch(uncached.map((dependency) => ({
+            package: { ecosystem: 'npm', name: dependency.name },
+            version: dependency.version
+        })), context.signal);
+        for (const result of freshResults) {
+            await context.cache?.set(`osv:v1:npm:${result.query.package.name}@${result.query.version}`, result, 6 * 60 * 60 * 1000);
+        }
+        const queryResults = [...cachedResults, ...freshResults];
+        const findings = queryResults.flatMap((result) => {
+            const dependency = dependencies.find((item) => item.name === result.query.package.name && item.version === result.query.version);
+            return dependency ? result.vulnerabilities.map((vulnerability) => toFinding(dependency, vulnerability)) : [];
+        });
+        return {
+            analyzer: this.id,
+            durationMs: Math.round(performance.now() - startedAt),
+            findings,
+            metadata: {
+                dependenciesChecked: dependencies.length,
+                vulnerabilities: findings.length
+            }
+        };
+    }
+}
+//# sourceMappingURL=osv-analyzer.js.map

package/dist/src/analyzers/vulnerability/osv-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-analyzer.js","sourceRoot":"","sources":["../../../../src/analyzers/vulnerability/osv-analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,0BAA0B,EAA2B,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAuB,MAAM,+BAA+B,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,SAAS,aAAa,CAAC,aAA+B;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,aAAa,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;gBAAE,IAAI,KAAK,CAAC,KAAK;oBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,UAA8B,EAAE,aAA+B;IAChF,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,IAAI,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC;QACjG,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,aAAa,CAAC,OAAO,IAAI,0BAA0B,UAAU,CAAC,IAAI,EAAE;QAC3E,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,cAAc,CAAC,aAAa,CAAC;QACvC,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,YAAY,aAAa,CAAC,EAAE,UAAU;QACvF,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;gBACT,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,oCAAoC;gBACrF,WAAW,EAAE,OAAO,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,EAAE;aAChF,CAAC;QACF,WAAW,EAAE;YACX,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACvE,CAAC,CAAC,UAAU,aAAa,CAAC,EAAE,2BAA2B,UAAU,CAAC,IAAI,2BAA2B;YACnG,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;YACtB,UAAU,EAAE,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;iBACzC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;iBACjC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAChB;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,UAAU,CAAC,IAAI;YACxB,gBAAgB,EAAE,UAAU,CAAC,OAAO;YACpC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,eAAe,EAAE,aAAa,CAAC,EAAE;YACjC,OAAO,EAAE,aAAa,CAAC,OAAO,IAAI,EAAE;SACrC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,wBAAwB;IAIN;IAHpB,EAAE,GAAG,mBAAmB,CAAC;IACzB,OAAO,GAAG,OAAO,CAAC;IAE3B,YAA6B,SAAS,IAAI,SAAS,EAAE;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAEzD,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,aAAa,GAAqB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAE1C,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,cAAc,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAiB,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;gBAClC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAC5E,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,KAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;YAC7D,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC,CAAC,EACH,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CACtB,cAAc,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACjE,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CACjF,CAAC;YACF,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACrD,QAAQ;YACR,QAAQ,EAAE;gBACR,mBAAmB,EAAE,YAAY,CAAC,MAAM;gBACxC,eAAe,EAAE,QAAQ,CAAC,MAAM;aACjC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/analyzers/vulnerability/severity.d.ts

@@ -0,0 +1,3 @@
+import type { FindingSeverity } from '../../contracts/finding.js';
+import type { OsvVulnerability } from '../../providers/osv/types.js';
+export declare function mapOsvSeverity(vulnerability: OsvVulnerability): FindingSeverity;

package/dist/src/analyzers/vulnerability/severity.js

@@ -0,0 +1,13 @@
+export function mapOsvSeverity(vulnerability) {
+    const databaseSeverity = vulnerability.database_specific?.severity;
+    if (typeof databaseSeverity === 'string') {
+        const normalized = databaseSeverity.toLowerCase();
+        if (normalized === 'critical' || normalized === 'high' || normalized === 'medium' || normalized === 'low') {
+            return normalized;
+        }
+        if (normalized === 'moderate')
+            return 'medium';
+    }
+    return 'medium';
+}
+//# sourceMappingURL=severity.js.map

package/dist/src/analyzers/vulnerability/severity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.js","sourceRoot":"","sources":["../../../../src/analyzers/vulnerability/severity.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,cAAc,CAAC,aAA+B;IAC5D,MAAM,gBAAgB,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IACnE,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC1G,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,UAAU,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/application/analyzer-runner.d.ts

