@contrast/agent-bundle 5.39.1 → 5.41.0

package/node_modules/@contrast/protect/lib/semantic-analysis/handlers.js

@@ -75,6 +75,79 @@ module.exports = function(core) {
     }
   }
 
+  /**
+   * Backdoor detection logic:
+   *  - command is >= 2 chars
+   *  - iterates over every piece of request and checks
+   *    - the full value is the param to sink
+   *    - the value matches a regex and ends the param to the sink
+   */
+  function findBackdoorInjection(sourceContext, command) {
+    if (command?.length < 2) {
+      return null;
+    }
+
+    const { sourceInfo } = core.scopes.sources.getStore();
+    const valuesOfInterest = {
+      [InputType.QUERYSTRING]: sourceContext.parsedQuery,
+      [InputType.PARAMETER_VALUE]: sourceContext.parsedParams,
+      [InputType.BODY]: sourceContext.parsedBody,
+      [InputType.COOKIE_VALUE]: sourceContext.parsedCookies,
+      [InputType.HEADER]: sourceInfo.rawHeaders,
+    };
+
+    let found;
+    for (const inputType in valuesOfInterest) {
+      if (found) break;
+
+      const values = valuesOfInterest[inputType];
+
+      if (values && Object.keys(values).length) {
+        traverseValues(values, (path, type, value, obj) => {
+          if (isBackdoorDetected(value, command)) {
+            let key;
+            if (inputType === InputType.HEADER) {
+              key = obj[path[0] - 1];
+            } else {
+              key = path[path.length - 1];
+            }
+
+            found = {
+              key,
+              inputType: path.length > 1 ? InputType.JSON_VALUE : inputType,
+              path: ArrayPrototypeSlice.call(path, 0, -1),
+              value: command
+            };
+
+            // halt traversal
+            return true;
+          }
+        });
+      }
+    }
+
+    return found;
+  }
+
+  /**
+     * strips the whitespace of the request value and the command,
+     * checks if the command equals the request value
+     * or if the command looks like the start of a shell execution
+     * and ends with the request value passed to the sink
+     *
+     * @param {string} value from request key
+     */
+  function isBackdoorDetected(requestValue, command) {
+    const normalizedValue = stripWhiteSpace(requestValue);
+    const normalizedCommand = stripWhiteSpace(command);
+
+    return (
+      normalizedValue === normalizedCommand ||
+      (normalizedCommand.endsWith(normalizedValue) &&
+        RegExpPrototypeTest.call(SINK_EXPLOIT_PATTERN_START, normalizedCommand))
+    );
+  }
+
   semanticAnalysis.handleCmdInjectionSemanticDangerous = function(sourceContext, sinkContext) {
     const mode = sourceContext.policy[Rule.CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS];
 
@@ -137,75 +210,3 @@ module.exports = function(core) {
 
   return semanticAnalysis;
 };
-
-/**
- * Backdoor detection logic:
- *  - command is >= 2 chars
- *  - iterates over every piece of request and checks
- *    - the full value is the param to sink
- *    - the value matches a regex and ends the param to the sink
- */
-function findBackdoorInjection(sourceContext, command) {
-  if (command?.length < 2) {
-    return null;
-  }
-
-  const valuesOfInterest = {
-    [InputType.QUERYSTRING]: sourceContext.parsedQuery,
-    [InputType.PARAMETER_VALUE]: sourceContext.parsedParams,
-    [InputType.BODY]: sourceContext.parsedBody,
-    [InputType.COOKIE_VALUE]: sourceContext.parsedCookies,
-    [InputType.HEADER]: sourceContext.reqData.headers,
-  };
-
-  let found;
-  for (const inputType in valuesOfInterest) {
-    if (found) break;
-
-    const values = valuesOfInterest[inputType];
-
-    if (values && Object.keys(values).length) {
-      traverseValues(values, (path, type, value, obj) => {
-        if (isBackdoorDetected(value, command)) {
-          let key;
-          if (inputType === InputType.HEADER) {
-            key = obj[path[0] - 1];
-          } else {
-            key = path[path.length - 1];
-          }
-
-          found = {
-            key,
-            inputType: path.length > 1 ? InputType.JSON_VALUE : inputType,
-            path: ArrayPrototypeSlice.call(path, 0, -1),
-            value: command
-          };
-
-          // halt traversal
-          return true;
-        }
-      });
-    }
-  }
-
-  return found;
-}
-
-/**
-   * strips the whitespace of the request value and the command,
-   * checks if the command equals the request value
-   * or if the command looks like the start of a shell execution
-   * and ends with the request value passed to the sink
-   *
-   * @param {string} value from request key
-   */
-function isBackdoorDetected(requestValue, command) {
-  const normalizedValue = stripWhiteSpace(requestValue);
-  const normalizedCommand = stripWhiteSpace(command);
-
-  return (
-    normalizedValue === normalizedCommand ||
-      (normalizedCommand.endsWith(normalizedValue) &&
-      RegExpPrototypeTest.call(SINK_EXPLOIT_PATTERN_START, normalizedCommand))
-  );
-}

