@nahisaho/musubix-security 1.8.0

package/dist/types/secret.d.ts

@@ -0,0 +1,151 @@
+/**
+ * @fileoverview Secret detection type definitions
+ * @module @nahisaho/musubix-security/types/secret
+ * @trace REQ-SEC-SECRET-001, REQ-SEC-SECRET-002
+ */
+import type { SourceLocation, Severity } from './vulnerability.js';
+/**
+ * Secret type classification
+ * @trace REQ-SEC-SECRET-001
+ */
+export type SecretType = 'api-key' | 'aws-access-key' | 'aws-secret-key' | 'azure-connection-string' | 'gcp-service-account' | 'github-token' | 'gitlab-token' | 'npm-token' | 'private-key' | 'ssh-key' | 'database-url' | 'jwt-secret' | 'oauth-secret' | 'password' | 'encryption-key' | 'slack-webhook' | 'stripe-key' | 'twilio-key' | 'sendgrid-key' | 'custom';
+/**
+ * Secret context (where it was found)
+ */
+export type SecretContext = 'source-code' | 'config-file' | 'environment' | 'comment' | 'string-literal' | 'template-literal' | 'object-property' | 'array-element';
+/**
+ * Detected secret
+ * @trace REQ-SEC-SECRET-001
+ */
+export interface Secret {
+    /** Unique secret ID (e.g., "SEC-2026-001") */
+    id: string;
+    /** Secret type */
+    type: SecretType;
+    /** Source code location */
+    location: SourceLocation;
+    /** Masked value (first 4 and last 4 chars visible) */
+    maskedValue: string;
+    /** Full value hash (SHA-256) for deduplication */
+    valueHash: string;
+    /** Variable/key name if identifiable */
+    keyName?: string;
+    /** Context where secret was found */
+    context: SecretContext;
+    /** Detection confidence (0.0 - 1.0) */
+    confidence: number;
+    /** Whether this appears to be a test/example value */
+    isTestValue: boolean;
+    /** Pattern ID that detected this secret */
+    patternId: string;
+    /** Detection timestamp */
+    detectedAt: Date;
+    /** Severity based on secret type */
+    severity: Severity;
+}
+/**
+ * Secret detection pattern
+ * @trace REQ-SEC-SECRET-002
+ */
+export interface SecretPattern {
+    /** Unique pattern ID */
+    id: string;
+    /** Pattern name */
+    name: string;
+    /** Secret type this pattern detects */
+    type: SecretType;
+    /** Regex pattern to match */
+    regex: RegExp;
+    /** Optional key name patterns (for key=value pairs) */
+    keyPatterns?: RegExp[];
+    /** Severity when matched */
+    severity: Severity;
+    /** Patterns that indicate test/example values */
+    testValuePatterns?: RegExp[];
+    /** Additional validation function name */
+    validator?: string;
+    /** Pattern description */
+    description: string;
+    /** Whether pattern is enabled by default */
+    enabled: boolean;
+    /** False positive rate (for tuning) */
+    falsePositiveRate?: number;
+}
+/**
+ * Built-in secret patterns
+ */
+export declare const BUILTIN_SECRET_PATTERNS: Omit<SecretPattern, 'regex' | 'keyPatterns' | 'testValuePatterns'>[];
+/**
+ * Secret scan options
+ */
+export interface SecretScanOptions {
+    /** Custom patterns to use */
+    customPatterns?: SecretPattern[];
+    /** Built-in patterns to disable */
+    disablePatterns?: string[];
+    /** File patterns to exclude */
+    excludePatterns?: string[];
+    /** Ignore test/example values */
+    ignoreTestValues?: boolean;
+    /** Maximum file size in bytes */
+    maxFileSize?: number;
+    /** Verify secrets (check if they're valid/active) */
+    verify?: boolean;
+    /** Entropy threshold for generic detection */
+    entropyThreshold?: number;
+}
+/**
+ * Secret scan result
+ * @trace REQ-SEC-SECRET-001
+ */
+export interface SecretScanResult {
+    /** Detected secrets */
+    secrets: Secret[];
+    /** Number of files scanned */
+    scannedFiles: number;
+    /** Number of files skipped */
+    skippedFiles: number;
+    /** Scan duration in milliseconds */
+    duration: number;
+    /** Scan timestamp */
+    timestamp: Date;
+    /** Scan options used */
+    options: SecretScanOptions;
+    /** Summary by type */
+    summary: {
+        byType: Partial<Record<SecretType, number>>;
+        bySeverity: {
+            critical: number;
+            high: number;
+            medium: number;
+            low: number;
+        };
+        total: number;
+        testValues: number;
+    };
+}
+/**
+ * Secret verification result
+ */
+export interface SecretVerification {
+    /** Secret ID */
+    secretId: string;
+    /** Whether the secret is valid/active */
+    isValid: boolean;
+    /** Verification method used */
+    method: 'api-call' | 'format-check' | 'entropy' | 'none';
+    /** Additional info from verification */
+    info?: {
+        /** For API keys: associated account/org */
+        account?: string;
+        /** For API keys: permissions */
+        permissions?: string[];
+        /** Expiration if known */
+        expiresAt?: Date;
+    };
+    /** Verification timestamp */
+    verifiedAt: Date;
+    /** Error if verification failed */
+    error?: string;
+}
+//# sourceMappingURL=secret.d.ts.map