@@ -0,0 +1,12 @@
+import type { Analyzer, AnalyzerContext, AnalyzerResult } from '../contracts/analyzer.js';
+export type AnalyzerRunnerOptions = {
+    concurrency?: number;
+    timeoutMs?: number;
+};
+export declare class AnalyzerRunner {
+    private readonly concurrency;
+    private readonly timeoutMs;
+    constructor(options?: AnalyzerRunnerOptions);
+    run(analyzers: Analyzer[], context: AnalyzerContext): Promise<AnalyzerResult[]>;
+    private runOne;
+}

package/dist/src/application/analyzer-runner.js

@@ -0,0 +1,45 @@
+import { performance } from 'node:perf_hooks';
+export class AnalyzerRunner {
+    concurrency;
+    timeoutMs;
+    constructor(options = {}) {
+        this.concurrency = Math.max(1, options.concurrency ?? 4);
+        this.timeoutMs = Math.max(1_000, options.timeoutMs ?? 30_000);
+    }
+    async run(analyzers, context) {
+        const results = [];
+        let cursor = 0;
+        const worker = async () => {
+            while (cursor < analyzers.length) {
+                const analyzer = analyzers[cursor];
+                cursor += 1;
+                if (!analyzer) {
+                    return;
+                }
+                results.push(await this.runOne(analyzer, context));
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(this.concurrency, analyzers.length) }, () => worker()));
+        return results;
+    }
+    async runOne(analyzer, context) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        const startedAt = performance.now();
+        try {
+            const result = await analyzer.analyze({
+                ...context,
+                signal: controller.signal
+            });
+            return {
+                ...result,
+                analyzer: analyzer.id,
+                durationMs: Math.round(performance.now() - startedAt)
+            };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+//# sourceMappingURL=analyzer-runner.js.map

package/dist/src/application/analyzer-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer-runner.js","sourceRoot":"","sources":["../../../src/application/analyzer-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAY9C,MAAM,OAAO,cAAc;IACR,WAAW,CAAS;IACpB,SAAS,CAAS;IAEnC,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,GAAG,CACP,SAAqB,EACrB,OAAwB;QAExB,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,OAAO,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,IAAI,CAAC,CAAC;gBAEZ,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CACrC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EACxD,GAAG,EAAE,CAAC,MAAM,EAAE,CACf,CACF,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,QAAkB,EAClB,OAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACpC,GAAG,OAAO;gBACV,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,OAAO;gBACL,GAAG,MAAM;gBACT,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;aACtD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}

package/dist/src/commands/announce.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAnnounceCommand(program: Command): void;

package/dist/src/commands/announce.js

@@ -0,0 +1,27 @@
+import { generateAnnouncement } from '../core/announce/generate.js';
+export function registerAnnounceCommand(program) {
+    program
+        .command('announce')
+        .description('Generate a deterministic plain-language security update.')
+        .option('--version <version>', 'Release version.')
+        .option('--fixed <number>', 'Fixed findings.', '0')
+        .option('--added <number>', 'New findings.', '0')
+        .option('--removed <number>', 'Removed findings.', '0')
+        .option('--score-before <number>', 'Previous score.')
+        .option('--score-after <number>', 'Current score.')
+        .action((options) => {
+        console.log(generateAnnouncement({
+            version: options.version,
+            fixed: Number(options.fixed ?? 0),
+            added: Number(options.added ?? 0),
+            removed: Number(options.removed ?? 0),
+            scoreBefore: options.scoreBefore === undefined
+                ? undefined
+                : Number(options.scoreBefore),
+            scoreAfter: options.scoreAfter === undefined
+                ? undefined
+                : Number(options.scoreAfter)
+        }));
+    });
+}
+//# sourceMappingURL=announce.js.map

package/dist/src/commands/announce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"announce.js","sourceRoot":"","sources":["../../../src/commands/announce.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;SACjD,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,CAAC;SAClD,MAAM,CAAC,kBAAkB,EAAE,eAAe,EAAE,GAAG,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,GAAG,CAAC;SACtD,MAAM,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;SACpD,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;SAClD,MAAM,CAAC,CAAC,OAA2C,EAAE,EAAE;QACtD,OAAO,CAAC,GAAG,CACT,oBAAoB,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACjC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YACrC,WAAW,EACT,OAAO,CAAC,WAAW,KAAK,SAAS;gBAC/B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YACjC,UAAU,EACR,OAAO,CAAC,UAAU,KAAK,SAAS;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SACjC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/ast-scan.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAstScanCommand(program: Command): void;

