0sec-cli 0.15.0 → 0.17.0

package/chunks/web-recon-prepass-DPVCBRZA.js

@@ -0,0 +1,1148 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  enumerateJsChunkUrls,
+  fingerprintWebStack,
+  runBaselineWebChecks,
+  summarizeWebStackFingerprint
+} from "./chunk-QJQKHO7G.js";
+import {
+  enumerateSubdomains,
+  scanJsArtifacts,
+  searchAdvisories
+} from "./chunk-LOHTE223.js";
+import "./chunk-KKGE5RQE.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+
+// packages/core/dist/stages/web-recon-prepass.js
+import { randomUUID } from "node:crypto";
+
+// packages/core/dist/intel/version-cve.js
+async function lookupVersionCves(input, opts = {}) {
+  const { advisories } = await searchAdvisories({
+    ecosystem: input.ecosystem,
+    packageName: input.name,
+    version: input.version,
+    cacheDir: input.cacheDir,
+    offline: input.offline,
+    ttlMs: input.ttlMs
+  }, opts);
+  const byId = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    if (byId.has(advisory.id))
+      continue;
+    byId.set(advisory.id, toVersionCve(advisory));
+  }
+  return [...byId.values()];
+}
+function toVersionCve(advisory) {
+  return {
+    id: advisory.id,
+    severity: advisory.severity === "info" ? void 0 : advisory.severity,
+    summary: advisory.summary ?? advisory.details ?? advisory.id,
+    affectedRange: advisory.affectedRanges[0],
+    fixedVersion: advisory.fixedVersions[0],
+    source: advisory.source
+  };
+}
+
+// packages/core/dist/recon/dns-email.js
+var DEFAULT_DKIM_SELECTORS = [
+  "google",
+  "default",
+  "selector1",
+  "selector2",
+  "k1"
+];
+function joinTxt(record) {
+  return record.join("");
+}
+async function resolveTxtStrings(resolveTxt, name) {
+  try {
+    const records = await resolveTxt(name);
+    return records.map(joinTxt);
+  } catch {
+    return [];
+  }
+}
+function parseSpfPolicy(record) {
+  const match = /(^|\s)([-~?+]?)all(\s|$)/i.exec(record);
+  if (!match)
+    return void 0;
+  const qualifier = match[2] || "+";
+  return `${qualifier}all`;
+}
+function parseDmarcPolicy(record) {
+  const match = /(^|;)\s*p\s*=\s*(none|quarantine|reject)\b/i.exec(record);
+  if (!match)
+    return void 0;
+  return match[2].toLowerCase();
+}
+function findSpfRecord(records) {
+  return records.find((r) => /^v=spf1\b/i.test(r.trim()));
+}
+function findDmarcRecord(records) {
+  return records.find((r) => /^v=DMARC1\b/i.test(r.trim()));
+}
+function looksLikeDkimKey(record) {
+  const r = record.trim();
+  return /(^|;)\s*v\s*=\s*DKIM1\b/i.test(r) || /(^|;)\s*p\s*=/i.test(r);
+}
+function gradeSpf(spf, findings) {
+  if (!spf.present) {
+    spf.issue = "no SPF record published";
+    findings.push({
+      severity: "medium",
+      title: "Missing SPF record",
+      detail: "No `v=spf1` TXT record was found for this domain. Without SPF, receivers cannot verify which hosts are authorized to send mail as the domain, making it trivial to spoof."
+    });
+    return;
+  }
+  switch (spf.policy) {
+    case "-all":
+      break;
+    case "~all":
+      spf.issue = "softfail (`~all`) is weaker than hardfail (`-all`)";
+      findings.push({
+        severity: "low",
+        title: "SPF uses softfail (~all)",
+        detail: "The SPF record ends in `~all` (softfail). Receivers are asked to accept-but-mark unlisted senders rather than reject them. Once the sending inventory is confirmed complete, tighten this to `-all` (hardfail) for stronger anti-spoofing."
+      });
+      break;
+    case "?all":
+      spf.issue = "neutral (`?all`) provides no enforcement";
+      findings.push({
+        severity: "low",
+        title: "SPF policy is neutral (?all)",
+        detail: "The SPF record ends in `?all` (neutral), which expresses no opinion on unlisted senders and provides no anti-spoofing value. Move to `-all` once the authorized-sender list is complete."
+      });
+      break;
+    case "+all":
+      spf.issue = "`+all` permits any host to send as the domain";
+      findings.push({
+        severity: "medium",
+        title: "SPF permits all senders (+all)",
+        detail: "The SPF record ends in `+all`, explicitly authorizing every host on the internet to send mail as this domain. This is equivalent to having no SPF protection and should be changed to `-all`."
+      });
+      break;
+    default:
+      spf.issue = "no explicit `all` mechanism \u2014 enforcement is ambiguous";
+      findings.push({
+        severity: "low",
+        title: "SPF has no explicit all mechanism",
+        detail: "An SPF record is published but lacks an explicit `all` mechanism (`-all`/`~all`). Add a terminal `-all` so receivers know how to treat senders not covered by the record."
+      });
+  }
+}
+function gradeDmarc(dmarc, findings) {
+  if (!dmarc.present) {
+    dmarc.issue = "no DMARC record published";
+    findings.push({
+      severity: "medium",
+      title: "Missing DMARC record",
+      detail: "No `v=DMARC1` TXT record was found at `_dmarc.<domain>`. Without DMARC, SPF/DKIM failures carry no receiver-side enforcement policy and spoofed mail is far more likely to be delivered."
+    });
+    return;
+  }
+  switch (dmarc.policy) {
+    case "reject":
+      break;
+    case "quarantine":
+      dmarc.issue = "`p=quarantine` is weaker than `p=reject`";
+      findings.push({
+        severity: "low",
+        title: "DMARC policy is p=quarantine",
+        detail: "The DMARC policy is `p=quarantine`, which sends failing mail to spam rather than rejecting it. After confirming legitimate senders pass alignment, move to `p=reject` for full anti-spoofing."
