@korayda4/vibe-security 0.3.0

package/dist/engine/rules/php/xss.js

@@ -0,0 +1,56 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'PHP-002',
+    title: 'PHP: XSS via echo of unescaped input',
+    layer: 'frontend',
+    severity: 'high',
+    description: '`echo $_GET["..."]` or `print $user_input` renders raw user input as HTML. Attackers inject `<script>` tags for session hijacking. The same applies to Laravel `{{ ... }}` raw output and Symfony `{{ var|raw }}`.',
+    threat: 'Reflected / Stored XSS → account takeover, session hijack, data exfiltration',
+    remediation: '1) Use `htmlspecialchars($input, ENT_QUOTES, "UTF-8")` before echo: `echo htmlspecialchars($_GET["q"])`. ' +
+        '2) Laravel: `{{ $input }}` auto-escapes; `{{!! $input !!}}` is raw (avoid). ' +
+        '3) Use Twig auto-escape; avoid `|raw` filter on user input. ' +
+        '4) Set `Content-Security-Policy` header. ' +
+        '5) Use a templating engine that escapes by default (Twig, Blade).',
+    references: [
+        'https://www.php.net/manual/en/function.htmlspecialchars.php',
+        'https://laravel.com/docs/blade#displaying-data',
+        'https://owasp.org/www-community/attacks/xss/',
+    ],
+    cwe: 'CWE-79',
+    owasp: 'A03:2021 Injection',
+    languages: ['php'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /\b(?:echo|print)\s+\$_(?:GET|POST|REQUEST|COOKIE)\s*\[/g,
+            /\b(?:echo|print)\s+\$this->input->/g,
+            /\{\{!!\s+[^}]+\s+!!\}\}/g,
+            /\{\{[^}]+\s*\|\s*raw\s*\}\}/g,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=xss.js.map

package/dist/engine/rules/php/xss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../../src/engine/rules/php/xss.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,sCAAsC;IAC7C,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,oNAAoN;IACtN,MAAM,EAAE,8EAA8E;IACtF,WAAW,EACT,2GAA2G;QAC3G,8EAA8E;QAC9E,8DAA8D;QAC9D,2CAA2C;QAC3C,mEAAmE;IACrE,UAAU,EAAE;QACV,6DAA6D;QAC7D,gDAAgD;QAChD,8CAA8C;KAC/C;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,yDAAyD;YACzD,qCAAqC;YACrC,0BAA0B;YAC1B,8BAA8B;SAC/B,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/ruby/index.d.ts

@@ -0,0 +1,6 @@
+export declare const rules: {
+    sqlInjection: import("../../../types.js").Rule;
+    strongParams: import("../../../types.js").Rule;
+    xss: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/ruby/index.js

@@ -0,0 +1,10 @@
+import sqlInjection from './sqlInjection.js';
+import strongParams from './strongParams.js';
+import xss from './xss.js';
+export const rules = {
+    sqlInjection,
+    strongParams,
+    xss,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/ruby/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/ruby/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,YAAY;IACZ,YAAY;IACZ,GAAG;CACJ,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/ruby/sqlInjection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/ruby/sqlInjection.js

@@ -0,0 +1,56 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'RB-001',
+    title: 'Ruby: SQL injection via string interpolation',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'Ruby on Rails ActiveRecord parameterizes queries by default. However, raw `where("...")` with string interpolation, `sanitize_sql` with concatenation, or find_by_sql bypass that protection.',
+    threat: 'Database exfiltration, authentication bypass, data destruction',
+    remediation: '1) Use ActiveRecord: `User.where(email: params[:email])` — auto-parameterized. ' +
+        '2) For raw SQL: `where("email = ?", params[:email])` with `?` placeholders. ' +
+        '3) Use `sanitize_sql_array` for IN clauses: `where("id IN (?)", ids)`. ' +
+        '4) Hash conditions: `where("name = :name", name: input)` — named placeholders. ' +
+        "5) NEVER use string interpolation in raw SQL: where(\"email = '#{params[:email]}'\") is vulnerable.",
+    references: [
+        'https://guides.rubyonrails.org/security.html#sql-injection',
+        'https://api.rubyonrails.org/classes/ActiveRecord/Sanitization/ClassMethods.html',
+        'https://owasp.org/www-community/attacks/SQL_Injection',
+    ],
+    cwe: 'CWE-89',
+    owasp: 'A03:2021 Injection',
+    languages: ['ruby'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /where\s*\(\s*["'][^"']*#\{[^}]*(?:params|request|input|params\[|@user\.input)/g,
+            /find_by_sql\s*\(\s*["'][^"']*#\{/g,
+            /execute\s*\(\s*["'][^"']*#\{/g,
+            /sanitize_sql\s*\(\s*["'][^"']*#\{/g,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sqlInjection.js.map

