@iris-code/core 0.1.0

package/dist/secrets.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasSuspectKeyword = hasSuspectKeyword;
+exports.detectHardcodedSecrets = detectHardcodedSecrets;
+const guards_1 = require("./guards");
+const SUSPECT_KEYWORDS = new Set(['key', 'token', 'secret', 'password', 'passwd', 'pwd', 'auth', 'credential', 'private', 'api', 'apikey']);
+function hasSuspectKeyword(varName) {
+    const normalized = varName
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[^A-Za-z0-9]+/g, ' ')
+        .toLowerCase();
+    const segments = normalized.split(/\s+/).filter(Boolean);
+    return segments.some(seg => SUSPECT_KEYWORDS.has(seg));
+}
+// Values that are obviously placeholders, not real credentials
+const PLACEHOLDER_RE = /your.*here|changeme|placeholder|^x{3,}$|^<[^>]+>$|^your_|^my_secret|^example|^sample|^test_|^dummy|^fake/i;
+function maskSecret(value) {
+    return `${value.slice(0, 4)}****`;
+}
+function lineOf(source, index) {
+    let count = 0;
+    for (let i = 0; i < index; i++) {
+        if (source[i] === '\n')
+            count++;
+    }
+    return count + 1;
+}
+function isPlaceholder(value, varName) {
+    if (!value || !value.trim())
+        return true;
+    const v = value.trim();
+    if (PLACEHOLDER_RE.test(v))
+        return true;
+    // Value is ALL_CAPS (e.g. YOUR_TOKEN, REPLACE_ME)
+    if (/^[A-Z][A-Z0-9_]{2,}$/.test(v))
+        return true;
+    // Value equals the variable name (e.g. password = "password")
+    if (v.toLowerCase() === varName.toLowerCase())
+        return true;
+    return false;
+}
+// Layer 1: JS/TS — const/let/var name[: type] = "value" or 'value'
+function detectLayer1Ts(source) {
+    const results = [];
+    const re = /(?:const|let|var)\s+(\w+)(?:\s*:\s*\S+)?\s*=\s*(['"])([^'"]{4,500})\2/g;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[3];
+        if (value.length < 8)
+            continue;
+        if (!hasSuspectKeyword(varName))
+            continue;
+        if (isPlaceholder(value, varName))
+            continue;
+        results.push({
+            line: lineOf(source, m.index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    }
+    return results;
+}
+// Layer 1: Go — name := "value"  or  var/const name [type] = "value"
+function detectLayer1Go(source) {
+    const results = [];
+    let m;
+    // Short var decl
+    const shortRe = /(\w+)\s*:=\s*"([^"\n]{4,500})"/g;
+    while ((m = shortRe.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[2];
+        if (value.length < 8)
+            continue;
+        if (!hasSuspectKeyword(varName))
+            continue;
+        if (isPlaceholder(value, varName))
+            continue;
+        results.push({
+            line: lineOf(source, m.index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    }
+    // Explicit var/const decl
+    const varRe = /(?:var|const)\s+(\w+)(?:\s+\w+)?\s*=\s*"([^"\n]{4,500})"/g;
+    while ((m = varRe.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[2];
+        if (value.length < 8)
+            continue;
+        if (!hasSuspectKeyword(varName))
+            continue;
+        if (isPlaceholder(value, varName))
+            continue;
+        results.push({
+            line: lineOf(source, m.index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    }
+    return results;
+}
+// Layer 1: Python — name = "value" or name = 'value'
+function detectLayer1Py(source) {
+    const results = [];
+    const re = /^[ \t]*(\w+)\s*=\s*(?:"([^"\n]{4,500})"|'([^'\n]{4,500})')/gm;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[2] ?? m[3];
+        if (value.length < 8)
+            continue;
+        if (!hasSuspectKeyword(varName))
+            continue;
+        if (isPlaceholder(value, varName))
+            continue;
+        results.push({
+            line: lineOf(source, m.index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    }
+    return results;
+}
+// Layer 1: Ruby constants, locals, instance/class variables and hash-style config.
+function detectLayer1Ruby(source) {
+    const results = [];
+    const re = /^[ \t]*(?:(?:self\.)?([A-Za-z_]\w*[!?]?)|(@@?[A-Za-z_]\w*)|:([A-Za-z_]\w*))\s*(?:=>|:)??\s*=\s*(?:"([^"\n]{4,500})"|'([^'\n]{4,500})')/gm;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const varName = m[1] ?? m[2] ?? m[3];
+        const value = m[4] ?? m[5];
+        if (!varName || !value || value.length < 8 || !hasSuspectKeyword(varName) || isPlaceholder(value, varName))
+            continue;
+        results.push({ line: lineOf(source, m.index), variable: varName, pattern: 'suspicious-name', message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`, value, maskedValue: maskSecret(value) });
+    }
+    return results;
+}
+// MSBuild properties whose NAME contains a suspect keyword but whose value is
+// never a credential. UserSecretsId is the important one: it is the id of the
+// out-of-tree secrets file, so flagging it would punish the very feature that
+// keeps secrets out of the repo.
+const CSHARP_XML_EXEMPT_PROPERTIES = new Set([