+      });
+      break;
+    case "none":
+      dmarc.issue = "`p=none` is monitor-only and does not block spoofing";
+      findings.push({
+        severity: "low",
+        title: "DMARC policy is p=none (monitor only)",
+        detail: "The DMARC policy is `p=none`, which only collects reports and applies no enforcement. Progress to `p=quarantine` and then `p=reject` once alignment is verified."
+      });
+      break;
+    default:
+      dmarc.issue = "DMARC record present but `p=` tag is missing or invalid";
+      findings.push({
+        severity: "low",
+        title: "DMARC record missing a valid policy",
+        detail: "A DMARC record is published but its `p=` tag is missing or unrecognized. Set an explicit `p=reject` (or staged `p=none` \u2192 `p=quarantine` \u2192 `p=reject`) policy."
+      });
+  }
+}
+async function checkEmailPosture(opts) {
+  const domain = opts.domain.trim().replace(/\.$/, "").toLowerCase();
+  if (!domain)
+    throw new Error("dns-email: empty domain");
+  const resolveTxt = opts.resolveTxt ?? await defaultResolveTxt();
+  const dkimSelectors = opts.dkimSelectors ?? DEFAULT_DKIM_SELECTORS;
+  const findings = [];
+  const apexTxt = await resolveTxtStrings(resolveTxt, domain);
+  const spfRecord = findSpfRecord(apexTxt);
+  const spf = spfRecord ? { present: true, record: spfRecord, policy: parseSpfPolicy(spfRecord) } : { present: false };
+  gradeSpf(spf, findings);
+  const dmarcTxt = await resolveTxtStrings(resolveTxt, `_dmarc.${domain}`);
+  const dmarcRecord = findDmarcRecord(dmarcTxt);
+  const dmarc = dmarcRecord ? { present: true, record: dmarcRecord, policy: parseDmarcPolicy(dmarcRecord) } : { present: false };
+  gradeDmarc(dmarc, findings);
+  const checkedSelectors = [...dkimSelectors];
+  const found = [];
+  for (const selector of checkedSelectors) {
+    const records = await resolveTxtStrings(resolveTxt, `${selector}._domainkey.${domain}`);
+    if (records.some(looksLikeDkimKey))
+      found.push(selector);
+  }
+  if (found.length === 0) {
+    findings.push({
+      severity: "low",
+      title: "No DKIM key found for common selectors",
+      detail: `None of the probed DKIM selectors (${checkedSelectors.join(", ")}) returned a signing key. DKIM may use a non-standard selector, or mail may be unsigned. Confirm DKIM is configured so DMARC alignment can rely on a cryptographic signature, not SPF alone.`
+    });
+  }
+  const dkim = { checkedSelectors, found };
+  return { domain, spf, dmarc, dkim, findings };
+}
+async function defaultResolveTxt() {
+  const dns = await import("node:dns/promises");
+  return (name) => dns.resolveTxt(name);
+}
+
+// packages/core/dist/recon/rate-limit.js
+var DEFAULT_BURST = 15;
+var MAX_BURST = 25;
+function clampBurst(burst) {
+  const requested = Number.isFinite(burst) ? Math.floor(burst) : DEFAULT_BURST;
+  return Math.max(1, Math.min(requested, MAX_BURST));
+}
+function sawStatusChange(statuses) {
+  if (statuses.length < 2)
+    return false;
+  const first = statuses[0];
+  const changeAt = statuses.findIndex((s) => s !== first);
+  if (changeAt <= 0)
+    return false;
+  const after = statuses[changeAt];
+  return statuses.slice(changeAt).every((s) => s === after);
+}
+async function probeRateLimit(opts) {
+  const burst = clampBurst(opts.burst);
+  const statuses = [];
+  for (let i = 0; i < burst; i++) {
+    const { status } = await opts.request(i);
+    statuses.push(status);
+  }
+  const saw429 = statuses.includes(429);
+  const changed = sawStatusChange(statuses);
+  const throttled = saw429 || changed;
+  let note;
+  if (saw429) {
+    note = `throttled: saw HTTP 429 within ${statuses.length} requests`;
+  } else if (changed) {
+    note = `throttled: status changed mid-burst (${statuses[0]} -> ${statuses[statuses.length - 1]})`;
+  } else {
+    note = `no rate limiting observed: ${statuses.length} requests, no 429, no status change (all ${statuses[0] ?? "n/a"})`;
+  }
+  return { sent: statuses.length, statuses, saw429, throttled, note };
+}
+
+// packages/core/dist/agent/web-cve-codex.js
+function parseSemver(version) {
+  const cleaned = version.trim().replace(/^v/i, "");
+  const core = cleaned.split(/[-+]/, 1)[0] ?? "";
+  const parts = core.split(".");
+  const num = (s) => {
+    const n = Number.parseInt(s ?? "", 10);
+    return Number.isFinite(n) ? n : 0;
+  };
+  return [num(parts[0]), num(parts[1]), num(parts[2])];
+}
+function semverLt(version, bound) {
+  const a = parseSemver(version);
+  const b = parseSemver(bound);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] < b[i])
+      return true;
+    if (a[i] > b[i])
+      return false;
+  }
+  return false;
+}
+function semverInRange(version, lo, hi) {
+  return !semverLt(version, lo) && semverLt(version, hi);
+}