package/dist/engine/rules/ruby/sqlInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.js","sourceRoot":"","sources":["../../../../src/engine/rules/ruby/sqlInjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,8CAA8C;IACrD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,+LAA+L;IACjM,MAAM,EAAE,gEAAgE;IACxE,WAAW,EACT,iFAAiF;QACjF,8EAA8E;QAC9E,yEAAyE;QACzE,iFAAiF;QACjF,qGAAqG;IACvG,UAAU,EAAE;QACV,4DAA4D;QAC5D,iFAAiF;QACjF,uDAAuD;KACxD;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,gFAAgF;YAChF,mCAAmC;YACnC,+BAA+B;YAC/B,oCAAoC;SACrC,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/ruby/strongParams.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/ruby/strongParams.js

@@ -0,0 +1,35 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'RB-002',
+    title: 'Ruby on Rails: mass assignment — params.require only',
+    layer: 'backend',
+    severity: 'high',
+    description: 'In Rails, `User.create(params[:user])` or `User.update(params[:user])` passes the entire params hash to the model. Attackers can set `admin: true`, `role: \'admin\`, etc. Rails 4+ requires using strong parameters (`params.require(:user).permit(...)`).',
+    threat: 'Privilege escalation (become admin), business logic bypass',
+    remediation: '1) Use strong parameters in every controller: `def user_params; params.require(:user).permit(:name, :email); end`. ' +
+        '2) Never call `User.create(params[:user])` directly. ' +
+        '3) Use `before_action :authenticate_user!` for protected actions. ' +
+        '4) For nested attributes: `.permit(:name, emails_attributes: [:address])`. ' +
+        '5) In Rails 5+, `config.load_defaults 5.0` enables `permit_all_parameters = false` by default.',
+    references: [
+        'https://guides.rubyonrails.org/action_controller_overview.html#strong-parameters',
+        'https://guides.rubyonrails.org/security.html#mass-assignment',
+    ],
+    cwe: 'CWE-915',
+    owasp: 'A04:2021 Insecure Design',
+    languages: ['ruby'],
+    check: (ctx) => {
+        const patterns = [
+            /\.(?:create|update|update_attributes)\s*\(\s*params\s*[,:]/g,
+            /\.(?:create|update|update_attributes)\s*\(\s*params\[:/g,
+            /User\.create\s*\(\s*params/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=strongParams.js.map

package/dist/engine/rules/ruby/strongParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strongParams.js","sourceRoot":"","sources":["../../../../src/engine/rules/ruby/strongParams.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,sDAAsD;IAC7D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,6PAA6P;IAC/P,MAAM,EAAE,4DAA4D;IACpE,WAAW,EACT,qHAAqH;QACrH,uDAAuD;QACvD,oEAAoE;QACpE,6EAA6E;QAC7E,gGAAgG;IAClG,UAAU,EAAE;QACV,kFAAkF;QAClF,8DAA8D;KAC/D;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG;YACf,6DAA6D;YAC7D,yDAAyD;YACzD,6BAA6B;SAC9B,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/ruby/xss.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/ruby/xss.js