+    'usersecretsid', 'assemblyoriginatorkeyfile', 'keyoriginatorfile', 'publicsign',
+    'signassembly', 'delaysign', 'packagelicensefile', 'privateassets',
+]);
+// Layer 1: C# fields, properties, locals, and XML project properties.
+// `var` is included on purpose - `var apiKey = "..."` is at least as common in
+// C# as an explicitly typed field, and typing it `string` is optional.
+function detectLayer1CSharp(source) {
+    const results = [];
+    const assignRe = /(?:(?:const|readonly|static|private|protected|internal|public|required|volatile)\s+)*\b(?:string|var)\s+([A-Za-z_]\w*)\s*(?:\{[^}]*\}\s*)?=\s*(?:@?"([^"\n]{4,500})"|"""([^"\n]{4,500})""")/g;
+    let m;
+    while ((m = assignRe.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[2] ?? m[3];
+        if (!varName || !value || value.length < 8 || !hasSuspectKeyword(varName) || isPlaceholder(value, varName))
+            continue;
+        results.push({ line: lineOf(source, m.index), variable: varName, pattern: 'suspicious-name', message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`, value, maskedValue: maskSecret(value) });
+    }
+    const xmlRe = /<([A-Za-z_][\w.-]*(?:Key|Token|Secret|Password|Credential|Private|Pwd)[\w.-]*)>([^<]{8,500})<\/\1>/gi;
+    while ((m = xmlRe.exec(source)) !== null) {
+        const varName = m[1];
+        const value = m[2].trim();
+        if (!value || CSHARP_XML_EXEMPT_PROPERTIES.has(varName.toLowerCase()) || isPlaceholder(value, varName))
+            continue;
+        // A value made only of MSBuild property/item references - $(ApiToken),
+        // @(Items), %(Meta) - is injected at build time from CI or a secret store.
+        // That is the FIX for this rule, so flagging it would punish it.
+        if (/^(?:[$@%]\([^)]+\)|\s)+$/.test(value))
+            continue;
+        results.push({ line: lineOf(source, m.index), variable: varName, pattern: 'suspicious-name', message: `Possible hardcoded secret: ${varName} assigned directly in project XML`, value, maskedValue: maskSecret(value) });
+    }
+    return results;
+}
+// Layer 2: Known secret format patterns — language-agnostic, scan full source
+const KNOWN_PATTERNS = [
+    { re: /sk-[a-zA-Z0-9]{10,}/g, name: 'OpenAI/Stripe secret key (sk-)' },
+    // Stripe live/restricted keys use underscores, so the sk- pattern above
+    // never matched them - gap found in the 2026-07-19 security pass.
+    { re: /[sr]k_live_[a-zA-Z0-9]{16,}/g, name: 'Stripe live key (sk_live_/rk_live_)' },
+    { re: /ghp_[a-zA-Z0-9]{36,}/g, name: 'GitHub PAT (ghp_)' },
+    { re: /ghs_[a-zA-Z0-9]{36,}/g, name: 'GitHub token (ghs_)' },
+    { re: /github_pat_[a-zA-Z0-9_]{36,}/g, name: 'GitHub fine-grained PAT (github_pat_)' },
+    { re: /glpat-[a-zA-Z0-9_-]{20,}/g, name: 'GitLab PAT (glpat-)' },
+    { re: /npm_[a-zA-Z0-9]{36,}/g, name: 'npm access token (npm_)' },
+    { re: /SG\.[a-zA-Z0-9_-]{16,}\.[a-zA-Z0-9_-]{16,}/g, name: 'SendGrid API key (SG.)' },
+    { re: /xoxb-[a-zA-Z0-9-]{10,}/g, name: 'Slack bot token (xoxb-)' },
+    { re: /xoxp-[a-zA-Z0-9-]{10,}/g, name: 'Slack user token (xoxp-)' },
+    { re: /AIza[a-zA-Z0-9_-]{35}/g, name: 'Google API key (AIza)' },
+    { re: /AKIA[A-Z0-9]{16}/g, name: 'AWS access key (AKIA)' },
+    { re: /Bearer\s+[a-zA-Z0-9_\-.=+/]{20,}/g, name: 'Inline Bearer token' },
+    { re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g, name: 'Private key material (PEM header)' },
+];
+function detectLayer2(source) {
+    const results = [];
+    for (const { re, name } of KNOWN_PATTERNS) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(source)) !== null) {
+            results.push({
+                line: lineOf(source, m.index),
+                pattern: name,
+                message: `Possible hardcoded secret: ${name} detected`,
+                value: m[0],
+                maskedValue: maskSecret(m[0]),
+            });
+        }
+    }
+    return results;
+}
+function detectHardcodedSecrets(source, config, language, filePath = '') {
+    if (!config.enableSecretsDetection)
+        return [];
+    // In test files, fixture credentials (e.g. password="secret123") are expected
+    // and not real. Skip the suspicious-name heuristic (Layer 1) there, but keep
+    // Layer 2 so a genuinely leaked provider token (AWS/Stripe/GitHub/...) is still
+    // flagged even when it appears in a test.
+    const layer1 = (0, guards_1.isTestFile)(filePath)
+        ? []
+        : language === 'go' ? detectLayer1Go(source) :
+            language === 'python' ? detectLayer1Py(source) :
+                language === 'ruby' ? detectLayer1Ruby(source) :
+                    language === 'csharp' ? detectLayer1CSharp(source) :
+                        detectLayer1Ts(source);
+    const layer2 = detectLayer2(source);
+    // Suppress Layer 2 hits on lines already flagged by Layer 1 (avoid duplicate Problems entries)
+    const layer1Lines = new Set(layer1.map(s => s.line));
+    const uniqueLayer2 = layer2.filter(s => !layer1Lines.has(s.line));
