0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-UJE4WOQS.js → chunk-6GV5G6U3.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-X2ZMSRTP.js → chunk-6SNOKNCS.js}

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  scanExecutionSignal
+} from "./chunk-SSPP64FF.js";
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/scope/waf-detect.js
 function readHeader(headers, name) {
@@ -2584,9 +2587,332 @@ function warnRejectedSources(sources, results, context) {
   }
 }
 
+// packages/core/dist/scope/rate-limit.js
+var TokenBucket = class {
+  state;
+  nowFn;
+  sleepFn;
+  jitter;
+  constructor(rps, capacity = rps, nowFn = () => Date.now(), sleepFn = defaultSleep2, jitter) {
+    if (!Number.isFinite(rps) || rps <= 0) {
+      throw new Error(`TokenBucket: rps must be a positive finite number, got ${rps}`);
+    }
+    if (!Number.isFinite(capacity) || capacity <= 0) {
+      throw new Error(`TokenBucket: capacity must be a positive finite number, got ${capacity}`);
+    }
+    this.nowFn = nowFn;
+    this.sleepFn = sleepFn;
+    this.jitter = jitter && jitter.baseMs > 0 ? jitter : void 0;
+    this.state = {
+      tokens: capacity,
+      refillRatePerMs: rps / 1e3,
+      capacity,
+      lastRefill: nowFn(),
+      retryUntil: 0
+    };
+  }
+  refill() {
+    const now = this.nowFn();
+    const elapsed = now - this.state.lastRefill;
+    if (elapsed > 0) {
+      this.state.tokens = Math.min(this.state.capacity, this.state.tokens + elapsed * this.state.refillRatePerMs);
+      this.state.lastRefill = now;
+    }
+  }
+  /**
+   * Non-blocking. Returns true and consumes `n` tokens if available;
+   * returns false and consumes nothing otherwise. Blocked during 429
+   * cool-off (returns false until park expires).
+   */
+  tryConsume(n = 1) {
+    if (this.nowFn() < this.state.retryUntil)
+      return false;
+    this.refill();
+    if (this.state.tokens >= n) {
+      this.state.tokens -= n;
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Block until `n` tokens are available, then consume them. Honours
+   * the 429 park deadline first, then refill-and-spin with sleeps
+   * sized to the exact next-token-available time.
+   */
+  async acquire(n = 1, signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
+    if (n > this.state.capacity) {
+      n = this.state.capacity;
+    }
+    while (this.nowFn() < this.state.retryUntil) {
+      const wait = this.state.retryUntil - this.nowFn();
+      await this.sleepFn(Math.max(1, Math.min(wait, 1e3)), signal);
+    }
+    while (true) {
+      signal?.throwIfAborted();
+      this.refill();
+      if (this.state.tokens >= n) {
+        this.state.tokens -= n;
+        await this.pace(signal);
+        return;
+      }
+      const tokensNeeded = n - this.state.tokens;
+      const waitMs = Math.max(1, Math.ceil(tokensNeeded / this.state.refillRatePerMs));
+      await this.sleepFn(waitMs, signal);
+    }
+  }
+  /**
+   * Sleep the configured full-jitter delay. No-op (and no `await`-visible
+   * sleep) when no jitter is configured, so the default path is unchanged.
+   *
+   * Reuses `jitterFor` from `waf-detect.ts` — attempt 0 with an injected rng
+   * yields full jitter in `[0, baseMs]` — rather than growing a second
+   * jitter implementation.
+   */
+  async pace(signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
+    if (!this.jitter)
+      return;
+    const ms = jitterFor(0, this.jitter.baseMs, this.jitter.rng ?? Math.random);
+    if (ms > 0)
+      await this.sleepFn(ms, signal);
+  }
+  /**
+   * Park the bucket until `deadline` (ms since epoch). Subsequent
+   * `acquire`/`tryConsume` calls block until the deadline passes.
+   * Idempotent in the "later wins" sense: a longer park overrides a
+   * shorter one, but a shorter park does NOT shorten an existing one.