+function isNext(framework) {
+  return /^next(\.?js)?$/i.test(framework.trim());
+}
+function isDjango(framework) {
+  return /^django$/i.test(framework.trim());
+}
+function isRails(framework) {
+  return /^(ruby[\s-]?on[\s-]?)?rails$/i.test(framework.trim());
+}
+function isAffectedBy29927(version) {
+  const [major] = parseSemver(version);
+  if (major === 15)
+    return semverLt(version, "15.2.3");
+  if (major === 14)
+    return semverLt(version, "14.2.25");
+  if (major === 13)
+    return semverInRange(version, "13.0.0", "13.5.9");
+  if (major === 12)
+    return semverInRange(version, "12.0.0", "12.3.5");
+  return false;
+}
+function isAffectedByRscBypass(version) {
+  return semverInRange(version, "13.4.0", "15.3.0");
+}
+function isRedirect(status) {
+  return status >= 300 && status < 400;
+}
+function looksLikeLogin(res, loginPath) {
+  const loc = res.headers["location"] ?? res.headers["Location"] ?? "";
+  if (loc && loginPath && loc.includes(loginPath))
+    return true;
+  const body = res.body ?? "";
+  const lower = body.toLowerCase();
+  if (/<form[^>]+(login|signin|sign-in)|name=["']password["']|type=["']password["']/.test(lower)) {
+    return true;
+  }
+  const contentType = (res.headers["content-type"] ?? res.headers["Content-Type"] ?? "").toLowerCase();
+  const isRscFlight = contentType.includes("text/x-component") || /^\s*\d+:\s*("?\$|I\[)/.test(body);
+  const redirectsToLogin = /\b(replace|redirect|push|navigate)\b[\s;:"',]*\/?[a-z0-9/_-]*(sign-?in|log-?in|auth)/i.test(body);
+  if (isRscFlight && redirectsToLogin)
+    return true;
+  const normalizedLogin = loginPath.replace(/^\/+/, "").toLowerCase();
+  if (normalizedLogin && new RegExp(`\\b(replace|redirect|push|navigate)\\b[\\s;:"',]*\\/?${normalizedLogin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`, "i").test(body)) {
+    return true;
+  }
+  return false;
+}
+async function fetchBaseline(opts) {
+  const res = await opts.httpGet(opts.protectedPath);
+  const gated = isRedirect(res.status) || looksLikeLogin(res, opts.loginPath);
+  return { res, gated };
+}
+function isBypass(baseline, crafted, loginPath) {
+  if (!baseline.gated)
+    return false;
+  if (crafted.status !== 200)
+    return false;
+  if (looksLikeLogin(crafted, loginPath))
+    return false;
+  return true;
+}
+var CVE_29927 = "CVE-2025-29927";
+var CVE_29927_TITLE = "Next.js middleware auth bypass via x-middleware-subrequest header";
+var CVE_29927_PAYLOADS = [
+  "middleware",
+  "src/middleware",
+  "middleware:middleware:middleware:middleware:middleware"
+];
+async function checkCve29927(opts) {
+  const applicable = isAffectedBy29927(opts.version);
+  const base = {
+    cve: CVE_29927,
+    title: CVE_29927_TITLE,
+    applicableToVersion: applicable,
+    severityIfExploitable: "critical"
+  };
+  if (!applicable) {
+    return {
+      ...base,
+      tested: false,
+      exploitable: false,
+      evidence: `Next.js ${opts.version} is outside the affected range for ${CVE_29927} (fixed in 15.2.3 / 14.2.25 / 13.5.9 / 12.3.5). Version-gap note only; not tested.`
+    };
+  }
+  const baseline = await fetchBaseline(opts);
+  if (!baseline.gated) {
+    return {
+      ...base,
+      tested: true,
+      exploitable: false,
+      evidence: `Baseline ${opts.protectedPath} returned status ${baseline.res.status} without the crafted header and did not redirect to ${opts.loginPath} or render a login page \u2014 the route is not auth-gated, so a middleware-skip bypass cannot be proven here. Reporting not-exploitable (conservative).`
+    };
+  }
+  const observations = [];
+  observations.push(`baseline ${opts.protectedPath} => ${baseline.res.status} (gated; redirects/login).`);
+  for (const payload of CVE_29927_PAYLOADS) {
+    const crafted = await opts.httpGet(opts.protectedPath, {
+      "x-middleware-subrequest": payload
+    });
+    const bypassed = isBypass(baseline, crafted, opts.loginPath);
+    observations.push(`x-middleware-subrequest: "${payload}" => ${crafted.status}` + (bypassed ? " (PROTECTED CONTENT RETURNED \u2014 bypass)" : " (still gated)"));
+    if (bypassed) {
+      return {
+        ...base,
+        tested: true,
+        exploitable: true,
+        evidence: `${CVE_29927} confirmed: with header x-middleware-subrequest="${payload}", ${opts.protectedPath} returned 200 protected content where the baseline redirected to login. Target=${opts.baseUrl}.
+` + observations.join("\n")
+      };
+    }
+  }
+  return {
+    ...base,
+    tested: true,
+    exploitable: false,
+    evidence: `All ${CVE_29927_PAYLOADS.length} x-middleware-subrequest payloads still hit the login gate (baseline behavior preserved) \u2014 middleware not skipped, likely patched or mitigated (e.g. Vercel edge mitigation). Reporting not-exploitable.