package/node_modules/@contrast/protect/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/protect",
-  "version": "1.64.1",
+  "version": "1.65.0",
   "description": "Contrast service providing framework-agnostic Protect support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,16 +21,16 @@
   },
   "dependencies": {
     "@contrast/agent-lib": "^9.1.0",
-    "@contrast/common": "1.34.1",
-    "@contrast/config": "1.49.1",
-    "@contrast/core": "1.54.1",
-    "@contrast/dep-hooks": "1.23.1",
-    "@contrast/esm-hooks": "2.28.1",
-    "@contrast/instrumentation": "1.33.1",
-    "@contrast/logger": "1.27.1",
-    "@contrast/patcher": "1.26.1",
-    "@contrast/rewriter": "1.30.1",
-    "@contrast/scopes": "1.24.1",
+    "@contrast/common": "1.35.0",
+    "@contrast/config": "1.50.0",
+    "@contrast/core": "1.55.0",
+    "@contrast/dep-hooks": "1.24.0",
+    "@contrast/esm-hooks": "2.29.0",
+    "@contrast/instrumentation": "1.34.0",
+    "@contrast/logger": "1.28.0",
+    "@contrast/patcher": "1.27.0",
+    "@contrast/rewriter": "1.31.0",
+    "@contrast/scopes": "1.25.0",
     "async-hook-domain": "^4.0.1",
     "ipaddr.js": "^2.0.1",
     "on-finished": "^2.4.1",

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/application-activity/index.js

@@ -27,15 +27,15 @@ class ApplicationActivity extends ng_endpoint_1.default {
         this.defendPayload = [];
         this.lastUpdate = 0;
         this.userAgentSet = new Set();
-        uiReporter.subscribeWithLock(common_1.Event.PROTECT, (msg) => {
-            if (!msg.protect)
+        uiReporter.subscribeWithLock(common_1.Event.PROTECT, (store) => {
+            if (!store.protect || !store.sourceInfo)
                 return;
-            const { userAgent, attackModel } = (0, translations_1.handleProtectMessage)(msg.protect);
-            if (userAgent) {
-                this.userAgentSet.add(userAgent);
+            const result = (0, translations_1.handleProtectMessage)(store);
+            if (result?.userAgent) {
+                this.userAgentSet.add(result.userAgent);
             }
-            if (attackModel) {
-                this.defendPayload.push(attackModel);
+            if (result?.attackModel) {
+                this.defendPayload.push(result.attackModel);
             }
         });
     }

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/application-activity/translations.d.ts

@@ -1,7 +1,7 @@
-import { ProtectMessage } from '@contrast/common';
+import { RequestStore } from '@contrast/common';
 import { AttackModel } from '../../types';
-export declare function handleProtectMessage(protectMsg: ProtectMessage): {
+export declare function handleProtectMessage(store: RequestStore): {
     userAgent: string | null;
     attackModel: AttackModel | null;
-};
+} | null;
 //# sourceMappingURL=translations.d.ts.map

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/application-activity/translations.js

