@js-recon/js-recon 1.4.4 → 2.0.1-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (440) hide show
  1. package/.claude-sync/sync.sh +1 -1
  2. package/.github/dependabot.yml +50 -0
  3. package/.github/workflows/build-and-prettify.yaml +49 -19
  4. package/.github/workflows/codeql.yml +33 -0
  5. package/.github/workflows/exploit-smoke-test.yaml +160 -0
  6. package/.github/workflows/framework-detection-smoke-test.yaml +135 -0
  7. package/.github/workflows/plumber.yml +20 -0
  8. package/.github/workflows/promote-js-recon.yml +5 -3
  9. package/.github/workflows/publish-js-recon.yml +31 -2
  10. package/.github/workflows/rules-smoke-test.yaml +13 -5
  11. package/.nvmrc +1 -0
  12. package/.plumber.yaml +151 -0
  13. package/CHANGELOG.md +55 -0
  14. package/CONTRIBUTING.md +32 -0
  15. package/Dockerfile +1 -0
  16. package/README.md +3 -2
  17. package/SECURITY.md +1 -1
  18. package/build/analyze/engine/astEngine.js +10 -9
  19. package/build/analyze/engine/astEngine.js.map +1 -1
  20. package/build/analyze/engine/csMastSEngine.js +6 -6
  21. package/build/analyze/engine/csMastSEngine.js.map +1 -1
  22. package/build/analyze/engine/index.js +1 -1
  23. package/build/analyze/engine/index.js.map +1 -1
  24. package/build/analyze/engine/requestEngine.js +6 -6
  25. package/build/analyze/engine/requestEngine.js.map +1 -1
  26. package/build/analyze/helpers/determineCompatibleVersion.js +70 -0
  27. package/build/analyze/helpers/determineCompatibleVersion.js.map +1 -0
  28. package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js +9 -3
  29. package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map +1 -1
  30. package/build/analyze/helpers/initRules.js +9 -9
  31. package/build/analyze/helpers/initRules.js.map +1 -1
  32. package/build/analyze/helpers/outputHelper.js +3 -3
  33. package/build/analyze/helpers/outputHelper.js.map +1 -1
  34. package/build/analyze/helpers/schemas.js +1 -0
  35. package/build/analyze/helpers/schemas.js.map +1 -1
  36. package/build/analyze/helpers/validate.js +9 -5
  37. package/build/analyze/helpers/validate.js.map +1 -1
  38. package/build/analyze/index.js +26 -16
  39. package/build/analyze/index.js.map +1 -1
  40. package/build/cliProgram.js +733 -0
  41. package/build/cliProgram.js.map +1 -0
  42. package/build/completion/index.js +247 -382
  43. package/build/completion/index.js.map +1 -1
  44. package/build/completion/introspect.js +17 -0
  45. package/build/completion/introspect.js.map +1 -0
  46. package/build/config/applicationConfig.js +3 -2
  47. package/build/config/applicationConfig.js.map +1 -1
  48. package/build/cs_mast/index.js +18 -17
  49. package/build/cs_mast/index.js.map +1 -1
  50. package/build/endpoints/gen_report/gen_json.js +2 -2
  51. package/build/endpoints/gen_report/gen_json.js.map +1 -1
  52. package/build/endpoints/gen_report/utility/iterate_n_store.js +1 -1
  53. package/build/endpoints/gen_report/utility/iterate_n_store.js.map +1 -1
  54. package/build/endpoints/index.js +12 -12
  55. package/build/endpoints/index.js.map +1 -1
  56. package/build/endpoints/next_js/client_jsFilesHref.js +3 -3
  57. package/build/endpoints/next_js/client_jsFilesHref.js.map +1 -1
  58. package/build/endpoints/next_js/client_jsonParse.js +4 -4
  59. package/build/endpoints/next_js/client_jsonParse.js.map +1 -1
  60. package/build/endpoints/next_js/client_mappedJsonFile.js +6 -6
  61. package/build/endpoints/next_js/client_mappedJsonFile.js.map +1 -1
  62. package/build/endpoints/next_js/client_subsequentRequests.js +5 -5
  63. package/build/endpoints/next_js/client_subsequentRequests.js.map +1 -1
  64. package/build/exploit/angular/cve-2026-68945.js +61 -0
  65. package/build/exploit/angular/cve-2026-68945.js.map +1 -0
  66. package/build/exploit/index.js +60 -0
  67. package/build/exploit/index.js.map +1 -0
  68. package/build/exploit/next/cve-2025-29927.js +65 -0
  69. package/build/exploit/next/cve-2025-29927.js.map +1 -0
  70. package/build/exploit/next/cve-2026-64645.js +51 -0
  71. package/build/exploit/next/cve-2026-64645.js.map +1 -0
  72. package/build/exploit/nuxt/cve-2026-71315.js +47 -0
  73. package/build/exploit/nuxt/cve-2026-71315.js.map +1 -0
  74. package/build/exploit/nuxt/cve-2026-71320.js +114 -0
  75. package/build/exploit/nuxt/cve-2026-71320.js.map +1 -0
  76. package/build/exploit/react/cve-2025-55182.js +116 -0
  77. package/build/exploit/react/cve-2025-55182.js.map +1 -0
  78. package/build/exploit/registry/cveRegistry.js +115 -0
  79. package/build/exploit/registry/cveRegistry.js.map +1 -0
  80. package/build/exploit/types.js +2 -0
  81. package/build/exploit/types.js.map +1 -0
  82. package/build/exploit/utility/compareResponses.js +29 -0
  83. package/build/exploit/utility/compareResponses.js.map +1 -0
  84. package/build/exploit/utility/outputHelper.js +22 -0
  85. package/build/exploit/utility/outputHelper.js.map +1 -0
  86. package/build/exploit/utility/rawRequest.js +56 -0
  87. package/build/exploit/utility/rawRequest.js.map +1 -0
  88. package/build/exploit/utility/sandboxRce.js +49 -0
  89. package/build/exploit/utility/sandboxRce.js.map +1 -0
  90. package/build/exploit/utility/toEngineOutput.js +28 -0
  91. package/build/exploit/utility/toEngineOutput.js.map +1 -0
  92. package/build/exploit/utility/wsClient.js +78 -0
  93. package/build/exploit/utility/wsClient.js.map +1 -0
  94. package/build/exploit/vite/cve-2025-30208.js +44 -0
  95. package/build/exploit/vite/cve-2025-30208.js.map +1 -0
  96. package/build/exploit/vite/cve-2026-39363.js +60 -0
  97. package/build/exploit/vite/cve-2026-39363.js.map +1 -0
  98. package/build/fingerprint/index.js +3 -2
  99. package/build/fingerprint/index.js.map +1 -1
  100. package/build/globalConfig.js +2 -2
  101. package/build/globalConfig.js.map +1 -1
  102. package/build/index.js +5 -596
  103. package/build/index.js.map +1 -1
  104. package/build/lazyLoad/angular/angular_getFromPageSource.js +3 -3
  105. package/build/lazyLoad/angular/angular_getFromPageSource.js.map +1 -1
  106. package/build/lazyLoad/downloadFilesUtil.js +14 -11
  107. package/build/lazyLoad/downloadFilesUtil.js.map +1 -1
  108. package/build/lazyLoad/downloadQueue.js +9 -1
  109. package/build/lazyLoad/downloadQueue.js.map +1 -1
  110. package/build/lazyLoad/downloadResponse.js +1 -0
  111. package/build/lazyLoad/downloadResponse.js.map +1 -1
  112. package/build/lazyLoad/generic/generic_crawlPages.js +186 -0
  113. package/build/lazyLoad/generic/generic_crawlPages.js.map +1 -0
  114. package/build/lazyLoad/generic/generic_downloadFiles.js +81 -0
  115. package/build/lazyLoad/generic/generic_downloadFiles.js.map +1 -0
  116. package/build/lazyLoad/generic/generic_extractLinks.js +79 -0
  117. package/build/lazyLoad/generic/generic_extractLinks.js.map +1 -0
  118. package/build/lazyLoad/generic/generic_getScriptTags.js +152 -0
  119. package/build/lazyLoad/generic/generic_getScriptTags.js.map +1 -0
  120. package/build/lazyLoad/generic/generic_importMapDiscovery.js +87 -0
