toolip 2.0.1 → 2.1.1

package/README.md

@@ -6,9 +6,9 @@ Toolip helps developers inspect what enters their applications, identify risky c
 
 ## Status
 
-The latest stable release is Toolip v2.0.0.
+The latest stable release is **Toolip v2.1.1**.
 
-Toolip v2.0.0 is the current stable release. It combines local vulnerability intelligence, AST-based security analysis, supply-chain auditing, Git security, container checks, SBOM generation, configurable policy, shareable reports, GitHub workflows, and a read-only MCP server.
+Toolip v2.1.1 combines local vulnerability intelligence, AST-based security analysis, supply-chain auditing, Git security, container checks, SBOM generation, configurable policy, shareable reports, GitHub workflows, unified dependency-health scoring, and a read-only MCP server.
 
 ## Why Toolip Exists
 
@@ -20,16 +20,17 @@ Toolip does not aim to replace enterprise security platforms. It focuses on usef
 
 ## Design Principles
 
-- Local-first and privacy-conscious
-- Free and useful without an account
-- Deterministic analysis where possible
-- Explicit confidence for heuristic findings
-- Stable, machine-readable output
-- Actionable remediation
-- Bounded resource usage
-- Opt-in remote integrations
-- Verified npm release artifacts
-- One shared analysis engine across every interface
+* Local-first and privacy-conscious
+* Free and useful without an account
+* Deterministic analysis where possible
+* Explicit confidence for heuristic findings
+* Stable, machine-readable output
+* Actionable remediation
+* Bounded resource usage
+* Opt-in remote integrations
+* Verified npm release artifacts
+* One shared analysis engine across every interface
+* One canonical dependency-health calculation across commands
 
 ## Installation
 
@@ -39,6 +40,12 @@ Install the latest stable release globally:
 npm install -g toolip
 ```
 
+Install a specific version:
+
+```bash
+npm install -g toolip@2.1.1
+```
+
 Verify the installation:
 
 ```bash
@@ -67,6 +74,7 @@ Audit Git safety:
 
 ```bash
 toolip git-audit
+toolip git-history
 toolip pre-commit
 ```
 
@@ -80,6 +88,13 @@ toolip tree
 toolip alternatives request
 ```
 
+Generate software bills of materials:
+
+```bash
+toolip sbom --format cyclonedx
+toolip sbom --format spdx
+```
+
 Use the local encrypted vault:
 