+    return [...layer1, ...uniqueLayer2];
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":";;AAOA,8CAOC;AAoND,wDA2BC;AA3PD,qCAAqC;AAGrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE3I,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,WAAW,EAAE,CAAA;IAChB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,+DAA+D;AAC/D,MAAM,cAAc,GAAG,2GAA2G,CAAA;AAElI,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAA;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,KAAK,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,CAAA;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAe;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,kDAAkD;IAClD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,8DAA8D;IAC9D,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAA;IAC1D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,EAAE,GAAG,wEAAwE,CAAA;IACnF,IAAI,CAAyB,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,SAAQ;QACzC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QAC3C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,8BAA8B,OAAO,wCAAwC;YACtF,KAAK;YACL,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,qEAAqE;AACrE,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,IAAI,CAAyB,CAAA;IAE7B,iBAAiB;IACjB,MAAM,OAAO,GAAG,iCAAiC,CAAA;IACjD,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,SAAQ;QACzC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QAC3C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,8BAA8B,OAAO,wCAAwC;YACtF,KAAK;YACL,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,2DAA2D,CAAA;IACzE,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,SAAQ;QACzC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QAC3C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,8BAA8B,OAAO,wCAAwC;YACtF,KAAK;YACL,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,EAAE,GAAG,8DAA8D,CAAA;IACzE,IAAI,CAAyB,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,SAAQ;QACzC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QAC3C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,8BAA8B,OAAO,wCAAwC;YACtF,KAAK;YACL,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,EAAE,GAAG,0IAA0I,CAAA;IACrJ,IAAI,CAAyB,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QACpH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,OAAO,wCAAwC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/N,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AACjC,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,eAAe,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,YAAY;IAC/E,cAAc,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe;CACnE,CAAC,CAAA;AAEF,sEAAsE;AACtE,+EAA+E;AAC/E,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,8LAA8L,CAAA;IAC/M,IAAI,CAAyB,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QACpH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,OAAO,wCAAwC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/N,CAAC;IAED,MAAM,KAAK,GAAG,sGAAsG,CAAA;IACpH,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,SAAQ;QAChH,uEAAuE;QACvE,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,OAAO,mCAAmC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1N,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAOD,8EAA8E;AAC9E,MAAM,cAAc,GAAiB;IACnC,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACtE,wEAAwE;IACxE,kEAAkE;IAClE,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,qCAAqC,EAAE;IACnF,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC1D,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC5D,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,uCAAuC,EAAE;IACtF,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAChE,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAChE,EAAE,EAAE,EAAE,6CAA6C,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACrF,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAClE,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACnE,EAAE,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC/D,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC1D,EAAE,EAAE,EAAE,mCAAmC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACxE,EAAE,EAAE,EAAE,yDAAyD,EAAE,IAAI,EAAE,mCAAmC,EAAE;CAC7G,CAAA;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;QAC1C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAA;QAChB,IAAI,CAAyB,CAAA;QAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC7B,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,8BAA8B,IAAI,WAAW;gBACtD,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;gBACX,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAc,EACd,MAAkB,EAClB,QAAkB,EAClB,QAAQ,GAAG,EAAE;IAEb,IAAI,CAAC,MAAM,CAAC,sBAAsB;QAAE,OAAO,EAAE,CAAA;IAE7C,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChD,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChD,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;wBACpD,cAAc,CAAC,MAAM,CAAC,CAAA;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAEnC,+FAA+F;IAC/F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAEjE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,CAAA;AACrC,CAAC"}