package/dist/types/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/types/secret.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,gBAAgB,GAChB,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,cAAc,GACd,cAAc,GACd,WAAW,GACX,aAAa,GACb,SAAS,GACT,cAAc,GACd,YAAY,GACZ,cAAc,GACd,UAAU,GACV,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,aAAa,GACb,aAAa,GACb,SAAS,GACT,gBAAgB,GAChB,kBAAkB,GAClB,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,WAAW,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,oCAAoC;IACpC,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,IAAI,EAAE,UAAU,CAAC;IACjB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,aAAa,GAAG,mBAAmB,CAAC,EAiFvG,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,mCAAmC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,sBAAsB;IACtB,OAAO,EAAE;QACP,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,UAAU,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;YACf,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;QACF,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,MAAM,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;IACzD,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,2CAA2C;QAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gCAAgC;QAChC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,0BAA0B;QAC1B,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,CAAC;IACF,6BAA6B;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/types/secret.js

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview Secret detection type definitions
+ * @module @nahisaho/musubix-security/types/secret
+ * @trace REQ-SEC-SECRET-001, REQ-SEC-SECRET-002
+ */
+/**
+ * Built-in secret patterns
+ */
+export const BUILTIN_SECRET_PATTERNS = [
+    {
+        id: 'aws-access-key',
+        name: 'AWS Access Key ID',
+        type: 'aws-access-key',
+        severity: 'critical',
+        description: 'AWS Access Key ID (starts with AKIA)',
+        enabled: true,
+    },
+    {
+        id: 'aws-secret-key',
+        name: 'AWS Secret Access Key',
+        type: 'aws-secret-key',
+        severity: 'critical',
+        description: 'AWS Secret Access Key (40 character base64)',
+        enabled: true,
+    },
+    {
+        id: 'github-pat',
+        name: 'GitHub Personal Access Token',
+        type: 'github-token',
+        severity: 'critical',
+        description: 'GitHub PAT (ghp_*, gho_*, ghu_*, ghs_*, ghr_*)',
+        enabled: true,
+    },
+    {
+        id: 'private-key',
+        name: 'Private Key',
+        type: 'private-key',
+        severity: 'critical',
+        description: 'RSA/EC/DSA private key in PEM format',
+        enabled: true,
+    },
+    {
+        id: 'jwt-secret',
+        name: 'JWT Secret',
+        type: 'jwt-secret',
+        severity: 'high',
+        description: 'JWT signing secret in common patterns',
+        enabled: true,
+    },
+    {
+        id: 'database-url',
+        name: 'Database URL',
+        type: 'database-url',
+        severity: 'high',
+        description: 'Database connection string with credentials',
+        enabled: true,
+    },
+    {
+        id: 'generic-api-key',
+        name: 'Generic API Key',
+        type: 'api-key',
+        severity: 'medium',
+        description: 'Generic API key patterns',
+        enabled: true,
+    },
+    {
+        id: 'azure-connection',
+        name: 'Azure Connection String',
+        type: 'azure-connection-string',
+        severity: 'critical',
+        description: 'Azure storage/service connection strings',
+        enabled: true,
+    },
+    {
+        id: 'stripe-key',
+        name: 'Stripe API Key',
+        type: 'stripe-key',
+        severity: 'critical',
+        description: 'Stripe API keys (sk_live_*, rk_live_*)',
+        enabled: true,
+    },
+    {
+        id: 'slack-webhook',
+        name: 'Slack Webhook URL',
+        type: 'slack-webhook',
+        severity: 'medium',
+        description: 'Slack incoming webhook URLs',
+        enabled: true,
+    },
+];
+//# sourceMappingURL=secret.js.map