  121. package/build/lazyLoad/generic/generic_importMapDiscovery.js.map +1 -0
  122. package/build/lazyLoad/generic/generic_resolveScope.js +66 -0
  123. package/build/lazyLoad/generic/generic_resolveScope.js.map +1 -0
  124. package/build/lazyLoad/generic/generic_scanAttributesForJs.js +122 -0
  125. package/build/lazyLoad/generic/generic_scanAttributesForJs.js.map +1 -0
  126. package/build/lazyLoad/generic/generic_stringsDiscovery.js +103 -0
  127. package/build/lazyLoad/generic/generic_stringsDiscovery.js.map +1 -0
  128. package/build/lazyLoad/generic/generic_webpackChunkPaths.js +56 -0
  129. package/build/lazyLoad/generic/generic_webpackChunkPaths.js.map +1 -0
  130. package/build/lazyLoad/globals.js +31 -0
  131. package/build/lazyLoad/globals.js.map +1 -1
  132. package/build/lazyLoad/index.js +172 -75
  133. package/build/lazyLoad/index.js.map +1 -1
  134. package/build/lazyLoad/methodFilter.js +9 -1
  135. package/build/lazyLoad/methodFilter.js.map +1 -1
  136. package/build/lazyLoad/next_js/NextJsCrawler.js +98 -14
  137. package/build/lazyLoad/next_js/NextJsCrawler.js.map +1 -1
  138. package/build/lazyLoad/next_js/next_GetJSScript.js +3 -3
  139. package/build/lazyLoad/next_js/next_GetJSScript.js.map +1 -1
  140. package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js +4 -4
  141. package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js.map +1 -1
  142. package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js +17 -11
  143. package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js.map +1 -1
  144. package/build/lazyLoad/next_js/next_SubsequentRequests.js +7 -6
  145. package/build/lazyLoad/next_js/next_SubsequentRequests.js.map +1 -1
  146. package/build/lazyLoad/next_js/next_bruteForceJsFiles.js +1 -1
  147. package/build/lazyLoad/next_js/next_bruteForceJsFiles.js.map +1 -1
  148. package/build/lazyLoad/next_js/next_buildId.js +2 -2
  149. package/build/lazyLoad/next_js/next_buildId.js.map +1 -1
  150. package/build/lazyLoad/next_js/next_getClientSidePaths.js +2 -2
  151. package/build/lazyLoad/next_js/next_getClientSidePaths.js.map +1 -1
  152. package/build/lazyLoad/next_js/next_parseLayoutJs.js +6 -6
  153. package/build/lazyLoad/next_js/next_parseLayoutJs.js.map +1 -1
  154. package/build/lazyLoad/next_js/next_promiseResolve.js +1 -1
  155. package/build/lazyLoad/next_js/next_promiseResolve.js.map +1 -1
  156. package/build/lazyLoad/next_js/next_routerStateForge.js +407 -0
  157. package/build/lazyLoad/next_js/next_routerStateForge.js.map +1 -0
  158. package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js +1 -1
  159. package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js.map +1 -1
  160. package/build/lazyLoad/next_js/next_serverActionIdScan.js +77 -0
  161. package/build/lazyLoad/next_js/next_serverActionIdScan.js.map +1 -0
  162. package/build/lazyLoad/nuxt_js/nuxt_astParse.js +15 -13
  163. package/build/lazyLoad/nuxt_js/nuxt_astParse.js.map +1 -1
  164. package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js +2 -2
  165. package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js.map +1 -1
  166. package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js +3 -3
  167. package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js.map +1 -1
  168. package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js +29 -5
  169. package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js.map +1 -1
  170. package/build/lazyLoad/react/react_sourcemapUrls.js +7 -28
  171. package/build/lazyLoad/react/react_sourcemapUrls.js.map +1 -1
  172. package/build/lazyLoad/react/react_webpackChunkPaths.js +10 -202
  173. package/build/lazyLoad/react/react_webpackChunkPaths.js.map +1 -1
  174. package/build/lazyLoad/researchUtils.js +15 -0
  175. package/build/lazyLoad/researchUtils.js.map +1 -0
  176. package/build/lazyLoad/shared/webpackChunkParsers.js +218 -0
  177. package/build/lazyLoad/shared/webpackChunkParsers.js.map +1 -0
  178. package/build/lazyLoad/sourcemap.js +120 -0
  179. package/build/lazyLoad/sourcemap.js.map +1 -1
  180. package/build/lazyLoad/stagnation/stagnationMonitor.js +63 -0
  181. package/build/lazyLoad/stagnation/stagnationMonitor.js.map +1 -0
  182. package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js +1 -0
  183. package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js.map +1 -1
  184. package/build/lazyLoad/svelte/svelte_getFromPageSource.js +5 -5
  185. package/build/lazyLoad/svelte/svelte_getFromPageSource.js.map +1 -1
  186. package/build/lazyLoad/svelte/svelte_getVersionJson.js +2 -2
  187. package/build/lazyLoad/svelte/svelte_getVersionJson.js.map +1 -1
  188. package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js +6 -6
  189. package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js.map +1 -1
  190. package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js +15 -6
  191. package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js.map +1 -1
  192. package/build/lazyLoad/techDetect/checkAngularJS.js +1 -1
  193. package/build/lazyLoad/techDetect/checkAngularJS.js.map +1 -1
  194. package/build/lazyLoad/techDetect/checkNuxtJS.js +3 -3
  195. package/build/lazyLoad/techDetect/checkNuxtJS.js.map +1 -1
  196. package/build/lazyLoad/techDetect/checkSvelte.js +0 -1
  197. package/build/lazyLoad/techDetect/checkSvelte.js.map +1 -1
  198. package/build/lazyLoad/techDetect/checkVueJS.js +6 -6
  199. package/build/lazyLoad/techDetect/checkVueJS.js.map +1 -1
  200. package/build/lazyLoad/techDetect/index.js +17 -1
  201. package/build/lazyLoad/techDetect/index.js.map +1 -1
  202. package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js +2 -2
  203. package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js.map +1 -1
  204. package/build/lazyLoad/vue/vue_discoverJsFiles.js +13 -11
  205. package/build/lazyLoad/vue/vue_discoverJsFiles.js.map +1 -1
  206. package/build/lazyLoad/vue/vue_getClientSidePaths.js +1 -1
  207. package/build/lazyLoad/vue/vue_getClientSidePaths.js.map +1 -1
  208. package/build/lazyLoad/vue/vue_pageSrc.js +1 -1
  209. package/build/lazyLoad/vue/vue_pageSrc.js.map +1 -1
  210. package/build/lazyLoad/vue/vue_reconstructSourceMaps.js +12 -3
  211. package/build/lazyLoad/vue/vue_reconstructSourceMaps.js.map +1 -1
  212. package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js +2 -2
  213. package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js.map +1 -1
  214. package/build/lazyLoad/vue/vue_severalJsFilesHome.js +3 -3
  215. package/build/lazyLoad/vue/vue_severalJsFilesHome.js.map +1 -1
  216. package/build/load/index.js +28 -38
  217. package/build/load/index.js.map +1 -1
  218. package/build/map/angular_js/getAngularConnections.js +6 -6
  219. package/build/map/angular_js/getAngularConnections.js.map +1 -1
  220. package/build/map/graphql/resolveGraphql.js +6 -6
  221. package/build/map/graphql/resolveGraphql.js.map +1 -1
  222. package/build/map/index.js +17 -17
  223. package/build/map/index.js.map +1 -1
  224. package/build/map/interactive-mode/commandHandler.js +278 -0
