@datahogo/core 0.1.0

package/dist/scanning/orchestrator.js

@@ -0,0 +1,186 @@
+// Multi-technology scan orchestrator.
+// Uses TechDetector to identify technologies, instantiates the relevant
+// ScanAgents, runs them in parallel, and aggregates into a ScanReport.
+import { detectTechnologies } from "./tech-detector.js";
+import { PythonScanAgent } from "./agents/python-agent.js";
+import { JavaScriptScanAgent } from "./agents/javascript-agent.js";
+import { GoScanAgent } from "./agents/go-agent.js";
+import { JavaScanAgent } from "./agents/java-agent.js";
+import { PHPScanAgent } from "./agents/php-agent.js";
+import { CSharpScanAgent } from "./agents/csharp-agent.js";
+import { MobileScanAgent } from "./agents/mobile-agent.js";
+import { SupabaseScanAgent } from "./agents/supabase-agent.js";
+const SEVERITY_PENALTY = {
+    CRITICAL: 15,
+    HIGH: 10,
+    MEDIUM: 5,
+    LOW: 2,
+    INFO: 0,
+};
+const AGENT_TIMEOUT_MS = 90_000; // 90s per agent
+/**
+ * Registry of all available scan agents.
+ * Agents register themselves here; the orchestrator picks which ones to run.
+ */
+const agentRegistry = [];
+/** Register a scan agent. Called by each agent module on import. */
+export function registerAgent(agent) {
+    agentRegistry.push(agent);
+}
+/** Get all registered agents (for testing). */
+export function getRegisteredAgents() {
+    return agentRegistry;
+}
+/** Clear registry (for testing). */
+export function clearAgentRegistry() {
+    agentRegistry.length = 0;
+}
+// Register built-in agents
+registerAgent(new PythonScanAgent());
+registerAgent(new JavaScriptScanAgent());
+registerAgent(new GoScanAgent());
+registerAgent(new JavaScanAgent());
+registerAgent(new PHPScanAgent());
+registerAgent(new CSharpScanAgent());
+registerAgent(new MobileScanAgent());
+registerAgent(new SupabaseScanAgent());
+/**
+ * Run a full multi-technology scan.
+ *
+ * 1. Detect technologies in the repo
+ * 2. Filter agents to only those whose technologies match
+ * 3. Run matching agents in parallel (with timeout)
+ * 4. Deduplicate and aggregate results into a ScanReport
+ */
+export async function runMultiTechScan(files, options = {}) {
+    const startTime = Date.now();
+    const detection = detectTechnologies(files);
+    const excluded = options.exclude ?? [];
+    // Find agents that support at least one detected technology
+    const matchingAgents = agentRegistry.filter((agent) => {
+        const meta = agent.getMetadata();
+        if (excluded.includes(meta.name))
+            return false;
+        return meta.technologies.some((tech) => detection.technologies.includes(tech));
+    });
+    const matchedNames = matchingAgents.map((a) => a.getMetadata().name);
+    // Run detect() on matching agents to confirm (agents may have stricter checks)
+    const confirmedAgents = [];
+    await Promise.all(matchingAgents.map(async (agent) => {
+        try {
+            const detected = await agent.detect(files);
+            if (detected)
+                confirmedAgents.push(agent);
+        }
+        catch {
+            // If detect fails, skip this agent
+        }
+    }));
+    const confirmedNames = confirmedAgents.map((a) => a.getMetadata().name);
+    // Run scan() on confirmed agents in parallel with timeout
+    const agentResults = await Promise.all(confirmedAgents.map((agent) => runAgentWithTimeout(agent, files)));
+    // Build agent logs by diffing getChecks() against findings
+    const agentLogs = agentResults.map((ar) => {
+        const agent = confirmedAgents.find((a) => a.getMetadata().name === ar.agentName);
+        const meta = agent?.getMetadata();
+        const checks = agent?.getChecks?.() ?? [];
+        const checkResults = checks.map((check) => {
+            const count = ar.results.filter((r) => r.checkId === check.id).length;
+            return {
+                checkId: check.id,
+                status: count > 0 ? "fail" : "pass",
+                findingCount: count,
+            };
+        });
+        const passed = checkResults.filter((c) => c.status === "pass").length;
+        const failed = checkResults.filter((c) => c.status === "fail").length;
+        return {
+            agentName: ar.agentName,
+            agentVersion: meta?.version ?? "unknown",
+            technologies: meta?.technologies ?? [],
+            status: ar.error
+                ? ar.error.includes("timed out") ? "timeout" : "error"
+                : "completed",
+            durationMs: ar.durationMs,
+            checkResults,
+            totalChecks: checkResults.length,
+            passed,
+            failed,
+            error: ar.error,
+        };
+    });
+    const scanLog = {
+        technologiesDetected: detection.technologies,
+        technologyDetails: Object.fromEntries(detection.details),
+        agentsMatched: matchedNames,
+        agentsConfirmed: confirmedNames,
+        agentLogs,
+        totalDurationMs: Date.now() - startTime,
+        summary: {
