@datahogo/core 0.1.0

package/dist/utils/context-classifier.js

@@ -0,0 +1,79 @@
+// Context classifier — determines if a finding is in production code,
+// test files, examples, config, rule definitions, or vendored code.
+// Used to separate real issues from noise in scan reports.
+// Order matters: first match wins.
+// Use (^|\/) to match both "test/foo.ts" and "src/test/foo.ts".
+const PATH_RULES = [
+    // Test files
+    { pattern: /\.test\.[cm]?[tj]sx?$/, context: "test" },
+    { pattern: /\.spec\.[cm]?[tj]sx?$/, context: "test" },
+    { pattern: /(^|\/)__tests__\//, context: "test" },
+    { pattern: /(^|\/)__mocks__\//, context: "test" },
+    { pattern: /(^|\/)fixtures?\//i, context: "test" },
+    { pattern: /(^|\/)test\//, context: "test" },
+    { pattern: /(^|\/)tests\//, context: "test" },
+    { pattern: /(^|\/)e2e\//, context: "test" },
+    { pattern: /(^|\/)cypress\//, context: "test" },
+    { pattern: /(^|\/)playwright\//, context: "test" },
+    { pattern: /\.stories\.[tj]sx?$/, context: "test" },
+    { pattern: /vitest\.config/, context: "test" },
+    { pattern: /jest\.config/, context: "test" },
+    { pattern: /playwright\.config/, context: "test" },
+    { pattern: /setup-e2e/, context: "test" },
+    { pattern: /setup-test/, context: "test" },
+    { pattern: /seed\.(ts|js|sql)$/i, context: "test" },
+    { pattern: /(^|\/)seeds?\//, context: "test" },
+    // Rule definitions and scanner engine code
+    { pattern: /(^|\/)rules\/.*\.ya?ml$/, context: "rule" },
+    { pattern: /\.semgrep\.ya?ml$/, context: "rule" },
+    { pattern: /\.gitleaks\.toml$/, context: "rule" },
+    { pattern: /worker\/src\/engines\//, context: "rule" },
+    { pattern: /worker\/src\/scanning\//, context: "rule" },
+    // Examples and documentation
+    { pattern: /(^|\/)content\//, context: "example" },
+    { pattern: /(^|\/)docs\//, context: "example" },
+    { pattern: /(^|\/)examples?\//, context: "example" },
+    { pattern: /(^|\/)demos?\//, context: "example" },
+    { pattern: /(^|\/)tutorials?\//, context: "example" },
+    { pattern: /(^|\/)samples?\//, context: "example" },
+    { pattern: /\.example\.[^/]+$/, context: "example" },
+    { pattern: /(^|\/)messages\/.*\.json$/, context: "example" },
+    // Config, scripts, and infrastructure
+    { pattern: /(^|\/)scripts\//, context: "config" },
+    { pattern: /(^|\/)\.github\/workflows\//, context: "config" },
+    { pattern: /(^|\/)\.circleci\//, context: "config" },
+    { pattern: /\.gitlab-ci\.ya?ml$/, context: "config" },
+    { pattern: /Jenkinsfile$/, context: "config" },
+    { pattern: /(^|\/)infra\//, context: "config" },
+    { pattern: /(^|\/)terraform\//, context: "config" },
+    { pattern: /(^|\/)pulumi\//, context: "config" },
+    { pattern: /(^|\/)supabase\/migrations\//, context: "config" },
+    { pattern: /(^|\/)migrations\//, context: "config" },
+    { pattern: /(^|\/)prisma\/migrations\//, context: "config" },
+    // Vendored / generated
+    { pattern: /(^|\/)vendor\//, context: "vendored" },
+    { pattern: /(^|\/)generated\//, context: "vendored" },
+    { pattern: /\.gen\.[tj]sx?$/, context: "vendored" },
+    { pattern: /\.generated\.[tj]sx?$/, context: "vendored" },
+    { pattern: /(^|\/)dist\//, context: "vendored" },
+    { pattern: /(^|\/)node_modules\//, context: "vendored" },
+];
+export function classifyContext(input) {
+    const filePath = input.file_path ?? "";
+    // No file path = URL scanner or DB rules findings = always production
+    if (!filePath)
+        return "production";
+    for (const rule of PATH_RULES) {
+        if (rule.pattern.test(filePath)) {
+            return rule.context;
+        }
+    }
+    return "production";
+}
+export function classifyFindings(findings) {
+    return findings.map((f) => ({
+        ...f,
+        context: classifyContext(f),
+    }));
+}
+//# sourceMappingURL=context-classifier.js.map