package/dist/securityContext.d.ts

@@ -0,0 +1,2 @@
+export declare function hasSecurityContext(text: string, index: number): boolean;
+//# sourceMappingURL=securityContext.d.ts.map

package/dist/securityContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityContext.d.ts","sourceRoot":"","sources":["../src/securityContext.ts"],"names":[],"mappings":"AASA,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIvE"}

package/dist/securityContext.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasSecurityContext = hasSecurityContext;
+const secrets_1 = require("./secrets");
+// Math.random()/rand.Intn()/random.random() are only a security smell when
+// the value feeds something security-sensitive (a token, key, password, ...).
+// Most calls are UI jitter, sampling, or test data, so a nearby suspect
+// keyword is required before flagging - otherwise every RNG call would fire.
+const CONTEXT_CHARS_BEFORE = 200;
+const CONTEXT_CHARS_AFTER = 60;
+function hasSecurityContext(text, index) {
+    const start = Math.max(0, index - CONTEXT_CHARS_BEFORE);
+    const end = Math.min(text.length, index + CONTEXT_CHARS_AFTER);
+    return (0, secrets_1.hasSuspectKeyword)(text.slice(start, end));
+}
+//# sourceMappingURL=securityContext.js.map

package/dist/securityContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityContext.js","sourceRoot":"","sources":["../src/securityContext.ts"],"names":[],"mappings":";;AASA,gDAIC;AAbD,uCAA6C;AAE7C,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,SAAgB,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,oBAAoB,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,mBAAmB,CAAC,CAAA;IAC9D,OAAO,IAAA,2BAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;AAClD,CAAC"}