+            totalChecks: agentLogs.reduce((s, a) => s + a.totalChecks, 0),
+            passed: agentLogs.reduce((s, a) => s + a.passed, 0),
+            failed: agentLogs.reduce((s, a) => s + a.failed, 0),
+        },
+    };
+    // Aggregate all results
+    const allResults = agentResults.flatMap((ar) => ar.results);
+    const deduplicated = deduplicateResults(allResults);
+    const score = calculateScore(deduplicated);
+    return {
+        score,
+        results: deduplicated,
+        techsDetected: detection.technologies,
+        timestamp: new Date().toISOString(),
+        agentResults,
+        scanLog,
+    };
+}
+async function runAgentWithTimeout(agent, files) {
+    const meta = agent.getMetadata();
+    const start = Date.now();
+    try {
+        const results = await Promise.race([
+            agent.scan(files),
+            new Promise((_, reject) => setTimeout(() => reject(new Error(`Agent ${meta.name} timed out after ${AGENT_TIMEOUT_MS}ms`)), AGENT_TIMEOUT_MS)),
+        ]);
+        return {
+            agentName: meta.name,
+            results,
+            durationMs: Date.now() - start,
+        };
+    }
+    catch (error) {
+        return {
+            agentName: meta.name,
+            results: [],
+            durationMs: Date.now() - start,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+function deduplicateResults(results) {
+    const seen = new Map();
+    const deduped = [];
+    for (const result of results) {
+        const key = `${result.title}:${result.file}`;
+        const seenLines = seen.get(key);
+        if (seenLines) {
+            if (seenLines.some((l) => Math.abs(l - result.line) <= 2))
+                continue;
+            seenLines.push(result.line);
+        }
+        else {
+            seen.set(key, [result.line]);
+        }
+        deduped.push(result);
+    }
+    return deduped;
+}
+function calculateScore(results) {
+    let score = 100;
+    for (const result of results) {
+        score -= SEVERITY_PENALTY[result.severity] ?? 0;
+    }
+    return Math.max(0, score);
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/scanning/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/scanning/orchestrator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,wEAAwE;AACxE,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAW/D,MAAM,gBAAgB,GAA6B;IACjD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,gBAAgB;AASjD;;;GAGG;AACH,MAAM,aAAa,GAAgB,EAAE,CAAC;AAEtC,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,kBAAkB;IAChC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,2BAA2B;AAC3B,aAAa,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;AACrC,aAAa,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;AACzC,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;AACjC,aAAa,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;AACnC,aAAa,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;AAClC,aAAa,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;AACrC,aAAa,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;AACrC,aAAa,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA0B,EAC1B,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAEvC,4DAA4D;IAC5D,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAa,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAErE,+EAA+E;IAC/E,MAAM,eAAe,GAAgB,EAAE,CAAC;IACxC,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,QAAQ;gBAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAExE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAClE,CAAC;IAEF,2DAA2D;IAC3D,MAAM,SAAS,GAAoB,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB;gBACzD,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAEtE,OAAO;YACL,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,YAAY,EAAE,IAAI,EAAE,OAAO,IAAI,SAAS;YACxC,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE;YACtC,MAAM,EAAE,EAAE,CAAC,KAAK;gBACd,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,OAAgB;gBACxE,CAAC,CAAC,WAAoB;YACxB,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,YAAY;YACZ,WAAW,EAAE,YAAY,CAAC,MAAM;YAChC,MAAM;YACN,MAAM;YACN,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAY;QACvB,oBAAoB,EAAE,SAAS,CAAC,YAAY;QAC5C,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC;QACxD,aAAa,EAAE,YAAY;QAC3B,eAAe,EAAE,cAAc;QAC/B,SAAS;QACT,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACvC,OAAO,EAAE;YACP,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACpD;KACF,CAAC;IAEF,wBAAwB;IACxB,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAE3C,OAAO;QACL,KAAK;QACL,OAAO,EAAE,YAAY;QACrB,aAAa,EAAE,SAAS,CAAC,YAAY;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAgB,EAChB,KAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,gBAAgB,IAAI,CAAC,CAAC,EACnF,gBAAgB,CACjB,CACF;SACF,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAqB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACpE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAqB;IAC3C,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/scanning/tech-detector.d.ts