  225. package/build/map/interactive-mode/commandHandler.js.map +1 -0
  226. package/build/map/interactive-mode/commandHelpers.js +189 -0
  227. package/build/map/interactive-mode/commandHelpers.js.map +1 -0
  228. package/build/map/interactive-mode/esqueryGen.js.map +1 -0
  229. package/build/map/interactive-mode/helpMenu.js +11 -0
  230. package/build/map/interactive-mode/helpMenu.js.map +1 -0
  231. package/build/map/interactive-mode/inputPatch.js.map +1 -0
  232. package/build/map/interactive-mode/interactive.js +71 -0
  233. package/build/map/interactive-mode/interactive.js.map +1 -0
  234. package/build/map/interactive-mode/keybindings.js.map +1 -0
  235. package/build/map/interactive-mode/printer.js.map +1 -0
  236. package/build/map/interactive-mode/ui.js.map +1 -0
  237. package/build/map/next_js/getAxiosInstances.js +5 -5
  238. package/build/map/next_js/getAxiosInstances.js.map +1 -1
  239. package/build/map/next_js/getExports.js +4 -4
  240. package/build/map/next_js/getExports.js.map +1 -1
  241. package/build/map/next_js/getFetchInstances.js +10 -10
  242. package/build/map/next_js/getFetchInstances.js.map +1 -1
  243. package/build/map/next_js/getTurbopackConnections.js +8 -8
  244. package/build/map/next_js/getTurbopackConnections.js.map +1 -1
  245. package/build/map/next_js/getWebpackConnections.js +27 -16
  246. package/build/map/next_js/getWebpackConnections.js.map +1 -1
  247. package/build/map/next_js/interactive.js +3 -65
  248. package/build/map/next_js/interactive.js.map +1 -1
  249. package/build/map/next_js/interactive_helpers/commandHandler.js +38 -290
  250. package/build/map/next_js/interactive_helpers/commandHandler.js.map +1 -1
  251. package/build/map/next_js/interactive_helpers/commandHelpers.js +0 -184
  252. package/build/map/next_js/interactive_helpers/commandHelpers.js.map +1 -1
  253. package/build/map/next_js/interactive_helpers/helpMenu.js +2 -10
  254. package/build/map/next_js/interactive_helpers/helpMenu.js.map +1 -1
  255. package/build/map/next_js/resolveAxios.js +6 -6
  256. package/build/map/next_js/resolveAxios.js.map +1 -1
  257. package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js +4 -4
  258. package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js.map +1 -1
  259. package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js +2 -2
  260. package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js.map +1 -1
  261. package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js +5 -5
  262. package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js.map +1 -1
  263. package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js +10 -10
  264. package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js.map +1 -1
  265. package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js +13 -9
  266. package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js.map +1 -1
  267. package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js +12 -8
  268. package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js.map +1 -1
  269. package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js +12 -8
  270. package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js.map +1 -1
  271. package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js +11 -11
  272. package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js.map +1 -1
  273. package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js +16 -16
  274. package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js.map +1 -1
  275. package/build/map/next_js/resolveFetch.js +23 -23
  276. package/build/map/next_js/resolveFetch.js.map +1 -1
  277. package/build/map/next_js/resolveNewRequest.js +10 -10
  278. package/build/map/next_js/resolveNewRequest.js.map +1 -1
  279. package/build/map/next_js/resolveServerActions.js +4 -4
  280. package/build/map/next_js/resolveServerActions.js.map +1 -1
  281. package/build/map/next_js/utils.js +8 -2
  282. package/build/map/next_js/utils.js.map +1 -1
  283. package/build/map/react_js/getReactConnections.js +21 -14
  284. package/build/map/react_js/getReactConnections.js.map +1 -1
  285. package/build/map/svelte_js/interactive.js +3 -54
  286. package/build/map/svelte_js/interactive.js.map +1 -1
  287. package/build/map/vue_js/getViteConnections.js +23 -16
  288. package/build/map/vue_js/getViteConnections.js.map +1 -1
  289. package/build/map/vue_js/interactive.js +3 -63
  290. package/build/map/vue_js/interactive.js.map +1 -1
  291. package/build/map/vue_js/interactive_helpers/commandHandler.js +34 -283
  292. package/build/map/vue_js/interactive_helpers/commandHandler.js.map +1 -1
  293. package/build/map/vue_js/interactive_helpers/helpMenu.js +2 -10
  294. package/build/map/vue_js/interactive_helpers/helpMenu.js.map +1 -1
  295. package/build/map/vue_js/taint_utils.js +1 -1
  296. package/build/map/vue_js/taint_utils.js.map +1 -1
  297. package/build/map/vue_js/vue_resolveFetch.js +12 -12
  298. package/build/map/vue_js/vue_resolveFetch.js.map +1 -1
  299. package/build/map/vue_js/vue_resolveHttpClient.js +18 -18
  300. package/build/map/vue_js/vue_resolveHttpClient.js.map +1 -1
  301. package/build/map/vue_js/vue_resolveXhr.js +11 -11
  302. package/build/map/vue_js/vue_resolveXhr.js.map +1 -1
  303. package/build/mcp/chatOneShot.js +7 -7
  304. package/build/mcp/chatOneShot.js.map +1 -1
  305. package/build/mcp/claudeCodeCreds.js +5 -5
  306. package/build/mcp/claudeCodeCreds.js.map +1 -1
  307. package/build/mcp/cli.js +36 -35
  308. package/build/mcp/cli.js.map +1 -1
  309. package/build/mcp/config.js +4 -4
  310. package/build/mcp/config.js.map +1 -1
  311. package/build/mcp/index.js +7 -7
  312. package/build/mcp/index.js.map +1 -1
  313. package/build/mcp/mcpServer.js +4 -3
  314. package/build/mcp/mcpServer.js.map +1 -1
  315. package/build/mcp/skills.js +1 -0
  316. package/build/mcp/skills.js.map +1 -1
  317. package/build/mcp/tools.js +6 -5
  318. package/build/mcp/tools.js.map +1 -1
  319. package/build/proxy/detectBlockedResponse.js +2 -0
  320. package/build/proxy/detectBlockedResponse.js.map +1 -1
  321. package/build/proxy/index.js +3 -3
  322. package/build/proxy/index.js.map +1 -1
  323. package/build/refactor/index.js +83 -79
  324. package/build/refactor/index.js.map +1 -1
  325. package/build/refactor/next/index.js +69 -26
  326. package/build/refactor/next/index.js.map +1 -1
  327. package/build/refactor/next/transform.js +11 -4
  328. package/build/refactor/next/transform.js.map +1 -1
  329. package/build/refactor/next/validator.js +7 -7
  330. package/build/refactor/next/validator.js.map +1 -1
  331. package/build/refactor/react/index.js +13 -13
  332. package/build/refactor/react/index.js.map +1 -1
  333. package/build/refactor/react/validator.js +7 -7
  334. package/build/refactor/react/validator.js.map +1 -1
  335. package/build/refactor/react-vite/index.js +3 -3
  336. package/build/refactor/react-vite/index.js.map +1 -1
  337. package/build/refactor/remote/hf-client.js +1 -0