package/dist/sfc.d.ts

@@ -0,0 +1,32 @@
+import type { Language } from './types';
+export type SingleFileComponentKind = 'vue' | 'svelte';
+export interface SfcScriptBlock {
+    /** Zero-based source offsets. The content excludes the opening/closing tags. */
+    start: number;
+    end: number;
+    startLine: number;
+    endLine: number;
+    language: 'javascript' | 'typescript';
+    attributes: string;
+}
+export interface PreparedSource {
+    source: string;
+    language: Language;
+    kind: 'source' | SingleFileComponentKind | 'erb';
+    scriptBlocks: readonly SfcScriptBlock[];
+}
+export declare function singleFileComponentKind(filePath: string): SingleFileComponentKind | null;
+export declare function isSingleFileComponent(filePath: string): boolean;
+/**
+ * Extract every executable script region from a Vue or Svelte component.
+ *
+ * Non-script characters become spaces while CR/LF characters are retained.
+ * The result therefore has the same length and line layout as the component,
+ * allowing every existing analyser and suppression/duplicate finding to report
+ * native SFC line numbers without a host-specific remapping layer.
+ */
+export declare function extractSfcScripts(source: string, filePath: string): PreparedSource;
+export declare function prepareSourceForAnalysis(source: string, filePath: string): PreparedSource;
+/** Extract executable ERB tags while retaining byte offsets and native lines. */
+export declare function extractErbRuby(source: string): PreparedSource;
+//# sourceMappingURL=sfc.d.ts.map

package/dist/sfc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sfc.d.ts","sourceRoot":"","sources":["../src/sfc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,YAAY,GAAG,YAAY,CAAA;IACrC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,QAAQ,GAAG,uBAAuB,GAAG,KAAK,CAAA;IAChD,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;CACxC;AAMD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAGxF;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAgFD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAmElF;AAcD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAGzF;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CA2B7D"}