@@ -0,0 +1,12 @@
+import type { Technology } from "./types.js";
+export interface TechDetectionResult {
+    technologies: Technology[];
+    /** Raw details: which rule matched and how. */
+    details: Map<Technology, string>;
+}
+/**
+ * Detect technologies used in a repository by analyzing file names and content.
+ * Works with the existing Map<string, string> file representation.
+ */
+export declare function detectTechnologies(files: Map<string, string>): TechDetectionResult;
+//# sourceMappingURL=tech-detector.d.ts.map

package/dist/scanning/tech-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tech-detector.d.ts","sourceRoot":"","sources":["../../src/scanning/tech-detector.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuM7C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,mBAAmB,CAoDlF"}

package/dist/scanning/tech-detector.js

@@ -0,0 +1,252 @@
+// Automatic technology detection from repository files.
+// Analyzes package manifests, config files, and imports to determine
+// which technologies a project uses. This drives which ScanAgents run.
+const DETECTION_RULES = [
+    // --- JavaScript / TypeScript ecosystem ---
+    {
+        tech: "nodejs",
+        files: [/^package\.json$/],
+    },
+    {
+        tech: "nextjs",
+        npmDeps: ["next"],
+        files: [/^next\.config\.[tjm]s$/],
+    },
+    {
+        tech: "react",
+        npmDeps: ["react", "react-dom"],
+    },
+    {
+        tech: "express",
+        npmDeps: ["express"],
+    },
+    {
+        tech: "fastify",
+        npmDeps: ["fastify"],
+    },
+    {
+        tech: "hono",
+        npmDeps: ["hono"],
+    },
+    {
+        tech: "koa",
+        npmDeps: ["koa"],
+    },
+    {
+        tech: "nestjs",
+        npmDeps: ["@nestjs/core"],
+    },
+    {
+        tech: "react-native",
+        npmDeps: ["react-native"],
+        files: [/^app\.json$/],
+    },
+    {
+        tech: "expo",
+        npmDeps: ["expo"],
+        files: [/^app\.json$/, /^app\.config\.[tj]s$/],
+    },
+    {
+        tech: "prisma",
+        npmDeps: ["prisma", "@prisma/client"],
+        files: [/prisma\/schema\.prisma$/],
+    },
+    {
+        tech: "graphql",
+        npmDeps: ["graphql", "apollo-server", "@apollo/server", "type-graphql"],
+    },
+    {
+        tech: "stripe",
+        npmDeps: ["stripe"],
+    },
+    {
+        tech: "mongodb",
+        npmDeps: ["mongodb", "mongoose"],
+    },
+    {
+        tech: "redis",
+        npmDeps: ["redis", "ioredis"],
+    },
+    {
+        tech: "vue",
+        npmDeps: ["vue"],
+    },
+    {
+        tech: "angular",
+        npmDeps: ["@angular/core"],
+    },
+    {
+        tech: "svelte",
+        npmDeps: ["svelte"],
+    },
+    // --- Python ecosystem ---
+    {
+        tech: "python",
+        files: [/^requirements\.txt$/, /^pyproject\.toml$/, /^setup\.py$/, /^Pipfile$/],
+    },
+    {
+        tech: "django",
+        files: [/^requirements\.txt$/, /^pyproject\.toml$/],
+        contentPatterns: [/django/i],
+    },
+    {
+        tech: "flask",
+        files: [/^requirements\.txt$/, /^pyproject\.toml$/],
+        contentPatterns: [/flask/i],
+    },
+    {
+        tech: "fastapi",
+        files: [/^requirements\.txt$/, /^pyproject\.toml$/],
+        contentPatterns: [/fastapi/i],
+    },
+    // --- Go ---
+    {
+        tech: "go",
+        files: [/^go\.mod$/],
+    },
+    // --- Java / Kotlin ---
+    {
+        tech: "java",
+        files: [/^pom\.xml$/, /^build\.gradle(?:\.kts)?$/],
+    },
+    {
+        tech: "spring",
+        files: [/^pom\.xml$/, /^build\.gradle(?:\.kts)?$/],
+        contentPatterns: [/spring-boot|springframework/i],
+    },
+    {
+        tech: "kotlin",
+        files: [/^build\.gradle\.kts$/],
+        contentPatterns: [/kotlin/i],
+    },
+    // --- PHP ---
+    {
+        tech: "php",
+        files: [/^composer\.json$/],
+    },