  338. package/build/refactor/remote/hf-client.js.map +1 -1
  339. package/build/refactor/remote/version-detect.js +12 -12
  340. package/build/refactor/remote/version-detect.js.map +1 -1
  341. package/build/refactor/vue/index.js +6 -6
  342. package/build/refactor/vue/index.js.map +1 -1
  343. package/build/refactor/vue/vite.js +6 -6
  344. package/build/refactor/vue/vite.js.map +1 -1
  345. package/build/report/index.js +30 -8
  346. package/build/report/index.js.map +1 -1
  347. package/build/report/swaggerJacker.js +63 -0
  348. package/build/report/swaggerJacker.js.map +1 -0
  349. package/build/report/utility/dataTables/genDataTablesPage.js +2 -1
  350. package/build/report/utility/dataTables/genDataTablesPage.js.map +1 -1
  351. package/build/report/utility/genHtml.js +316 -25
  352. package/build/report/utility/genHtml.js.map +1 -1
  353. package/build/report/utility/markdownGen/addAnalyze.js +2 -1
  354. package/build/report/utility/markdownGen/addAnalyze.js.map +1 -1
  355. package/build/report/utility/populateDb/populateAnalysisFindings.js +2 -2
  356. package/build/report/utility/populateDb/populateAnalysisFindings.js.map +1 -1
  357. package/build/report/utility/populateDb/populateEndpoints.js +3 -3
  358. package/build/report/utility/populateDb/populateEndpoints.js.map +1 -1
  359. package/build/report/utility/populateDb/populateMappedJson.js +2 -2
  360. package/build/report/utility/populateDb/populateMappedJson.js.map +1 -1
  361. package/build/report/utility/populateDb/populateMappedOpenapi.js +3 -3
  362. package/build/report/utility/populateDb/populateMappedOpenapi.js.map +1 -1
  363. package/build/report/utility/severityColors.js +35 -0
  364. package/build/report/utility/severityColors.js.map +1 -0
  365. package/build/run/bundler-detect.js +45 -9
  366. package/build/run/bundler-detect.js.map +1 -1
  367. package/build/run/dashboard/dashboardHtml.js +150 -0
  368. package/build/run/dashboard/dashboardHtml.js.map +1 -0
  369. package/build/run/dashboard/fsBrowser.js +43 -0
  370. package/build/run/dashboard/fsBrowser.js.map +1 -0
  371. package/build/run/dashboard/server.js +123 -0
  372. package/build/run/dashboard/server.js.map +1 -0
  373. package/build/run/dashboard/state.js +97 -0
  374. package/build/run/dashboard/state.js.map +1 -0
  375. package/build/run/index.js +177 -110
  376. package/build/run/index.js.map +1 -1
  377. package/build/run/interruptHandler.js +18 -0
  378. package/build/run/interruptHandler.js.map +1 -1
  379. package/build/sourcemaps/index.js +7 -6
  380. package/build/sourcemaps/index.js.map +1 -1
  381. package/build/strings/index.js +27 -24
  382. package/build/strings/index.js.map +1 -1
  383. package/build/strings/openapi.js +4 -4
  384. package/build/strings/openapi.js.map +1 -1
  385. package/build/strings/permutate.js +4 -4
  386. package/build/strings/permutate.js.map +1 -1
  387. package/build/strings/secrets.js +1 -0
  388. package/build/strings/secrets.js.map +1 -1
  389. package/build/strings/trufflehog.js +66 -19
  390. package/build/strings/trufflehog.js.map +1 -1
  391. package/build/strings/trufflehogConfig.js +36 -0
  392. package/build/strings/trufflehogConfig.js.map +1 -0
  393. package/build/strings/trufflehogDownload.js +115 -0
  394. package/build/strings/trufflehogDownload.js.map +1 -0
  395. package/build/utility/ai.js +33 -4
  396. package/build/utility/ai.js.map +1 -1
  397. package/build/utility/banner.js +4 -3
  398. package/build/utility/banner.js.map +1 -1
  399. package/build/utility/cacheDb.js +78 -0
  400. package/build/utility/cacheDb.js.map +1 -0
  401. package/build/utility/configureSandbox.js +2 -2
  402. package/build/utility/configureSandbox.js.map +1 -1
  403. package/build/utility/customHeaders.js +30 -0
  404. package/build/utility/customHeaders.js.map +1 -0
  405. package/build/utility/globals.js +37 -12
  406. package/build/utility/globals.js.map +1 -1
  407. package/build/utility/heap.js +2 -1
  408. package/build/utility/heap.js.map +1 -1
  409. package/build/utility/makeReq.js +38 -87
  410. package/build/utility/makeReq.js.map +1 -1
  411. package/build/utility/openapiGenerator.js +2 -2
  412. package/build/utility/openapiGenerator.js.map +1 -1
  413. package/build/utility/printMsg.js +53 -0
  414. package/build/utility/printMsg.js.map +1 -0
  415. package/build/utility/progressLog.js +4 -3
  416. package/build/utility/progressLog.js.map +1 -1
  417. package/build/utility/resolvePath.js +2 -1
  418. package/build/utility/resolvePath.js.map +1 -1
  419. package/build/utility/ruleVersionMap.js +73 -0
  420. package/build/utility/ruleVersionMap.js.map +1 -0
  421. package/config.dist.yaml +3 -3
  422. package/contributing/testing.md +106 -0
  423. package/eslint.config.js +24 -0
  424. package/package.json +22 -6
  425. package/scripts/exploit-smoke-test.js +82 -0
  426. package/scripts/framework-detect-smoke-test.js +64 -0
  427. package/scripts/postinstall-completion.mjs +40 -0
  428. package/scripts/smoke-test.js +12 -0
  429. package/build/lazyLoad/downloadLoadedJsUtil.js +0 -98
  430. package/build/lazyLoad/downloadLoadedJsUtil.js.map +0 -1
  431. package/build/map/next_js/interactive_helpers/esqueryGen.js.map +0 -1
  432. package/build/map/next_js/interactive_helpers/inputPatch.js.map +0 -1
  433. package/build/map/next_js/interactive_helpers/keybindings.js.map +0 -1
  434. package/build/map/next_js/interactive_helpers/printer.js.map +0 -1
  435. package/build/map/next_js/interactive_helpers/ui.js.map +0 -1
  436. /package/build/map/{next_js/interactive_helpers → interactive-mode}/esqueryGen.js +0 -0
  437. /package/build/map/{next_js/interactive_helpers → interactive-mode}/inputPatch.js +0 -0
  438. /package/build/map/{next_js/interactive_helpers → interactive-mode}/keybindings.js +0 -0
  439. /package/build/map/{next_js/interactive_helpers → interactive-mode}/printer.js +0 -0
  440. /package/build/map/{next_js/interactive_helpers → interactive-mode}/ui.js +0 -0
@@ -7,134 +7,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
7
7
  step((generator = generator.apply(thisArg, _arguments || [])).next());
8
8
  });
9
9
  };
10
- var _a;
11
10
  import makeRequest from "../../utility/makeReq.js";
12
- import chalk from "chalk";
13
- import _traverse from "@babel/traverse";
14
- import parser from "@babel/parser";
15
- import execFunc from "../../utility/runSandboxed.js";
16
11
  import { runWithConcurrency } from "../../utility/concurrency.js";
17
- const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
12
+ import { extractWebpackChunkUrls } from "../shared/webpackChunkParsers.js";
13
+ import { printMsg, MSG } from "../../utility/printMsg.js";
18
14
  export const deduplicateWebpackChunkPaths = (paths) => [...new Set(paths)];
19
- /**
20
- * Pure parser: extracts `[chunkId, chunkName]` entries from webpack's
21
- * FunctionExpression object-map pattern:
22
- * function(e) { return ({123: "name", ...}[e] || e) + ".js"; }
23
- * Returns entries from the first qualifying object map (≥ 3 numeric-keyed string entries).