package/dist/utils/context-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-classifier.js","sourceRoot":"","sources":["../../src/utils/context-classifier.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,oEAAoE;AACpE,2DAA2D;AAS3D,mCAAmC;AACnC,gEAAgE;AAChE,MAAM,UAAU,GAAwD;IACtE,aAAa;IACb,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;IACrD,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;IACrD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE;IAClD,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE;IAC7C,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE;IAC3C,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE;IAC/C,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE;IAClD,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE;IACnD,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE;IAC9C,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE;IAClD,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE;IACzC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1C,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE;IACnD,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE;IAE9C,2CAA2C;IAC3C,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE;IACvD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE;IACjD,EAAE,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE;IACtD,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE;IAEvD,6BAA6B;IAC7B,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE;IAClD,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC/C,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE;IACpD,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE;IACjD,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE;IACrD,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE;IACnD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE;IACpD,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,SAAS,EAAE;IAE5D,sCAAsC;IACtC,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACjD,EAAE,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC7D,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACpD,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrD,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9C,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC/C,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE;IAChD,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9D,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACpD,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,QAAQ,EAAE;IAE5D,uBAAuB;IACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE;IAClD,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE;IACrD,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE;IACnD,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,EAAE;IACzD,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE;IAChD,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU,EAAE;CACzD,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAEvC,sEAAsE;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAa;IAEb,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,CAAC;QACJ,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/utils/exec.d.ts

@@ -0,0 +1,18 @@
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export interface ExecOptions {
+    timeoutMs: number;
+    cwd?: string;
+    env?: Record<string, string>;
+    maxBuffer?: number;
+}
+/**
+ * Execute a command with timeout. Returns stdout/stderr/exitCode.
+ * Throws on timeout or signal kill. Does NOT throw on non-zero exit code
+ * (many tools like gitleaks/npm audit exit non-zero when they find issues).
+ */
+export declare function execWithTimeout(command: string, args: string[], options: ExecOptions): Promise<ExecResult>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/utils/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAqDrB"}

package/dist/utils/exec.js

@@ -0,0 +1,51 @@
+// Shared utility for running external tool binaries with timeout support.
+// Uses execFile (not exec) to avoid shell injection — critical for a security product.
+import { execFile } from "./child-process.js";
+import { warn } from "./logger.js";
+const DEFAULT_MAX_BUFFER = 10 * 1024 * 1024; // 10MB
+/**
+ * Execute a command with timeout. Returns stdout/stderr/exitCode.
+ * Throws on timeout or signal kill. Does NOT throw on non-zero exit code
+ * (many tools like gitleaks/npm audit exit non-zero when they find issues).
+ */
+export function execWithTimeout(command, args, options) {
+    return new Promise((resolve, reject) => {
+        const child = execFile(command, args, {
+            cwd: options.cwd,
+            env: options.env ? { ...process.env, ...options.env } : undefined,
+            maxBuffer: options.maxBuffer ?? DEFAULT_MAX_BUFFER,
+            timeout: 0, // We handle timeout ourselves for graceful kill
+        }, (error, stdout, stderr) => {
+            clearTimeout(timer);
+            if (timedOut) {
+                return; // Already rejected by timeout handler
+            }
+            if (error && error.killed) {
+                reject(new Error(`${command} was killed by signal`));
+                return;
+            }
+            // Non-zero exit code is NOT an error — tools like gitleaks exit 1 on findings
+            const exitCode = error?.code !== undefined
+                ? (typeof error.code === "number" ? error.code : 1)
+                : 0;
+            resolve({ stdout, stderr, exitCode });
+        });
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            warn(`${command} timed out after ${options.timeoutMs}ms, sending SIGTERM`);
+            child.kill("SIGTERM");
+            // Force kill after 5s if still alive
+            const forceKillTimer = setTimeout(() => {
+                if (!child.killed) {
+                    warn(`${command} did not exit after SIGTERM, sending SIGKILL`);
+                    child.kill("SIGKILL");
+                }
+            }, 5000);
+            forceKillTimer.unref();
+            reject(new Error(`${command} timed out after ${options.timeoutMs}ms`));
+        }, options.timeoutMs);
+        timer.unref();
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/utils/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,uFAAuF;AAEvF,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAenC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAEpD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,IAAc,EACd,OAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,IAAI,EACJ;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YACjE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;YAClD,OAAO,EAAE,CAAC,EAAE,gDAAgD;SAC7D,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,sCAAsC;YAChD,CAAC;YAED,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,KAAK,SAAS;gBACxC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC,CAAC,CAAC,CAAC;YAEN,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC,CACF,CAAC;QAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,GAAG,OAAO,oBAAoB,OAAO,CAAC,SAAS,qBAAqB,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAEtB,qCAAqC;YACrC,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBACrC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,IAAI,CAAC,GAAG,OAAO,8CAA8C,CAAC,CAAC;oBAC/D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,cAAc,CAAC,KAAK,EAAE,CAAC;YAEvB,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,oBAAoB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/file-filter.d.ts