+    {
+        tech: "laravel",
+        files: [/^composer\.json$/],
+        contentPatterns: [/laravel/i],
+    },
+    // --- Ruby ---
+    {
+        tech: "ruby",
+        files: [/^Gemfile$/],
+    },
+    {
+        tech: "rails",
+        files: [/^Gemfile$/],
+        contentPatterns: [/rails/i],
+    },
+    // --- Dart / Flutter ---
+    {
+        tech: "dart",
+        files: [/^pubspec\.yaml$/],
+    },
+    {
+        tech: "flutter",
+        files: [/^pubspec\.yaml$/],
+        contentPatterns: [/flutter/i],
+    },
+    // --- .NET ---
+    {
+        tech: "dotnet",
+        files: [/\.csproj$/, /\.fsproj$/, /\.sln$/],
+    },
+    // --- Rust ---
+    {
+        tech: "rust",
+        files: [/^Cargo\.toml$/],
+    },
+    // --- Infrastructure ---
+    {
+        tech: "docker",
+        files: [/^Dockerfile$/, /^docker-compose\.ya?ml$/],
+    },
+    // --- BaaS ---
+    {
+        tech: "firebase",
+        files: [/^firebase\.json$/, /^\.firebaserc$/, /^firestore\.rules$/],
+        npmDeps: ["firebase", "firebase-admin"],
+    },
+    {
+        tech: "supabase",
+        files: [/^supabase\/config\.toml$/],
+        npmDeps: ["@supabase/supabase-js"],
+    },
+];
+/**
+ * Detect technologies used in a repository by analyzing file names and content.
+ * Works with the existing Map<string, string> file representation.
+ */
+export function detectTechnologies(files) {
+    const detected = new Set();
+    const details = new Map();
+    const filePaths = [...files.keys()];
+    // Parse package.json deps once (used by many rules)
+    const allNpmDeps = extractNpmDeps(files);
+    for (const rule of DETECTION_RULES) {
+        if (detected.has(rule.tech))
+            continue;
+        // Check npm dependencies
+        if (rule.npmDeps) {
+            const matchedDep = rule.npmDeps.find((dep) => allNpmDeps.has(dep));
+            if (matchedDep) {
+                detected.add(rule.tech);
+                details.set(rule.tech, `npm dependency: ${matchedDep}`);
+                continue;
+            }
+        }
+        // Check file existence + optional content patterns
+        if (rule.files) {
+            for (const filePattern of rule.files) {
+                const matchingFile = filePaths.find((fp) => filePattern.test(fp));
+                if (!matchingFile)
+                    continue;
+                if (!rule.contentPatterns) {
+                    // File existence alone is enough
+                    detected.add(rule.tech);
+                    details.set(rule.tech, `file: ${matchingFile}`);
+                    break;
+                }
+                // Check file content
+                const content = files.get(matchingFile);
+                if (!content)
+                    continue;
+                const matchedPattern = rule.contentPatterns.find((p) => p.test(content));
+                if (matchedPattern) {
+                    detected.add(rule.tech);
+                    details.set(rule.tech, `file: ${matchingFile} (content match)`);
+                    break;
+                }
+            }
+        }
+    }
+    return {
+        technologies: [...detected].sort(),
+        details,
+    };
+}
+/** Extract all dependency names from package.json (deps + devDeps). */
+function extractNpmDeps(files) {
+    const deps = new Set();
+    const packageJson = files.get("package.json");
+    if (!packageJson)
+        return deps;
+    try {
+        const pkg = JSON.parse(packageJson);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+            if (pkg[key] && typeof pkg[key] === "object") {
+                for (const name of Object.keys(pkg[key])) {
+                    deps.add(name);
+                }
+            }
+        }
+    }
+    catch {
+        // Malformed package.json — skip
+    }
+    return deps;
+}
+//# sourceMappingURL=tech-detector.js.map