+   */
+  markRetryUntil(deadline) {
+    if (deadline > this.state.retryUntil) {
+      this.state.retryUntil = deadline;
+    }
+  }
+  /** Test introspection. */
+  _peek() {
+    this.refill();
+    return {
+      tokens: this.state.tokens,
+      retryUntil: this.state.retryUntil,
+      capacity: this.state.capacity
+    };
+  }
+};
+var RateLimiter = class _RateLimiter {
+  buckets = /* @__PURE__ */ new Map();
+  defaultCfg;
+  perHost;
+  jitter;
+  nowFn;
+  sleepFn;
+  /**
+   * Conservative cool-off floor when a 429 lands without a useful
+   * `Retry-After`, or with a tiny one. 60s matches the PoC-runtime
+   * precedent in #206 — a target that just told us to slow down has
+   * earned more than a one-second pause.
+   */
+  static RETRY_AFTER_FLOOR_MS = 6e4;
+  /**
+   * Optional observer invoked once whenever a fetch is actually throttled:
+   * either an `acquire` that had to block because the bucket was dry, or a
+   * 429 response parking the host. Used by the http_audit enforcement
+   * tracker to populate `rate_limited_count`. No-op when unset, so the
+   * normal scan path is unaffected.
+   */
+  onThrottle;
+  constructor(config, opts = {}) {
+    this.defaultCfg = config.default;
+    this.jitter = config.jitter;
+    this.perHost = {};
+    if (config.perHost) {
+      for (const [host, cfg] of Object.entries(config.perHost)) {
+        this.perHost[host.toLowerCase()] = cfg;
+      }
+    }
+    this.nowFn = opts.nowFn ?? (() => Date.now());
+    this.sleepFn = opts.sleepFn ?? defaultSleep2;
+    this.onThrottle = opts.onThrottle;
+  }
+  /**
+   * Normalize a URL or host string to a bucket key. Lowercased,
+   * port-stripped, IPv6 brackets retained on the literal but dropped
+   * from the port suffix (e.g. `[::1]:443` → `[::1]`).
+   */
+  hostKey(urlOrHost) {
+    let host;
+    try {
+      host = new URL(urlOrHost).hostname;
+    } catch {
+      const trimmed = urlOrHost.trim();
+      if (!trimmed)
+        return null;
+      if (trimmed.startsWith("[")) {
+        const close = trimmed.indexOf("]");
+        if (close < 0)
+          return null;
+        host = trimmed.slice(0, close + 1);
+      } else {
+        host = trimmed.split(":")[0];
+      }
+    }
+    return host.toLowerCase();
+  }
+  getBucket(host) {
+    let bucket = this.buckets.get(host);
+    if (!bucket) {
+      const cfg = this.perHost[host] ?? this.defaultCfg;
+      bucket = new TokenBucket(cfg.rps, cfg.burst ?? cfg.rps, this.nowFn, this.sleepFn, this.jitter);
+      this.buckets.set(host, bucket);
+    }
+    return bucket;
+  }
+  /**
+   * Block until a token is available for `urlOrHost`'s host, then
+   * consume it. Unparseable input is treated as a no-op (returns
+   * immediately) — callers should not rely on rate-limiting unknowable
+   * hosts. The fetch sites that wire this up always pass full URLs.
+   */
+  async acquire(urlOrHost, n = 1, signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return;
+    const bucket = this.getBucket(host);
+    if (bucket.tryConsume(n)) {
+      await bucket.pace(signal);
+      return;
+    }
+    this.onThrottle?.();
+    await bucket.acquire(n, signal);
+  }
+  /**
+   * Non-blocking variant. Returns true and consumes if available,
+   * false otherwise. Used by callers that want to fall through to a
+   * fast-path / degrade rather than wait.
+   */
+  tryAcquire(urlOrHost, n = 1) {
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return true;
+    return this.getBucket(host).tryConsume(n);
+  }
+  /**
+   * Inspect a fetch response and, if it's a 429, park the host's
+   * bucket until `Retry-After` (or 60s, whichever is longer). The
+   * parsed value supports both delta-seconds (RFC 7231 §7.1.3) and
+   * HTTP-date forms; anything else falls back to the floor.