package/dist/sfc.js

@@ -0,0 +1,228 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.singleFileComponentKind = singleFileComponentKind;
+exports.isSingleFileComponent = isSingleFileComponent;
+exports.extractSfcScripts = extractSfcScripts;
+exports.prepareSourceForAnalysis = prepareSourceForAnalysis;
+exports.extractErbRuby = extractErbRuby;
+const lines_1 = require("./lines");
+const SFC_EXTENSION_RE = /\.(vue|svelte)$/i;
+const LANG_ATTRIBUTE_RE = /(?:^|\s)lang\s*=\s*(?:["']([^"']+)["']|([^\s]+))/i;
+const VOID_ELEMENTS = new Set(['area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source', 'track', 'wbr']);
+function singleFileComponentKind(filePath) {
+    const match = SFC_EXTENSION_RE.exec(filePath);
+    return match ? match[1].toLowerCase() : null;
+}
+function isSingleFileComponent(filePath) {
+    return singleFileComponentKind(filePath) !== null;
+}
+function scriptLanguage(attributes) {
+    const match = LANG_ATTRIBUTE_RE.exec(attributes);
+    if (!match)
+        return 'javascript';
+    const value = (match[1] ?? match[2] ?? '').toLowerCase();
+    if (value === 'ts' || value === 'typescript' || value === 'tsx')
+        return 'typescript';
+    if (value === 'js' || value === 'javascript' || value === 'jsx')
+        return 'javascript';
+    return null;
+}
+function tagEndAt(source, start) {
+    let quote = null;
+    for (let index = start; index < source.length; index++) {
+        const character = source[index];
+        if (quote) {
+            if (character === quote)
+                quote = null;
+        }
+        else if (character === '"' || character === "'") {
+            quote = character;
+        }
+        else if (character === '>') {
+            return index;
+        }
+    }
+    return -1;
+}
+/** True only when a script tag is at component root, not rendered markup. */
+function isTopLevelScript(structure, offset) {
+    const stack = [];
+    let svelteBlockDepth = 0;
+    let index = 0;
+    while (index < offset) {
+        if (structure[index] === '{' && structure[index + 1] === '#') {
+            svelteBlockDepth++;
+            index += 2;
+            continue;
+        }
+        if (structure[index] === '{' && structure[index + 1] === '/') {
+            svelteBlockDepth = Math.max(0, svelteBlockDepth - 1);
+            index += 2;
+            continue;
+        }
+        if (structure[index] !== '<') {
+            index++;
+            continue;
+        }
+        if (structure.slice(index, index + 4).join('') === '<!--') {
+            const end = structure.slice(index + 4).join('').indexOf('-->');
+            index = end === -1 ? offset : index + 4 + end + 3;
+            continue;
+        }
+        const closing = structure[index + 1] === '/';
+        let nameStart = index + (closing ? 2 : 1);
+        if (!/[A-Za-z]/.test(structure[nameStart] ?? '')) {
+            index++;
+            continue;
+        }
+        let nameEnd = nameStart + 1;
+        while (/[\w:.-]/.test(structure[nameEnd] ?? ''))
+            nameEnd++;
+        const name = structure.slice(nameStart, nameEnd).join('').toLowerCase();
+        const tagEnd = tagEndAt(structure, nameEnd);
+        if (tagEnd === -1 || tagEnd >= offset)
+            break;
+        if (closing) {
+            const matching = stack.lastIndexOf(name);
+            if (matching !== -1)
+                stack.splice(matching);
+        }
+        else {
+            let slash = tagEnd - 1;
+            while (slash > nameEnd && /\s/.test(structure[slash]))
+                slash--;
+            if (structure[slash] !== '/' && !VOID_ELEMENTS.has(name))
+                stack.push(name);
+        }
+        index = tagEnd + 1;
+    }
+    return stack.length === 0 && svelteBlockDepth === 0;
+}
+/**
+ * Extract every executable script region from a Vue or Svelte component.
+ *
+ * Non-script characters become spaces while CR/LF characters are retained.
+ * The result therefore has the same length and line layout as the component,
+ * allowing every existing analyser and suppression/duplicate finding to report
+ * native SFC line numbers without a host-specific remapping layer.
+ */
+function extractSfcScripts(source, filePath) {
+    const kind = singleFileComponentKind(filePath);
+    if (!kind) {
+        return {
+            source,
+            language: languageForRegularFile(filePath),
+            kind: 'source',
+            scriptBlocks: [],
+        };
+    }
+    const output = Array.from(source, character => character === '\n' || character === '\r' ? character : ' ');
+    const structure = Array.from(source);
+    const blocks = [];
+    const openTag = /<script(?=\s|>)/gi;
+    let match;
+    while ((match = openTag.exec(source)) !== null) {
+        const topLevel = isTopLevelScript(structure, match.index);
+        // Vue's `generic` attribute may itself contain `>` characters. Find the
+        // real tag end instead of relying on `[^>]*`, respecting quoted values.
+        const tagEnd = tagEndAt(source, openTag.lastIndex);
+        if (tagEnd === -1)
+            break;
+        const attributes = source.slice(openTag.lastIndex, tagEnd);
+        openTag.lastIndex = tagEnd + 1;
+        if (/\/\s*$/.test(attributes))
+            continue;
+        const contentStart = tagEnd + 1;
+        const closeTag = /<\/script\s*>/gi;
+        closeTag.lastIndex = contentStart;
+        const close = closeTag.exec(source);
+        const contentEnd = close?.index ?? source.length;
+        const language = scriptLanguage(attributes);
+        for (let index = contentStart; index < contentEnd; index++) {
+            if (structure[index] !== '\n' && structure[index] !== '\r')
+                structure[index] = ' ';
+        }
+        if (!topLevel || !language) {
+            if (!close)
+                break;
+            openTag.lastIndex = close.index + close[0].length;
+            continue;
+        }
+        for (let index = contentStart; index < contentEnd; index++) {
+            output[index] = source[index];
+        }
+        blocks.push({
+            start: contentStart,
+            end: contentEnd,
+            startLine: (0, lines_1.lineOf)(source, contentStart),
+            endLine: (0, lines_1.lineOf)(source, contentEnd),
+            language,
+            attributes,
+        });
+        if (!close)
+            break;
+        openTag.lastIndex = close.index + close[0].length;
+    }
+    return {
+        source: output.join(''),
+        // A component containing any TypeScript block must be analysed with the TS
+        // metrics enabled. Plain/missing script tags use JavaScript semantics.
+        language: blocks.some(block => block.language === 'typescript') ? 'typescript' : 'javascript',
+        kind,
+        scriptBlocks: blocks,
+    };
+}
+function languageForRegularFile(filePath) {
+    const lower = filePath.toLowerCase();
+    if (lower.endsWith('.go'))
+        return 'go';
+    if (lower.endsWith('.py') || lower.endsWith('.pyw'))
+        return 'python';
+    if (/\.(?:rb|rbw|rake|gemspec|ru|thor|builder|jbuilder|rabl|arb|podspec|erb|rhtml)$/.test(lower))
+        return 'ruby';
+    if (/\.(?:cs|csproj)$/.test(lower))
+        return 'csharp';
+    const base = lower.replace(/\\/g, '/').split('/').pop() ?? lower;
+    if (new Set(['appfile', 'berksfile', 'brewfile', 'capfile', 'dangerfile', 'deliverfile', 'fastfile', 'gemfile', 'guardfile', 'gymfile', 'matchfile', 'podfile', 'pluginfile', 'puppetfile', 'rakefile', 'scanfile', 'snapfile', 'thorfile', 'vagrantfile', '.irbrc', '.pryrc']).has(base))
+        return 'ruby';
+    if (/\.(js|jsx|mjs|cjs)$/.test(lower))
+        return 'javascript';
+    return 'typescript';
+}
+function prepareSourceForAnalysis(source, filePath) {
+    if (/\.(?:erb|rhtml)$/i.test(filePath))
+        return extractErbRuby(source);
+    return extractSfcScripts(source, filePath);
+}
+/** Extract executable ERB tags while retaining byte offsets and native lines. */
+function extractErbRuby(source) {
+    const output = Array.from(source, character => character === '\n' || character === '\r' ? character : ' ');
+    const blocks = [];
+    const open = /<%(?!%)([-=#]?)/g;
+    let match;
+    while ((match = open.exec(source)) !== null) {
+        const marker = match[1];
+        const contentStart = open.lastIndex;
+        const close = /-?%>/g;
+        close.lastIndex = contentStart;
+        const endMatch = close.exec(source);
+        const contentEnd = endMatch?.index ?? source.length;
+        if (marker !== '#') {
+            for (let index = contentStart; index < contentEnd; index++)
+                output[index] = source[index];
+            blocks.push({
+                start: contentStart,
+                end: contentEnd,
+                startLine: (0, lines_1.lineOf)(source, contentStart),
+                endLine: (0, lines_1.lineOf)(source, contentEnd),
+                language: 'javascript',
+                attributes: marker,
+            });
+        }
+        if (!endMatch)
+            break;
+        open.lastIndex = endMatch.index + endMatch[0].length;
+    }
+    return { source: output.join(''), language: 'ruby', kind: 'erb', scriptBlocks: blocks };
+}
+//# sourceMappingURL=sfc.js.map

