toolip 1.0.7 → 2.0.1

package/dist/src/commands/git-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-history.js","sourceRoot":"","sources":["../../../src/commands/git-history.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,UAAU,yBAAyB,CACvC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CACV,oEAAoE,CACrE;SACA,MAAM,CACL,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,wBAAwB,EACxB,0BAA0B,EAC1B,MAAM,CACP;SACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CACL,KAAK,EACH,OAIC,EACD,EAAE;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,CAAC,EACD,MAAM,CAAC,QAAQ,CACb,OAAO,CAAC,UAAU,EAClB,EAAE,CACH,IAAI,IAAI,CACV,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,GACZ,MAAM,IAAI,cAAc,CAAC;YACvB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC,GAAG,CACJ;YACE,IAAI,wBAAwB,CAC1B,UAAU,CACX;SACF,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,iCAAiC,CAClC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,oBACE,MAAM,CAAC,QAAQ,EAAE,cAAc,IAAI,CACrC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,WACE,OAAO,CAAC,QAAQ,EAAE,MACpB,EAAE,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CACT,aACE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OACzB,EAAE,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/history.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerHistoryCommand(program: Command): void;

package/dist/src/commands/history.js

@@ -0,0 +1,69 @@
+import { clearHistory, readHistory } from '../core/history/store.js';
+export function registerHistoryCommand(program) {
+    const command = program
+        .command('history')
+        .description('Inspect locally stored Toolip scan history.');
+    command
+        .command('list')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-l, --limit <number>', 'Maximum entries.', '20')
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const history = await readHistory(options.path);
+        const limit = Math.max(1, Number.parseInt(options.limit, 10) || 20);
+        const entries = history.entries.slice(-limit);
+        if (options.json) {
+            console.log(JSON.stringify({
+                schemaVersion: history.schemaVersion,
+                entries
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip History');
+        console.log('');
+        if (entries.length === 0) {
+            console.log('No historical scan entries are available.');
+            return;
+        }
+        for (const entry of entries.reverse()) {
+            console.log(`${entry.createdAt} ${entry.command} ` +
+                `score=${entry.score ?? 'n/a'} ` +
+                `findings=${entry.summary.total}`);
+            if (entry.git?.branch ||
+                entry.git?.commit) {
+                console.log(`  ${entry.git.branch ?? 'detached'} ` +
+                    `${entry.git.commit?.slice(0, 12) ?? ''}`);
+            }
+        }
+    });
+    command
+        .command('trend')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-l, --limit <number>', 'Maximum entries.', '10')
+        .action(async (options) => {
+        const history = await readHistory(options.path);
+        const limit = Math.max(2, Number.parseInt(options.limit, 10) || 10);
+        const entries = history.entries
+            .filter((entry) => entry.score !== undefined)
+            .slice(-limit);
+        console.log('Toolip Security Trend');
+        console.log('');
+        if (entries.length < 2) {
+            console.log('At least two scored history entries are required.');
+            return;
+        }
+        const first = entries[0];
+        const last = entries[entries.length - 1];
+        console.log(`Score: ${first?.score} → ${last?.score}`);
+        console.log(`Change: ${(last?.score ?? 0) - (first?.score ?? 0)}`);
+        console.log(`Findings: ${first?.summary.total} → ${last?.summary.total}`);
+    });
+    command
+        .command('clear')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .action(async (options) => {
+        await clearHistory(options.path);
+        console.log('Toolip history cleared.');
+    });
+}
+//# sourceMappingURL=history.js.map

package/dist/src/commands/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../../src/commands/history.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,MAAM,UAAU,sBAAsB,CACpC,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,6CAA6C,CAC9C,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,sBAAsB,EACtB,kBAAkB,EAClB,IAAI,CACL;SACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CACzC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,aAAa,EACX,OAAO,CAAC,aAAa;gBACvB,OAAO;aACR,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CACT,2CAA2C,CAC5C,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG;gBACpC,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;gBAChC,YAAY,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CACpC,CAAC;YAEF,IACE,KAAK,CAAC,GAAG,EAAE,MAAM;gBACjB,KAAK,CAAC,GAAG,EAAE,MAAM,EACjB,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,UAAU,GAAG;oBACpC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,sBAAsB,EACtB,kBAAkB,EAClB,IAAI,CACL;SACA,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,EACD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CACzC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;aAC5B,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CACrC;aACA,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,mDAAmD,CACpD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CACT,UAAU,KAAK,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAC1C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,CACtD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aAAa,KAAK,EAAE,OAAO,CAAC,KAAK,MAAM,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CACL,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/install-scripts.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerInstallScriptsCommand(program: Command): void;

