@hookwarden/engine 0.0.1 → 0.1.0

package/dist/types/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/types/handler.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,2EAA2E;AAC3E,mGAAmG;AACnG,6CAA6C;AAC7C,mDAAmD"}

package/dist/types/index.d.ts

@@ -0,0 +1,7 @@
+export type { Config } from "./config.ts";
+export type { Finding, FindingId, Severity, SourceLocation, SuppressedPayload, SuppressionSource, Verdict, } from "./finding.ts";
+export type { Framework, ReachableSymbol, ResolvedMiddleware, WebhookEvidence, WebhookEvidenceKind, WebhookHandler, } from "./handler.ts";
+export type { ImportEdge, MiddlewareRegistration, ParsedFile, ParseErrorRecord, ProjectModel, } from "./project-model.ts";
+export type { DeclarativeMatcher, MatcherName, PathSeverityOverride, ProviderCatalog, ProviderCatalogEntry, RuleDefinition, RulePredicate, RuleSet, } from "./rule-set.ts";
+export type { ScanMetadata, ScanResult } from "./scan-result.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EACV,OAAO,EACP,SAAS,EACT,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,4 @@
+// Public type surface for @hookwarden/engine. Anything not exported here is internal.
+// Locked by phase-2 plan 01; later plans wire the runtime against these contracts.
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,mFAAmF"}

package/dist/types/project-model.d.ts

@@ -0,0 +1,42 @@
+import type { WebhookHandler } from "./handler.ts";
+export interface ParsedFile {
+    readonly file_path: string;
+    readonly language: "javascript" | "typescript" | "python";
+    readonly dialect: "babel" | "tree-sitter-python";
+    readonly source_text: string;
+    readonly raw_ast: unknown;
+    readonly imports: ReadonlyArray<ImportEdge>;
+    readonly parse_error: ParseErrorRecord | null;
+}
+export interface ParseErrorRecord {
+    readonly message: string;
+    readonly location: {
+        readonly line: number;
+        readonly col: number;
+    };
+    readonly source: "babel" | "tree-sitter";
+}
+export interface ImportEdge {
+    readonly from_file: string;
+    readonly to_module: string;
+    readonly imported_names: ReadonlyArray<{
+        readonly local: string;
+        readonly source: string;
+    }>;
+    readonly is_default: boolean;
+}
+export interface MiddlewareRegistration {
+    readonly file_path: string;
+    readonly framework: WebhookHandler["framework"];
+    readonly app_symbol: string;
+    readonly call_site_position: number;
+    readonly middleware_name: string;
+    readonly import_source: string | null;
+}
+export interface ProjectModel {
+    readonly parsed_files: ReadonlyArray<ParsedFile>;
+    readonly handlers: ReadonlyArray<WebhookHandler>;
+    readonly middleware_registrations: ReadonlyArray<MiddlewareRegistration>;
+    readonly import_graph: ReadonlyArray<ImportEdge>;
+}
+//# sourceMappingURL=project-model.d.ts.map

package/dist/types/project-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-model.d.ts","sourceRoot":"","sources":["../../src/types/project-model.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC/C;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAAC;CAC1C;AAGD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACjD,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACzE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAClD"}

package/dist/types/project-model.js

@@ -0,0 +1,5 @@
+// D-25: Hybrid normalization layer — ParsedFile retains raw AST plus normalized concepts.
+// D-26: Normalized layer = WebhookHandler + MiddlewareChain + ImportEdge ONLY in v1.
+// D-27: Parse errors are all-or-nothing — one parse-error Finding per failed file.
+export {};
+//# sourceMappingURL=project-model.js.map

package/dist/types/project-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-model.js","sourceRoot":"","sources":["../../src/types/project-model.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,qFAAqF;AACrF,mFAAmF"}

package/dist/types/rule-set.d.ts

@@ -0,0 +1,42 @@
+import type { Severity, Verdict } from "./finding.ts";
+import type { WebhookHandler } from "./handler.ts";
+import type { ProjectModel } from "./project-model.ts";
+export interface ProviderCatalogEntry {
+    readonly signature_header: ReadonlyArray<string>;
+    readonly sdk_packages: ReadonlyArray<string>;
+    readonly sdk_verify_calls: ReadonlyArray<string>;
+    readonly secret_env_prefix: ReadonlyArray<string>;
+    readonly secret_literal_prefix: ReadonlyArray<string>;
+    readonly conventional_paths: ReadonlyArray<string>;
+}
+export type ProviderCatalog = Readonly<Record<string, ProviderCatalogEntry>>;
+export type MatcherName = "importMissing" | "callMatches" | "argumentEquals" | "middlewareOrder" | "secretLiteralPrefix" | "signatureHeaderRead";
+export interface DeclarativeMatcher {
+    readonly name: MatcherName;
+    readonly args: Readonly<Record<string, string | number | boolean | ReadonlyArray<string>>>;
+}
+export type RulePredicate = (handler: WebhookHandler, model: ProjectModel) => Promise<Verdict | null>;
+export interface PathSeverityOverride {
+    readonly patterns: ReadonlyArray<string>;
+    readonly severity: Severity;
+}
+export interface RuleDefinition {
+    readonly rule_id: string;
+    readonly provider: string;
+    readonly severity: Severity;
+    readonly emits_state: Verdict;
+    readonly message: string;
+    readonly matcher: DeclarativeMatcher | null;
+    readonly predicate_name: string | null;
+    readonly applies_to: ReadonlyArray<WebhookHandler["framework"]> | "all";
+    readonly provider_docs_url: string;
+    readonly path_severity_overrides: ReadonlyArray<PathSeverityOverride> | null;
+}
+export interface RuleSet {
+    readonly schema_version: number;
+    readonly rule_pack_version: string;
+    readonly providers: ProviderCatalog;
+    readonly rules: ReadonlyArray<RuleDefinition>;
+    readonly predicates: Readonly<Record<string, RulePredicate>>;
+}
+//# sourceMappingURL=rule-set.d.ts.map