package/dist/sfc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sfc.js","sourceRoot":"","sources":["../src/sfc.ts"],"names":[],"mappings":";;AA0BA,0DAGC;AAED,sDAEC;AAwFD,8CAmEC;AAcD,4DAGC;AAGD,wCA2BC;AA1OD,mCAA0C;AAqB1C,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAC3C,MAAM,iBAAiB,GAAG,mDAAmD,CAAA;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAE9I,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAA6B,CAAC,CAAC,CAAC,IAAI,CAAA;AACzE,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAA;AACnD,CAAC;AAGD,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAA;IAC/B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,YAAY,CAAA;IACpF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,YAAY,CAAA;IACpF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkC,EAAE,KAAa;IACjE,IAAI,KAAK,GAAqB,IAAI,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,SAAS,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAA;QACvC,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAClD,KAAK,GAAG,SAAS,CAAA;QACnB,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAA;AACX,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,SAA4B,EAAE,MAAc;IACpE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,OAAO,KAAK,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,gBAAgB,EAAE,CAAA;YAClB,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACpD,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9D,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAA;QAC5C,IAAI,SAAS,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,KAAK,EAAE,CAAA;YACP,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,GAAG,SAAS,GAAG,CAAC,CAAA;QAC3B,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,EAAE,CAAA;QAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC3C,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,IAAI,MAAM;YAAE,MAAK;QAE5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC7C,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,GAAG,MAAM,GAAG,CAAC,CAAA;YACtB,OAAO,KAAK,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,EAAE,CAAA;YAC9D,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5E,CAAC;QACD,KAAK,GAAG,MAAM,GAAG,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,MAAc,EAAE,QAAgB;IAChE,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,CAAC;YAC1C,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,EAAE;SACjB,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAa,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACpH,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAA;IACnC,IAAI,KAA6B,CAAA;IAEjC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAEzD,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,MAAM,KAAK,CAAC,CAAC;YAAE,MAAK;QAExB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC1D,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,CAAC,CAAA;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,SAAQ;QACvC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,iBAAiB,CAAA;QAClC,QAAQ,CAAC,SAAS,GAAG,YAAY,CAAA;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAA;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;QAC3C,KAAK,IAAI,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,MAAK;YACjB,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACjD,SAAQ;QACV,CAAC;QAED,KAAK,IAAI,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,YAAY;YACnB,GAAG,EAAE,UAAU;YACf,SAAS,EAAE,IAAA,cAAM,EAAC,MAAM,EAAE,YAAY,CAAC;YACvC,OAAO,EAAE,IAAA,cAAM,EAAC,MAAM,EAAE,UAAU,CAAC;YACnC,QAAQ;YACR,UAAU;SACX,CAAC,CAAA;QAEF,IAAI,CAAC,KAAK;YAAE,MAAK;QACjB,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACnD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,uEAAuE;QACvE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAC7F,IAAI;QACJ,YAAY,EAAE,MAAM;KACrB,CAAA;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAA;IACpE,IAAI,gFAAgF,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAC/G,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAA;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IACxS,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IAC1D,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,SAAgB,wBAAwB,CAAC,MAAc,EAAE,QAAgB;IACvE,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;IACrE,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,iFAAiF;AACjF,SAAgB,cAAc,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAa,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACpH,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,kBAAkB,CAAA;IAC/B,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAA;QACnC,MAAM,KAAK,GAAG,OAAO,CAAA;QACrB,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,UAAU,GAAG,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAA;QACnD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,KAAK,IAAI,KAAK,GAAG,YAAY,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YACzF,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,YAAY;gBACnB,GAAG,EAAE,UAAU;gBACf,SAAS,EAAE,IAAA,cAAM,EAAC,MAAM,EAAE,YAAY,CAAC;gBACvC,OAAO,EAAE,IAAA,cAAM,EAAC,MAAM,EAAE,UAAU,CAAC;gBACnC,QAAQ,EAAE,YAAY;gBACtB,UAAU,EAAE,MAAM;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,MAAK;QACpB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAA;AACzF,CAAC"}