@@ -0,0 +1,55 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'RB-003',
+    title: 'Ruby: XSS via raw / html_safe in views',
+    layer: 'frontend',
+    severity: 'high',
+    description: 'In Rails, `<%= ... %>` escapes HTML by default. However `<%= raw ... %>` or `<%== ... %>` (or `html_safe` in controllers) bypasses escaping and renders raw HTML — XSS.',
+    threat: 'Stored / Reflected XSS → session hijack, account takeover, data exfiltration',
+    remediation: '1) NEVER use `<%= raw user_input %>` or `<%== user_input %>`. ' +
+        '2) Use `<%= user_input %>` which auto-escapes. ' +
+        '3) For rich text, sanitize via `sanitize(user_input)` or a gem like `loofah` / `sanitize`. ' +
+        '4) In controllers, NEVER call `.html_safe` on user-controlled data. ' +
+        '5) Set `Content-Security-Policy` headers to add defense in depth.',
+    references: [
+        'https://guides.rubyonrails.org/security.html#cross-site-scripting-xss',
+        'https://owasp.org/www-community/attacks/xss/',
+    ],
+    cwe: 'CWE-79',
+    owasp: 'A03:2021 Injection',
+    languages: ['ruby'],
+    check: (ctx) => {
+        const findings = [];
+        const patterns = [
+            /<%=\s*raw\s+/g,
+            /<%==\s*/g,
+            /<%=\s*\w+\.html_safe\s*%>/g,
+            /\.html_safe\s*(?:!|\b)/g,
+        ];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=xss.js.map

package/dist/engine/rules/ruby/xss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xss.js","sourceRoot":"","sources":["../../../../src/engine/rules/ruby/xss.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,wCAAwC;IAC/C,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,yKAAyK;IAC3K,MAAM,EAAE,8EAA8E;IACtF,WAAW,EACT,gEAAgE;QAChE,iDAAiD;QACjD,6FAA6F;QAC7F,sEAAsE;QACtE,mEAAmE;IACrE,UAAU,EAAE;QACV,uEAAuE;QACvE,8CAA8C;KAC/C;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG;YACf,eAAe;YACf,UAAU;YACV,4BAA4B;YAC5B,yBAAyB;SAC1B,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/rust/index.d.ts

@@ -0,0 +1,6 @@
+export declare const rules: {
+    unsafeExpect: import("../../../types.js").Rule;
+    sqlInjection: import("../../../types.js").Rule;
+    secretInCode: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/rust/index.js

@@ -0,0 +1,10 @@
+import unsafeExpect from './unsafeExpect.js';
+import sqlInjection from './sqlInjection.js';
+import secretInCode from './secretInCode.js';
+export const rules = {
+    unsafeExpect,
+    sqlInjection,
+    secretInCode,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/rust/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/rust/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAE7C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/rust/secretInCode.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/rust/secretInCode.js

@@ -0,0 +1,36 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'RS-003',
+    title: 'Rust: hardcoded secret / credential',
+    layer: 'cicd',
+    severity: 'critical',
+    description: 'Hardcoded API keys, database passwords, JWT secrets, or private keys in Rust source code or `.env` files. Once committed to Git, they are public.',
+    threat: 'Cloud account takeover, financial fraud, lateral movement',
+    remediation: '1) Move all secrets to environment variables + secret manager (Vault, AWS Secrets Manager). ' +
+        '2) Use `std::env::var("API_KEY")` with proper error handling. ' +
+        '3) Add `dotenvy` only for local development; never commit `.env`. ' +
+        '4) Add `git-secrets` or `gitleaks` pre-commit hook. ' +
+        '5) If a secret leaked, rotate immediately.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html',
+        'https://github.com/YoyoFate/secretfinder-rs',
+    ],
+    cwe: 'CWE-798',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['rust'],
+    check: (ctx) => {
+        const patterns = [
+            /AKIA[0-9A-Z]{16}/g,
+            /sk_live_[0-9a-zA-Z]{24,}/g,
+            /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+            /(?:SECRET|API_KEY|PASSWORD|TOKEN|PRIVATE_KEY)\s*:\s*&?\[\s*u?8\s*\][\s\S]{0,200}=\s*["'][a-zA-Z0-9_\-/+=]{20,}["']/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=secretInCode.js.map