 ```bash
@@ -99,57 +114,86 @@ toolip learn dependencies
 
 ## Current Commands
 
-| Command | Purpose |
-| --- | --- |
-| `toolip self-test` | Run internal diagnostics |
-| `toolip profile` | Detect project technologies and structure |
-| `toolip scan` | Analyze dependency and project risk |
-| `toolip vulnerabilities` | Match resolved npm dependencies against OSV.dev |
-| `toolip ast-scan` | Analyze JavaScript and TypeScript through the TypeScript Compiler API |
-| `toolip reachability` | Show package usage observed in source imports |
-| `toolip install-scripts` | Inspect npm lifecycle scripts for suspicious behavior indicators |
-| `toolip sbom` | Generate CycloneDX 1.5 or SPDX 2.3 JSON |
-| `toolip history` | Inspect local security history and score trends |
-| `toolip config` | Initialize and validate Toolip policy configuration |
-| `toolip package-health <package> <version>` | Inspect package metadata and provenance through deps.dev |
-| `toolip dependency-confusion` | Check internal-looking package names against public npm |
-| `toolip git-history` | Scan local Git history for deleted or historical secrets |
-| `toolip doctor` | Run security hygiene checks |
-| `toolip score` | Calculate a project security score |
-| `toolip inspect <package>` | Inspect npm package metadata and risk signals |
-| `toolip compare <packages...>` | Compare package health and maintenance signals |
-| `toolip licenses` | Analyze dependency licenses |
-| `toolip alternatives <package>` | Suggest maintained package alternatives |
-| `toolip tree` | Display dependency relationships |
-| `toolip vault` | Manage encrypted local secrets |
-| `toolip git-audit` | Audit repository and ignore-file safety |
-| `toolip pre-commit` | Run blocking security checks before commit |
-| `toolip hook install` | Install the Toolip pre-commit hook |
-| `toolip learn [topic]` | Read secure-development lessons |
-| `toolip docker-scan` | Scan Dockerfiles for risky container patterns |
-| `toolip monorepo` | Discover npm and pnpm workspace packages |
-| `toolip audit-repo <url>` | Audit a public GitHub repository through `gh` |
-| `toolip upgrade-pr <package> <version>` | Create a tested dependency-upgrade PR |
-| `toolip diff <base> [head]` | Summarize security-relevant Git changes |
-| `toolip publish` | Generate a static HTML security report |
-| `toolip watch` | Continuously rerun security checks as files change |
-| `toolip announce` | Generate a deterministic security update summary |
-| `toolip mcp` | Start the read-only Toolip MCP server over stdio |
+| Command                                     | Purpose                                                               |
+| ------------------------------------------- | --------------------------------------------------------------------- |
+| `toolip self-test`                          | Run internal diagnostics                                              |
+| `toolip profile`                            | Detect project technologies and structure                             |
+| `toolip scan`                               | Analyze dependency and project risk                                   |
+| `toolip vulnerabilities`                    | Match resolved npm dependencies against OSV.dev                       |
+| `toolip ast-scan`                           | Analyze JavaScript and TypeScript through the TypeScript Compiler API |
+| `toolip reachability`                       | Show package usage observed in source imports                         |
+| `toolip install-scripts`                    | Inspect npm lifecycle scripts for suspicious behavior indicators      |
+| `toolip sbom`                               | Generate CycloneDX 1.5 or SPDX 2.3 JSON                               |
+| `toolip history`                            | Inspect local security history and score trends                       |
+| `toolip config`                             | Initialize and validate Toolip policy configuration                   |
+| `toolip package-health <package> <version>` | Inspect package metadata and provenance through deps.dev              |
+| `toolip dependency-confusion`               | Check internal-looking package names against public npm               |
+| `toolip git-history`                        | Scan local Git history for deleted or historical secrets              |
+| `toolip doctor`                             | Run security hygiene checks                                           |
+| `toolip score`                              | Calculate a project security score                                    |
+| `toolip inspect <package>`                  | Inspect npm package metadata and risk signals                         |
+| `toolip compare <packages...>`              | Compare package health and maintenance signals                        |
+| `toolip licenses`                           | Analyze dependency licenses                                           |
+| `toolip alternatives <package>`             | Suggest maintained package alternatives                               |
+| `toolip tree`                               | Display dependency relationships                                      |
+| `toolip vault`                              | Manage encrypted local secrets                                        |
+| `toolip git-audit`                          | Audit repository and ignore-file safety                               |
+| `toolip pre-commit`                         | Run blocking security checks before commit                            |
+| `toolip hook install`                       | Install the Toolip pre-commit hook                                    |
+| `toolip learn [topic]`                      | Read secure-development lessons                                       |
+| `toolip docker-scan`                        | Scan Dockerfiles for risky container patterns                         |
+| `toolip monorepo`                           | Discover npm and pnpm workspace packages                              |
+| `toolip audit-repo <url>`                   | Audit a public GitHub repository through `gh`                         |
+| `toolip upgrade-pr <package> <version>`     | Create a tested dependency-upgrade pull request                       |
+| `toolip diff <base> [head]`                 | Summarize security-relevant Git changes                               |
+| `toolip publish`                            | Generate a static HTML security report                                |
+| `toolip watch`                              | Continuously rerun security checks as files change                    |
+| `toolip announce`                           | Generate a deterministic security update summary                      |
+| `toolip mcp`                                | Start the read-only Toolip MCP server over stdio                      |
 
 Use command-specific help for current options:
 
 ```bash
 toolip doctor --help
 toolip scan --help
+toolip score --help
 toolip vault --help
 ```
 
 ## Core Capabilities
 
+### Vulnerability Intelligence
+
+Toolip matches resolved npm dependencies against OSV.dev and reports known disclosed vulnerabilities using exact package versions.
+
+It separates disclosed vulnerabilities from general package-maintenance signals so security risk and dependency freshness are not treated as the same thing.
+
+See [docs/VULNERABILITY-INTELLIGENCE.md](docs/VULNERABILITY-INTELLIGENCE.md).
+
 ### Dependency Intelligence
 
 Toolip reads project manifests and lockfiles, identifies outdated or deprecated dependencies, inspects package metadata, compares alternatives, reports license distribution, and visualizes dependency relationships.
 
+Toolip also integrates with deps.dev for package metadata, dependency graph information, license data, provenance, attestations, and advisory intelligence.
+
+### Risk-Aware Dependency Scoring
+
+Toolip v2.1 introduced a risk-aware dependency-health model.
+
+The scoring engine distinguishes between:
+
+* disclosed vulnerabilities
+* deprecated packages
+* missing maintainer signals
+* stale publishing activity
+* major version gaps
+* minor version gaps
+* patch version gaps
+
+Vulnerability penalties receive the greatest weight. Maintenance and freshness penalties are independently capped, preventing outdated packages alone from collapsing dependency health to zero.
+
+Toolip v2.1.1 also ensures that `toolip scan` and `toolip score` consume the same canonical dependency-health result.
+
 ### AST Security Analysis
 
 Toolip uses the TypeScript Compiler API for semantic dangerous-code checks. It resolves supported imports and call targets instead of treating every matching method name as the same operation.
@@ -182,7 +226,27 @@ Toolip checks source and configuration files for secret exposure, unsafe executi
 
 ### Git Safety
 
-Toolip audits sensitive file patterns, ignore rules, committed artifacts, and pre-commit risks. Git hooks can run Toolip checks before changes enter repository history.
+Toolip audits sensitive file patterns, ignore rules, committed artifacts, and pre-commit risks.
+
+Git-history scanning can detect credentials that were committed and later deleted. Historical test fixtures are classified separately from genuine application credentials, and evidence remains redacted.
+
+### Docker and Container Security
+
+Toolip scans Dockerfiles for risky patterns including:
+
+* root execution
+* secret-like `ARG` or `ENV` declarations
+* unpinned base images
+* remote `ADD` instructions
+* package-install cleanup issues
+
+See [docs/DOCKER-SCANNING.md](docs/DOCKER-SCANNING.md).
+
+### Monorepo Support
+
+Toolip discovers npm and pnpm workspaces and identifies package boundaries for per-workspace analysis and reporting.
+
+See [docs/MONOREPOS.md](docs/MONOREPOS.md).
 