package/dist/slop.d.ts

@@ -0,0 +1,37 @@
+export type SlopBand = 'clean' | 'drifting' | 'slop';
+export type SlopContributorKey = 'duplication' | 'security' | 'suppressions' | 'type-debt' | 'debug-prints' | 'complexity' | 'todos' | 'file-naming';
+export interface SlopScoreInput {
+    totalCodeLines: number;
+    fileCount: number;
+    typeScriptFileCount: number;
+    duplicationPercent: number;
+    duplicateBlockCount: number;
+    bareSuppressionCount: number;
+    suppressedCount: number;
+    securitySmellCount: number;
+    anyUsageCount: number;
+    missingReturnTypeCount: number;
+    debugPrintCount: number;
+    todoCount: number;
+    highComplexityFileCount: number;
+    namingViolationCount: number;
+}
+export interface SlopContributor {
+    key: SlopContributorKey;
+    label: string;
+    rawValue: number;
+    points: number;
+}
+export interface SlopScoreResult {
+    score: number;
+    band: SlopBand;
+    contributors: SlopContributor[];
+}
+export declare const SLOP_WEIGHTS: Readonly<Record<SlopContributorKey, number>>;
+export declare const SLOP_SATURATION: Readonly<Record<SlopContributorKey, number>>;
+export declare const SLOP_BANDS: {
+    readonly cleanMax: 24;
+    readonly driftingMax: 54;
+};
+export declare function computeSlopScore(input: SlopScoreInput): SlopScoreResult;
+//# sourceMappingURL=slop.d.ts.map

package/dist/slop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slop.d.ts","sourceRoot":"","sources":["../src/slop.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAA;AAEpD,MAAM,MAAM,kBAAkB,GAC1B,aAAa,GACb,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,YAAY,GACZ,OAAO,GACP,aAAa,CAAA;AAEjB,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,sBAAsB,EAAE,MAAM,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,kBAAkB,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,eAAe,EAAE,CAAA;CAChC;AAED,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CASrE,CAAA;AAID,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CASxE,CAAA;AAED,eAAO,MAAM,UAAU;;;CAGb,CAAA;AAYV,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CA2CvE"}