package/dist/src/commands/install-scripts.js

@@ -0,0 +1,52 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { InstallScriptAnalyzer } from '../analyzers/install-scripts/install-script-analyzer.js';
+export function registerInstallScriptsCommand(program) {
+    program
+        .command('install-scripts')
+        .description('Inspect installed npm lifecycle scripts for suspicious behavior indicators.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependency findings.')
+        .action(async (options) => {
+        const runner = new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        });
+        const [result] = await runner.run([new InstallScriptAnalyzer()], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('Install-script analyzer returned no result.');
+        }
+        const findings = options.includeDev
+            ? result.findings
+            : result.findings.filter((finding) => finding.metadata?.development !== true);
+        if (options.json) {
+            console.log(JSON.stringify({
+                analyzer: result.analyzer,
+                durationMs: result.durationMs,
+                summary: result.metadata,
+                findings
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip Install-Script Analysis');
+        console.log('');
+        console.log(`Packages inspected: ${result.metadata?.packagesInspected ?? 0}`);
+        console.log(`Lifecycle scripts: ${result.metadata?.lifecycleScripts ?? 0}`);
+        console.log(`Findings: ${findings.length}`);
+        console.log('');
+        for (const finding of findings) {
+            console.log(`[${finding.severity.toUpperCase()}] ${finding.title}`);
+            console.log(`Package: ${finding.metadata?.package}@` +
+                `${finding.metadata?.version}`);
+            console.log(`Lifecycle: ${finding.metadata?.lifecycle}`);
+            console.log(`Message: ${finding.message}`);
+            console.log('');
+        }
+        if (findings.length === 0) {
+            console.log('No supported suspicious lifecycle-script indicators were found.');
+        }
+    });
+}
+//# sourceMappingURL=install-scripts.js.map

package/dist/src/commands/install-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-scripts.js","sourceRoot":"","sources":["../../../src/commands/install-scripts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAQhG,MAAM,UAAU,6BAA6B,CAC3C,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,6EAA6E,CAC9E;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,eAAe,EACf,0CAA0C,CAC3C;SACA,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,CAAC,IAAI,qBAAqB,EAAE,CAAC,EAC7B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CACzC,CAAC;QAEN,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,QAAQ;aACT,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,uBACE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,IAAI,CACxC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,sBACE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,CACvC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,YAAY,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG;gBACtC,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CACjC,CAAC;YACF,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/mcp.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMcpCommand(program: Command): void;

package/dist/src/commands/mcp.js

@@ -0,0 +1,10 @@
+import { startMcpServer } from '../mcp/server.js';
+export function registerMcpCommand(program) {
+    program
+        .command('mcp')
+        .description('Start the Toolip MCP server over stdio.')
+        .action(async () => {
+        await startMcpServer();
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/src/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/commands/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/monorepo.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMonorepoCommand(program: Command): void;

package/dist/src/commands/monorepo.js

@@ -0,0 +1,21 @@
+import { discoverWorkspaces } from '../core/monorepo/discover.js';
+export function registerMonorepoCommand(program) {
+    program
+        .command('monorepo')
+        .description('Discover and summarize workspace packages.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--json', 'Print JSON.')
+        .action(async (options) => {
+        const workspaces = await discoverWorkspaces(options.path);
+        if (options.json) {
+            console.log(JSON.stringify({ workspaces }, null, 2));
+            return;
+        }
+        console.log('Toolip Monorepo Discovery');
+        console.log('');
+        for (const workspace of workspaces) {
+            console.log(`${workspace.relativePath} ${workspace.name ?? ''}`.trim());
+        }
+    });
+}
+//# sourceMappingURL=monorepo.js.map

package/dist/src/commands/monorepo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monorepo.js","sourceRoot":"","sources":["../../../src/commands/monorepo.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/package-health.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPackageHealthCommand(program: Command): void;