package/dist/types/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/types/secret.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuGH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAyE;IAC3G;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,IAAI;KACd;CACF,CAAC"}

package/dist/types/taint.d.ts

@@ -0,0 +1,182 @@
+/**
+ * @fileoverview Taint analysis type definitions
+ * @module @nahisaho/musubix-security/types/taint
+ * @trace REQ-SEC-TAINT-001, REQ-SEC-TAINT-002, REQ-SEC-TAINT-003, REQ-SEC-TAINT-004
+ */
+import type { SourceLocation, Severity } from './vulnerability.js';
+/**
+ * Taint source category
+ * @trace REQ-SEC-TAINT-001
+ */
+export type TaintSourceCategory = 'user-input' | 'database' | 'file-system' | 'network' | 'environment' | 'config' | 'cli-args';
+/**
+ * Taint source (where untrusted data enters)
+ * @trace REQ-SEC-TAINT-001
+ */
+export interface TaintSource {
+    /** Unique source ID */
+    id: string;
+    /** Source category */
+    category: TaintSourceCategory;
+    /** Source code location */
+    location: SourceLocation;
+    /** Variable/parameter name holding tainted data */
+    variableName: string;
+    /** Expression that produces tainted data */
+    expression: string;
+    /** Human-readable description */
+    description: string;
+    /** Detection confidence */
+    confidence: number;
+}
+/**
+ * Taint sink category
+ * @trace REQ-SEC-TAINT-002
+ */
+export type TaintSinkCategory = 'sql-query' | 'nosql-query' | 'command-exec' | 'file-write' | 'file-read' | 'html-output' | 'redirect' | 'eval' | 'deserialization' | 'ldap-query' | 'xpath-query' | 'http-request';
+/**
+ * Taint sink (where tainted data could cause harm)
+ * @trace REQ-SEC-TAINT-002
+ */
+export interface TaintSink {
+    /** Unique sink ID */
+    id: string;
+    /** Sink category */
+    category: TaintSinkCategory;
+    /** Source code location */
+    location: SourceLocation;
+    /** Function/method name being called */
+    functionName: string;
+    /** Argument index receiving tainted data (0-based) */
+    argumentIndex: number;
+    /** Expected sanitization functions */
+    expectedSanitizers: string[];
+    /** Human-readable description */
+    description: string;
+    /** Severity if tainted data reaches this sink */
+    severity: Severity;
+}
+/**
+ * Taint flow step in the propagation path
+ * @trace REQ-SEC-TAINT-003
+ */
+export interface TaintFlowStep {
+    /** Step index in the path (0-based) */
+    index: number;
+    /** Source code location */
+    location: SourceLocation;
+    /** Expression at this step */
+    expression: string;
+    /** Variable name holding data at this step */
+    variableName?: string;
+    /** Type of operation (assignment, call, return, etc.) */
+    operation: 'assignment' | 'call' | 'return' | 'parameter' | 'property-access' | 'array-access';
+    /** Whether sanitization was applied at this step */
+    sanitized: boolean;
+    /** Sanitizer function if sanitization was applied */
+    sanitizer?: string;
+}
+/**