24
- */
25
- export const extractObjectMapChunkEntries = (jsContent) => {
26
- const result = [];
27
- let ast;
28
- try {
29
- ast = parser.parse(jsContent, {
30
- sourceType: "unambiguous",
31
- plugins: ["jsx", "typescript"],
32
- errorRecovery: true,
33
- });
34
- }
35
- catch (_a) {
36
- return result;
37
- }
38
- traverse(ast, {
39
- FunctionExpression(path) {
40
- var _a, _b;
41
- const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
42
- const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
43
- const source = jsContent.slice(start, end);
44
- if (!source.match(/\|\|\s*e/) || !source.includes('".js"'))
45
- return;
46
- path.traverse({
47
- ObjectExpression(objPath) {
48
- const props = objPath.node.properties;
49
- if (props.length < 3)
50
- return;
51
- const entries = [];
52
- for (const prop of props) {
53
- if (prop.type !== "ObjectProperty")
54
- continue;
55
- const key = prop.key;
56
- const value = prop.value;
57
- if (value.type !== "StringLiteral")
58
- continue;
59
- let keyNum = null;
60
- if (key.type === "NumericLiteral")
61
- keyNum = key.value;
62
- else if (key.type === "StringLiteral" && /^\d+$/.test(key.value))
63
- keyNum = parseInt(key.value);
64
- else if (key.type === "Identifier" && /^\d+$/.test(key.name))
65
- keyNum = parseInt(key.name);
66
- if (keyNum === null)
67
- continue;
68
- entries.push([keyNum, value.value]);
69
- }
70
- if (entries.length >= 3) {
71
- result.push(...entries);
72
- objPath.stop();
73
- path.stop();
74
- }
75
- },
76
- });
77
- },
78
- });
79
- return result;
80
- };
81
- /**
82
- * Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
83
- * if-chain pattern:
84
- * (e) => { if (123 === e) return "name.js"; if (456 === e) return "other.js"; ... }
85
- * Returns filenames only when there are at least 3 qualifying if-statements.
86
- */
87
- export const extractIfChainChunkFilenames = (jsContent) => {
88
- const result = [];
89
- let ast;
90
- try {
91
- ast = parser.parse(jsContent, {
92
- sourceType: "unambiguous",
93
- plugins: ["jsx", "typescript"],
94
- errorRecovery: true,
95
- });
96
- }
97
- catch (_a) {
98
- return result;
99
- }
100
- traverse(ast, {
101
- ArrowFunctionExpression(path) {
102
- var _a, _b;
103
- const body = path.node.body;
104
- if (body.type !== "BlockStatement")
105
- return;
106
- // skip expression-body arrows (handled by execFunc path)
107
- const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
108
- const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
109
- const source = jsContent.slice(start, end);
110
- if (source.match(/"\.js".{0,15}$/))
111
- return;
112
- const filenames = [];
113
- for (const stmt of body.body) {
114
- if (stmt.type !== "IfStatement")
115
- continue;
116
- const test = stmt.test;
117
- if (test.type !== "BinaryExpression" || test.operator !== "===")
118
- continue;
119
- const { left, right } = test;
120
- const isNumericEqParam = (left.type === "NumericLiteral" && right.type === "Identifier") ||
121
- (right.type === "NumericLiteral" && left.type === "Identifier");
122
- if (!isNumericEqParam)
123
- continue;
124
- const consequent = stmt.consequent;
125
- if (consequent.type !== "ReturnStatement" || !consequent.argument)
126
- continue;
127
- const arg = consequent.argument;
128
- if (arg.type !== "StringLiteral" || !arg.value.endsWith(".js"))
129
- continue;
130
- filenames.push(arg.value);
131
- }
132
- if (filenames.length >= 3)
133
- result.push(...filenames);
134
- },
135
- });
136
- return result;
137
- };
138
15
  // url param kept for API consistency with other react_* functions
139
16
  const react_webpackChunkPaths = (_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1) => __awaiter(void 0, [_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1], void 0, function* (_url, maxJsSizeMb, jsFiles, threads = 1) {
140
17
  let toReturn = [];
@@ -145,96 +22,27 @@ const react_webpackChunkPaths = (_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1) =>
145
22
  return;
146
23
  const contentLength = req.headers.get("content-length");
147
24
  if (contentLength && parseInt(contentLength) > maxJsSizeMb * 1024 * 1024) {
148
- console.error(chalk.yellow(`[!] Skipping ${jsFile} (too large)`));
25
+ printMsg(MSG.Warn, `[!] Skipping ${jsFile} (too large)`);
149
26
  return;
150
27
  }
151
28
  const jsContent = yield req.text();
152
29
  if (jsContent.length > maxJsSizeMb * 1024 * 1024) {
153
- console.error(chalk.yellow(`[!] Skipping ${jsFile} (too large)`));
30
+ printMsg(MSG.Warn, `[!] Skipping ${jsFile} (too large)`);
154
31
  return;
155
32
  }
156
- // pattern 3: FunctionExpression with object map
157
- const objectMapEntries = extractObjectMapChunkEntries(jsContent);
158
- if (objectMapEntries.length > 0) {
159
- console.log(chalk.green(`[✓] Found webpack object-map chunk path builder in ${jsFile}`));
160
- for (const [, chunkName] of objectMapEntries) {
161
- try {
162
- const finalUrl = new URL("../" + chunkName + ".js", jsFile).href;
163
- toReturn.push(finalUrl);
164
- }
165
- catch (_a) {
166
- // skip filenames that fail URL resolution
167
- }
168
- }
169
- }
170
- // pattern 2: ArrowFunctionExpression if-chain
171
- const ifChainFilenames = extractIfChainChunkFilenames(jsContent);
172
- if (ifChainFilenames.length > 0) {
173
- console.log(chalk.green(`[✓] Found webpack if-chain chunk path builder in ${jsFile}`));
174
- for (const filename of ifChainFilenames) {
175
- try {
176
- const output = filename.startsWith("/") ||
177
- filename.startsWith("http") ||
178
- filename.startsWith("./") ||
179
- filename.startsWith("../")
180
- ? filename
181
- : "../" + filename;
182
- const finalUrl = new URL(output, jsFile).href;
183
- toReturn.push(finalUrl);
184
- }
185
- catch (_b) {
186
- // skip filenames that fail URL resolution
187
- }
188
- }
33
+ const urls = extractWebpackChunkUrls(jsContent, jsFile);
34
+ if (urls.length > 0) {
35
+ printMsg(MSG.Run, `[✓] Found ${urls.length} webpack chunk JS file(s) in ${jsFile}`);
36
+ toReturn.push(...urls);
189
37
  }
190
- // pattern 1: ArrowFunctionExpression expression body via execFunc
191
- const ast = parser.parse(jsContent, {
192
- sourceType: "unambiguous",
193
- plugins: ["jsx", "typescript"],
194
- errorRecovery: true,
195
- });
196
- traverse(ast, {
197
- ArrowFunctionExpression(path) {
198
- var _a, _b;
199
- const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
200
- const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
201
- const source = jsContent.slice(start, end);
202
- if (!source.match(/"\.js".{0,15}$/))
203
- return;
204
- console.log(chalk.green(`[✓] Found webpack chunk path builder in ${jsFile}`));
205
- console.log(chalk.yellow(source.slice(0, 200) + (source.length > 200 ? "..." : "")));
206
- const urlBuilderFunc = `(() => (${source}))()`;
207
- const integers = source.match(/\d+/g);
208
- if (!integers)
209
- return;
210
- for (const i of integers) {
211
- try {
212
- let output = execFunc(urlBuilderFunc, parseInt(i));
213
- if (typeof output !== "string" || output.includes("undefined"))
214
- continue;
215
- if (!(output.startsWith("/") ||
216
- output.startsWith("http") ||
217
- output.startsWith("./") ||
218
- output.startsWith("../"))) {
219
- output = "../" + output;
220
- }
221
- const finalUrl = new URL(output, jsFile).href;
222
- toReturn.push(finalUrl);
223
- }
224
- catch (_c) {
225
- // skip integers that cause errors in sandboxed execution
226
- }
227
- }
228
- },
229
- });
230
38
  }
231
39
  catch (err) {
232
- console.error(chalk.red(`[!] Error processing ${jsFile}:`, err));
40
+ printMsg(MSG.Err, `[!] Error processing ${jsFile}: ${err}`);
233
41
  }
234
42
  }));
235
43