package/dist/src/commands/package-health.js

@@ -0,0 +1,50 @@
+import { DepsDevClient } from '../providers/depsdev/client.js';
+export function registerPackageHealthCommand(program) {
+    program
+        .command('package-health <package> [version]')
+        .description('Inspect npm package health and provenance through deps.dev.')
+        .option('--json', 'Print structured JSON.')
+        .action(async (packageName, version, options) => {
+        if (!version) {
+            throw new Error('A resolved package version is required.');
+        }
+        const client = new DepsDevClient();
+        const [metadata, dependencies] = await Promise.all([
+            client.getVersion(packageName, version),
+            client.getDependencies(packageName, version)
+        ]);
+        const result = {
+            package: packageName,
+            version,
+            publishedAt: metadata.publishedAt,
+            deprecated: metadata.isDeprecated ?? false,
+            deprecatedReason: metadata.deprecatedReason,
+            licenses: metadata.licenses ?? [],
+            advisories: metadata.advisoryKeys
+                ?.map((item) => item.id)
+                .filter((value) => Boolean(value)) ?? [],
+            verifiedProvenance: (metadata.slsaProvenances ?? [])
+                .filter((item) => item.verified === true).length,
+            verifiedAttestations: (metadata.attestations ?? [])
+                .filter((item) => item.verified === true).length,
+            relatedProjects: metadata.relatedProjects ?? [],
+            dependencyNodes: dependencies.nodes?.length ?? 0,
+            dependencyEdges: dependencies.edges?.length ?? 0
+        };
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log('Toolip Package Health');
+        console.log('');
+        console.log(`Package: ${packageName}@${version}`);
+        console.log(`Published: ${result.publishedAt ?? 'unknown'}`);
+        console.log(`Deprecated: ${result.deprecated}`);
+        console.log(`Licenses: ${result.licenses.join(', ') || 'unknown'}`);
+        console.log(`Advisories: ${result.advisories.length}`);
+        console.log(`Dependency nodes: ${result.dependencyNodes}`);
+        console.log(`Verified provenance: ${result.verifiedProvenance}`);
+        console.log(`Verified attestations: ${result.verifiedAttestations}`);
+    });
+}
+//# sourceMappingURL=package-health.js.map

package/dist/src/commands/package-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-health.js","sourceRoot":"","sources":["../../../src/commands/package-health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAM/D,MAAM,UAAU,4BAA4B,CAC1C,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CACV,6DAA6D,CAC9D;SACA,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,OAA2B,EAC3B,OAA6B,EAC7B,EAAE;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAEnC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,UAAU,CACf,WAAW,EACX,OAAO,CACR;YACD,MAAM,CAAC,eAAe,CACpB,WAAW,EACX,OAAO,CACR;SACF,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,WAAW;YACpB,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EACR,QAAQ,CAAC,YAAY,IAAI,KAAK;YAChC,gBAAgB,EACd,QAAQ,CAAC,gBAAgB;YAC3B,QAAQ,EACN,QAAQ,CAAC,QAAQ,IAAI,EAAE;YACzB,UAAU,EACR,QAAQ,CAAC,YAAY;gBACnB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;iBACvB,MAAM,CACL,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,CAAC,KAAK,CAAC,CACjB,IAAI,EAAE;YACX,kBAAkB,EAChB,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;iBAC7B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,KAAK,IAAI,CACzB,CAAC,MAAM;YACZ,oBAAoB,EAClB,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;iBAC1B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,KAAK,IAAI,CACzB,CAAC,MAAM;YACZ,eAAe,EACb,QAAQ,CAAC,eAAe,IAAI,EAAE;YAChC,eAAe,EACb,YAAY,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;YACjC,eAAe,EACb,YAAY,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;SAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,YAAY,WAAW,IAAI,OAAO,EAAE,CACrC,CAAC;QACF,OAAO,CAAC,GAAG,CACT,cAAc,MAAM,CAAC,WAAW,IAAI,SAAS,EAAE,CAChD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,eAAe,MAAM,CAAC,UAAU,EAAE,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,CACT,aACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAChC,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,eAAe,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAC1C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,qBAAqB,MAAM,CAAC,eAAe,EAAE,CAC9C,CAAC;QACF,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,kBAAkB,EAAE,CACpD,CAAC;QACF,OAAO,CAAC,GAAG,CACT,0BAA0B,MAAM,CAAC,oBAAoB,EAAE,CACxD,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/commands/publish.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPublishCommand(program: Command): void;