+ * Complete taint propagation path from source to sink
+ * @trace REQ-SEC-TAINT-003
+ */
+export interface TaintPath {
+    /** Unique path ID */
+    id: string;
+    /** Source where tainted data originates */
+    source: TaintSource;
+    /** Sink where tainted data is used unsafely */
+    sink: TaintSink;
+    /** Steps in the propagation path */
+    steps: TaintFlowStep[];
+    /** Whether any sanitization was applied */
+    sanitized: boolean;
+    /** Overall path confidence */
+    confidence: number;
+    /** Path length (number of steps) */
+    length: number;
+}
+/**
+ * Taint analysis result
+ * @trace REQ-SEC-TAINT-001
+ */
+export interface TaintResult {
+    /** Detected taint sources */
+    sources: TaintSource[];
+    /** Detected taint sinks */
+    sinks: TaintSink[];
+    /** Unsafe taint paths (source → sink without proper sanitization) */
+    unsafePaths: TaintPath[];
+    /** Number of files analyzed */
+    analyzedFiles: number;
+    /** Analysis duration in milliseconds */
+    duration: number;
+    /** Analysis timestamp */
+    timestamp: Date;
+    /** Summary statistics */
+    summary: {
+        totalSources: number;
+        totalSinks: number;
+        unsafePathCount: number;
+        bySeverity: {
+            critical: number;
+            high: number;
+            medium: number;
+            low: number;
+        };
+        bySourceCategory: Record<TaintSourceCategory, number>;
+        bySinkCategory: Record<TaintSinkCategory, number>;
+    };
+}
+/**
+ * Taint analysis options
+ * @trace REQ-SEC-TAINT-004
+ */
+export interface TaintAnalysisOptions {
+    /** Custom source patterns (regex patterns) */
+    customSources?: {
+        pattern: string;
+        category: TaintSourceCategory;
+        description: string;
+    }[];
+    /** Custom sink patterns */
+    customSinks?: {
+        pattern: string;
+        category: TaintSinkCategory;
+        severity: Severity;
+        description: string;
+    }[];
+    /** Additional sanitizer functions to recognize */
+    additionalSanitizers?: {
+        functionName: string;
+        sinkCategories: TaintSinkCategory[];
+    }[];
+    /** Maximum path depth to track */
+    maxPathDepth?: number;
+    /** Enable inter-procedural analysis */
+    interprocedural?: boolean;
+    /** Track through async/await boundaries */
+    trackAsync?: boolean;
+    /** File patterns to exclude */
+    excludePatterns?: string[];
+}
+/**
+ * Known sanitizer function
+ */
+export interface SanitizerDefinition {
+    /** Function name or pattern */
+    name: string;
+    /** Package/module containing the sanitizer */
+    package?: string;
+    /** Sink categories this sanitizer protects against */
+    protects: TaintSinkCategory[];
+    /** Whether sanitization is complete or partial */
+    complete: boolean;
+    /** Notes about the sanitizer */
+    notes?: string;
+}
+/**
+ * Built-in sanitizer definitions
+ */
+export declare const BUILTIN_SANITIZERS: SanitizerDefinition[];
+//# sourceMappingURL=taint.d.ts.map