  toReturn = deduplicateWebpackChunkPaths(toReturn);
236
44
  if (toReturn.length > 0) {
237
- console.log(chalk.green(`[✓] Found ${toReturn.length} webpack chunk JS files`));
45
+ printMsg(MSG.Run, `[✓] Found ${toReturn.length} webpack chunk JS files`);
238
46
  }
239
47
  return toReturn;
240
48
  });
@@ -1 +1 @@
1
- {"version":3,"file":"react_webpackChunkPaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/react/react_webpackChunkPaths.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,KAAwB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAExG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA2B,EAAE;IACvF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,kBAAkB,CAAC,IAAI;;YACnB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO;YAEnE,IAAI,CAAC,QAAQ,CAAC;gBACV,gBAAgB,CAAC,OAAO;oBACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO;oBAE7B,MAAM,OAAO,GAA4B,EAAE,CAAC;oBAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;4BAAE,SAAS;wBAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;wBACzB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;4BAAE,SAAS;wBAE7C,IAAI,MAAM,GAAkB,IAAI,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;4BAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;6BACjD,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;6BAC1F,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAE1F,IAAI,MAAM,KAAK,IAAI;4BAAE,SAAS;wBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxC,CAAC;oBAED,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;wBACxB,OAAO,CAAC,IAAI,EAAE,CAAC;wBACf,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChB,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAAY,EAAE;IACxE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,uBAAuB,CAAC,IAAI;;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO;YAE3C,yDAAyD;YACzD,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;oBAAE,SAAS;gBAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;gBAC7B,MAAM,gBAAgB,GAClB,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;oBAC/D,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBACpE,IAAI,CAAC,gBAAgB;oBAAE,SAAS;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;gBACnC,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAAE,SAAS;gBAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAChC,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACzE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QACzD,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,8CAKX,EAAE,qFAJnB,IAAY,EACZ,WAAmB,EACnB,OAAiB,EACjB,UAAkB,CAAC;IAEnB,IAAI,QAAQ,GAAa,EAAE,CAAC;IAE5B,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAO,MAAM,EAAE,EAAE;QACxD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAEtC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO;YAEvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,MAAM,cAAc,CAAC,CAAC,CAAC;gBAClE,OAAO;YACX,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,MAAM,cAAc,CAAC,CAAC,CAAC;gBAClE,OAAO;YACX,CAAC;YAED,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC,CAAC;gBACzF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,gBAAgB,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;wBACjE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;oBAAC,WAAM,CAAC;wBACL,0CAA0C;oBAC9C,CAAC;gBACL,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC,CAAC;gBACvF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACD,MAAM,MAAM,GACR,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;4BACxB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;4BAC3B,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;4BACzB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;4BACtB,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;wBAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;wBAC9C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;oBAAC,WAAM,CAAC;wBACL,0CAA0C;oBAC9C,CAAC;gBACL,CAAC;YACL,CAAC;YAED,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;gBAChC,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,QAAQ,CAAC,GAAG,EAAE;gBACV,uBAAuB,CAAC,IAAI;;oBACxB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;oBACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;oBAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;wBAAE,OAAO;oBAE5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAErF,MAAM,cAAc,GAAG,WAAW,MAAM,MAAM,CAAC;oBAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,CAAC,QAAQ;wBAAE,OAAO;oBAEtB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACD,IAAI,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;4BACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gCAAE,SAAS;4BAEzE,IAAI,CAAC,CACD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCACtB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gCACzB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gCACvB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAC3B,EAAE,CAAC;gCACA,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;4BAC5B,CAAC;4BACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;4BAC9C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC5B,CAAC;wBAAC,WAAM,CAAC;4BACL,yDAAyD;wBAC7D,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,QAAQ,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
1
+ {"version":3,"file":"react_webpackChunkPaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/react/react_webpackChunkPaths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,KAAwB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAExG,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,8CAKX,EAAE,qFAJnB,IAAY,EACZ,WAAmB,EACnB,OAAiB,EACjB,UAAkB,CAAC;IAEnB,IAAI,QAAQ,GAAa,EAAE,CAAC;IAE5B,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAO,MAAM,EAAE,EAAE;QACxD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAEtC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO;YAEvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACvE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC/C,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,CAAC,MAAM,gCAAgC,MAAM,EAAE,CAAC,CAAC;gBACpF,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,QAAQ,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
@@ -0,0 +1,15 @@
1
+ /**
2
+ * Appends newly discovered URLs onto a technique's existing entry in a
3
+ * research-mode efficiency map, without deduplicating across techniques —
4
+ * the same URL may legitimately appear under multiple techniques since this
5
+ * measures each technique's individual yield.
6
+ */
7
+ export const accumulateTechnique = (map, technique, urls) => {
8
+ if (!urls || urls.length === 0)
9
+ return;
10
+ map[technique] = [...(map[technique] || []), ...urls];
11
+ };
12
+ export const createTechniqueRecorder = (map) => {
13
+ return (technique, urls) => accumulateTechnique(map, technique, urls);
14
+ };
15
+ //# sourceMappingURL=researchUtils.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"researchUtils.js","sourceRoot":"","sources":["../../src/lazyLoad/researchUtils.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAA6B,EAAE,SAAiB,EAAE,IAAc,EAAQ,EAAE;IAC1G,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAA6B,EAAqB,EAAE;IACxF,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC,CAAC"}
@@ -0,0 +1,218 @@
1
+ var _a;
2
+ import _traverse from "@babel/traverse";
3
+ import parser from "@babel/parser";
4
+ import execFunc from "../../utility/runSandboxed.js";
5
+ const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
6
+ /**
7
+ * Pure parser: extracts `[chunkId, chunkName]` entries from webpack's
8
+ * FunctionExpression object-map pattern:
9
+ * function(e) { return ({123: "name", ...}[e] || e) + ".js"; }
10
+ * Returns entries from the first qualifying object map (≥ 3 numeric-keyed string entries).