package/dist/src/commands/publish.js

@@ -0,0 +1,25 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { renderHtmlReport } from '../core/publish/html.js';
+export function registerPublishCommand(program) {
+    program
+        .command('publish')
+        .description('Generate a static HTML security report.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('-o, --output <directory>', 'Output directory.', '.toolip-report')
+        .action(async (options) => {
+        const report = await runSecurityDoctor(options.path);
+        const directory = path.resolve(options.path, options.output);
+        await mkdir(directory, { recursive: true });
+        const html = renderHtmlReport({
+            project: path.basename(path.resolve(options.path)),
+            generatedAt: new Date().toISOString(),
+            findings: report.findings
+        });
+        await writeFile(path.join(directory, 'index.html'), html, 'utf8');
+        console.log(`Static report written to ${path.join(directory, 'index.html')}`);
+        console.log('Deploy this directory to GitHub Pages only after reviewing it for private data.');
+    });
+}
+//# sourceMappingURL=publish.js.map

package/dist/src/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,gBAAgB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/reachability.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerReachabilityCommand(program: Command): void;

package/dist/src/commands/reachability.js

@@ -0,0 +1,47 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { ReachabilityAnalyzer } from '../analyzers/reachability/reachability-analyzer.js';
+export function registerReachabilityCommand(program) {
+    program
+        .command('reachability')
+        .description('Show which npm packages are observed in JavaScript and TypeScript source imports.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependencies.')
+        .action(async (options) => {
+        const runner = new AnalyzerRunner({
+            concurrency: 1,
+            timeoutMs: 60_000
+        });
+        const [result] = await runner.run([new ReachabilityAnalyzer()], {
+            root: options.path
+        });
+        if (!result) {
+            throw new Error('The reachability analyzer returned no result.');
+        }
+        const allPackages = (result.metadata?.packages ??
+            []);
+        const packages = options.includeDev
+            ? allPackages
+            : allPackages.filter((item) => !item.development);
+        if (options.json) {
+            console.log(JSON.stringify({
+                analyzer: result.analyzer,
+                durationMs: result.durationMs,
+                packages
+            }, null, 2));
+            return;
+        }
+        console.log('Toolip Package Reachability');
+        console.log('');
+        for (const item of packages) {
+            console.log(`${item.state.padEnd(18)} ${item.packageName}`);
+            for (const reference of item.references.slice(0, 5)) {
+                console.log(`  ${reference.file}:${reference.line}:` +
+                    `${reference.column} (${reference.kind})`);
+            }
+        }
+        console.log('');
+        console.log('Reachability is static evidence, not proof that exploitation is impossible.');
+    });
+}
+//# sourceMappingURL=reachability.js.map

package/dist/src/commands/reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.js","sourceRoot":"","sources":["../../../src/commands/reachability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,oBAAoB,EAErB,MAAM,oDAAoD,CAAC;AAQ5D,MAAM,UAAU,2BAA2B,CACzC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CACV,mFAAmF,CACpF;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CACL,eAAe,EACf,mCAAmC,CACpC;SACA,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,CAAC,IAAI,oBAAoB,EAAE,CAAC,EAC5B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ;YACxB,EAAE,CAA0B,CAAC;QAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAC5B,CAAC;QAEN,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ;aACT,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAC/C,CAAC;YAEF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,CAAC,EACD,CAAC,CACF,EAAE,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG;oBACtC,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,GAAG,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,6EAA6E,CAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sbom.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerSbomCommand(program: Command): void;

package/dist/src/commands/sbom.js

@@ -0,0 +1,33 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { generateSbom } from '../core/sbom/generate.js';
+function assertFormat(value) {
+    if (value !== 'cyclonedx' &&
+        value !== 'spdx') {
+        throw new Error('SBOM format must be cyclonedx or spdx.');
+    }
+}
+export function registerSbomCommand(program) {
+    program
+        .command('sbom')
+        .description('Generate a CycloneDX 1.5 or SPDX 2.3 software bill of materials.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('-f, --format <format>', 'cyclonedx or spdx.', 'cyclonedx')
+        .option('-o, --output <file>', 'Write JSON to a file instead of stdout.')
+        .action(async (options) => {
+        assertFormat(options.format);
+        const document = await generateSbom(options.path, options.format);
+        const output = `${JSON.stringify(document, null, 2)}\n`;
+        if (!options.output) {
+            process.stdout.write(output);
+            return;
+        }
+        const outputPath = path.resolve(options.path, options.output);
+        await mkdir(path.dirname(outputPath), {
+            recursive: true
+        });
+        await writeFile(outputPath, output, 'utf8');
+        console.log(`SBOM written to ${outputPath}`);
+    });
+}
+//# sourceMappingURL=sbom.js.map