package/dist/scanning/tech-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tech-detector.js","sourceRoot":"","sources":["../../src/scanning/tech-detector.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,qEAAqE;AACrE,uEAAuE;AAcvE,MAAM,eAAe,GAAoB;IACvC,4CAA4C;IAC5C;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,iBAAiB,CAAC;KAC3B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,CAAC,wBAAwB,CAAC;KAClC;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;KAChC;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,SAAS,CAAC;KACrB;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,SAAS,CAAC;KACrB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;IACD;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,CAAC,KAAK,CAAC;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,cAAc,CAAC;KAC1B;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,KAAK,EAAE,CAAC,aAAa,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;KAC/C;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QACrC,KAAK,EAAE,CAAC,yBAAyB,CAAC;KACnC;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC;KACxE;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;KACjC;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC9B;IAED;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,CAAC,KAAK,CAAC;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,eAAe,CAAC;KAC3B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,aAAa,EAAE,WAAW,CAAC;KAChF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QACnD,eAAe,EAAE,CAAC,SAAS,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QACnD,eAAe,EAAE,CAAC,QAAQ,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QACnD,eAAe,EAAE,CAAC,UAAU,CAAC;KAC9B;IAED,aAAa;IACb;QACE,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,CAAC,WAAW,CAAC;KACrB;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,YAAY,EAAE,2BAA2B,CAAC;KACnD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,YAAY,EAAE,2BAA2B,CAAC;QAClD,eAAe,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,sBAAsB,CAAC;QAC/B,eAAe,EAAE,CAAC,SAAS,CAAC;KAC7B;IAED,cAAc;IACd;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,CAAC,kBAAkB,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,CAAC,kBAAkB,CAAC;QAC3B,eAAe,EAAE,CAAC,UAAU,CAAC;KAC9B;IAED,eAAe;IACf;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,WAAW,CAAC;KACrB;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,WAAW,CAAC;QACpB,eAAe,EAAE,CAAC,QAAQ,CAAC;KAC5B;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,iBAAiB,CAAC;KAC3B;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,CAAC,iBAAiB,CAAC;QAC1B,eAAe,EAAE,CAAC,UAAU,CAAC;KAC9B;IAED,eAAe;IACf;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;KAC5C;IAED,eAAe;IACf;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,eAAe,CAAC;KACzB;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,cAAc,EAAE,yBAAyB,CAAC;KACnD;IAED,eAAe;IACf;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,CAAC;QACnE,OAAO,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,CAAC,0BAA0B,CAAC;QACnC,OAAO,EAAE,CAAC,uBAAuB,CAAC;KACnC;CACF,CAAC;AAQF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpC,oDAAoD;IACpD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEtC,yBAAyB;QACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACnE,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,UAAU,EAAE,CAAC,CAAC;gBACxD,SAAS;YACX,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrC,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY;oBAAE,SAAS;gBAE5B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC1B,iCAAiC;oBACjC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC,CAAC;oBAChD,MAAM;gBACR,CAAC;gBAED,qBAAqB;gBACrB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzE,IAAI,cAAc,EAAE,CAAC;oBACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,YAAY,kBAAkB,CAAC,CAAC;oBAChE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAClC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,KAA0B;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC1E,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scanning/types.d.ts