@@ -0,0 +1,4 @@
+export declare function isRelevantFile(filePath: string): boolean;
+export declare function filterFiles(files: Map<string, string>): Map<string, string>;
+export declare function getFileLanguage(filePath: string): string;
+//# sourceMappingURL=file-filter.d.ts.map

package/dist/utils/file-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-filter.d.ts","sourceRoot":"","sources":["../../src/utils/file-filter.ts"],"names":[],"mappings":"AAiCA,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgBxD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ3E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUxD"}

package/dist/utils/file-filter.js

@@ -0,0 +1,68 @@
+const SCANNABLE_EXTENSIONS = [
+    // JavaScript / TypeScript
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
+    // Languages covered by the multi-tech scan agents
+    ".py", ".go", ".java", ".kt", ".kts", ".php", ".cs", ".fs",
+    ".rb", ".rs", ".dart",
+    // Config / data formats (includes pyproject.toml, Cargo.toml, etc.)
+    ".json", ".yaml", ".yml", ".toml", ".gradle", ".sql", ".rules",
+    ".csproj", ".fsproj", ".sln",
+    ".env", ".env.local", ".env.production",
+];
+const SCANNABLE_EXACT_FILES = [
+    ".gitignore", "Dockerfile", "docker-compose.yml", "docker-compose.yaml",
+    ".dockerignore", "Makefile", ".npmrc", ".yarnrc",
+    "vercel.json", "netlify.toml", "tsconfig.json",
+    ".eslintrc.json", ".eslintrc.js", ".prettierrc",
+    "next.config.js", "next.config.ts", "next.config.mjs",
+    "firebase.json", "firestore.rules", "storage.rules",
+    "supabase/config.toml",
+    ".env.example",
+    // Manifests the TechDetector relies on for non-JS stacks
+    "requirements.txt", "Pipfile", "go.mod", "go.sum",
+    "pom.xml", "Gemfile", "Gemfile.lock",
+];
+const SKIP_DIRECTORIES = [
+    "node_modules", ".next", ".git", "dist", "build", ".cache",
+    "coverage", ".nyc_output", "__pycache__", ".venv",
+];
+const MAX_FILE_SIZE = 500_000; // 500KB - skip very large files
+export function isRelevantFile(filePath) {
+    // Skip hidden/build directories (allow .github for workflow scanning)
+    const parts = filePath.split("/");
+    for (const part of parts.slice(0, -1)) {
+        if (part === ".github")
+            continue; // Allow .github/workflows/
+        if (SKIP_DIRECTORIES.includes(part))
+            return false;
+        if (part.startsWith(".") && part !== ".")
+            return false; // Skip other hidden dirs
+    }
+    const fileName = parts[parts.length - 1];
+    // Check exact file matches
+    if (SCANNABLE_EXACT_FILES.includes(fileName))
+        return true;
+    // Check extensions
+    return SCANNABLE_EXTENSIONS.some(ext => fileName.endsWith(ext));
+}
+export function filterFiles(files) {
+    const filtered = new Map();
+    for (const [path, content] of files) {
+        if (isRelevantFile(path) && content.length <= MAX_FILE_SIZE) {
+            filtered.set(path, content);
+        }
+    }
+    return filtered;
+}
+export function getFileLanguage(filePath) {
+    const ext = filePath.split(".").pop()?.toLowerCase();
+    const langMap = {
+        ts: "typescript", tsx: "typescript",
+        js: "javascript", jsx: "javascript", mjs: "javascript", cjs: "javascript",
+        json: "json", yaml: "yaml", yml: "yaml",
+        sql: "sql", rules: "text",
+        env: "dotenv",
+    };
+    return langMap[ext || ""] || "text";
+}
+//# sourceMappingURL=file-filter.js.map