@@ -166,8 +166,8 @@ const xxeSemanticAnalysisDetailsBuilder = (el) => {
     }, exploitMetadata);
     return exploitMetadata;
 };
-const buildRequestObject = (reqData) => {
-    const searchParams = new URLSearchParams(reqData.queries);
+const buildRequestObject = (sourceInfo) => {
+    const searchParams = new URLSearchParams(sourceInfo.queries);
     const parameters = {};
     for (const [key, value] of searchParams) {
         if (parameters[key]) {
@@ -178,14 +178,14 @@ const buildRequestObject = (reqData) => {
         }
     }
     const headers = {};
-    for (let i = 0; i < reqData.headers.length; i += 2) {
-        headers[reqData.headers[i]] = StringPrototypeSplit.call(reqData.headers[i + 1], /[,;]+/);
+    for (let i = 0; i < sourceInfo.rawHeaders.length; i += 2) {
+        headers[sourceInfo.rawHeaders[i]] = StringPrototypeSplit.call(sourceInfo.rawHeaders[i + 1], /[,;]+/);
     }
     return {
-        version: reqData.httpVersion,
-        method: reqData.method,
-        uri: reqData.uriPath,
-        queryString: reqData.queries,
+        version: sourceInfo.httpVersion,
+        method: sourceInfo.method,
+        uri: sourceInfo.uriPath,
+        queryString: sourceInfo.queries,
         parameters,
         headers,
     };
@@ -247,26 +247,27 @@ const buildProtectionRules = (results, requestPayload, time, isBlockMode, detail
         return;
     return accumulator;
 };
-const buildDefendPayload = (protect) => {
-    const requestPayload = buildRequestObject(protect.reqData);
+const buildDefendPayload = (store) => {
+    const { sourceInfo, protect } = store;
+    const requestPayload = buildRequestObject(store.sourceInfo);
     const time = Date.now();
     let hasAttack = false;
     const defendObject = {
-        source: { ip: protect.reqData.ip },
+        source: { ip: store.sourceInfo.ip },
         protectionRules: {},
     };
-    const sqlInjection = protect.resultsMap[common_1.Rule.SQL_INJECTION];
+    const sqlInjection = store.protect.resultsMap[common_1.Rule.SQL_INJECTION];
     if (sqlInjection) {
-        const isBlockMode = protect.policy[common_1.Rule.SQL_INJECTION] === 'block';
+        const isBlockMode = store.protect.policy[common_1.Rule.SQL_INJECTION] === 'block';
         const protectionRules = buildProtectionRules(sqlInjection, requestPayload, time, isBlockMode, sqlInjectionDetailsBuilder);
         if (protectionRules) {
             defendObject.protectionRules[common_1.Rule.SQL_INJECTION] = protectionRules;
             hasAttack = true;
         }
     }
-    const cmdInjection = protect.resultsMap[common_1.Rule.CMD_INJECTION];
+    const cmdInjection = store.protect.resultsMap[common_1.Rule.CMD_INJECTION];
     if (cmdInjection) {
-        const isBlockMode = protect.policy[common_1.Rule.CMD_INJECTION] === 'block';
+        const isBlockMode = store.protect.policy[common_1.Rule.CMD_INJECTION] === 'block';
         const protectionRules = buildProtectionRules(cmdInjection, requestPayload, time, isBlockMode, cmdInjectionDetailsBuilder);
         if (protectionRules) {
             defendObject.protectionRules[common_1.Rule.CMD_INJECTION] = protectionRules;
@@ -442,10 +443,10 @@ const buildDefendPayload = (protect) => {
     }
     const botBlocker = protect.resultsMap[common_1.Rule.BOT_BLOCKER];
     if (botBlocker) {
-        const uaIdx = protect.reqData.headers.indexOf('user-agent');
+        const uaIdx = sourceInfo.rawHeaders.indexOf('user-agent');
         const protectionRules = buildProtectionRules(botBlocker, requestPayload, time, true, (result) => ({
             bot: result?.idsList?.[0],
-            userAgent: protect.reqData.headers[uaIdx + 1],
+            userAgent: sourceInfo.rawHeaders[uaIdx + 1],
         }));
         if (protectionRules) {
             defendObject.protectionRules[common_1.Rule.BOT_BLOCKER] = protectionRules;
@@ -454,16 +455,18 @@ const buildDefendPayload = (protect) => {
     }
     return hasAttack ? defendObject : null;
 };
-function handleProtectMessage(protectMsg) {
+function handleProtectMessage(store) {
+    if (!store.sourceInfo || !store.protect)
+        return null;
     const attackers = {
         userAgent: null,
         attackModel: null,
     };
-    const userAgentIndex = protectMsg.reqData.headers.findIndex((el) => el === 'user-agent');
+    const userAgentIndex = store.sourceInfo.rawHeaders.findIndex((el) => el === 'user-agent');
     attackers.userAgent = userAgentIndex != -1
-        ? protectMsg.reqData.headers[userAgentIndex + 1]
+        ? store.sourceInfo.rawHeaders[userAgentIndex + 1]
         : null;
-    attackers.attackModel = buildDefendPayload(protectMsg);
+    attackers.attackModel = buildDefendPayload(store);
     return attackers;
 }
 exports.handleProtectMessage = handleProtectMessage;