package/dist/engine/rules/rust/secretInCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretInCode.js","sourceRoot":"","sources":["../../../../src/engine/rules/rust/secretInCode.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,qCAAqC;IAC5C,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,mJAAmJ;IACrJ,MAAM,EAAE,2DAA2D;IACnE,WAAW,EACT,8FAA8F;QAC9F,gEAAgE;QAChE,oEAAoE;QACpE,sDAAsD;QACtD,4CAA4C;IAC9C,UAAU,EAAE;QACV,oFAAoF;QACpF,6CAA6C;KAC9C;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG;YACf,mBAAmB;YACnB,2BAA2B;YAC3B,oDAAoD;YACpD,qHAAqH;SACtH,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/rust/sqlInjection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/rust/sqlInjection.js

@@ -0,0 +1,55 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'RS-002',
+    title: 'Rust: SQL/NoSQL injection via string concatenation',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'Using `format!` or string concatenation to build SQL queries lets attackers inject SQL via untrusted input. While sqlx and diesel parameterize by default, raw `query_as` / `sqlx::query` with concatenation bypasses that protection.',
+    threat: 'Database exfiltration, authentication bypass, data destruction',
+    remediation: '1) Use sqlx::query with bind parameters: `query("SELECT * FROM users WHERE id = $1").bind(id)`. ' +
+        '2) Diesel: `users.filter(id.eq(&given_id)).first(&conn)`. ' +
+        '3) SeaORM / SQLAlchemy: parameter binding via `.bind()` or placeholder. ' +
+        '4) NEVER use `format!("SELECT ... WHERE id = {}", user_input)`. ' +
+        '5) For complex dynamic queries, build with sqlx::QueryBuilder and `.push_bind`.',
+    references: [
+        'https://docs.rs/sqlx/latest/sqlx/struct.Query.html',
+        'https://github.com/launchbadge/sqlx-secure-ext',
+        'https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-89',
+    owasp: 'A03:2021 Injection',
+    languages: ['rust'],
+    check: (ctx) => {
+        const patterns = [
+            /format!\s*\(\s*['"`](?:SELECT|INSERT|UPDATE|DELETE|DROP)[^'"`]*\{\s*\w+/gi,
+            /format!\s*\(\s*['"`](?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)[^'"`]*\{\s*\w+/gi,
+            /\.exec\(\s*format!\(/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sqlInjection.js.map

package/dist/engine/rules/rust/sqlInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.js","sourceRoot":"","sources":["../../../../src/engine/rules/rust/sqlInjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,oDAAoD;IAC3D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,wOAAwO;IAC1O,MAAM,EAAE,gEAAgE;IACxE,WAAW,EACT,kGAAkG;QAClG,4DAA4D;QAC5D,0EAA0E;QAC1E,kEAAkE;QAClE,iFAAiF;IACnF,UAAU,EAAE;QACV,oDAAoD;QACpD,gDAAgD;QAChD,0FAA0F;KAC3F;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG;YACf,2EAA2E;YAC3E,iFAAiF;YACjF,uBAAuB;SACxB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/rust/unsafeExpect.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/rust/unsafeExpect.js