+   *
+   * No-ops on non-429 responses, or on hosts with no bucket yet
+   * (which can't happen if the caller acquired before fetching, but
+   * we don't depend on that).
+   */
+  noteResponse(urlOrHost, res) {
+    if (res.status !== 429)
+      return;
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return;
+    this.onThrottle?.();
+    const bucket = this.getBucket(host);
+    const retryAfter = readHeader2(res.headers, "retry-after");
+    const delayMs = parseRetryAfter(retryAfter, this.nowFn());
+    const deadline = this.nowFn() + Math.max(delayMs, _RateLimiter.RETRY_AFTER_FLOOR_MS);
+    bucket.markRetryUntil(deadline);
+  }
+  /** Test-only. Reset all buckets. */
+  _reset() {
+    this.buckets.clear();
+  }
+};
+function defaultSleep2(ms, signal) {
+  signal?.throwIfAborted();
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const timer = setTimeout(() => {
+    signal?.removeEventListener("abort", abort);
+    resolve();
+  }, ms);
+  const abort = () => {
+    clearTimeout(timer);
+    reject(signal?.reason ?? new Error("Rate-limit wait cancelled."));
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  return promise;
+}
+function readHeader2(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  return null;
+}
+function parseRetryAfter(value, now) {
+  if (!value)
+    return 0;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return 0;
+  if (/^\d+$/.test(trimmed)) {
+    const seconds = parseInt(trimmed, 10);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : 0;
+  }
+  const date = Date.parse(trimmed);
+  if (Number.isFinite(date)) {
+    return Math.max(0, date - now);
+  }
+  return 0;
+}
+function parseRateLimitFlag(spec, fallbackRps = 5) {
+  const trimmed = spec.trim();
+  if (!trimmed) {
+    return { default: { rps: fallbackRps } };
+  }
+  const parts = trimmed.split(",").map((p) => p.trim()).filter(Boolean);
+  let defaultCfg = null;
+  const perHost = {};
+  for (const part of parts) {
+    const eq = part.indexOf("=");
+    if (eq < 0) {
+      const cfg = parseRpsBurst(part);
+      defaultCfg = cfg;
+    } else {
+      const host = part.slice(0, eq).trim().toLowerCase();
+      const cfg = parseRpsBurst(part.slice(eq + 1));
+      if (!host) {
+        throw new Error(`--rate-limit: empty host in "${part}"`);
+      }
+      perHost[host] = cfg;
+    }
+  }
+  return {
+    default: defaultCfg ?? { rps: fallbackRps },
+    perHost: Object.keys(perHost).length > 0 ? perHost : void 0
+  };
+}
+function parseRpsBurst(s) {
+  const trimmed = s.trim();
+  if (!trimmed) {
+    throw new Error(`--rate-limit: empty rps value`);
+  }
+  const colon = trimmed.indexOf(":");
+  if (colon < 0) {
+    const rps2 = Number(trimmed);
+    if (!Number.isFinite(rps2) || rps2 <= 0) {
+      throw new Error(`--rate-limit: invalid rps "${trimmed}"`);
+    }
+    return { rps: rps2 };
+  }
+  const rps = Number(trimmed.slice(0, colon));
+  const burst = Number(trimmed.slice(colon + 1));
+  if (!Number.isFinite(rps) || rps <= 0) {
+    throw new Error(`--rate-limit: invalid rps "${trimmed.slice(0, colon)}"`);
+  }
+  if (!Number.isFinite(burst) || burst <= 0) {
+    throw new Error(`--rate-limit: invalid burst "${trimmed.slice(colon + 1)}"`);
+  }
+  return { rps, burst };
+}
+
 export {
   classifyResponse,
-  jitterFor,
   runEvasionCampaign,
   WafDetector,
   enumerateSubdomains,
@@ -2622,5 +2948,9 @@ export {
   searchTargetHistory,
   lookupAdvisory,
   searchPublicReports,
-  advisorySweep
+  advisorySweep,
+  TokenBucket,
+  RateLimiter,
+  parseRetryAfter,
+  parseRateLimitFlag
 };