+` + observations.join("\n")
+  };
+}
+var RSC_BYPASS_ID = "NEXT-RSC-PREFETCH-BYPASS-2026-05";
+var RSC_BYPASS_TITLE = "Next.js middleware auth bypass via .rsc / RSC segment-prefetch requests";
+function rscVariants(protectedPath) {
+  const trimmed = protectedPath.replace(/\/+$/, "") || "/";
+  const rscPath = trimmed === "/" ? "/index.rsc" : `${trimmed}.rsc`;
+  return [
+    { label: "<route>.rsc", path: rscPath },
+    { label: "RSC: 1 header", path: protectedPath, headers: { RSC: "1" } },
+    {
+      label: "Next-Router-Segment-Prefetch header",
+      path: protectedPath,
+      headers: { "Next-Router-Segment-Prefetch": "/_index" }
+    }
+  ];
+}
+async function checkRscBypass(opts) {
+  const applicable = isAffectedByRscBypass(opts.version);
+  const base = {
+    cve: RSC_BYPASS_ID,
+    title: RSC_BYPASS_TITLE,
+    applicableToVersion: applicable,
+    severityIfExploitable: "high"
+  };
+  if (!applicable) {
+    return {
+      ...base,
+      tested: false,
+      exploitable: false,
+      evidence: `Next.js ${opts.version} is outside the affected window for the RSC / segment-prefetch middleware bypass (13.4.0 <= affected < 15.3.0). Version-gap note only; not tested.`
+    };
+  }
+  const baseline = await fetchBaseline(opts);
+  if (!baseline.gated) {
+    return {
+      ...base,
+      tested: true,
+      exploitable: false,
+      evidence: `Baseline ${opts.protectedPath} returned status ${baseline.res.status} and is not auth-gated (no redirect to ${opts.loginPath}, no login page) \u2014 cannot prove an RSC bypass against an ungated route. Reporting not-exploitable (conservative).`
+    };
+  }
+  const observations = [];
+  observations.push(`baseline ${opts.protectedPath} => ${baseline.res.status} (gated; redirects/login).`);
+  for (const v of rscVariants(opts.protectedPath)) {
+    const crafted = await opts.httpGet(v.path, v.headers);
+    const bypassed = isBypass(baseline, crafted, opts.loginPath);
+    observations.push(`${v.label} (${v.path}) => ${crafted.status}` + (bypassed ? " (PROTECTED CONTENT RETURNED \u2014 bypass)" : " (still gated)"));
+    if (bypassed) {
+      return {
+        ...base,
+        tested: true,
+        exploitable: true,
+        evidence: `${RSC_BYPASS_ID} confirmed: ${v.label} returned 200 protected content where the baseline redirected to login. Target=${opts.baseUrl}.
+` + observations.join("\n")
+      };
+    }
+  }
+  return {
+    ...base,
+    tested: true,
+    exploitable: false,
+    evidence: `All RSC / segment-prefetch variants still hit the login gate (baseline behavior preserved) \u2014 middleware re-runs for RSC payloads here. Reporting not-exploitable.
+` + observations.join("\n")
+  };
+}
+var DJANGO_DEBUG_ID = "DJANGO-DEBUG-TRUE-INFO-DISCLOSURE";
+var DJANGO_DEBUG_TITLE = "Django DEBUG=True exposes traceback / settings on error pages";
+var DJANGO_DEBUG_PROBE_PATH = "/0sec-debug-probe-0nonexistent-9z/?__0sec_debug_check__=1";
+var DJANGO_DEBUG_PROOF_RE = /You'?re seeing this error because you have\s+DEBUG\s*=\s*True/i;
+var DJANGO_DEBUG_CORROBORATING_RES = [
+  /Django Version/i,
+  /\bTraceback\b/i,
+  /Request Method:/i,
+  /Exception Type:/i
+];
+async function checkDjangoDebug(opts) {
+  const base = {
+    cve: DJANGO_DEBUG_ID,
+    title: DJANGO_DEBUG_TITLE,
+    // DEBUG is config, not a patched version range — applicable to any Django.
+    applicableToVersion: true,
+    severityIfExploitable: "medium"
+  };
+  const res = await opts.httpGet(DJANGO_DEBUG_PROBE_PATH);
+  const body = res.body ?? "";
+  const hasProof = DJANGO_DEBUG_PROOF_RE.test(body);
+  const corroborating = DJANGO_DEBUG_CORROBORATING_RES.filter((re) => re.test(body)).length;
+  if (hasProof) {
+    return {
+      ...base,
+      tested: true,
+      exploitable: true,
+      evidence: `${DJANGO_DEBUG_ID} confirmed: GET ${DJANGO_DEBUG_PROBE_PATH} returned status ${res.status} carrying Django's DEBUG=True technical error page ("You're seeing this error because you have DEBUG = True"), with ${corroborating}/${DJANGO_DEBUG_CORROBORATING_RES.length} corroborating signatures (traceback / Django version / request metadata). This leaks settings, installed apps and stack traces. Target=${opts.baseUrl}, Django ${opts.version || "version unknown"}.`
+    };
+  }
+  return {
+    ...base,
+    tested: true,
+    exploitable: false,
+    evidence: `GET ${DJANGO_DEBUG_PROBE_PATH} returned status ${res.status} but the body did not contain the "DEBUG = True" banner (${corroborating}/${DJANGO_DEBUG_CORROBORATING_RES.length} corroborating signatures, proof banner absent) \u2014 DEBUG is off or the response is a generic error page. Reporting not-exploitable (conservative).`
+  };
+}
+var RAILS_INFO_ID = "RAILS-DEV-INFO-ENDPOINTS-EXPOSED";
+var RAILS_INFO_TITLE = "Rails dev-only /rails/info endpoints publicly reachable (config leak)";
+var RAILS_INFO_PROBES = [
+  {
+    label: "/rails/info/properties",
+    path: "/rails/info/properties",
+    signatures: [/Rails version/i, /Ruby version/i, /Middleware/i]
+  },
+  {
+    label: "/rails/info/routes",
+    path: "/rails/info/routes",
+    signatures: [/Helper/i, /HTTP Verb/i, /Path\s*\/?\s*Url/i, /Controller#Action/i]
+  }
+];
+async function checkRailsInfoEndpoints(opts) {
+  const base = {
+    cve: RAILS_INFO_ID,
+    title: RAILS_INFO_TITLE,
+    // Dev-mode-in-prod is config, not a patched version range — any Rails.