@@ -0,0 +1,56 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'RS-001',
+    title: 'Rust: unwrap() / expect() / panic! in production code',
+    layer: 'backend',
+    severity: 'medium',
+    description: 'Calling .unwrap(), .expect(), or panic!() in production code causes a panic (crash) on unexpected states. In a web handler or critical path this leads to DoS via attacker-controlled input.',
+    threat: 'Denial of service via panic on untrusted input; information disclosure from stack trace',
+    remediation: '1) Use proper error handling with `Result<T, E>` and the `?` operator. ' +
+        '2) For invariant assertions, document why the value cannot fail; consider `debug_assert!` for non-critical checks. ' +
+        '3) Wrap input parsing in dedicated `try_from` / `parse` and return HTTP 400. ' +
+        '4) Catch panics at the boundary (e.g. actix_web::middleware::panic_handler, tower_http::catch_panic). ' +
+        '5) Add a global catch_unwind or tokio::spawn wrapper for resilience.',
+    references: [
+        'https://doc.rust-lang.org/book/ch09-00-error-handling.html',
+        'https://github.com/tokio-rs/axum/blob/main/examples/testing-errors/src/main.rs',
+    ],
+    cwe: 'CWE-754',
+    owasp: 'A04:2021 Insecure Design',
+    languages: ['rust'],
+    check: (ctx) => {
+        const patterns = [
+            /\.unwrap\(\)/g,
+            /\.expect\([^)]*\)/g,
+            /\bpanic!\(/g,
+            /unimplemented!\(/g,
+            /todo!\(/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=unsafeExpect.js.map

package/dist/engine/rules/rust/unsafeExpect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafeExpect.js","sourceRoot":"","sources":["../../../../src/engine/rules/rust/unsafeExpect.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,uDAAuD;IAC9D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,8LAA8L;IAChM,MAAM,EAAE,yFAAyF;IACjG,WAAW,EACT,yEAAyE;QACzE,qHAAqH;QACrH,+EAA+E;QAC/E,wGAAwG;QACxG,sEAAsE;IACxE,UAAU,EAAE;QACV,4DAA4D;QAC5D,gFAAgF;KACjF;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG;YACf,eAAe;YACf,oBAAoB;YACpB,aAAa;YACb,mBAAmB;YACnB,UAAU;SACX,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/scanner.d.ts

@@ -0,0 +1,5 @@
+import { type WalkedFile } from './walker.js';
+import type { Finding, Language, ScanOptions, ScanResult, ScanSummary } from '../types.js';
+export declare function scan(options: ScanOptions): Promise<ScanResult>;
+export declare function summarize(findings: readonly Finding[]): ScanSummary;
+export type { WalkedFile, Language };