 ### Local Secrets Management
 
@@ -192,66 +256,149 @@ Toolip Vault provides password-protected local encryption for development secret
 
 Learning mode explains security concepts, common mistakes, practical risks, secure alternatives, and recommended development practices.
 
-### Reports
+### Reports and Automation
 
-Commands can produce terminal output and machine-readable reports for automation. Toolip v2 introduces a versioned report schema shared across scanning, history, diffs, publishing, watch mode, and MCP tools.
+Toolip can generate:
+
+* terminal reports
+* structured JSON output
+* historical security records
+* CycloneDX and SPDX SBOMs
+* static HTML security reports
+* Git security diffs
+* deterministic release summaries
+
+These outputs can support CI, review workflows, historical comparison, and integration with other tools.
 
 ## Architecture
 
-Toolip v2 separates interfaces, application services, analyzers, providers, contracts, reporting, and storage.
+Toolip separates interfaces, application services, analyzers, providers, contracts, reporting, and storage.
 
 Commands handle input and presentation. Application services orchestrate work. Analyzers return normalized findings. Providers isolate Git, filesystem, package registry, vulnerability database, and GitHub access. Storage implementations manage cache, policy, history, and baselines.
 
-This structure allows CLI commands, future watch mode, HTML reports, GitHub automation, and the MCP server to reuse one security engine.
+CLI commands, watch mode, HTML reports, GitHub automation, and the MCP server reuse the same security engine and shared finding contracts.
 
 See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the architectural model and [docs/ENGINEERING.md](docs/ENGINEERING.md) for development standards.
 
-## Toolip v2 Capabilities
-
-Toolip v2.0.0 includes:
-
-- OSV-backed CVE and vulnerability matching
-- AST-based JavaScript and TypeScript security analysis
-- package reachability evidence
-- npm lifecycle-script inspection
-- CycloneDX and SPDX SBOM generation
-- historical security trends
-- project policy and severity configuration
-- deps.dev package intelligence
-- dependency-confusion detection
-- full Git-history secret scanning
-- Dockerfile and container configuration analysis
-- monorepo-aware discovery
-- remote public repository audits
-- tested dependency-upgrade pull requests
-- security diffs between commits and branches
-- static HTML report generation
-- real-time terminal watch mode
-- deterministic release-summary generation
-- a read-only MCP server
+## Toolip v2.1 Capabilities
+
+Toolip v2.1.1 includes:
+
+* OSV-backed CVE and vulnerability matching
+* AST-based JavaScript and TypeScript security analysis
+* package reachability evidence
+* npm lifecycle-script inspection
+* CycloneDX and SPDX SBOM generation
+* historical security trends
+* project policy and severity configuration
+* deps.dev package intelligence
+* dependency-confusion detection
+* full Git-history secret scanning
+* Dockerfile and container configuration analysis
+* monorepo-aware discovery
+* remote public repository audits
+* tested dependency-upgrade pull requests
+* security diffs between commits and branches
+* static HTML report generation
+* real-time terminal watch mode
+* deterministic release-summary generation
+* a read-only MCP server
+* risk-aware dependency-health scoring
+* unified dependency-health results across `scan` and `score`
 
 Remote repository audits and pull-request creation remain opt-in and use the user's own GitHub authorization.
 
 ## Configuration
 
-Toolip currently supports `.toolipignore` for scan exclusions.
+Toolip supports `.toolipignore` for scan exclusions and `toolip.config.json` for project policy.
+
+Create a configuration file:
+
+```bash
+toolip config init
+```
+
+Validate it:
+
+```bash
+toolip config validate
+```
+
+Display the resolved configuration:
 
-Toolip v2 will introduce a versioned `toolip.config.json` schema supporting path policies, rule severity overrides, test-fixture treatment, suppressions with reasons and expiry dates, provider settings, cache controls, and monorepo behavior.
+```bash
+toolip config show
+```
+
+The configuration schema supports:
+
+* include and exclude paths
+* rule enablement
+* severity overrides
+* path-specific rule policy
+* suppressions with reasons
+* optional suppression expiry dates
+* history retention
+* provider settings
+* OSV and deps.dev timeouts
 
 ## Output and Automation
 
-Toolip commands use non-zero exit codes for blocking failures where appropriate. Machine-readable reports are intended for CI, review workflows, historical comparison, and integration with other tools.
+Toolip commands use non-zero exit codes for blocking failures where appropriate.
+
+Machine-readable reports are intended for CI, review workflows, historical comparison, and integration with other tools.
+
+Toolip reports can include:
 