package/dist/utils/file-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-filter.js","sourceRoot":"","sources":["../../src/utils/file-filter.ts"],"names":[],"mappings":"AAAA,MAAM,oBAAoB,GAAG;IAC3B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,kDAAkD;IAClD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;IAC1D,KAAK,EAAE,KAAK,EAAE,OAAO;IACrB,oEAAoE;IACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ;IAC9D,SAAS,EAAE,SAAS,EAAE,MAAM;IAC5B,MAAM,EAAE,YAAY,EAAE,iBAAiB;CACxC,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC5B,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,qBAAqB;IACvE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;IAChD,aAAa,EAAE,cAAc,EAAE,eAAe;IAC9C,gBAAgB,EAAE,cAAc,EAAE,aAAa;IAC/C,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB;IACrD,eAAe,EAAE,iBAAiB,EAAE,eAAe;IACnD,sBAAsB;IACtB,cAAc;IACd,yDAAyD;IACzD,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IACjD,SAAS,EAAE,SAAS,EAAE,cAAc;CACrC,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;IAC1D,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO;CAClD,CAAC;AAEF,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,gCAAgC;AAE/D,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,sEAAsE;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,2BAA2B;QAC7D,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEzC,2BAA2B;IAC3B,IAAI,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,mBAAmB;IACnB,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA0B;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;YAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACrD,MAAM,OAAO,GAA2B;QACtC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY;QACnC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY;QACzE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;QACvC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;QACzB,GAAG,EAAE,QAAQ;KACd,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC;AACtC,CAAC"}

package/dist/utils/fs.d.ts

@@ -0,0 +1,2 @@
+export { readFile, rm, access } from "node:fs/promises";
+//# sourceMappingURL=fs.d.ts.map

package/dist/utils/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/utils/fs.js

@@ -0,0 +1,5 @@
+// Re-export fs/promises functions for testability.
+// Vitest cannot reliably mock node:fs/promises builtins,
+// so engines import from this module instead.
+export { readFile, rm, access } from "node:fs/promises";
+//# sourceMappingURL=fs.js.map

package/dist/utils/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,yDAAyD;AACzD,8CAA8C;AAE9C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/utils/logger.d.ts

@@ -0,0 +1,12 @@
+interface LogContext {
+    scanId?: string;
+    engine?: string;
+    duration?: number;
+    [key: string]: unknown;
+}
+export declare function log(message: string, context?: LogContext): void;
+export declare function warn(message: string, context?: LogContext): void;
+export declare function error(message: string, context?: LogContext): void;
+export declare function debug(message: string, context?: LogContext): void;
+export {};
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAEA,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAE/D;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAEhE;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAEjE;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAIjE"}