+    applicableToVersion: true,
+    severityIfExploitable: "medium"
+  };
+  const observations = [];
+  for (const probe of RAILS_INFO_PROBES) {
+    const res = await opts.httpGet(probe.path);
+    const body = res.body ?? "";
+    const matched = probe.signatures.filter((re) => re.test(body)).length;
+    const exposed = res.status === 200 && matched >= 2;
+    observations.push(`${probe.label} => ${res.status} (${matched}/${probe.signatures.length} Rails-internals signatures)` + (exposed ? " (RAILS INTERNALS EXPOSED)" : ""));
+    if (exposed) {
+      return {
+        ...base,
+        tested: true,
+        exploitable: true,
+        evidence: `${RAILS_INFO_ID} confirmed: GET ${probe.label} returned 200 with ${matched}/${probe.signatures.length} Rails-internals signatures \u2014 this dev-only endpoint is publicly reachable, leaking Rails/Ruby versions, middleware and routes (app is serving development mode). Target=${opts.baseUrl}, Rails ${opts.version || "version unknown"}.
+` + observations.join("\n")
+      };
+    }
+  }
+  return {
+    ...base,
+    tested: true,
+    exploitable: false,
+    evidence: `Neither Rails dev-info endpoint returned 200 with Rails internals \u2014 the dev-only routes are gated (production mode or 403/404). Reporting not-exploitable (conservative).
+` + observations.join("\n")
+  };
+}
+var FRAMEWORK_REGISTRY = [
+  {
+    name: "next",
+    matches: isNext,
+    checks: [checkCve29927, checkRscBypass]
+  },
+  {
+    name: "django",
+    matches: isDjango,
+    checks: [checkDjangoDebug]
+  },
+  {
+    name: "rails",
+    matches: isRails,
+    checks: [checkRailsInfoEndpoints]
+  }
+];
+async function runFrameworkCveChecks(opts) {
+  const entry = FRAMEWORK_REGISTRY.find((e) => e.matches(opts.framework));
+  if (!entry) {
+    return [];
+  }
+  const results = [];
+  for (const check of entry.checks) {
+    results.push(await check(opts));
+  }
+  return results;
+}
+
+// packages/core/dist/stages/web-recon-prepass.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+async function runWebReconPrePass(config, options = {}) {
+  const findings = [];
+  const leads = [];
+  let fingerprint;
+  let subdomains = [];
+  const target = config.target;
+  const timeout = config.timeout ?? DEFAULT_TIMEOUT_MS;
+  const base = target.replace(/\/+$/, "");
+  const targetHost = safeHost(target);
+  const domain = registrableDomain(target);
+  const limiter = options.rateLimiter;
+  const resetBurstProbeAllowed = options.posture?.resetBurstProbe ?? true;
+  const fetchResponse = async (url) => {
+    if (!isInScopeUrl(url, targetHost, domain)) {
+      return { status: 0, headers: {}, body: "" };
+    }
+    if (limiter)
+      await limiter.acquire(url);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    try {
+      const res = await fetch(url, {
+        method: "GET",
+        headers: { Accept: "*/*" },
+        redirect: "manual",
+        signal: controller.signal
+      });
+      limiter?.noteResponse(url, res);
+      const body = await res.text();
+      const headers = {};
+      res.headers.forEach((value, key) => {
+        headers[key.toLowerCase()] = value;
+      });
+      return { status: res.status, headers, body };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const fetchText = async (url) => {
+    const r = await fetchResponse(url);
+    return { status: r.status, headers: r.headers, body: r.body };
+  };
+  let baseline;
+  try {
+    const ctx = buildScanContext(config);
+    const result = await runBaselineWebChecks(ctx);
+    findings.push(...result.findings);
+  } catch {
+  }
+  try {
+    baseline = await fetchResponse(base);
+  } catch {
+    baseline = void 0;
+  }
+  try {
+    fingerprint = await fingerprintWebStack({ baseUrl: base, fetchText });
+  } catch {
+    fingerprint = void 0;
+  }
+  const chunkUrls = baseline?.body ? enumerateJsChunkUrls(baseline.body, base) : [];
+  const onVercel = detectVercelHosting(baseline?.headers);
+  const activeByCveId = /* @__PURE__ */ new Map();
+  if (fingerprint?.framework && isNextFramework(fingerprint.framework.name) && fingerprint.framework.version && baseline) {
+    const redirect = deriveProtectedAndLogin(base, baseline);
+    if (redirect) {
+      try {
+        const httpGet = async (path, headers) => {
+          const url = new URL(path, `${base}/`).toString();
+          if (!isInScopeUrl(url, targetHost, domain)) {
+            return { status: 0, headers: {}, body: "" };
+          }
+          if (limiter)
+            await limiter.acquire(url);
+          const controller = new AbortController();
+          const timer = setTimeout(() => controller.abort(), timeout);
+          try {
+            const res = await fetch(url, {
+              method: "GET",
+              headers: { Accept: "*/*", ...headers ?? {} },
+              redirect: "manual",
+              signal: controller.signal
+            });
+            limiter?.noteResponse(url, res);
+            const body = await res.text();
+            const h = {};
+            res.headers.forEach((value, key) => {
+              h[key.toLowerCase()] = value;
+            });
+            return { status: res.status, headers: h, body };
+          } finally {
+            clearTimeout(timer);
+          }
+        };
+        const results = await runFrameworkCveChecks({
+          framework: fingerprint.framework.name,
+          version: fingerprint.framework.version,
+          baseUrl: base,
+          protectedPath: redirect.protectedPath,
+          loginPath: redirect.loginPath,
+          httpGet
+        });
+        for (const r of results) {
+          activeByCveId.set(r.cve, r);
+          if (!r.exploitable)
+            continue;
+          findings.push(createFinding({
+            templateId: "web-recon-framework-cve",
+            title: `${r.title} (${r.cve})`,
+            description: `Active check confirmed ${r.cve} is exploitable on the target.`,
+            severity: r.severityIfExploitable,
+            category: "security-misconfiguration",
+            request: `GET ${redirect.protectedPath} (crafted ${r.cve} check)`,
+            response: r.evidence,
+            analysis: r.evidence
+          }));
+        }
+      } catch {
+      }
+    } else {