-Toolip v2 reports include:
+* report schema version
+* Toolip version
+* project identity
+* summary counts
+* normalized findings
+* analyzer metadata
+* provider status
+* generation timestamp
+* scoring breakdowns
+* confidence levels
+* evidence fingerprints
+* remediation guidance
 
-- report schema version
-- Toolip version
-- project identity
-- summary counts
-- normalized findings
-- analyzer metadata
-- provider status
-- generation timestamp
+## GitHub Integration
+
+Remote repository audits and dependency-upgrade pull requests use the authenticated GitHub CLI.
+
+Authenticate before using GitHub-connected commands:
+
+```bash
+gh auth login
+```
+
+Audit a public repository:
+
+```bash
+toolip audit-repo https://github.com/owner/repository
+```
+
+Create a tested dependency-upgrade pull request:
+
+```bash
+toolip upgrade-pr express 5.1.0 --dry-run
+toolip upgrade-pr express 5.1.0
+```
+
+## MCP Server
+
+Toolip includes a read-only MCP server over stdio.
+
+Start it with:
+
+```bash
+toolip mcp
+```
+
+The MCP server exposes supported security analysis tools without exposing arbitrary shell execution or unrestricted write operations.
+
+See [docs/MCP.md](docs/MCP.md).
 
 ## Development
 
@@ -290,7 +437,9 @@ The release check performs type checking, tests, a clean production build, packa
 
 ## Release Safety
 
-Toolip v1.0.6 exposed an important release-engineering failure: the published npm package did not contain the compiled CLI. Toolip now verifies releases from the packed artifact rather than assuming a successful local build means the package is valid.
+Toolip v1.0.6 exposed an important release-engineering failure: the published npm package did not contain the compiled CLI.
+
+Toolip now verifies releases from the packed artifact rather than assuming a successful local build means the package is valid.
 
 A release is blocked unless the tarball contains:
 