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/routes-observed.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const v1_endpoint_1 = __importDefault(require("./v1-endpoint"));
+const common_1 = require("@contrast/common");
 class RoutesObserved extends v1_endpoint_1.default {
     constructor(core, uiReporter) {
         super(core, {
@@ -13,7 +14,7 @@ class RoutesObserved extends v1_endpoint_1.default {
     }
     async post(route) {
         const { client, core: { config }, } = this;
-        const PROD = config.getEffectiveSource('server.environment');
+        const PROD = config.getEffectiveSource('server.environment') == common_1.ServerEnvironment.PRODUCTION;
         const session_id = config.getEffectiveValue('application.session_id');
         await client.post(this.appUrl('/observed'), {
             /**

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/index.js

@@ -125,7 +125,7 @@ class Traces extends ng_endpoint_1.default {
             if (route) {
                 accum.routes = tx.getRoutes(route, this.inProd);
             }
-            if (store?.assess?.reqData) {
+            if (store?.sourceInfo) {
                 accum.request = tx.getRequest(store, this.inProd);
             }
             this.initiateCompletenessCondition(accum);

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/translations.d.ts

@@ -1,4 +1,3 @@
-import { RequestStore } from '@contrast/common';
 import { Signature, TraceEvent } from './types';
 export declare function getTaintRanges(tags: Record<string, number[]>): Record<string, string>[];
 export declare function getEventAction(event: any): string;
@@ -16,7 +15,7 @@ export declare function getRoutes(route: any, prod?: boolean): {
     signature: any;
 }[];
 export declare function maskSensitiveRequestData(req: any): any;
-export declare function getRequest(store: RequestStore, prod?: boolean): any;
+export declare function getRequest(store: any, prod?: boolean): any;
 export declare function maskSensitiveTraceData(event: any): any;
 export declare function getTraceEvents(sinkEvent: any, prod: boolean, eventDetail: string): TraceEvent[];
 //# sourceMappingURL=translations.d.ts.map

package/node_modules/@contrast/reporter/lib/reporters/contrast-ui/endpoints/traces/translations.js

@@ -272,10 +272,16 @@ function maskSensitiveRequestData(req) {
 }
 exports.maskSensitiveRequestData = maskSensitiveRequestData;
 function getRequest(store, prod) {
-    const { assess: { reqData: { method, headers: reqHeaders, httpVersion, queries: queryString, uriPath: uri, } }, route, } = store;
+    const { 
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore
-    const headers = Object.entries(reqHeaders).reduce((acc, [key, val]) => Object.assign(acc, { [key]: StringPrototypeSplit.call(val, ';') }), {});
+    sourceInfo: { method, rawHeaders, httpVersion, queries: queryString, uriPath: uri, }, route, } = store;
+    const headers = {};
+    for (let idx = 0; idx < rawHeaders.length - 1; idx += 2) {
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore
+        headers[rawHeaders[idx]] = StringPrototypeSplit.call(rawHeaders[idx + 1], ';');
+    }
     const request = {
         body: undefined,
         headers,