+      leads.push(`Framework is ${fingerprint.framework.name}${fingerprint.framework.version ? ` v${fingerprint.framework.version}` : ""}; could not auto-derive an auth-gated route \u2014 manually identify a protected path and test known middleware-bypass CVEs.`);
+    }
+  }
+  if (fingerprint) {
+    const versioned = [];
+    if (fingerprint.framework?.version) {
+      versioned.push({
+        name: npmPackageName(fingerprint.framework.name),
+        version: fingerprint.framework.version
+      });
+    }
+    for (const lib of fingerprint.libraries) {
+      if (lib.version)
+        versioned.push({ name: lib.name, version: lib.version });
+    }
+    for (const { name, version } of versioned) {
+      let cves = [];
+      try {
+        cves = await lookupVersionCves({ ecosystem: "npm", name, version });
+      } catch {
+        continue;
+      }
+      const consolidated = buildConsolidatedCveFinding({
+        name,
+        version,
+        base,
+        cves,
+        activeByCveId,
+        onVercel
+      });
+      if (consolidated)
+        findings.push(consolidated);
+    }
+  }
+  if (chunkUrls.length > 0) {
+    try {
+      const artifacts = await scanJsArtifacts({ baseUrl: base, chunkUrls, fetchText });
+      for (const sm of artifacts.sourceMaps) {
+        if (!sm.exposed)
+          continue;
+        findings.push(createFinding({
+          templateId: "web-recon-source-map",
+          title: "Exposed JavaScript source map",
+          description: "A production JavaScript bundle ships a source map that is served publicly, leaking original (pre-minification) source.",
+          severity: "medium",
+          category: "information-disclosure",
+          request: `GET ${sm.url}`,
+          response: "HTTP 200 (source map served)",
+          analysis: `The source map at ${sm.url} is publicly reachable and discloses original source code.`
+        }));
+      }
+      for (const secret of artifacts.secrets) {
+        if (secret.confidence !== "high")
+          continue;
+        findings.push(createFinding({
+          templateId: "web-recon-leaked-secret",
+          title: `Leaked credential in JS bundle (${secret.kind})`,
+          description: `A high-confidence ${secret.kind} credential was found in a client-side JavaScript bundle.`,
+          severity: "high",
+          category: "information-disclosure",
+          request: `GET ${secret.chunk}`,
+          response: `Matched ${secret.kind}: ${secret.match}`,
+          analysis: `A ${secret.kind} value (${secret.match}) was found in ${secret.chunk}. A genuine credential shipped to the browser should be treated as compromised and rotated.`
+        }));
+      }
+    } catch {
+    }
+  }
+  if (domain) {
+    try {
+      const posture = await checkEmailPosture({ domain });
+      for (const f of posture.findings) {
+        findings.push(createFinding({
+          templateId: "web-recon-email-posture",
+          title: f.title,
+          description: f.detail,
+          severity: f.severity,
+          category: "security-misconfiguration",
+          request: `DNS TXT lookup for ${domain}`,
+          response: f.detail,
+          analysis: `Email anti-spoofing posture for ${domain}: ${f.title}.`
+        }));
+      }
+    } catch {
+    }
+  }
+  if (domain) {
+    try {
+      subdomains = await enumerateSubdomains({ domain });
+      for (const host of subdomains) {
+        if (host.host === targetHost)
+          continue;
+        findings.push(createFinding({
+          templateId: "web-recon-subdomain",
+          title: `Additional exposed host: ${host.host}`,
+          description: `A subdomain of ${domain} resolves in DNS and may expand the attack surface.`,
+          severity: "info",
+          category: "information-disclosure",
+          request: `crt.sh + DNS resolution for ${host.host}`,
+          response: `host=${host.host}` + (host.addresses?.length ? `, addresses=${host.addresses.join(", ")}` : "") + (host.cname ? `, cname=${host.cname}` : ""),
+          analysis: `Discovered via ${host.source}. Additional exposed host worth including in the engagement scope.`
+        }));
+      }
+    } catch {
+      subdomains = [];
+    }
+  }
+  const resetEndpoint = baseline?.body ? findPasswordResetEndpoint(base, baseline.body) : void 0;
+  if (resetBurstProbeAllowed && resetEndpoint && isInScopeUrl(resetEndpoint, targetHost, domain)) {
+    try {
+      const invalidEmail = `0sec-noreply-${randomUUID().slice(0, 8)}@invalid.example`;
+      const probe = await probeRateLimit({
+        request: async () => {
+          if (limiter)
+            await limiter.acquire(resetEndpoint);
+          const controller = new AbortController();
+          const timer = setTimeout(() => controller.abort(), timeout);
+          try {
+            const res = await fetch(resetEndpoint, {
+              method: "POST",
+              headers: { "content-type": "application/json", Accept: "*/*" },
+              body: JSON.stringify({ email: invalidEmail }),
+              redirect: "manual",
+              signal: controller.signal
+            });
+            return { status: res.status };
+          } finally {
+            clearTimeout(timer);
+          }
+        }
+      });
+      if (!probe.throttled) {
+        findings.push(createFinding({
+          templateId: "web-recon-rate-limit",
+          title: "Password-reset endpoint lacks rate limiting",
+          description: "A small bounded burst of password-reset requests (with a clearly-invalid, non-existent email) saw no throttling \u2014 no HTTP 429 and no status change.",
+          severity: "medium",
+          category: "security-misconfiguration",
+          request: `POST ${resetEndpoint} x${probe.sent} (invalid email ${invalidEmail})`,
+          response: probe.note,
+          analysis: `${probe.note}. Missing anti-automation controls on a sensitive endpoint enable account enumeration and abuse.`
+        }));
+      }
+    } catch {
+    }
+  } else if (!resetBurstProbeAllowed) {
+    leads.push("Anti-automation testing on sensitive endpoints (password-reset / OTP) is DISABLED for this engagement by the hardening profile \u2014 do not send request bursts. Report missing rate limiting as a manual test item for the client instead.");
+  } else {