package/dist/types/rule-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-set.d.ts","sourceRoot":"","sources":["../../src/types/rule-set.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAG7E,MAAM,MAAM,WAAW,GACnB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CAC5F;AAGD,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAI7B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC;IAGxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,uBAAuB,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CAC9D"}

package/dist/types/rule-set.js

@@ -0,0 +1,6 @@
+// D-03: RuleSet is pre-parsed by the caller; engine never reads YAML.
+// D-28: Declarative matchers + signed TS predicate escape hatch.
+// D-29: Rule emits state directly.
+// D-33: ProviderCatalog ships in @hookwarden/rules; consumed via RuleSet.
+export {};
+//# sourceMappingURL=rule-set.js.map

package/dist/types/rule-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-set.js","sourceRoot":"","sources":["../../src/types/rule-set.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,iEAAiE;AACjE,mCAAmC;AACnC,0EAA0E"}

package/dist/types/scan-result.d.ts

@@ -0,0 +1,19 @@
+import type { Finding } from "./finding.ts";
+import type { WebhookHandler } from "./handler.ts";
+export interface ScanMetadata {
+    readonly engine_version: string;
+    readonly engine_commit_sha: string | null;
+    readonly rule_pack_version: string;
+    readonly rule_pack_content_hash: string;
+    readonly scanned_at: string;
+    readonly parse_errors_count: number;
+    readonly parsed_files_count: number;
+    readonly total_files_count: number;
+    readonly parse_candidates_count: number;
+}
+export interface ScanResult {
+    readonly findings: ReadonlyArray<Finding>;
+    readonly inventory: ReadonlyArray<WebhookHandler>;
+    readonly metadata: ScanMetadata;
+}
+//# sourceMappingURL=scan-result.d.ts.map

package/dist/types/scan-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-result.d.ts","sourceRoot":"","sources":["../../src/types/scan-result.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAGD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC"}

package/dist/types/scan-result.js

@@ -0,0 +1,8 @@
+// D-35: ScanResult bundle shape — atomic snapshot of findings + inventory + metadata.
+// D-38: ScanMetadata fields — every field surfaced through CLI/SaaS for ENGINE-08.
+// D-64: parse_candidates_count is the extension-allowlisted denominator for the CLI-side parse-coverage gate.
+//       Population happens in Plan 09 (packages/cli/src/pipeline.ts) by overriding ScanResult.metadata
+//       after engine.evaluate(...) returns. This preserves engine purity (D-01): the engine never
+//       imports from packages/cli/, never reads the walker's allowlist, never knows the candidate count.
+export {};
+//# sourceMappingURL=scan-result.js.map

package/dist/types/scan-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-result.js","sourceRoot":"","sources":["../../src/types/scan-result.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,mFAAmF;AACnF,8GAA8G;AAC9G,uGAAuG;AACvG,kGAAkG;AAClG,yGAAyG"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const ENGINE_VERSION = "0.0.1";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,UAAU,CAAC"}

package/dist/version.js

@@ -0,0 +1,5 @@
+// Single source of truth for engine version. Changesets keeps this in lockstep with
+// package.json (D-05). Update both fields at the same commit. Plan 02-09 adds a CI gate
+// that asserts they match.
+export const ENGINE_VERSION = "0.0.1";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wFAAwF;AACxF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookwarden/engine",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "hookwarden audit engine — browser-safe, pure-functional. Performs zero I/O.",
   "license": "Apache-2.0",
   "type": "module",
@@ -25,6 +25,17 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "dependencies": {
+    "@babel/parser": "^7.29.3",
+    "picomatch": "^4.0.4",
+    "tree-sitter-python": "^0.25.0",
+    "web-tree-sitter": "^0.26.8"
+  },
+  "devDependencies": {
+    "@babel/types": "^7.29.0",
+    "@types/picomatch": "^4.0.3",
+    "fast-check": "^3.23.0"
+  },
   "scripts": {
     "test": "vitest run"
   }