package/node_modules/@contrast/reporter/lib/reporters/security-logger/index.d.ts

@@ -27,8 +27,8 @@ export default class SecurityLogger extends BaseReporter {
     private buildMetadata;
     private handleProtectResult;
     install(): Promise<void>;
-    handleAssessEvent(msg: RequestStore): void;
-    handleProtectEvent(msg: RequestStore): void;
+    handleAssessEvent(store: RequestStore): void;
+    handleProtectEvent(store: RequestStore): void;
 }
 export {};
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@contrast/reporter/lib/reporters/security-logger/index.js

@@ -98,8 +98,8 @@ class SecurityLogger extends base_1.default {
             });
         });
         if (core.config.protect.enable) {
-            this.subscribeWithLock(common_1.Event.PROTECT, (msg) => {
-                this.handleProtectEvent(msg);
+            this.subscribeWithLock(common_1.Event.PROTECT, (store) => {
+                this.handleProtectEvent(store);
             });
         }
     }
@@ -142,25 +142,27 @@ class SecurityLogger extends base_1.default {
             });
         }
     }
-    buildMetadata(reqData, outcome) {
+    buildMetadata(sourceInfo, outcome) {
         return {
-            src: reqData.ip,
+            src: sourceInfo.ip,
             spt: '-', // do we have port data?
-            requestMethod: reqData.method,
-            request: reqData.uriPath,
+            requestMethod: sourceInfo.method,
+            request: sourceInfo.uriPath,
             app: this.appInfo.name,
             outcome,
         };
     }
-    handleProtectResult(protect, rule, result) {
-        const mode = protect.policy[rule] || common_1.ProtectRuleMode.OFF;
+    handleProtectResult(store, rule, result) {
+        if (!store?.protect && !store?.sourceInfo)
+            return;
+        const mode = store.protect?.policy[rule] || common_1.ProtectRuleMode.OFF;
         if (mode === common_1.ProtectRuleMode.OFF)
             return;
         if (rule === common_1.Rule.BOT_BLOCKER) {
             const level = this.loggerConfig.syslog.severity_blocked;
             this.log(level, {
                 bbi: 'Contrast Bot Blocker',
-                ...this.buildMetadata(protect.reqData, 'success'),
+                ...this.buildMetadata(store.sourceInfo, 'success'),
             }, messages.botBlocker(result));
             return;
         }
@@ -193,25 +195,25 @@ class SecurityLogger extends base_1.default {
         }
         this.log(level, {
             pri: result.mappedId,
-            ...this.buildMetadata(protect.reqData, outcome),
+            ...this.buildMetadata(store.sourceInfo, outcome),
         }, message(result));
     }
     async install() { }
     /* c8 ignore next 3 */
-    handleAssessEvent(msg) {
+    handleAssessEvent(store) {
         // Assess NYI
     }
-    handleProtectEvent(msg) {
-        if (!msg.protect)
+    handleProtectEvent(store) {
+        if (!store.protect || !store.sourceInfo)
             return;
-        const { protect } = msg;
+        const { protect, sourceInfo } = store;
         const virtualPatchResults = protect.resultsMap[common_1.Rule.VIRTUAL_PATCH];
         if (virtualPatchResults) {
             virtualPatchResults.forEach((result) => {
                 const level = this.loggerConfig.syslog.severity_blocked;
                 this.log(level, {
                     vpi: result.uuid,
-                    ...this.buildMetadata(protect.reqData, 'success'),
+                    ...this.buildMetadata(sourceInfo, 'success'),
                 }, messages.virtualPatch(result));
             });
         }
@@ -221,24 +223,24 @@ class SecurityLogger extends base_1.default {
                 const level = this.loggerConfig.syslog.severity_blocked;
                 this.log(level, {
                     bli: result.uuid,
-                    ...this.buildMetadata(protect.reqData, 'success'),
-                }, messages.ipDenyList(protect.reqData.ip, result));
+                    ...this.buildMetadata(sourceInfo, 'success'),
+                }, messages.ipDenyList(sourceInfo.ip, result));
             });
         }
         const { commonResultsMap, hardeningResultsMap, semanticResultsMap } = (0, common_1.groupResultsMap)(protect.resultsMap);
         Object.entries(commonResultsMap).forEach(([rule, results]) => {
             results.forEach((result) => {
-                this.handleProtectResult(protect, rule, result);
+                this.handleProtectResult(store, rule, result);
             });
         });
         Object.entries(hardeningResultsMap).forEach(([rule, results]) => {
             results.forEach((result) => {
-                this.handleProtectResult(protect, rule, result);
+                this.handleProtectResult(store, rule, result);
             });
         });
         Object.entries(semanticResultsMap).forEach(([rule, results]) => {
             results.forEach((result) => {
-                this.handleProtectResult(protect, rule, result);
+                this.handleProtectResult(store, rule, result);
             });
         });
     }