@@ -309,6 +458,8 @@ toolip self-test
 toolip --help
 ```
 
+Release verification also checks version synchronization, the CLI executable shebang, changelog validity, required package contents, and isolated installation of the exact tarball that will be published.
+
 See [RELEASING.md](RELEASING.md) for the complete release policy.
 
 ## Security
@@ -319,7 +470,9 @@ Please report suspected Toolip vulnerabilities privately according to [SECURITY.
 
 ## Contributing
 
-Contributions should include tests, clear tradeoffs, and accurate security claims. Analyzer changes require regression coverage and must use the shared finding contracts.
+Contributions should include tests, clear tradeoffs, and accurate security claims.
+
+Analyzer changes require regression coverage and must use the shared finding contracts.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md).
 
@@ -334,7 +487,3 @@ GitHub: https://github.com/wbizmo
 ## License
 
 Toolip is available under the MIT License.
-
-## Vulnerability Intelligence
-
-Toolip matches resolved npm dependencies against OSV.dev. See [docs/VULNERABILITY-INTELLIGENCE.md](docs/VULNERABILITY-INTELLIGENCE.md).

package/dist/src/commands/scan.js

@@ -3,7 +3,7 @@ import { createScannerContext } from '../core/scanner-context.js';
 import { createReport } from '../core/report.js';
 import { writeReport } from '../core/report-writer.js';
 import { scanDependencies } from '../core/dependency-scan.js';
-import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+import { calculateScore } from '../core/score.js';
 import { TOOLIP_VERSION } from '../config/version.js';
 import { printReportSummary, printScannerContext } from '../utils/output.js';
 export function registerScanCommand(program) {
@@ -18,8 +18,10 @@ export function registerScanCommand(program) {
         const context = await createScannerContext(options.path);
         printScannerContext(context);
         const dependencyScan = await scanDependencies(context.root);
-        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
-        const score = calculateScore({ dependencyHealth });
+        const dependencyHealth = dependencyScan.dependencyHealth;
+        const score = calculateScore({
+            dependencyHealth: dependencyHealth.score
+        });
         const report = createReport({
             version: TOOLIP_VERSION,
             command: 'scan',
@@ -34,7 +36,7 @@ export function registerScanCommand(program) {
         console.log(`${chalk.dim('High Risk:')} ${dependencyScan.summary.highRisk}`);
         console.log(`${chalk.dim('Medium Risk:')} ${dependencyScan.summary.mediumRisk}`);
         console.log(`${chalk.dim('Average Risk:')} ${dependencyScan.summary.averageRiskScore}`);
-        console.log(`${chalk.dim('Dependency Health:')} ${dependencyHealth}`);
+        console.log(`${chalk.dim('Dependency Health:')} ${dependencyHealth.score}`);
         console.log(`${chalk.dim('Overall Grade:')} ${score.grade}`);
         console.log('');
         printReportSummary(report);

package/dist/src/commands/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACnE,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/scan.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACnE,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,gBAAgB,GACpB,cAAc,CAAC,gBAAgB,CAAC;QAElC,MAAM,KAAK,GAAG,cAAc,CAAC;YAC3B,gBAAgB,EACd,gBAAgB,CAAC,KAAK;SACzB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/score.js

@@ -1,15 +1,26 @@
 import chalk from 'chalk';
 import { scanDependencies } from '../core/dependency-scan.js';
-import { calculateDependencyHealth, calculateScore } from '../core/score.js';
+import { calculateScore } from '../core/score.js';
 export function registerScoreCommand(program) {
     program
         .command('score')
         .description('Calculate a Toolip security scorecard for the current project.')
         .option('-p, --path <path>', 'Project path to score.', process.cwd())
+        .option('--json', 'Print structured JSON output.')
         .action(async (options) => {
         const dependencyScan = await scanDependencies(options.path);
-        const dependencyHealth = calculateDependencyHealth(dependencyScan.findings);
-        const score = calculateScore({ dependencyHealth });
+        const dependencyHealth = dependencyScan.dependencyHealth;
+        const score = calculateScore({
+            dependencyHealth: dependencyHealth.score
+        });
+        if (options.json) {
+            console.log(JSON.stringify({
+                score,
+                dependencyHealth,
+                dependencySummary: dependencyScan.summary
+            }, null, 2));
+            return;
+        }
         console.log(chalk.bold('Toolip Security Scorecard'));
         console.log('');
         console.log(`${chalk.dim('Dependency Health ....')} ${score.dependencyHealth}`);
@@ -19,6 +30,12 @@ export function registerScoreCommand(program) {
         console.log('');
         console.log(`${chalk.dim('Overall Score ........')} ${score.overall}`);
         console.log(`${chalk.dim('Grade ................')} ${score.grade}`);
+        console.log('');
+        console.log(chalk.dim('Dependency score breakdown'));
+        console.log(`${chalk.dim('Vulnerability penalty')} ${dependencyHealth.vulnerabilityPenalty}`);
+        console.log(`${chalk.dim('Deprecation penalty ..')} ${dependencyHealth.deprecationPenalty}`);
+        console.log(`${chalk.dim('Maintenance penalty ..')} ${dependencyHealth.maintenancePenalty}`);
+        console.log(`${chalk.dim('Freshness penalty ....')} ${dependencyHealth.freshnessPenalty}`);
     });
 }
 //# sourceMappingURL=score.js.map

package/dist/src/commands/score.js.map

@@ -1 +1 @@