package/dist/engine/scanner.js

@@ -0,0 +1,135 @@
+import fs from 'node:fs/promises';
+import { detectLanguage, buildProjectProfile } from './language.js';
+import { walkProject } from './walker.js';
+import { getRulesForLanguage } from './rules/index.js';
+import { loadConfig, applyConfig } from './config.js';
+import { detectFrameworks } from './language.js';
+const ALL_LAYERS = ['frontend', 'backend', 'network', 'database', 'cicd', 'observability'];
+const PER_FILE_FINDING_CAP = 50;
+const GLOBAL_FINDING_CAP = 5000;
+export async function scan(options) {
+    const startedAt = new Date();
+    const rootDir = options.rootDir ?? process.cwd();
+    const config = await loadConfig(rootDir);
+    const effective = applyConfig(config, {
+        layers: options.layers,
+        ignore: options.ignore,
+        ruleIds: options.ruleIds,
+    });
+    const layers = (effective.layers && effective.layers.length > 0 ? effective.layers : ALL_LAYERS);
+    const disabledRuleIds = new Set(Object.entries(config.rules ?? {})
+        .filter(([, v]) => v.enabled === false)
+        .map(([k]) => k));
+    const severityOverrides = new Map();
+    for (const [id, v] of Object.entries(config.rules ?? {})) {
+        if (v.severity)
+            severityOverrides.set(id, v.severity);
+    }
+    const files = await walkProject({
+        rootDir,
+        ignore: effective.ignore,
+    });
+    const rulesEvaluated = new Set();
+    const findings = [];
+    const detectedLanguages = new Set();
+    const applicableRules = new Set();
+    const maxPerFile = options.maxMatchesPerFile ?? PER_FILE_FINDING_CAP;
+    const sourcesForProfile = [];
+    for (const file of files) {
+        let source;
+        try {
+            source = await fs.readFile(file.absolutePath, 'utf8');
+        }
+        catch {
+            source = '';
+        }
+        const language = detectLanguage(file.relativePath, source);
+        sourcesForProfile.push({ relativePath: file.relativePath, source });
+        if (language !== 'unknown')
+            detectedLanguages.add(language);
+        const candidates = getRulesForLanguage(language);
+        const applicable = candidates.filter((r) => {
+            if (disabledRuleIds.has(r.id))
+                return false;
+            if (effective.ruleIds && effective.ruleIds.length > 0) {
+                if (!effective.ruleIds.includes(r.id))
+                    return false;
+            }
+            if (!layers.includes(r.layer))
+                return false;
+            return true;
+        });
+        if (applicable.length === 0)
+            continue;
+        const lines = source.split(/\r?\n/);
+        for (const rule of applicable) {
+            rulesEvaluated.add(rule.id);
+            applicableRules.add(rule.id);
+            let ruleFindings;
+            try {
+                ruleFindings = rule.check({
+                    filePath: file.absolutePath,
+                    relativePath: file.relativePath,
+                    language,
+                    source,
+                    lines,
+                });
+            }
+            catch (err) {
+                continue;
+            }
+            for (let finding of ruleFindings) {
+                if (findings.length >= maxPerFile * 100)
+                    break;
+                const override = severityOverrides.get(finding.ruleId);
+                if (override) {
+                    finding = { ...finding, severity: override };
+                }
+                findings.push(finding);
+            }
+        }
+    }
+    const finishedAt = new Date();
+    const summary = summarize(findings);
+    const profileBase = buildProjectProfile(sourcesForProfile);
+    const frameworks = await detectFrameworks(rootDir);
+    const profile = {
+        ...profileBase,
+        applicableRules: Array.from(applicableRules).sort(),
+        frameworks,
+    };
+    return {
+        rootDir,
+        startedAt: startedAt.toISOString(),
+        finishedAt: finishedAt.toISOString(),
+        durationMs: finishedAt.getTime() - startedAt.getTime(),
+        filesScanned: files.length,
+        rulesEvaluated: rulesEvaluated.size,
+        findings: findings.slice(0, GLOBAL_FINDING_CAP),
+        summary,
+        profile,
+    };
+}
+export function summarize(findings) {
+    const bySeverity = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0,
+    };
+    const byLayer = {
+        frontend: 0,
+        backend: 0,
+        network: 0,
+        database: 0,
+        cicd: 0,
+        observability: 0,
+    };
+    for (const f of findings) {
+        bySeverity[f.severity]++;
+        byLayer[f.layer]++;
+    }
+    return { totalFindings: findings.length, bySeverity, byLayer };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/engine/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/engine/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAuB,MAAM,kBAAkB,CAAC;AAU5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAyB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,UAAU,GAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AAC7G,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAqB,CAAC;IACrH,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,QAAQ;YAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;QAC9B,OAAO;QACP,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAY,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IACrE,MAAM,iBAAiB,GAAqD,EAAE,CAAC;IAE/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3D,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,SAAS;YAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;YACtD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE7B,IAAI,YAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC;oBACxB,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,QAAQ;oBACR,MAAM;oBACN,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,IAAI,QAAQ,CAAC,MAAM,IAAI,UAAU,GAAG,GAAG;oBAAE,MAAM;gBAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBAC/C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG;QACd,GAAG,WAAW;QACd,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE;QACnD,UAAU;KACX,CAAC;IAEF,OAAO;QACL,OAAO;QACP,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;QACtD,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,cAAc,EAAE,cAAc,CAAC,IAAI;QACnC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QAC/C,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,UAAU,GAA6B;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,MAAM,OAAO,GAA0B;QACrC,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC"}

package/dist/engine/walker.d.ts

@@ -0,0 +1,11 @@
+export interface WalkedFile {
+    readonly absolutePath: string;
+    readonly relativePath: string;
+    readonly sizeBytes: number;
+}
+export interface WalkOptions {
+    readonly rootDir: string;
+    readonly ignore?: readonly string[];
+    readonly maxFiles?: number;
+}
+export declare function walkProject(options: WalkOptions): Promise<readonly WalkedFile[]>;