package/dist/types/taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.d.ts","sourceRoot":"","sources":["../../src/types/taint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,UAAU,GACV,aAAa,GACb,SAAS,GACT,aAAa,GACb,QAAQ,GACR,UAAU,CAAC;AAEf;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,aAAa,GACb,cAAc,GACd,YAAY,GACZ,WAAW,GACX,aAAa,GACb,UAAU,GACV,MAAM,GACN,iBAAiB,GACjB,YAAY,GACZ,aAAa,GACb,cAAc,CAAC;AAEnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,qBAAqB;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2BAA2B;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,wCAAwC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,cAAc,CAAC;IAC/F,oDAAoD;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,qBAAqB;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,+CAA+C;IAC/C,IAAI,EAAE,SAAS,CAAC;IAChB,oCAAoC;IACpC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,2BAA2B;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,qEAAqE;IACrE,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,yBAAyB;IACzB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;YACf,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACtD,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;KACnD,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;KACrB,EAAE,CAAC;IACJ,2BAA2B;IAC3B,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,QAAQ,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,EAAE,CAAC;IACJ,kDAAkD;IAClD,oBAAoB,CAAC,EAAE;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,iBAAiB,EAAE,CAAC;KACrC,EAAE,CAAC;IACJ,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,EAAE,OAAO,CAAC;IAClB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,mBAAmB,EAcnD,CAAC"}

package/dist/types/taint.js

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Taint analysis type definitions
+ * @module @nahisaho/musubix-security/types/taint
+ * @trace REQ-SEC-TAINT-001, REQ-SEC-TAINT-002, REQ-SEC-TAINT-003, REQ-SEC-TAINT-004
+ */
+/**
+ * Built-in sanitizer definitions
+ */
+export const BUILTIN_SANITIZERS = [
+    // SQL
+    { name: 'escape', package: 'mysql', protects: ['sql-query'], complete: true },
+    { name: 'escape', package: 'pg', protects: ['sql-query'], complete: true },
+    { name: 'parameterize', protects: ['sql-query', 'nosql-query'], complete: true },
+    // XSS
+    { name: 'escapeHtml', protects: ['html-output'], complete: true },
+    { name: 'sanitizeHtml', package: 'sanitize-html', protects: ['html-output'], complete: true },
+    { name: 'encode', package: 'html-entities', protects: ['html-output'], complete: true },
+    // Command
+    { name: 'quote', package: 'shell-quote', protects: ['command-exec'], complete: true },
+    // Path
+    { name: 'basename', package: 'path', protects: ['file-read', 'file-write'], complete: false, notes: 'Only removes directory components' },
+    { name: 'normalize', package: 'path', protects: ['file-read', 'file-write'], complete: false, notes: 'Resolves .. but does not prevent traversal' },
+];
+//# sourceMappingURL=taint.js.map

package/dist/types/taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/types/taint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2MH;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B;IACvD,MAAM;IACN,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChF,MAAM;IACN,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IACjE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7F,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvF,UAAU;IACV,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrF,OAAO;IACP,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACzI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;CACpJ,CAAC"}