-{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/commands/score.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE7E,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/commands/score.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,gBAAgB,EACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAClC,OAAgB;IAEhB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,gEAAgE,CACjE;SACA,MAAM,CACL,mBAAmB,EACnB,wBAAwB,EACxB,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,QAAQ,EACR,+BAA+B,CAChC;SACA,MAAM,CACL,KAAK,EACH,OAGC,EACD,EAAE;QACF,MAAM,cAAc,GAClB,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,gBAAgB,GACpB,cAAc,CAAC,gBAAgB,CAAC;QAElC,MAAM,KAAK,GAAG,cAAc,CAAC;YAC3B,gBAAgB,EACd,gBAAgB,CAAC,KAAK;SACzB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,KAAK;gBACL,gBAAgB;gBAChB,iBAAiB,EACf,cAAc,CAAC,OAAO;aACzB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YAEF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,2BAA2B,CAC5B,CACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAC9B,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,aAAa,EAAE,CAC3B,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,qBAAqB,EAAE,CACnC,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,SAAS,EAAE,CACvB,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,OAAO,EAAE,CACrB,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,KAAK,CAAC,KAAK,EAAE,CACnB,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,4BAA4B,CAC7B,CACF,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,uBAAuB,CACxB,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,CAC7C,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,CAC3C,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,CAC3C,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,GAAG,CACV,wBAAwB,CACzB,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,CACzC,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/src/core/dependency-scan.d.ts

@@ -1,8 +1,10 @@
 import type { PackageHealth } from './dependency-types.js';
 import type { ToolipFinding } from './report.js';
+import { type DependencyHealthBreakdown } from './score.js';
 export type DependencyScanResult = {
     packages: PackageHealth[];
     findings: ToolipFinding[];
+    dependencyHealth: DependencyHealthBreakdown;
     summary: {
         totalDependencies: number;
         outdated: number;

package/dist/src/core/dependency-scan.js

@@ -1,12 +1,15 @@
 import { readDependencies } from './read-dependencies.js';
 import { analyzePackage } from './analyze-package.js';
+import { calculateDependencyHealthFromPackages } from './score.js';
 export async function scanDependencies(root) {
     const dependencies = await readDependencies(root);
     const packages = await Promise.all(dependencies.map((dependency) => analyzePackage(dependency)));
     const findings = packages.flatMap(packageToFindings);
+    const dependencyHealth = calculateDependencyHealthFromPackages(packages);
     return {
         packages,
         findings,
+        dependencyHealth,
         summary: {
             totalDependencies: packages.length,
             outdated: packages.filter((pkg) => pkg.outdated).length,

package/dist/src/core/dependency-scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-scan.js","sourceRoot":"","sources":["../../../src/core/dependency-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAkBtD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE;YACP,iBAAiB,EAAE,QAAQ,CAAC,MAAM;YAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;YACvD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;YAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;YAC9D,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACtF,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACjF,gBAAgB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;SAC5F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,yBAAyB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACnF,KAAK,EAAE,uBAAuB,GAAG,CAAC,IAAI,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,+CAA+C;YACnE,cAAc,EAAE,sFAAsF;YACtG,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;SACzC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,uBAAuB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACjF,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,gBAAgB,aAAa,GAAG,CAAC,aAAa,IAAI,SAAS,GAAG;YACvH,cAAc,EAAE,qFAAqF;YACrG,QAAQ,EAAE,GAAG,GAAG,CAAC,gBAAgB,OAAO,GAAG,CAAC,aAAa,IAAI,SAAS,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,6BAA6B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACvF,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iEAAiE;YACrF,cAAc,EAAE,oGAAoG;SACrH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAC9E,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,gEAAgE;YACpF,cAAc,EAAE,wFAAwF;YACxG,QAAQ,EAAE,GAAG,GAAG,CAAC,SAAS,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"dependency-scan.js","sourceRoot":"","sources":["../../../src/core/dependency-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EACL,qCAAqC,EAEtC,MAAM,YAAY,CAAC;AAiBpB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD,MAAM,gBAAgB,GACpB,qCAAqC,CACnC,QAAQ,CACT,CAAC;IAEJ,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,OAAO,EAAE;YACP,iBAAiB,EAAE,QAAQ,CAAC,MAAM;YAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;YACvD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;YAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;YAC9D,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACtF,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM;YACjF,gBAAgB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;SAC5F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,yBAAyB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACnF,KAAK,EAAE,uBAAuB,GAAG,CAAC,IAAI,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,+CAA+C;YACnE,cAAc,EAAE,sFAAsF;YACtG,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;SACzC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,uBAAuB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACjF,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,gBAAgB,aAAa,GAAG,CAAC,aAAa,IAAI,SAAS,GAAG;YACvH,cAAc,EAAE,qFAAqF;YACrG,QAAQ,EAAE,GAAG,GAAG,CAAC,gBAAgB,OAAO,GAAG,CAAC,aAAa,IAAI,SAAS,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,6BAA6B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YACvF,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,iEAAiE;YACrF,cAAc,EAAE,oGAAoG;SACrH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,oBAAoB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;YAC9E,KAAK,EAAE,2BAA2B,GAAG,CAAC,IAAI,EAAE;YAC5C,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,gEAAgE;YACpF,cAAc,EAAE,wFAAwF;YACxG,QAAQ,EAAE,GAAG,GAAG,CAAC,SAAS,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/core/score.d.ts

@@ -1,3 +1,4 @@
+import type { PackageHealth } from './dependency-types.js';