package/dist/utils/logger.js

@@ -0,0 +1,27 @@
+function formatLog(level, message, context) {
+    const timestamp = new Date().toISOString();
+    const prefix = context?.scanId ? `[scan:${context.scanId}]` : "";
+    const enginePrefix = context?.engine ? `[${context.engine}]` : "";
+    const extra = context
+        ? Object.entries(context)
+            .filter(([key]) => key !== "scanId" && key !== "engine")
+            .map(([key, value]) => `${key}=${value}`)
+            .join(" ")
+        : "";
+    return `${timestamp} ${level.toUpperCase()} ${prefix}${enginePrefix} ${message}${extra ? " " + extra : ""}`;
+}
+export function log(message, context) {
+    console.log(formatLog("info", message, context));
+}
+export function warn(message, context) {
+    console.warn(formatLog("warn", message, context));
+}
+export function error(message, context) {
+    console.error(formatLog("error", message, context));
+}
+export function debug(message, context) {
+    if (process.env.DEBUG === "true") {
+        console.debug(formatLog("debug", message, context));
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AASA,SAAS,SAAS,CAAC,KAAe,EAAE,OAAe,EAAE,OAAoB;IACvE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,CAAC;aACvD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;aACxC,IAAI,CAAC,GAAG,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,GAAG,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,MAAM,GAAG,YAAY,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,OAAoB;IACvD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAe,EAAE,OAAoB;IACxD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,OAAoB;IACzD,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,OAAoB;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/utils/post-processor.d.ts

@@ -0,0 +1,10 @@
+import type { FindingData } from "../engines/types.js";
+/**
+ * Run all four post-processing steps on the aggregated findings.
+ *
+ * @param findings   Deduplicated, context-classified findings from all engines.
+ * @param technologies  Technology list from detectTechnologies().technologies.
+ * @returns          Processed findings ready for score calculation.
+ */
+export declare function postProcessFindings(findings: FindingData[], technologies: string[]): FindingData[];
+//# sourceMappingURL=post-processor.d.ts.map

package/dist/utils/post-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-processor.d.ts","sourceRoot":"","sources":["../../src/utils/post-processor.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAyMvD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,WAAW,EAAE,EACvB,YAAY,EAAE,MAAM,EAAE,GACrB,WAAW,EAAE,CAMf"}