package/dist/src/commands/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/commands/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,YAAY,EAEb,MAAM,0BAA0B,CAAC;AAQlC,SAAS,YAAY,CACnB,KAAa;IAEb,IACE,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,MAAM,EAChB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,kEAAkE,CACnE;SACA,MAAM,CACL,mBAAmB,EACnB,0BAA0B,EAC1B,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,uBAAuB,EACvB,oBAAoB,EACpB,WAAW,CACZ;SACA,MAAM,CACL,qBAAqB,EACrB,yCAAyC,CAC1C;SACA,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,MAAM,GACV,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAE3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YACpC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,SAAS,CACb,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/upgrade-pr.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerUpgradePrCommand(program: Command): void;

package/dist/src/commands/upgrade-pr.js

@@ -0,0 +1,15 @@
+import { createUpgradePullRequest } from '../core/github/upgrade-pr.js';
+export function registerUpgradePrCommand(program) {
+    program
+        .command('upgrade-pr <package> <version>')
+        .description('Create a tested dependency-upgrade pull request through gh.')
+        .option('-p, --path <path>', 'Repository path.', process.cwd())
+        .option('--dry-run', 'Validate the request without changing Git.')
+        .action(async (packageName, version, options) => {
+        const result = await createUpgradePullRequest(options.path, packageName, version, Boolean(options.dryRun));
+        console.log(options.dryRun
+            ? `Dry run passed. Proposed branch: ${result.branch}`
+            : `Pull request created from ${result.branch}`);
+    });
+}
+//# sourceMappingURL=upgrade-pr.js.map

package/dist/src/commands/upgrade-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-pr.js","sourceRoot":"","sources":["../../../src/commands/upgrade-pr.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,gCAAgC,CAAC;SACzC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;SACjE,MAAM,CAAC,KAAK,EACX,WAAmB,EACnB,OAAe,EACf,OAA2C,EAC3C,EAAE;QACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,OAAO,CAAC,IAAI,EACZ,WAAW,EACX,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CACxB,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,MAAM;YACZ,CAAC,CAAC,oCAAoC,MAAM,CAAC,MAAM,EAAE;YACrD,CAAC,CAAC,6BAA6B,MAAM,CAAC,MAAM,EAAE,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/vulnerabilities.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerVulnerabilitiesCommand(program: Command): void;

package/dist/src/commands/vulnerabilities.js

@@ -0,0 +1,42 @@
+import { AnalyzerRunner } from '../application/analyzer-runner.js';
+import { OsvVulnerabilityAnalyzer } from '../analyzers/vulnerability/osv-analyzer.js';
+import { MemoryCache } from '../storage/memory-cache.js';
+export function registerVulnerabilitiesCommand(program) {
+    program
+        .command('vulnerabilities')
+        .alias('vulns')
+        .description('Match resolved npm dependencies against OSV.dev.')
+        .option('-p, --path <path>', 'Project path to inspect.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
+        .option('--include-dev', 'Include development dependency findings.')
+        .action(async (options) => {
+        const [result] = await new AnalyzerRunner({ concurrency: 1, timeoutMs: 60000 }).run([new OsvVulnerabilityAnalyzer()], { root: options.path, cache: new MemoryCache() });
+        if (!result)
+            throw new Error('OSV analyzer returned no result.');
+        const findings = options.includeDev
+            ? result.findings
+            : result.findings.filter((finding) => finding.metadata?.development !== true);
+        if (options.json) {
+            console.log(JSON.stringify({ ...result, findings }, null, 2));
+        }
+        else {
+            console.log('Toolip Vulnerability Intelligence');
+            console.log('');
+            console.log(`Dependencies checked: ${result.metadata?.dependenciesChecked ?? 0}`);
+            console.log(`Known vulnerabilities: ${findings.length}`);
+            console.log('');
+            for (const finding of findings) {
+                console.log(`[${finding.severity.toUpperCase()}] ${finding.metadata?.vulnerabilityId}`);
+                console.log(`Package: ${finding.metadata?.package}@${finding.metadata?.installedVersion}`);
+                console.log(`Summary: ${finding.title}`);
+                if (finding.remediation?.summary)
+                    console.log(`Fix: ${finding.remediation.summary}`);
+                console.log('');
+            }
+            if (findings.length === 0) {
+                console.log('No disclosed vulnerabilities matched the resolved npm dependency versions.');
+            }
+        }
+    });
+}
+//# sourceMappingURL=vulnerabilities.js.map