 import type { ToolipFinding } from './report.js';
 export type ScoreGrade = 'A' | 'B' | 'C' | 'D' | 'F';
 export type ToolipScore = {
@@ -8,6 +9,27 @@ export type ToolipScore = {
     overall: number;
     grade: ScoreGrade;
 };
+export type DependencyHealthBreakdown = {
+    score: number;
+    vulnerabilityPenalty: number;
+    deprecationPenalty: number;
+    maintenancePenalty: number;
+    freshnessPenalty: number;
+    outdated: {
+        major: number;
+        minor: number;
+        patch: number;
+        unknown: number;
+    };
+};
 export declare function calculateScore(input?: Partial<Omit<ToolipScore, 'overall' | 'grade'>>): ToolipScore;
+export declare function calculateDependencyHealthFromPackages(packages: PackageHealth[], vulnerabilityFindings?: ToolipFinding[]): DependencyHealthBreakdown;
+/**
+ * Backward-compatible finding-based score.
+ *
+ * Outdated-package findings are treated as maintenance
+ * signals and capped so they cannot independently collapse
+ * dependency health to zero.
+ */
 export declare function calculateDependencyHealth(findings: ToolipFinding[]): number;
 export declare function gradeScore(score: number): ScoreGrade;

package/dist/src/core/score.js

@@ -1,9 +1,13 @@
+import semver from 'semver';
 export function calculateScore(input) {
     const dependencyHealth = clamp(input?.dependencyHealth ?? 100);
     const secretHygiene = clamp(input?.secretHygiene ?? 100);
     const configurationSecurity = clamp(input?.configurationSecurity ?? 100);
     const gitSafety = clamp(input?.gitSafety ?? 100);
-    const overall = Math.round((dependencyHealth + secretHygiene + configurationSecurity + gitSafety) / 4);
+    const overall = Math.round((dependencyHealth +
+        secretHygiene +
+        configurationSecurity +
+        gitSafety) / 4);
     return {
         dependencyHealth,
         secretHygiene,
@@ -13,19 +17,140 @@ export function calculateScore(input) {
         grade: gradeScore(overall)
     };
 }
+export function calculateDependencyHealthFromPackages(packages, vulnerabilityFindings = []) {
+    let criticalVulnerabilities = 0;
+    let highVulnerabilities = 0;
+    let mediumVulnerabilities = 0;
+    let lowVulnerabilities = 0;
+    for (const finding of vulnerabilityFindings) {
+        if (finding.category !== 'vulnerability') {
+            continue;
+        }
+        if (finding.severity === 'critical') {
+            criticalVulnerabilities += 1;
+        }
+        else if (finding.severity === 'high') {
+            highVulnerabilities += 1;
+        }
+        else if (finding.severity === 'medium') {
+            mediumVulnerabilities += 1;
+        }
+        else if (finding.severity === 'low') {
+            lowVulnerabilities += 1;
+        }
+    }
+    const vulnerabilityPenalty = Math.min(100, criticalVulnerabilities * 40 +
+        highVulnerabilities * 25 +
+        mediumVulnerabilities * 12 +
+        lowVulnerabilities * 4);
+    const deprecated = packages.filter((pkg) => pkg.deprecated).length;
+    const noMaintainers = packages.filter((pkg) => pkg.maintainers === 0).length;
+    const stale = packages.filter((pkg) => pkg.ageInDays !== null &&
+        pkg.ageInDays > 730).length;
+    const outdated = {
+        major: 0,
+        minor: 0,
+        patch: 0,
+        unknown: 0
+    };
+    for (const pkg of packages) {
+        if (!pkg.outdated ||
+            !pkg.latestVersion) {
+            continue;
+        }
+        const installed = semver.coerce(pkg.installedVersion);
+        const latest = semver.coerce(pkg.latestVersion);
+        if (!installed || !latest) {
+            outdated.unknown += 1;
+            continue;
+        }
+        if (latest.major > installed.major) {
+            outdated.major += 1;
+        }
+        else if (latest.minor > installed.minor) {
+            outdated.minor += 1;
+        }
+        else if (latest.patch > installed.patch) {
+            outdated.patch += 1;
+        }
+        else {
+            outdated.unknown += 1;
+        }
+    }
+    const deprecationPenalty = Math.min(40, deprecated * 18);
+    const maintenancePenalty = Math.min(20, noMaintainers * 4);
+    const freshnessPenalty = Math.min(15, outdated.major * 3 +
+        outdated.minor * 1 +
+        outdated.patch * 0.25 +
+        outdated.unknown * 1 +
+        stale * 1);
+    const score = clamp(100 -
+        vulnerabilityPenalty -
+        deprecationPenalty -
+        maintenancePenalty -
+        freshnessPenalty);
+    return {
+        score,
+        vulnerabilityPenalty,
+        deprecationPenalty,
+        maintenancePenalty,
+        freshnessPenalty: Math.round(freshnessPenalty * 100) /
+            100,
+        outdated
+    };
+}
+/**
+ * Backward-compatible finding-based score.
+ *
+ * Outdated-package findings are treated as maintenance
+ * signals and capped so they cannot independently collapse
+ * dependency health to zero.
+ */
 export function calculateDependencyHealth(findings) {
-    const penalty = findings.reduce((total, finding) => {
-        if (finding.severity === 'critical')
-            return total + 35;
-        if (finding.severity === 'high')
-            return total + 25;
-        if (finding.severity === 'medium')
-            return total + 12;
-        if (finding.severity === 'low')
-            return total + 5;
-        return total + 0;
-    }, 0);
-    return clamp(100 - penalty);
+    let vulnerabilityPenalty = 0;
+    let deprecationPenalty = 0;
+    let maintenancePenalty = 0;
+    let freshnessPenalty = 0;
+    for (const finding of findings) {
+        if (finding.category === 'vulnerability') {
+            vulnerabilityPenalty +=
+                severityPenalty(finding.severity);
+            continue;
+        }
+        if (finding.id.startsWith('TOOLIP-DEP-DEPRECATED-')) {
+            deprecationPenalty += 18;
+            continue;
+        }
+        if (finding.id.startsWith('TOOLIP-DEP-OUTDATED-')) {
+            freshnessPenalty += 1;
+            continue;
+        }
+        if (finding.id.startsWith('TOOLIP-DEP-NO-MAINTAINERS-')) {
+            maintenancePenalty += 4;
+            continue;
+        }
+        if (finding.id.startsWith('TOOLIP-DEP-STALE-')) {