+    leads.push("If you find a password-reset or OTP endpoint, test rate limiting with a safe, clearly-invalid email (e.g. a non-existent @invalid.example address) \u2014 no real mail should be triggered.");
+  }
+  const promptBlock = buildPromptBlock(fingerprint, findings, subdomains, leads);
+  return { findings, promptBlock };
+}
+function buildPromptBlock(fingerprint, findings, subdomains, leads) {
+  const lines = [];
+  lines.push("## Deterministic web recon (pursue these leads)");
+  lines.push("");
+  lines.push("A deterministic pre-pass already ran cheap, non-destructive probes against this target. Use the results below as priority leads. Findings it could prove are already saved \u2014 do not re-discover them; build on them.");
+  lines.push("");
+  if (fingerprint) {
+    lines.push("### Detected stack");
+    lines.push(summarizeWebStackFingerprint(fingerprint));
+    lines.push("");
+  }
+  const cveFindings = findings.filter((f) => f.templateId === "web-recon-version-cve" || f.templateId === "web-recon-framework-cve");
+  if (cveFindings.length > 0) {
+    lines.push(`### CVEs already surfaced (${cveFindings.length})`);
+    for (const f of cveFindings) {
+      lines.push(`- ${f.title}`);
+    }
+    lines.push("");
+  }
+  if (subdomains.length > 0) {
+    lines.push(`### Additional exposed hosts (${subdomains.length})`);
+    for (const host of subdomains.slice(0, 20)) {
+      lines.push(`- ${host.host}${host.cname ? ` (cname ${host.cname})` : ""}`);
+    }
+    lines.push("");
+  }
+  if (leads.length > 0) {
+    lines.push("### Unconfirmed leads to chase");
+    for (const lead of leads) {
+      lines.push(`- ${lead}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function buildScanContext(config) {
+  return {
+    config,
+    target: { url: config.target, type: "web-app" },
+    findings: [],
+    attacks: [],
+    warnings: [],
+    startedAt: Date.now()
+  };
+}
+function mapCveSeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "critical";
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    default:
+      return "info";
+  }
+}
+var SEVERITY_RANK = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  low: 1,
+  info: 0
+};
+var VERCEL_EDGE_MITIGATED_CVES = /* @__PURE__ */ new Set([
+  "CVE-2025-29927"
+]);
+function reconcileActiveResult(cve, activeByCveId) {
+  const direct = activeByCveId.get(cve.id);
+  if (direct)
+    return direct;
+  if (/\brsc\b|segment[\s-]?prefetch/i.test(`${cve.id} ${cve.summary}`)) {
+    return activeByCveId.get("NEXT-RSC-PREFETCH-BYPASS-2026-05");
+  }
+  return void 0;
+}
+function highestFixedVersion(versions) {
+  const cmp = (a, b) => {
+    const pa = a.replace(/^v/i, "").split(/[-+]/, 1)[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+    const pb = b.replace(/^v/i, "").split(/[-+]/, 1)[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+      if (d !== 0)
+        return d;
+    }
+    return 0;
+  };
+  let best;
+  for (const v of versions) {
+    if (!v)
+      continue;
+    if (!best || cmp(v, best) > 0)
+      best = v;
+  }
+  return best;
+}
+function buildConsolidatedCveFinding(input) {
+  const { name, version, base, cves, activeByCveId, onVercel } = input;
+  const relevant = cves.filter((c) => {
+    const sev = mapCveSeverity(c.severity);
+    return sev === "high" || sev === "critical";
+  });
+  if (relevant.length === 0)
+    return void 0;
+  const annotated = relevant.map((cve) => {
+    const sev = mapCveSeverity(cve.severity);
+    const active = reconcileActiveResult(cve, activeByCveId);
+    const confirmed = active?.tested === true && active.exploitable === true;
+    const testedNotExploitable = active?.tested === true && active.exploitable === false;
+    const vercelMitigated = onVercel && VERCEL_EDGE_MITIGATED_CVES.has(cve.id);
+    const countsTowardSeverity = confirmed || !testedNotExploitable && !vercelMitigated;
+    let note;
+    if (confirmed)
+      note = "active check: CONFIRMED exploitable";
+    else if (testedNotExploitable)
+      note = "active check: NOT exploitable on this deployment";
+    else if (vercelMitigated)
+      note = "auto-mitigated at the Vercel edge";
+    return {
+      cve,
+      sev,
+      confirmed,
+      testedNotExploitable,
+      vercelMitigated,
+      countsTowardSeverity,
+      note
+    };
+  });
+  const counting = annotated.filter((a) => a.countsTowardSeverity);
+  const rollupSeverity = counting.length ? counting.reduce((max, a) => SEVERITY_RANK[a.sev] > SEVERITY_RANK[max] ? a.sev : max, "info") : "medium";
+  const fixedTarget = highestFixedVersion(relevant.map((c) => c.fixedVersion).filter((v) => !!v));
+  const confirmedCount = annotated.filter((a) => a.confirmed).length;
+  const mitigatedCount = annotated.filter((a) => a.testedNotExploitable || a.vercelMitigated).length;
+  const cveLines = annotated.map((a) => {
+    const fixed = a.cve.fixedVersion ? ` fixed in ${a.cve.fixedVersion}` : " no fixed version published";
+    const annotation = a.note ? ` \u2014 ${a.note}` : "";
+    return `- ${a.cve.id} (${a.sev}, ${a.cve.source}):${fixed}${annotation}`;
+  }).join("\n");
+  const remediation = fixedTarget ? `Upgrade ${name} to >= ${fixedTarget} to clear all listed advisories.` : `Upgrade ${name} to the latest patched release.`;
+  const vercelNote = onVercel ? `
+
+Platform note: target appears to be hosted on Vercel. Several Next.js advisories \u2014 the x-middleware-subrequest middleware bypass (CVE-2025-29927) and the middleware-bypass / DoS classes \u2014 are auto-mitigated at the Vercel edge and are down-ranked here accordingly.` : "";
+  const activeNote = confirmedCount > 0 || mitigatedCount > 0 ? `
+
+Active checks reconciled: ${confirmedCount} confirmed exploitable, ${mitigatedCount} tested/known-mitigated (excluded from the rollup severity).` : "";
+  const description = `${name}@${version} is VERSION-AFFECTED by ${relevant.length} published HIGH/CRITICAL advisor${relevant.length === 1 ? "y" : "ies"}. This is an SCA (software-composition) signal: the detected version falls in each advisory's affected range, but exploitability against this deployment is NOT confirmed unless an advisory is annotated CONFIRMED below.`;
+  const analysis = `Consolidated SCA finding for ${name}@${version} (${relevant.length} advisories).