package/dist/src/commands/ast-scan.js

@@ -0,0 +1,86 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { AstSecurityAnalyzer } from '../analyzers/ast/ast-security-analyzer.js';
+const severityOrder = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0
+};
+function shouldFail(findings, failOn) {
+    if (!failOn || failOn === 'none') {
+        return false;
+    }
+    const threshold = severityOrder[failOn];
+    return findings.some((finding) => severityOrder[finding.severity] >= threshold);
+}
+function printFinding(finding) {
+    console.log(`[${finding.severity.toUpperCase()}] ${finding.ruleId} ${finding.title}`);
+    if (finding.location) {
+        console.log(`Location: ${finding.location.file}:` +
+            `${finding.location.line ?? 1}:` +
+            `${finding.location.column ?? 1}`);
+    }
+    console.log(`Message: ${finding.message}`);
+    if (finding.remediation?.summary) {
+        console.log(`Fix: ${finding.remediation.summary}`);
+    }
+    console.log('');
+}
+export function registerAstScanCommand(program) {
+    program
+        .command('ast-scan')
+        .description('Run TypeScript Compiler API security analysis on JavaScript and TypeScript source files.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--fail-on <severity>', 'Exit non-zero at or above: critical, high, medium, low, none.', 'high')
+        .action(async (options) => {
+        const runner = new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        });
+        const [result] = await runner.run([new AstSecurityAnalyzer()], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('The AST security analyzer returned no result.');
+        }
+        if (options.json) {
+            console.log(JSON.stringify({
+                analyzer: result.analyzer,
+                durationMs: result.durationMs,
+                summary: {
+                    filesAnalyzed: result.metadata?.filesAnalyzed ?? 0,
+                    findings: result.findings.length,
+                    warnings: result.warnings?.length ?? 0
+                },
+                findings: result.findings,
+                warnings: result.warnings ?? []
+            }, null, 2));
+        }
+        else {
+            console.log('Toolip AST Security Analysis');
+            console.log('');
+            console.log(`Files analyzed: ${result.metadata?.filesAnalyzed ?? 0}`);
+            console.log(`Findings: ${result.findings.length}`);
+            console.log('');
+            for (const finding of result.findings) {
+                printFinding(finding);
+            }
+            if (result.findings.length === 0) {
+                console.log('No supported dangerous-code patterns were resolved through the AST.');
+            }
+            if ((result.warnings?.length ?? 0) > 0) {
+                console.log('');
+                console.log('Warnings');
+                for (const warning of result.warnings ?? []) {
+                    console.log(`- ${warning}`);
+                }
+            }
+        }
+        if (shouldFail(result.findings, options.failOn)) {
+            process.exitCode = 2;
+        }
+    });
+}
+//# sourceMappingURL=ast-scan.js.map

package/dist/src/commands/ast-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-scan.js","sourceRoot":"","sources":["../../../src/commands/ast-scan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAShF,MAAM,aAAa,GAAG;IACpB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACC,CAAC;AAEX,SAAS,UAAU,CACjB,QAAmB,EACnB,MAAgC;IAEhC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CACzE,CAAC;IAEF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,aAAa,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG;YACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG;YAChC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE3C,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CACT,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CACtC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,0FAA0F,CAC3F;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,sBAAsB,EACtB,+DAA+D,EAC/D,MAAM,CACP;SACA,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,CAAC,IAAI,mBAAmB,EAAE,CAAC,EAC3B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE;oBACP,aAAa,EACX,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,CAAC;oBACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;oBAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;iBACvC;gBACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;aAChC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,mBACE,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,CACpC,EAAE,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CACT,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACtC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAExB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,UAAU,CACR,MAAM,CAAC,QAAQ,EACf,OAAO,CAAC,MAAM,CACf,EACD,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/audit-repo.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAuditRepoCommand(program: Command): void;