package/dist/src/commands/vulnerabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerabilities.js","sourceRoot":"","sources":["../../../src/commands/vulnerabilities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,KAAK,CAAC,OAAO,CAAC;SACd,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC;SACjD,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,OAA+D,EAAE,EAAE;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,IAAI,wBAAwB,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,EAAE,CACjD,CAAC;QAEF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,QAAQ,EAAE,mBAAmB,IAAI,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;gBACxF,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/watch.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerWatchCommand(program: Command): void;

package/dist/src/commands/watch.js

@@ -0,0 +1,34 @@
+import { runSecurityDoctor } from '../core/security-doctor.js';
+import { watchProject } from '../core/watch/watch.js';
+export function registerWatchCommand(program) {
+    program
+        .command('watch')
+        .description('Continuously rerun Toolip security checks as files change.')
+        .option('-p, --path <path>', 'Project path.', process.cwd())
+        .option('--once', 'Run once without watching.')
+        .action(async (options) => {
+        const render = async () => {
+            const result = await runSecurityDoctor(options.path);
+            console.clear();
+            console.log('Toolip Watch');
+            console.log('');
+            console.log(`Updated: ${new Date().toISOString()}`);
+            console.log(`Critical/secrets: ${result.summary.secrets}`);
+            console.log(`Dangerous code: ${result.summary.dangerousCode}`);
+            console.log(`Configuration: ${result.summary.configuration}`);
+            console.log(`Total findings: ${result.findings.length}`);
+        };
+        await render();
+        if (options.once)
+            return;
+        console.log('');
+        console.log('Watching for changes. Press Ctrl+C to stop.');
+        const close = watchProject(options.path, render);
+        process.once('SIGINT', () => {
+            close();
+            process.exit(0);
+        });
+        await new Promise(() => undefined);
+    });
+}
+//# sourceMappingURL=watch.js.map

package/dist/src/commands/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../../src/commands/watch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC;QAEF,MAAM,MAAM,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO;QAEzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEjD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC1B,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/contracts/analyzer.d.ts

@@ -0,0 +1,23 @@
+import type { Finding } from './finding.js';
+export type AnalyzerContext = {
+    root: string;
+    signal?: AbortSignal;
+    cache?: AnalyzerCache;
+    options?: Record<string, unknown>;
+};
+export type AnalyzerCache = {
+    get<T>(key: string): Promise<T | undefined>;
+    set<T>(key: string, value: T, ttlMs?: number): Promise<void>;
+};
+export type AnalyzerResult = {
+    analyzer: string;
+    durationMs: number;
+    findings: Finding[];
+    warnings?: string[];
+    metadata?: Record<string, unknown>;
+};
+export interface Analyzer {
+    readonly id: string;
+    readonly version: string;
+    analyze(context: AnalyzerContext): Promise<AnalyzerResult>;
+}

package/dist/src/contracts/analyzer.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=analyzer.js.map

package/dist/src/contracts/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../src/contracts/analyzer.ts"],"names":[],"mappings":""}

package/dist/src/contracts/finding.d.ts

@@ -0,0 +1,35 @@
+export declare const findingSeverities: readonly ["critical", "high", "medium", "low", "info"];
+export type FindingSeverity = (typeof findingSeverities)[number];
+export declare const findingConfidences: readonly ["high", "medium", "low"];
+export type FindingConfidence = (typeof findingConfidences)[number];
+export type FindingLocation = {
+    file: string;
+    line?: number;
+    column?: number;
+    endLine?: number;
+    endColumn?: number;
+};
+export type FindingEvidence = {
+    summary: string;
+    excerpt?: string;
+    fingerprint?: string;
+};
+export type FindingRemediation = {
+    summary: string;
+    fixedVersion?: string;
+    references?: string[];
+};
+export type Finding = {
+    id: string;
+    ruleId: string;
+    title: string;
+    category: string;
+    severity: FindingSeverity;
+    confidence: FindingConfidence;
+    message: string;
+    source: string;
+    location?: FindingLocation;
+    evidence?: FindingEvidence[];
+    remediation?: FindingRemediation;
+    metadata?: Record<string, unknown>;
+};

package/dist/src/contracts/finding.js

@@ -0,0 +1,13 @@
+export const findingSeverities = [
+    'critical',
+    'high',
+    'medium',
+    'low',
+    'info'
+];
+export const findingConfidences = [
+    'high',
+    'medium',
+    'low'
+];
+//# sourceMappingURL=finding.js.map

package/dist/src/contracts/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../../src/contracts/finding.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,QAAQ;IACR,KAAK;CACG,CAAC"}