@@ -0,0 +1,87 @@
+export type Severity = "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "INFO";
+export interface ScanResult {
+    title: string;
+    severity: Severity;
+    file: string;
+    line: number;
+    description: string;
+    fix: string;
+    cwe?: string;
+    /** Links this finding back to a CheckDefinition.id for scan log tracking. */
+    checkId?: string;
+    /**
+     * Confidence level for this finding.
+     * high   — direct pattern match, no ambiguity (DEBUG=True, pickle.loads with user input)
+     * medium — good signal but context-dependent (SQL f-string that might be parameterized)
+     * low    — broad match or absence-based (missing auth decorator, Flask CORS default)
+     */
+    confidence?: "high" | "medium" | "low";
+}
+export interface AgentMetadata {
+    name: string;
+    version: string;
+    technologies: string[];
+}
+export interface ScanReport {
+    score: number;
+    results: ScanResult[];
+    techsDetected: string[];
+    timestamp: string;
+}
+/**
+ * ScanAgent interface — every technology-specific scanner implements this.
+ * Agents are self-contained: they know how to detect their technology
+ * and how to scan for vulnerabilities within it.
+ */
+export interface ScanAgent {
+    /** Check if this agent's technology exists in the repo. */
+    detect(files: Map<string, string>): Promise<boolean>;
+    /** Run the security scan. Only called if detect() returned true. */
+    scan(files: Map<string, string>): Promise<ScanResult[]>;
+    /** Return metadata about this agent (name, version, supported techs). */
+    getMetadata(): AgentMetadata;
+    /** Return the list of checks this agent can perform (for scan log). */
+    getChecks?(): CheckDefinition[];
+}
+/** Technology identifiers returned by TechDetector. */
+export type Technology = "nodejs" | "nextjs" | "react" | "express" | "fastify" | "hono" | "koa" | "nestjs" | "python" | "django" | "flask" | "fastapi" | "go" | "java" | "spring" | "kotlin" | "php" | "laravel" | "ruby" | "rails" | "dart" | "flutter" | "dotnet" | "rust" | "docker" | "firebase" | "supabase" | "react-native" | "expo" | "prisma" | "mongodb" | "redis" | "graphql" | "stripe" | "vue" | "angular" | "svelte";
+/** A check that an agent can perform. */
+export interface CheckDefinition {
+    id: string;
+    name: string;
+    severity: Severity;
+}
+/** Result of a single check after a scan. */
+export interface CheckResult {
+    checkId: string;
+    status: "pass" | "fail";
+    findingCount: number;
+}
+/** Log entry for one agent's execution. */
+export interface AgentLogEntry {
+    agentName: string;
+    agentVersion: string;
+    technologies: string[];
+    status: "completed" | "error" | "timeout" | "skipped";
+    durationMs: number;
+    checkResults: CheckResult[];
+    totalChecks: number;
+    passed: number;
+    failed: number;
+    error?: string;
+}
+/** Complete scan execution log. */
+export interface ScanLog {
+    technologiesDetected: string[];
+    technologyDetails: Record<string, string>;
+    agentsMatched: string[];
+    agentsConfirmed: string[];
+    agentLogs: AgentLogEntry[];
+    totalDurationMs: number;
+    summary: {
+        totalChecks: number;
+        passed: number;
+        failed: number;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/scanning/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scanning/types.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD,oEAAoE;IACpE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAExD,yEAAyE;IACzE,WAAW,IAAI,aAAa,CAAC;IAE7B,uEAAuE;IACvE,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC;CACjC;AAED,uDAAuD;AACvD,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,SAAS,GACT,MAAM,GACN,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,SAAS,GACT,MAAM,GACN,OAAO,GACP,MAAM,GACN,SAAS,GACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,UAAU,GACV,UAAU,GACV,cAAc,GACd,MAAM,GACN,QAAQ,GACR,SAAS,GACT,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,QAAQ,CAAC;AAIb,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mCAAmC;AACnC,MAAM,WAAW,OAAO;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}

package/dist/scanning/types.js

@@ -0,0 +1,5 @@
+// Multi-technology scanning architecture — shared types.
+// This is the new agent-based system. The existing engines/ directory
+// handles the current Next.js-focused scanner and remains untouched.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/scanning/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/scanning/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,sEAAsE;AACtE,qEAAqE"}

package/dist/utils/child-process.d.ts

@@ -0,0 +1,2 @@
+export { execFile } from "node:child_process";
+//# sourceMappingURL=child-process.d.ts.map

package/dist/utils/child-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../src/utils/child-process.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/utils/child-process.js

@@ -0,0 +1,4 @@
+// Re-export child_process functions for testability.
+// Vitest cannot reliably mock node:child_process builtins.
+export { execFile } from "node:child_process";
+//# sourceMappingURL=child-process.js.map

package/dist/utils/child-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.js","sourceRoot":"","sources":["../../src/utils/child-process.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,2DAA2D;AAE3D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/utils/context-classifier.d.ts

@@ -0,0 +1,11 @@
+import type { FindingContext } from "../engines/types.js";
+interface ClassifyInput {
+    file_path?: string;
+    code_snippet?: string;
+}
+export declare function classifyContext(input: ClassifyInput): FindingContext;
+export declare function classifyFindings<T extends ClassifyInput & {
+    context?: FindingContext;
+}>(findings: T[]): T[];
+export {};
+//# sourceMappingURL=context-classifier.d.ts.map

package/dist/utils/context-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-classifier.d.ts","sourceRoot":"","sources":["../../src/utils/context-classifier.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,UAAU,aAAa;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAgED,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAapE;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,aAAa,GAAG;IAAE,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,EACrF,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAKL"}