package/dist/src/commands/audit-repo.js

@@ -0,0 +1,20 @@
+import { auditRemoteRepository } from '../core/github/remote-audit.js';
+export function registerAuditRepoCommand(program) {
+    program
+        .command('audit-repo <url>')
+        .description('Audit a public GitHub repository through the authenticated gh CLI.')
+        .option('--json', 'Print JSON.')
+        .action(async (url, options) => {
+        const result = await auditRemoteRepository(url);
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Remote Repository Audit');
+        console.log('');
+        console.log(`Repository: ${result.repository}`);
+        console.log(`Findings: ${result.report.findings.length}`);
+        console.log(`Critical: ${result.report.summary.secrets}`);
+    });
+}
+//# sourceMappingURL=audit-repo.js.map

package/dist/src/commands/audit-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-repo.js","sourceRoot":"","sources":["../../../src/commands/audit-repo.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,OAA2B,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/config.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerConfigCommand(program: Command): void;

package/dist/src/commands/config.js

@@ -0,0 +1,69 @@
+import { access, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { loadToolipConfig, TOOLIP_CONFIG_FILE } from '../core/config/load.js';
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function registerConfigCommand(program) {
+    const command = program
+        .command('config')
+        .description('Initialize and validate Toolip project configuration.');
+    command
+        .command('init')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('--force', 'Replace an existing configuration.')
+        .action(async (options) => {
+        const filePath = path.join(options.path, TOOLIP_CONFIG_FILE);
+        if (!options.force &&
+            await exists(filePath)) {
+            throw new Error(`${TOOLIP_CONFIG_FILE} already exists.`);
+        }
+        const config = {
+            schemaVersion: '1.0',
+            include: [],
+            exclude: [
+                'dist/**',
+                'coverage/**'
+            ],
+            rules: {},
+            suppressions: [],
+            history: {
+                enabled: true,
+                maxEntries: 500
+            },
+            providers: {
+                osv: {
+                    enabled: true,
+                    timeoutMs: 20000
+                },
+                depsDev: {
+                    enabled: true,
+                    timeoutMs: 20000
+                }
+            }
+        };
+        await writeFile(filePath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+        console.log(`Created ${filePath}`);
+    });
+    command
+        .command('validate')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        await loadToolipConfig(options.path);
+        console.log('Toolip configuration is valid.');
+    });
+    command
+        .command('show')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        const config = await loadToolipConfig(options.path);
+        console.log(JSON.stringify(config, null, 2));
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/src/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,KAAK,UAAU,MAAM,CACnB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,uDAAuD,CACxD,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,SAAS,EACT,oCAAoC,CACrC;SACA,MAAM,CACL,KAAK,EACH,OAGC,EACD,EAAE;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,OAAO,CAAC,IAAI,EACZ,kBAAkB,CACnB,CAAC;QAEF,IACE,CAAC,OAAO,CAAC,KAAK;YACd,MAAM,MAAM,CAAC,QAAQ,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,kBAAkB,CACxC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG;YACb,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE;gBACP,SAAS;gBACT,aAAa;aACd;YACD,KAAK,EAAE,EAAE;YACT,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,GAAG;aAChB;YACD,SAAS,EAAE;gBACT,GAAG,EAAE;oBACH,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK;iBACjB;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK;iBACjB;aACF;SACF,CAAC;QAEF,MAAM,SAAS,CACb,QAAQ,EACR,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACtC,MAAM,CACP,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,WAAW,QAAQ,EAAE,CACtB,CAAC;IACJ,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,gCAAgC,CACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,MAAM,GACV,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/dependency-confusion.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerDependencyConfusionCommand(program: Command): void;

package/dist/src/commands/dependency-confusion.js

@@ -0,0 +1,37 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { DependencyConfusionAnalyzer } from '../analyzers/dependency-confusion/analyzer.js';
+export function registerDependencyConfusionCommand(program) {
+    program
+        .command('dependency-confusion')
+        .description('Check internal-looking dependency names against the public npm registry.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const [result] = await new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        }).run([
+            new DependencyConfusionAnalyzer()
+        ], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('Dependency-confusion analyzer returned no result.');
+        }
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Dependency Confusion Audit');
+        console.log('');
+        console.log(`Candidates: ${result.metadata?.candidates ?? 0}`);
+        console.log(`Public collisions: ${result.findings.length}`);
+        console.log('');
+        for (const finding of result.findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(finding.message);
+            console.log('');
+        }
+    });
+}
+//# sourceMappingURL=dependency-confusion.js.map