+
+${cveLines}` + vercelNote + activeNote + `
+
+Remediation: ${remediation}`;
+  return createFinding({
+    templateId: "web-recon-version-cve",
+    title: `Known-vulnerable dependency: ${name}@${version} (${relevant.length} published advisor${relevant.length === 1 ? "y" : "ies"})`,
+    description,
+    severity: rollupSeverity,
+    category: "known-vulnerable-package",
+    request: `GET ${base} (stack fingerprint: ${name}@${version})`,
+    response: `${relevant.length} advisories affect ${name}@${version}: ${relevant.map((c) => c.id).join(", ")}`,
+    analysis
+  });
+}
+function detectVercelHosting(headers) {
+  if (!headers)
+    return false;
+  if (typeof headers["x-vercel-id"] === "string" && headers["x-vercel-id"])
+    return true;
+  const server = headers["server"];
+  if (typeof server === "string" && /vercel/i.test(server))
+    return true;
+  return false;
+}
+function npmPackageName(frameworkName) {
+  const map = {
+    "next.js": "next",
+    nuxt: "nuxt",
+    remix: "@remix-run/server-runtime",
+    sveltekit: "@sveltejs/kit",
+    gatsby: "gatsby",
+    astro: "astro",
+    react: "react",
+    vue: "vue",
+    express: "express"
+  };
+  return map[frameworkName.toLowerCase()] ?? frameworkName.toLowerCase();
+}
+function isNextFramework(name) {
+  return /^next(\.?js)?$/i.test(name.trim());
+}
+function safeHost(target) {
+  try {
+    return new URL(target).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function registrableDomain(target) {
+  const host = safeHost(target);
+  if (!host)
+    return void 0;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":"))
+    return void 0;
+  const stripped = host.replace(/^www\./, "");
+  const labels = stripped.split(".");
+  if (labels.length <= 2)
+    return stripped;
+  return labels.slice(-2).join(".");
+}
+function isPrivateHost(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (h === "localhost" || h.endsWith(".localhost") || h === "0.0.0.0")
+    return true;
+  const v4 = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const a = Number(v4[1]);
+    const b = Number(v4[2]);
+    if (a === 0 || a === 10 || a === 127)
+      return true;
+    if (a === 169 && b === 254)
+      return true;
+    if (a === 172 && b >= 16 && b <= 31)
+      return true;
+    if (a === 192 && b === 168)
+      return true;
+    if (a === 100 && b >= 64 && b <= 127)
+      return true;
+    return false;
+  }
+  if (h.includes(":")) {
+    if (h === "::1" || /^f[cd][0-9a-f]{2}:/.test(h) || /^fe80:/.test(h))
+      return true;
+  }
+  return false;
+}
+function isInScopeUrl(rawUrl, targetHost, domain) {
+  let u;
+  try {
+    u = new URL(rawUrl);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:")
+    return false;
+  const host = u.hostname.toLowerCase();
+  if (isPrivateHost(host))
+    return false;
+  if (targetHost && host === targetHost.toLowerCase())
+    return true;
+  if (domain && (host === domain || host.endsWith("." + domain)))
+    return true;
+  return false;
+}
+function deriveProtectedAndLogin(base, baseline) {
+  if (baseline.status < 300 || baseline.status >= 400)
+    return void 0;
+  const location = baseline.headers["location"];
+  if (!location)
+    return void 0;
+  let loginPath;
+  try {
+    loginPath = new URL(location, `${base}/`).pathname;
+  } catch {
+    loginPath = location;
+  }
+  if (!/login|signin|sign-in|auth/i.test(loginPath))
+    return void 0;
+  return { protectedPath: "/", loginPath };
+}
+function findPasswordResetEndpoint(base, html) {
+  const refs = [...html.matchAll(/(?:href|action)=["']([^"']+)["']/gi)].map((m) => m[1]);
+  const match = refs.find((r) => /(forgot|reset).*(password|pwd)|password.*(reset|forgot)|reset-password|forgot-password/i.test(r));
+  if (!match)
+    return void 0;
+  try {
+    return new URL(match, `${base}/`).toString();
+  } catch {
+    return void 0;
+  }
+}
+function createFinding(input) {
+  return {
+    id: randomUUID(),
+    templateId: input.templateId,
+    title: input.title,
+    description: input.description,
+    severity: input.severity,
+    category: input.category,
+    status: "discovered",
+    evidence: {
+      request: input.request,
+      response: input.response,
+      analysis: input.analysis
+    },
+    timestamp: Date.now()
+  };
+}
+export {
+  isInScopeUrl,
+  runWebReconPrePass
+};