+            freshnessPenalty += 1;
+            continue;
+        }
+        maintenancePenalty += Math.min(10, severityPenalty(finding.severity));
+    }
+    return clamp(100 -
+        Math.min(100, vulnerabilityPenalty) -
+        Math.min(40, deprecationPenalty) -
+        Math.min(20, maintenancePenalty) -
+        Math.min(15, freshnessPenalty));
+}
+function severityPenalty(severity) {
+    if (severity === 'critical')
+        return 40;
+    if (severity === 'high')
+        return 25;
+    if (severity === 'medium')
+        return 12;
+    if (severity === 'low')
+        return 4;
+    return 0;
 }
 function clamp(value) {
     return Math.max(0, Math.min(100, Math.round(value)));

package/dist/src/core/score.js.map

@@ -1 +1 @@
-{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/core/score.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,cAAc,CAAC,KAAuD;IACpF,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,EAAE,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC;IACzD,MAAM,qBAAqB,GAAG,KAAK,CAAC,KAAK,EAAE,qBAAqB,IAAI,GAAG,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CAAC,gBAAgB,GAAG,aAAa,GAAG,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,CAC3E,CAAC;IAEF,OAAO;QACL,gBAAgB;QAChB,aAAa;QACb,qBAAqB;QACrB,SAAS;QACT,OAAO;QACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAyB;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,CAAC,CAAC;QACjD,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/core/score.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAsC5B,MAAM,UAAU,cAAc,CAC5B,KAEC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAC5B,KAAK,EAAE,gBAAgB,IAAI,GAAG,CAC/B,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CACzB,KAAK,EAAE,aAAa,IAAI,GAAG,CAC5B,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,CACjC,KAAK,EAAE,qBAAqB,IAAI,GAAG,CACpC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CACrB,KAAK,EAAE,SAAS,IAAI,GAAG,CACxB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CACE,gBAAgB;QAChB,aAAa;QACb,qBAAqB;QACrB,SAAS,CACV,GAAG,CAAC,CACN,CAAC;IAEF,OAAO;QACL,gBAAgB;QAChB,aAAa;QACb,qBAAqB;QACrB,SAAS;QACT,OAAO;QACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,QAAyB,EACzB,wBAAyC,EAAE;IAE3C,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,IACE,OAAO,CAAC,QAAQ,KAAK,eAAe,EACpC,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACpC,uBAAuB,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACvC,mBAAmB,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,qBAAqB,IAAI,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACtC,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CACnC,GAAG,EACH,uBAAuB,GAAG,EAAE;QAC1B,mBAAmB,GAAG,EAAE;QACxB,qBAAqB,GAAG,EAAE;QAC1B,kBAAkB,GAAG,CAAC,CACzB,CAAC;IAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CACxB,CAAC,MAAM,CAAC;IAET,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,CAC/B,CAAC,MAAM,CAAC;IAET,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,SAAS,GAAG,GAAG,CACtB,CAAC,MAAM,CAAC;IAET,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,CAAC;QACR,KAAK,EAAE,CAAC;QACR,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;KACX,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IACE,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,aAAa,EAClB,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,GAAG,CAAC,gBAAgB,CACrB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IACL,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,EAC9B,CAAC;YACD,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IACL,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,EAC9B,CAAC;YACD,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CACjC,EAAE,EACF,UAAU,GAAG,EAAE,CAChB,CAAC;IAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CACjC,EAAE,EACF,aAAa,GAAG,CAAC,CAClB,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,EAAE,EACF,QAAQ,CAAC,KAAK,GAAG,CAAC;QAChB,QAAQ,CAAC,KAAK,GAAG,CAAC;QAClB,QAAQ,CAAC,KAAK,GAAG,IAAI;QACrB,QAAQ,CAAC,OAAO,GAAG,CAAC;QACpB,KAAK,GAAG,CAAC,CACZ,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CACjB,GAAG;QACD,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,gBAAgB,CACnB,CAAC;IAEF,OAAO;QACL,KAAK;QACL,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,gBAAgB,EACd,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC;YAClC,GAAG;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAyB;IAEzB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IACE,OAAO,CAAC,QAAQ,KAAK,eAAe,EACpC,CAAC;YACD,oBAAoB;gBAClB,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEpC,SAAS;QACX,CAAC;QAED,IACE,OAAO,CAAC,EAAE,CAAC,UAAU,CACnB,wBAAwB,CACzB,EACD,CAAC;YACD,kBAAkB,IAAI,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,IACE,OAAO,CAAC,EAAE,CAAC,UAAU,CACnB,sBAAsB,CACvB,EACD,CAAC;YACD,gBAAgB,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IACE,OAAO,CAAC,EAAE,CAAC,UAAU,CACnB,4BAA4B,CAC7B,EACD,CAAC;YACD,kBAAkB,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IACE,OAAO,CAAC,EAAE,CAAC,UAAU,CACnB,mBAAmB,CACpB,EACD,CAAC;YACD,gBAAgB,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,kBAAkB,IAAI,IAAI,CAAC,GAAG,CAC5B,EAAE,EACF,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CACV,GAAG;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAmC;IAEnC,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAa;IAEb,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolip",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "A TypeScript-powered developer security companion CLI for supply chain security, dependency intelligence, secret detection, security auditing, encrypted local secrets management, Git security checks, and secure development education.",
   "type": "module",
   "bin": {
@@ -21,10 +21,11 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "verify:package": "node scripts/verify-package.mjs",
-    "verify": "npm run typecheck && npm test && npm run clean && npm run build && npm run verify:package",
+    "verify": "npm run verify:changelog && npm run typecheck && npm test && npm run clean && npm run build && npm run verify:package",
     "prepack": "npm run verify",
     "pack:check": "npm pack --dry-run",
-    "release:check": "bash scripts/release-check.sh"
+    "release:check": "bash scripts/release-check.sh",
+    "verify:changelog": "node scripts/verify-changelog.mjs"
   },
   "keywords": [
     "typescript",