package/dist/src/commands/dependency-confusion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-confusion.js","sourceRoot":"","sources":["../../../src/commands/dependency-confusion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F,MAAM,UAAU,kCAAkC,CAChD,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,sBAAsB,CAAC;SAC/B,WAAW,CACV,0EAA0E,CAC3E;SACA,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CACL,KAAK,EACH,OAGC,EACD,EAAE;QACF,MAAM,CAAC,MAAM,CAAC,GACZ,MAAM,IAAI,cAAc,CAAC;YACvB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC,GAAG,CACJ;YACE,IAAI,2BAA2B,EAAE;SAClC,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,mCAAmC,CACpC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,eACE,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,CACjC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAC/C,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/diff.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerDiffCommand(program: Command): void;

package/dist/src/commands/diff.js

@@ -0,0 +1,24 @@
+import { securityDiff } from '../core/diff/security-diff.js';
+export function registerDiffCommand(program) {
+    program
+        .command('diff <base> [head]')
+        .description('Summarize security-relevant changes between Git revisions.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--json', 'Print JSON.')
+        .action(async (base, head, options) => {
+        const result = await securityDiff(options.path, base, head ?? 'HEAD');
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Security Diff');
+        console.log('');
+        console.log(`Range: ${result.base}..${result.head}`);
+        console.log(`Changed files: ${result.files.length}`);
+        console.log(`Manifest changed: ${result.packageManifestChanged}`);
+        console.log(`Lockfile changed: ${result.lockfileChanged}`);
+        console.log(`Dockerfiles changed: ${result.dockerfilesChanged.length}`);
+        console.log(`Source files changed: ${result.sourceFilesChanged.length}`);
+    });
+}
+//# sourceMappingURL=diff.js.map

package/dist/src/commands/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../src/commands/diff.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EACX,IAAY,EACZ,IAAwB,EACxB,OAAyC,EACzC,EAAE;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC;QAEtE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/docker-scan.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerDockerScanCommand(program: Command): void;

package/dist/src/commands/docker-scan.js

@@ -0,0 +1,34 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { DockerfileAnalyzer } from '../analyzers/docker/analyzer.js';
+export function registerDockerScanCommand(program) {
+    program
+        .command('docker-scan')
+        .description('Scan Dockerfiles for risky container build patterns.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const [result] = await new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        }).run([new DockerfileAnalyzer()], {
+            root: options.path
+        });
+        if (!result)
+            throw new Error('Docker analyzer returned no result.');
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Dockerfile Security');
+        console.log('');
+        console.log(`Dockerfiles: ${result.metadata?.dockerfiles ?? 0}`);
+        console.log(`Findings: ${result.findings.length}`);
+        console.log('');
+        for (const finding of result.findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(`${finding.location?.file}:${finding.location?.line}`);
+            console.log('');
+        }
+    });
+}
+//# sourceMappingURL=docker-scan.js.map

package/dist/src/commands/docker-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-scan.js","sourceRoot":"","sources":["../../../src/commands/docker-scan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,cAAc,CAAC;YACxC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,kBAAkB,EAAE,CAAC,EAAE;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAEpE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/git-history.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerGitHistoryCommand(program: Command): void;

package/dist/src/commands/git-history.js

@@ -0,0 +1,40 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { GitHistorySecretAnalyzer } from '../analyzers/git-history/analyzer.js';
+export function registerGitHistoryCommand(program) {
+    program
+        .command('git-history')
+        .description('Scan added lines across Git commit history for secret-like values.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--max-commits <number>', 'Maximum commits to scan.', '1000')
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const maxCommits = Math.max(1, Number.parseInt(options.maxCommits, 10) || 1000);
+        const [result] = await new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 120_000
+        }).run([
+            new GitHistorySecretAnalyzer(maxCommits)
+        ], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('Git-history analyzer returned no result.');
+        }
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Git History Secret Audit');
+        console.log('');
+        console.log(`Commits scanned: ${result.metadata?.commitsScanned ?? 0}`);
+        console.log(`Findings: ${result.findings.length}`);
+        console.log('');
+        for (const finding of result.findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(`Commit: ${finding.metadata?.commit}`);
+            console.log(`Evidence: ${finding.evidence?.[0]?.summary}`);
+            console.log('');
+        }
+    });
+}
+//# sourceMappingURL=git-history.js.map