11
+ */
12
+ export const extractObjectMapChunkEntries = (jsContent) => {
13
+ const result = [];
14
+ let ast;
15
+ try {
16
+ ast = parser.parse(jsContent, {
17
+ sourceType: "unambiguous",
18
+ plugins: ["jsx", "typescript"],
19
+ errorRecovery: true,
20
+ });
21
+ }
22
+ catch (_a) {
23
+ return result;
24
+ }
25
+ traverse(ast, {
26
+ FunctionExpression(path) {
27
+ var _a, _b;
28
+ const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
29
+ const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
30
+ const source = jsContent.slice(start, end);
31
+ if (!source.match(/\|\|\s*e/) || !source.includes('".js"'))
32
+ return;
33
+ path.traverse({
34
+ ObjectExpression(objPath) {
35
+ const props = objPath.node.properties;
36
+ if (props.length < 3)
37
+ return;
38
+ const entries = [];
39
+ for (const prop of props) {
40
+ if (prop.type !== "ObjectProperty")
41
+ continue;
42
+ const key = prop.key;
43
+ const value = prop.value;
44
+ if (value.type !== "StringLiteral")
45
+ continue;
46
+ let keyNum = null;
47
+ if (key.type === "NumericLiteral")
48
+ keyNum = key.value;
49
+ else if (key.type === "StringLiteral" && /^\d+$/.test(key.value))
50
+ keyNum = parseInt(key.value);
51
+ else if (key.type === "Identifier" && /^\d+$/.test(key.name))
52
+ keyNum = parseInt(key.name);
53
+ if (keyNum === null)
54
+ continue;
55
+ entries.push([keyNum, value.value]);
56
+ }
57
+ if (entries.length >= 3) {
58
+ result.push(...entries);
59
+ objPath.stop();
60
+ path.stop();
61
+ }
62
+ },
63
+ });
64
+ },
65
+ });
66
+ return result;
67
+ };
68
+ /**
69
+ * Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
70
+ * if-chain pattern:
71
+ * (e) => { if (123 === e) return "name.js"; if (456 === e) return "other.js"; ... }
72
+ * Returns filenames only when there are at least 3 qualifying if-statements.
73
+ */
74
+ export const extractIfChainChunkFilenames = (jsContent) => {
75
+ const result = [];
76
+ let ast;
77
+ try {
78
+ ast = parser.parse(jsContent, {
79
+ sourceType: "unambiguous",
80
+ plugins: ["jsx", "typescript"],
81
+ errorRecovery: true,
82
+ });
83
+ }
84
+ catch (_a) {
85
+ return result;
86
+ }
87
+ traverse(ast, {
88
+ ArrowFunctionExpression(path) {
89
+ var _a, _b;
90
+ const body = path.node.body;
91
+ if (body.type !== "BlockStatement")
92
+ return;
93
+ // skip expression-body arrows (handled by extractExpressionBodyChunkFilenames)
94
+ const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
95
+ const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
96
+ const source = jsContent.slice(start, end);
97
+ if (source.match(/"\.js".{0,15}$/))
98
+ return;
99
+ const filenames = [];
100
+ for (const stmt of body.body) {
101
+ if (stmt.type !== "IfStatement")
102
+ continue;
103
+ const test = stmt.test;
104
+ if (test.type !== "BinaryExpression" || test.operator !== "===")
105
+ continue;
106
+ const { left, right } = test;
107
+ const isNumericEqParam = (left.type === "NumericLiteral" && right.type === "Identifier") ||
108
+ (right.type === "NumericLiteral" && left.type === "Identifier");
109
+ if (!isNumericEqParam)
110
+ continue;
111
+ const consequent = stmt.consequent;
112
+ if (consequent.type !== "ReturnStatement" || !consequent.argument)
113
+ continue;
114
+ const arg = consequent.argument;
115
+ if (arg.type !== "StringLiteral" || !arg.value.endsWith(".js"))
116
+ continue;
117
+ filenames.push(arg.value);
118
+ }
119
+ if (filenames.length >= 3)
120
+ result.push(...filenames);
121
+ },
122
+ });
123
+ return result;
124
+ };
125
+ /**
126
+ * Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
127
+ * expression-body pattern (e.g. `(e) => (HASHMAP[e] || e) + ".js"`) by executing the
128
+ * arrow in a sandbox for every integer literal referenced in its own source — the
129
+ * hash-map values aren't visible to plain string extraction because they're only
130
+ * produced by evaluating the expression.
131
+ */
132
+ export const extractExpressionBodyChunkFilenames = (jsContent) => {
133
+ const result = [];
134
+ let ast;
135
+ try {
136
+ ast = parser.parse(jsContent, {
137
+ sourceType: "unambiguous",
138
+ plugins: ["jsx", "typescript"],
139
+ errorRecovery: true,
140
+ });
141
+ }
142
+ catch (_a) {
143
+ return result;
144
+ }
145
+ traverse(ast, {
146
+ ArrowFunctionExpression(path) {
147
+ var _a, _b;
148
+ const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
149
+ const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
150
+ const source = jsContent.slice(start, end);
151
+ if (!source.match(/"\.js".{0,15}$/))
152
+ return;
153
+ const urlBuilderFunc = `(() => (${source}))()`;
154
+ const integers = source.match(/\d+/g);
155
+ if (!integers)
156
+ return;
157
+ for (const i of integers) {
158
+ try {
159
+ const output = execFunc(urlBuilderFunc, parseInt(i));
160
+ if (typeof output === "string" && !output.includes("undefined")) {
161
+ result.push(output);
162
+ }
163
+ }
164
+ catch (_c) {
165
+ // skip integers that cause errors in sandboxed execution
166
+ }
167
+ }
168
+ },
169
+ });
170
+ return result;
171
+ };
172
+ /**
173
+ * Resolves a raw chunk filename against the file it was found in. Webpack commonly
174
+ * emits chunk names one directory up from the entry chunk that references them, so a
175
+ * bare filename (no scheme, no leading "/", "./", or "../") is resolved against "../"
176
+ * relative to fileUrl; anything already absolute or explicitly relative is resolved
177
+ * as-is.
178
+ */
179
+ const resolveChunkUrl = (output, fileUrl) => {
180
+ try {
181
+ const normalized = output.startsWith("/") || output.startsWith("http") || output.startsWith("./") || output.startsWith("../")
182
+ ? output
183
+ : "../" + output;
184
+ return new URL(normalized, fileUrl).href;
185
+ }
186
+ catch (_a) {
187
+ return null;
188
+ }
189
+ };
190
+ /**
191
+ * Runs all three webpack chunk-path-builder patterns (object-map, if-chain,
192
+ * expression-body) against one file's content and returns every resolved chunk URL.
193
+ * Shared between the React crawler (`react_webpackChunkPaths.ts`) and `generic` tech's
194
+ * structural discovery (`generic_webpackChunkPaths.ts`, internal#75) — these are plain
195
+ * webpack output patterns, not React-specific, so a webpack/module-federation entry
196
+ * chunk's own async-chunk hash-map can be statically enumerated regardless of which
197
+ * tech branch downloaded it.