package/node_modules/@contrast/reporter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/reporter",
-  "version": "1.51.1",
+  "version": "1.52.0",
   "description": "Subscribes to agent messages and reports them",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -21,13 +21,13 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.34.1",
-    "@contrast/config": "1.49.1",
-    "@contrast/core": "1.54.1",
-    "@contrast/logger": "1.27.1",
+    "@contrast/common": "1.35.0",
+    "@contrast/config": "1.50.0",
+    "@contrast/core": "1.55.0",
+    "@contrast/logger": "1.28.0",
     "@contrast/perf": "1.3.1",
-    "@contrast/scopes": "1.24.1",
-    "axios": "^1.7.4",
+    "@contrast/scopes": "1.25.0",
+    "axios": "^1.11.0",
     "crc-32": "^1.2.2",
     "safe-stable-stringify": "^2.4.1",
     "sonic-boom": "^3.2.0"

package/node_modules/@contrast/rewriter/lib/index.js

@@ -200,9 +200,9 @@ module.exports = function init(core) {
     parseSync('');
   } catch (cause) {
     // @ts-expect-error TS hates errors.
-    throw cause.message === 'Bindings not found.'
+    throw cause.message === 'Failed to load native binding'
       ? new Error(
-        `Contrast cannot detect the correct precompiled dependencies for the current environment: ${platform()}-${arch()}. This typically occurs when deploying an installation from one environment to a different execution environment.`,
+        `Contrast cannot detect the correct precompiled dependencies for the current environment: ${platform()}-${arch()}. This typically occurs when deploying an installation from one environment to a different execution environment or when the \`--omit=optional\` or \`--no-optional\` flags are provided to \`npm install\`.`,
         // @ts-expect-error `cause` requires ts to target es2022 or above, which corresponds to Node 17+, despite being added to Node in 16.9.
         { cause },
       )

package/node_modules/@contrast/rewriter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/rewriter",
-  "version": "1.30.1",
+  "version": "1.31.0",
   "description": "A transpilation tool mainly used for instrumentation",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,11 +20,11 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/agent-swc-plugin": "3.0.0",
-    "@contrast/common": "1.34.1",
-    "@contrast/config": "1.49.1",
-    "@contrast/core": "1.54.1",
-    "@contrast/logger": "1.27.1",
+    "@contrast/agent-swc-plugin": "3.1.0",
+    "@contrast/common": "1.35.0",
+    "@contrast/config": "1.50.0",
+    "@contrast/core": "1.55.0",
+    "@contrast/logger": "1.28.0",
     "@swc/core": "1.11.24"
   }
 }

package/node_modules/@contrast/route-coverage/lib/index.d.ts

@@ -23,11 +23,13 @@ import { Scopes } from '@contrast/scopes';
 export { RouteInfo };
 
 export interface RouteCoverage extends Installable {
+  _normalizedUrlMapper: any;
   discover(info: RouteInfo): void;
   discoveryFinished(): void;
   queue(info: RouteInfo): void;
   queuingFinished(): void;
   observe(info: RouteInfo): void;
+  uriPathToNormalizedUrl(uriPath: string): string;
 }
 
 export interface Core {