package/dist/utils/post-processor.js

@@ -0,0 +1,183 @@
+// Post-processing pipeline for scan findings.
+// Runs after all engines complete but before score calculation.
+// Steps (in order):
+//   1. Framework-aware suppressions — mark findings that are known framework
+//      requirements so they don't penalize the score.
+//   2. Cross-engine deduplication — merge findings for the same root cause
+//      that survived the primary dedup (different file_path, same vuln_id).
+//   3. Contextual notes — add description_simple for specific patterns.
+//   4. Classification — label each finding as "actionable" or "informational".
+// Keys are lowercased technology names as returned by detectTechnologies().
+const FRAMEWORK_RULES = {
+    nextjs: [
+        {
+            vulnerability_id: 63,
+            title_contains: "unsafe-inline",
+            note: "Next.js App Router requires 'unsafe-inline' in script-src for hydration. This cannot be removed without breaking the framework.",
+        },
+        {
+            vulnerability_id: 99,
+            title_contains: "robots.txt",
+            note: "robots.txt is standard web practice and expected on production sites.",
+        },
+    ],
+    supabase: [
+        {
+            vulnerability_id: 67,
+            cookie_name_starts: "sb-",
+            note: "Supabase Auth manages cookie security flags through its SDK configuration.",
+        },
+        {
+            vulnerability_id: 68,
+            cookie_name_starts: "sb-",
+            note: "Supabase Auth cookies require client-side JavaScript access for session refresh.",
+        },
+    ],
+    "next-intl": [
+        {
+            vulnerability_id: 67,
+            cookie_name: "NEXT_LOCALE",
+            note: "next-intl locale cookie requires client-side JavaScript access for locale synchronization.",
+        },
+        {
+            vulnerability_id: 68,
+            cookie_name: "NEXT_LOCALE",
+            note: "next-intl locale cookie requires client-side JavaScript access for locale synchronization.",
+        },
+    ],
+};
+function matchesFrameworkRule(finding, rule) {
+    if (finding.vulnerability_id !== rule.vulnerability_id)
+        return false;
+    if (rule.title_contains !== undefined) {
+        if (!finding.title.toLowerCase().includes(rule.title_contains.toLowerCase())) {
+            return false;
+        }
+    }
+    if (rule.cookie_name_starts !== undefined) {
+        const snippet = finding.code_snippet ?? finding.title ?? "";
+        if (!snippet.includes(rule.cookie_name_starts))
+            return false;
+    }
+    if (rule.cookie_name !== undefined) {
+        const snippet = finding.code_snippet ?? finding.title ?? "";
+        if (!snippet.includes(rule.cookie_name))
+            return false;
+    }
+    return true;
+}
+function applyFrameworkSuppressions(findings, technologies) {
+    // Normalize tech names to lowercase for lookup.
+    const normalizedTechs = technologies.map((t) => t.toLowerCase());
+    // Collect applicable rules based on detected technologies.
+    const applicableRules = [];
+    for (const tech of normalizedTechs) {
+        const rules = FRAMEWORK_RULES[tech];
+        if (rules) {
+            applicableRules.push(...rules);
+        }
+    }
+    if (applicableRules.length === 0)
+        return findings;
+    return findings.map((finding) => {
+        for (const rule of applicableRules) {
+            if (matchesFrameworkRule(finding, rule)) {
+                return {
+                    ...finding,
+                    is_framework_requirement: true,
+                    framework_note: rule.note,
+                };
+            }
+        }
+        return finding;
+    });
+}
+// ---------------------------------------------------------------------------
+// Step 2: Cross-Engine Deduplication
+// ---------------------------------------------------------------------------
+// The primary dedup in orchestrator.ts groups by vulnerability_id + file_path +
+// line_number. That misses cases where two engines report the same root cause
+// at different levels — e.g. the config engine points to next.config.ts while
+// the URL scanner has no file_path at all. Group by vulnerability_id alone when
+// one side lacks a file_path and keep whichever finding HAS a file_path.
+function crossEngineDedup(findings) {
+    // Separate findings that have a file_path from those that don't.
+    const withPath = [];
+    const withoutPath = [];
+    for (const f of findings) {
+        if (f.file_path) {
+            withPath.push(f);
+        }
+        else {
+            withoutPath.push(f);
+        }
+    }
+    // For each no-path finding, check if there is already a with-path finding
+    // for the same vulnerability_id. If yes, skip the no-path finding (the
+    // with-path one is more actionable). Otherwise keep it.
+    const withPathVulnIds = new Set(withPath.map((f) => f.vulnerability_id));
+    const filteredWithoutPath = withoutPath.filter((f) => !withPathVulnIds.has(f.vulnerability_id));
+    return [...withPath, ...filteredWithoutPath];
+}
+// ---------------------------------------------------------------------------
+// Step 3: Contextual Notes
+// ---------------------------------------------------------------------------
+function addContextualNotes(findings) {
+    return findings.map((finding) => {
+        // Don't overwrite an existing description_simple.
+        if (finding.description_simple)
+            return finding;
+        if (finding.is_framework_requirement && finding.framework_note) {
+            return { ...finding, description_simple: finding.framework_note };
+        }
+        if (finding.category === "headers" && finding.severity === "info") {
+            return {
+                ...finding,
+                description_simple: "This is informational — no action required.",
+            };
+        }
+        if (finding.severity === "low" && finding.confidence === "low") {
+            return {
+                ...finding,
+                description_simple: "This is a low-confidence observation. Verify manually before acting.",
+            };
+        }
+        return finding;
+    });
+}
+// ---------------------------------------------------------------------------
+// Step 4: Classification
+// ---------------------------------------------------------------------------
+function classifyFindings(findings) {
+    return findings.map((finding) => {
+        let classification;
+        if (finding.is_framework_requirement) {
+            classification = "informational";
+        }
+        else if (finding.severity === "info") {
+            classification = "informational";
+        }
+        else {
+            classification = "actionable";
+        }
+        return { ...finding, classification };
+    });
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Run all four post-processing steps on the aggregated findings.
+ *
+ * @param findings   Deduplicated, context-classified findings from all engines.
+ * @param technologies  Technology list from detectTechnologies().technologies.
+ * @returns          Processed findings ready for score calculation.
+ */
+export function postProcessFindings(findings, technologies) {
+    const step1 = applyFrameworkSuppressions(findings, technologies);
+    const step2 = crossEngineDedup(step1);
+    const step3 = addContextualNotes(step2);
+    const step4 = classifyFindings(step3);
+    return step4;
+}
+//# sourceMappingURL=post-processor.js.map