package/dist/types/vulnerability.d.ts

@@ -0,0 +1,136 @@
+/**
+ * @fileoverview Vulnerability type definitions
+ * @module @nahisaho/musubix-security/types/vulnerability
+ * @trace REQ-SEC-SCAN-001, REQ-SEC-SCAN-002, REQ-SEC-SCAN-003
+ */
+/**
+ * OWASP Top 10 (2021) vulnerability categories
+ */
+export type OWASPCategory = 'A01:2021' | 'A02:2021' | 'A03:2021' | 'A04:2021' | 'A05:2021' | 'A06:2021' | 'A07:2021' | 'A08:2021' | 'A09:2021' | 'A10:2021';
+/**
+ * Vulnerability type classification
+ */
+export type VulnerabilityType = 'injection' | 'xss' | 'broken-access' | 'broken-auth' | 'sensitive-exposure' | 'xxe' | 'misconfig' | 'insecure-deser' | 'vuln-components' | 'insufficient-logging' | 'ssrf' | 'path-traversal' | 'command-injection' | 'code-injection' | 'open-redirect' | 'prototype-pollution';
+/**
+ * Severity levels for vulnerabilities
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+/**
+ * Source code location
+ * @trace DES-SEC-SCAN-001
+ */
+export interface SourceLocation {
+    /** Absolute file path */
+    file: string;
+    /** Start line number (1-based) */
+    startLine: number;
+    /** End line number (1-based) */
+    endLine: number;
+    /** Start column number (0-based) */
+    startColumn: number;
+    /** End column number (0-based) */
+    endColumn: number;
+}
+/**
+ * Detected vulnerability
+ * @trace REQ-SEC-SCAN-001
+ */
+export interface Vulnerability {
+    /** Unique vulnerability ID (e.g., "VULN-2026-001") */
+    id: string;
+    /** Vulnerability type classification */
+    type: VulnerabilityType;
+    /** Severity level */
+    severity: Severity;
+    /** Related CWE identifiers */
+    cwes: string[];
+    /** Related OWASP categories */
+    owasp?: OWASPCategory[];
+    /** Source code location */
+    location: SourceLocation;
+    /** Human-readable description */
+    description: string;
+    /** Recommended fix */
+    recommendation: string;
+    /** Detection confidence (0.0 - 1.0) */
+    confidence: number;
+    /** Rule ID that detected this vulnerability */
+    ruleId: string;
+    /** Original vulnerable code snippet */
+    codeSnippet?: string;
+    /** Detection timestamp */
+    detectedAt: Date;
+}
+/**
+ * Scan options
+ * @trace REQ-SEC-SCAN-004
+ */
+export interface ScanOptions {
+    /** Filter by severity levels */
+    severityFilter?: Severity[];
+    /** Rulesets to use */
+    rulesets?: ('owasp-top-10' | 'cwe-top-25' | 'custom')[];
+    /** File patterns to exclude */
+    excludePatterns?: string[];
+    /** Maximum file size in bytes */
+    maxFileSize?: number;
+    /** Enable incremental scanning */
+    incremental?: boolean;
+    /** Custom rules directory */
+    customRulesDir?: string;
+}
+/**
+ * Scan result
+ * @trace REQ-SEC-SCAN-001
+ */
+export interface ScanResult {
+    /** Detected vulnerabilities */
+    vulnerabilities: Vulnerability[];
+    /** Number of files scanned */
+    scannedFiles: number;
+    /** Number of files skipped */
+    skippedFiles: number;
+    /** Scan duration in milliseconds */
+    duration: number;
+    /** Scan timestamp */
+    timestamp: Date;
+    /** Scan options used */
+    options: ScanOptions;
+    /** Summary by severity */
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+        total: number;
+    };
+}
+/**
+ * Security rule definition
+ */
+export interface SecurityRule {
+    /** Unique rule ID */
+    id: string;
+    /** Rule name */
+    name: string;
+    /** Rule description */
+    description: string;
+    /** Vulnerability type this rule detects */
+    type: VulnerabilityType;
+    /** Default severity */
+    severity: Severity;
+    /** Related CWEs */
+    cwes: string[];
+    /** Related OWASP categories */
+    owasp?: OWASPCategory[];
+    /** AST pattern to match (simplified) */
+    pattern?: string;
+    /** Detection function name */
+    detector?: string;
+    /** Whether rule is enabled by default */
+    enabled: boolean;
+    /** Rule metadata */
+    metadata?: Record<string, unknown>;
+}
+//# sourceMappingURL=vulnerability.d.ts.map

package/dist/types/vulnerability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.d.ts","sourceRoot":"","sources":["../../src/types/vulnerability.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEf;;GAEG;AACH,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,KAAK,GACL,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,iBAAiB,GACjB,sBAAsB,GACtB,MAAM,GACN,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,iBAAiB,CAAC;IACxB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,UAAU,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,sBAAsB;IACtB,QAAQ,CAAC,EAAE,CAAC,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;IACxD,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,+BAA+B;IAC/B,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B;IAC1B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,qBAAqB;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/types/vulnerability.js

@@ -0,0 +1,7 @@
+/**
+ * @fileoverview Vulnerability type definitions
+ * @module @nahisaho/musubix-security/types/vulnerability
+ * @trace REQ-SEC-SCAN-001, REQ-SEC-SCAN-002, REQ-SEC-SCAN-003
+ */
+export {};
+//# sourceMappingURL=vulnerability.js.map

package/dist/types/vulnerability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.js","sourceRoot":"","sources":["../../src/types/vulnerability.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}