198
+ */
199
+ export const extractWebpackChunkUrls = (jsContent, fileUrl) => {
200
+ const urls = new Set();
201
+ for (const [, chunkName] of extractObjectMapChunkEntries(jsContent)) {
202
+ const resolved = resolveChunkUrl(`${chunkName}.js`, fileUrl);
203
+ if (resolved)
204
+ urls.add(resolved);
205
+ }
206
+ for (const filename of extractIfChainChunkFilenames(jsContent)) {
207
+ const resolved = resolveChunkUrl(filename, fileUrl);
208
+ if (resolved)
209
+ urls.add(resolved);
210
+ }
211
+ for (const filename of extractExpressionBodyChunkFilenames(jsContent)) {
212
+ const resolved = resolveChunkUrl(filename, fileUrl);
213
+ if (resolved)
214
+ urls.add(resolved);
215
+ }
216
+ return [...urls];
217
+ };
218
+ //# sourceMappingURL=webpackChunkParsers.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"webpackChunkParsers.js","sourceRoot":"","sources":["../../../src/lazyLoad/shared/webpackChunkParsers.ts"],"names":[],"mappings":";AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AAErD,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA2B,EAAE;IACvF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,kBAAkB,CAAC,IAAI;;YACnB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO;YAEnE,IAAI,CAAC,QAAQ,CAAC;gBACV,gBAAgB,CAAC,OAAO;oBACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO;oBAE7B,MAAM,OAAO,GAA4B,EAAE,CAAC;oBAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;4BAAE,SAAS;wBAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;wBACzB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;4BAAE,SAAS;wBAE7C,IAAI,MAAM,GAAkB,IAAI,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;4BAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;6BACjD,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;6BAC1F,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAE1F,IAAI,MAAM,KAAK,IAAI;4BAAE,SAAS;wBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxC,CAAC;oBAED,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;wBACxB,OAAO,CAAC,IAAI,EAAE,CAAC;wBACf,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChB,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAAY,EAAE;IACxE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,uBAAuB,CAAC,IAAI;;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO;YAE3C,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;oBAAE,SAAS;gBAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;gBAC7B,MAAM,gBAAgB,GAClB,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;oBAC/D,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBACpE,IAAI,CAAC,gBAAgB;oBAAE,SAAS;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;gBACnC,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAAE,SAAS;gBAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAChC,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACzE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QACzD,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,SAAiB,EAAY,EAAE;IAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,uBAAuB,CAAC,IAAI;;YACxB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAE5C,MAAM,cAAc,GAAG,WAAW,MAAM,MAAM,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;gBAAC,WAAM,CAAC;oBACL,yDAAyD;gBAC7D,CAAC;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,OAAe,EAAiB,EAAE;IACvE,IAAI,CAAC;QACD,MAAM,UAAU,GACZ,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACtG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAY,EAAE;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,SAAS,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,mCAAmC,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC"}
@@ -3,6 +3,22 @@
3
3
  *
4
4
  * Extracts original source code from minified JavaScript using source maps.
5
5
  */
6
+ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
7
+ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
8
+ return new (P || (P = Promise))(function (resolve, reject) {
9
+ function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
10
+ function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
11
+ function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
12
+ step((generator = generator.apply(thisArg, _arguments || [])).next());
13
+ });
14
+ };
15
+ import fs from "fs";
16
+ import path from "path";
17
+ import chalk from "chalk";
18
+ import makeRequest from "../utility/makeReq.js";
19
+ import { runWithConcurrency } from "../utility/concurrency.js";
20
+ import { progressLog } from "../utility/progressLog.js";
21
+ import { getSanitizedAssetFilename, resolveAssetOutputDirectory } from "./outputPath.js";
6
22
  /**
7
23
  * Extract original source files from a source map.
8
24
  *
@@ -183,6 +199,110 @@ function joinPaths(base, path) {
183
199
  const pathClean = path.startsWith("/") ? path.slice(1) : path;
184
200
  return `${baseClean}/${pathClean}`;
185
201
  }
202
+ /**
203
+ * Decode an inline `data:` URI sourceMappingURL reference into raw source-map JSON text.
204
+ *
205
+ * Handles both base64-encoded (`data:application/json;base64,<...>`, with or without a
206
+ * `charset` parameter) and percent-encoded (`data:application/json,<...>`) payloads.
207
+ * Verifies the decoded content actually looks like a source map (has a `sources` array)
208
+ * before returning it, so an unrelated `data:` URI that happens to be valid JSON doesn't
209
+ * get treated as a sourcemap.
210
+ *
211
+ * @param rawRef - The raw string following `sourceMappingURL=`
212
+ * @returns The decoded JSON text, or null if `rawRef` isn't a decodable inline source map
213
+ */
214
+ export function decodeInlineSourceMapDataUri(rawRef) {
215
+ if (!rawRef.startsWith("data:"))
216
+ return null;
217
+ const commaIndex = rawRef.indexOf(",");
218
+ if (commaIndex === -1)
219
+ return null;
220
+ const meta = rawRef.slice(5, commaIndex);
221
+ const payload = rawRef.slice(commaIndex + 1);
222
+ const isBase64 = meta.split(";").includes("base64");
223
+ try {
224
+ const decoded = isBase64 ? Buffer.from(payload, "base64").toString("utf-8") : decodeURIComponent(payload);
225
+ const parsed = JSON.parse(decoded);
226
+ if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.sources))
227
+ return null;
228
+ return decoded;
229
+ }
230
+ catch (_a) {
231
+ return null;
232
+ }
233
+ }
234
+ /**
235
+ * Write a decoded inline source map to disk at the same location a real downloaded
236
+ * `.map` file for this JS URL would land at, so the existing `extractSourceMaps` disk
237
+ * scan (which matches by `.map` extension, not by naming convention) picks it up.
238
+ *
239
+ * Best-effort: swallows all errors, per this directory's "sourcemap fetch is best-effort"
240
+ * convention. Never throws.
241
+ */
242
+ export function writeInlineSourceMap(output, jsUrl, mapContent) {
243
+ try {
244
+ const filename = getSanitizedAssetFilename(jsUrl);
245
+ if (!filename)
246
+ return;
247
+ const dir = resolveAssetOutputDirectory(output, jsUrl);
248
+ fs.mkdirSync(dir, { recursive: true });
249
+ fs.writeFileSync(path.join(dir, `${filename}.map`), mapContent);
250
+ }
251
+ catch (_a) {
252
+ // best-effort; never fatal
253
+ }
254
+ }
255
+ /**
256
+ * Discover sourcemaps referenced by a list of JS files.
257
+ *
258
+ * For each file, fetches its content and looks for a `//# sourceMappingURL=...` comment.
259
+ * Inline `data:` URI references are decoded and written directly to `output` (no HTTP
260
+ * fetch needed). Real relative/absolute references are resolved to absolute URLs and
261
+ * returned so the caller can enqueue them for download, same as before.
262
+ *
263
+ * @param jsFiles - JS file URLs to scan
264
+ * @param threads - concurrency for the fetch loop
265
+ * @param output - output directory inline maps are written under
266
+ * @returns Absolute URLs of real (non-inline) sourcemaps found
267
+ */
268
+ export function discoverSourcemapUrls(jsFiles_1) {
269
+ return __awaiter(this, arguments, void 0, function* (jsFiles, threads = 1, output = "") {
270
+ const mapUrls = [];
271
+ let inlineCount = 0;
272
+ yield runWithConcurrency(jsFiles, threads, (jsUrl) => __awaiter(this, void 0, void 0, function* () {
273
+ try {
274
+ const res = yield makeRequest(jsUrl, { reportErrors: false });
275
+ if (!res)
276
+ return;
277
+ const body = yield res.text();
278
+ const match = body.match(/\/\/# sourceMappingURL=(.+)$/m);
279
+ if (!match)
280
+ return;
281
+ const rawRef = match[1].trim();
282
+ if (rawRef.startsWith("data:")) {
283
+ const decoded = decodeInlineSourceMapDataUri(rawRef);
284
+ if (decoded) {
285
+ writeInlineSourceMap(output, jsUrl, decoded);
286
+ inlineCount++;
287
+ }
288
+ return;
289
+ }
290
+ const mapUrl = new URL(rawRef, jsUrl).href;
291
+ mapUrls.push(mapUrl);
292
+ }
293
+ catch (_) {
294
+ // skip files that fail to fetch
295
+ }
296
+ }));
297
+ if (mapUrls.length > 0) {
298
+ progressLog(chalk.green(`[✓] Found ${mapUrls.length} sourcemaps from ${jsFiles.length} JS files`));
299
+ }
300
+ if (inlineCount > 0) {
301
+ progressLog(chalk.green(`[✓] Decoded ${inlineCount} inline (base64) sourcemap(s)`));
302
+ }
303
+ return mapUrls;
304
+ });
305
+ }
186
306
  // Default export for convenience
187
307
  export default { extractSources, extractSource, listSources, hasSourceContent };
188
308
  //# sourceMappingURL=sourcemap.js.map