package/dist/utils/post-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-processor.js","sourceRoot":"","sources":["../../src/utils/post-processor.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,gEAAgE;AAChE,oBAAoB;AACpB,6EAA6E;AAC7E,sDAAsD;AACtD,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAmB/E,4EAA4E;AAC5E,MAAM,eAAe,GAAoC;IACvD,MAAM,EAAE;QACN;YACE,gBAAgB,EAAE,EAAE;YACpB,cAAc,EAAE,eAAe;YAC/B,IAAI,EAAE,iIAAiI;SACxI;QACD;YACE,gBAAgB,EAAE,EAAE;YACpB,cAAc,EAAE,YAAY;YAC5B,IAAI,EAAE,uEAAuE;SAC9E;KACF;IACD,QAAQ,EAAE;QACR;YACE,gBAAgB,EAAE,EAAE;YACpB,kBAAkB,EAAE,KAAK;YACzB,IAAI,EAAE,4EAA4E;SACnF;QACD;YACE,gBAAgB,EAAE,EAAE;YACpB,kBAAkB,EAAE,KAAK;YACzB,IAAI,EAAE,kFAAkF;SACzF;KACF;IACD,WAAW,EAAE;QACX;YACE,gBAAgB,EAAE,EAAE;YACpB,WAAW,EAAE,aAAa;YAC1B,IAAI,EAAE,4FAA4F;SACnG;QACD;YACE,gBAAgB,EAAE,EAAE;YACpB,WAAW,EAAE,aAAa;YAC1B,IAAI,EAAE,4FAA4F;SACnG;KACF;CACF,CAAC;AAEF,SAAS,oBAAoB,CAAC,OAAoB,EAAE,IAAmB;IACrE,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAErE,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAuB,EACvB,YAAsB;IAEtB,gDAAgD;IAChD,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEjE,2DAA2D;IAC3D,MAAM,eAAe,GAAoB,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,eAAe,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAElD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO;oBACL,GAAG,OAAO;oBACV,wBAAwB,EAAE,IAAI;oBAC9B,cAAc,EAAE,IAAI,CAAC,IAAI;iBAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AAEzE,SAAS,gBAAgB,CAAC,QAAuB;IAC/C,iEAAiE;IACjE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAkB,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAChD,CAAC;IAEF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,QAAuB;IACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,kDAAkD;QAClD,IAAI,OAAO,CAAC,kBAAkB;YAAE,OAAO,OAAO,CAAC;QAE/C,IAAI,OAAO,CAAC,wBAAwB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC/D,OAAO,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClE,OAAO;gBACL,GAAG,OAAO;gBACV,kBAAkB,EAAE,6CAA6C;aAClE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC/D,OAAO;gBACL,GAAG,OAAO;gBACV,kBAAkB,EAChB,sEAAsE;aACzE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,QAAuB;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,cAA8C,CAAC;QAEnD,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,cAAc,GAAG,eAAe,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACvC,cAAc,GAAG,eAAe,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;QAED,OAAO,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAuB,EACvB,YAAsB;IAEtB,MAAM,KAAK,GAAG,0BAA0B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@datahogo/core",
+  "version": "0.1.0",
+  "description": "Data Hogo scan engine — 300+ security checks for JS/TS, Python, Go, Java, PHP, C#, mobile and Supabase. Runs locally.",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/datahogo/datahogo.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://datahogo.com",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc && cp -R src/rules dist/rules",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "sast",
+    "static-analysis",
+    "vulnerability",
+    "secrets-detection"
+  ],
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.6.0"
+  }
+}