@obfuscan/core 0.1.0

package/dist/scan.js

@@ -0,0 +1,287 @@
+/**
+ * scan() — the orchestrator.
+ *
+ * Pipeline:
+ *   1. Validate ScanInput (exactly one of diff/paths/dir).
+ *   2. Resolve target file list:
+ *        diff   → parseDiffToFiles → addedRanges per file
+ *        paths  → use as-is, no addedRanges
+ *        dir    → host enumerates; we just respect the resolver's nulls
+ *   3. For each file (concurrency-limited):
+ *        a. Resolve content via fileResolver (catch errors; log+skip)
+ *        b. Build FileContext (path, source, languageId, config, addedRanges)
+ *        c. For each enabled detector where applies(ctx) is true:
+ *             - run() with per-file timeout + try/catch
+ *             - collect findings
+ *        d. Apply diff-range filter (drop findings outside addedRanges)
+ *        e. Apply in-source disable directives
+ *        f. Apply allowlist (paths + snippets)
+ *        g. Apply minSeverity
+ *        h. Truncate snippets to 200 chars defensively
+ *   4. Sort findings by (severity desc, score desc, file asc, line asc).
+ *   5. Return ScanResult.
+ */
+import { parseDiffToFiles, lineInRanges } from "./diff.js";
+import { extractDisableDirectives, isSuppressedByDirectives } from "./directives.js";
+import { matchesAllowlist } from "./allowlist.js";
+import { defaultRuleSet } from "./rules.js";
+import { defaultDetectors } from "./detectors/index.js";
+import { InvalidScanInputError } from "./errors.js";
+import { ENGINE_VERSION } from "./version.js";
+const SEVERITY_RANK = { info: 0, warn: 1, block: 2 };
+const DEFAULT_FILE_TIMEOUT_MS = 5000;
+const SNIPPET_CAP = 200;
+export async function scan(input, options) {
+    validateInput(input);
+    const t0 = Date.now();
+    const logger = options.logger ?? consoleLogger();
+    const ruleSet = options.rules ?? (await defaultRuleSet());
+    const detectors = (options.detectors ?? defaultDetectors()).filter(d => !(options.disabledDetectors ?? []).includes(d.id));
+    // Build the file work list.
+    const targets = await prepareTargets(input);
+    const results = [];
+    const findings = [];
+    const failedDetectors = new Set();
+    const minRank = SEVERITY_RANK[options.minSeverity ?? "info"];
+    const fileTimeout = options.fileTimeoutMs ?? DEFAULT_FILE_TIMEOUT_MS;
+    // Concurrency limiter
+    const concurrency = Math.max(1, options.concurrency ?? Math.max(2, defaultConcurrency()));
+    let filesDone = 0;
+    const total = targets.length;
+    const reportProgress = (currentFile) => {
+        if (!options.onProgress)
+            return;
+        const progress = currentFile
+            ? { filesTotal: total, filesDone, currentFile }
+            : { filesTotal: total, filesDone };
+        options.onProgress(progress);
+    };
+    await runWithConcurrency(targets, concurrency, async (target) => {
+        reportProgress(target.path);
+        let source = null;
+        try {
+            source = await options.fileResolver(target.path);
+        }
+        catch (e) {
+            logger.warn(`fileResolver threw for ${target.path}`, e);
+        }
+        let languageId = null;
+        if (source !== null) {
+            languageId = ruleSet.detectLanguage(target.path);
+        }
+        results.push({ path: target.path, languageId });
+        if (source === null) {
+            filesDone++;
+            reportProgress();
+            return;
+        }
+        const config = languageId ? ruleSet.configFor(languageId) : null;
+        let cachedGrammar = null;
+        let cachedTree = null;
+        let treeResolved = false;
+        const ctx = {
+            path: target.path,
+            languageId,
+            config,
+            source,
+            addedRanges: target.addedRanges,
+            grammar: null, // populated lazily if a detector accesses it
+            tree: async () => {
+                if (treeResolved)
+                    return cachedTree;
+                treeResolved = true;
+                if (!languageId)
+                    return null;
+                try {
+                    cachedGrammar = await ruleSet.loadGrammar(languageId);
+                    // If the host-supplied grammar exposes a parser, use it. The default
+                    // RuleSet returns a stub handle with no `parse` — the bundled
+                    // detectors are regex-driven and never call tree(). See
+                    // `docs/tree-sitter.md` for the host-override contract.
+                    if (cachedGrammar && typeof cachedGrammar.parse === "function") {
+                        cachedTree = await cachedGrammar.parse(source);
+                    }
+                    else {
+                        cachedTree = null;
+                    }
+                }
+                catch {
+                    cachedTree = null;
+                }
+                return cachedTree;
+            },
+        };
+        // Bind grammar lazily on first use; default detectors don't read this.
+        Object.defineProperty(ctx, "grammar", {
+            get() {
+                return cachedGrammar;
+            },
+            enumerable: true,
+        });
+        const directives = extractDisableDirectives(source);
+        const fileFindings = [];
+        for (const det of detectors) {
+            let applies = false;
+            try {
+                applies = det.applies(ctx);
+            }
+            catch (e) {
+                logger.warn(`detector ${det.id} threw in applies()`, e);
+                failedDetectors.add(det.id);
+                continue;
+            }
+            if (!applies)
+                continue;
+            let detFindings = [];
+            try {
+                const out = await runWithTimeout(det, ctx, fileTimeout);
+                detFindings = out;
+            }
+            catch (e) {
+                logger.warn(`detector ${det.id} failed on ${target.path}`, e);
+                failedDetectors.add(det.id);
+                continue;
+            }
+            for (const f of detFindings) {
+                const normalized = normalizeFinding(f);
+                if (target.diffMode && !lineInRanges(normalized.line, target.addedRanges)) {
+                    continue;
+                }
+                if (isSuppressedByDirectives(normalized.line, normalized.ruleId, directives)) {
+                    continue;
+                }
+                if (options.allowlist && matchesAllowlist(normalized, options.allowlist, target.path)) {
+                    continue;
+                }
+                if (SEVERITY_RANK[normalized.severity] < minRank)
+                    continue;
+                fileFindings.push(normalized);
+            }
+        }
+        if (options.symbolResolver) {
+            // Best-effort enclosing symbol enrichment.
+            for (let i = 0; i < fileFindings.length; i++) {
+                const f = fileFindings[i];
+                try {
+                    const sym = await options.symbolResolver(target.path, f.line);
+                    if (sym)
+                        fileFindings[i] = { ...f, enclosingSymbol: sym };
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+        findings.push(...fileFindings);
+        filesDone++;
+        reportProgress();
+    });
+    // Final progress emit (ensures filesDone === total even when no resolver work).
+    if (options.onProgress && total === 0) {
+        options.onProgress({ filesTotal: 0, filesDone: 0 });
+    }
+    findings.sort(compareFindings);
+    return {
+        findings: Object.freeze(findings.slice()),
+        files: Object.freeze(results.slice()),
+        durationMs: Math.max(0, Date.now() - t0),
+        failedDetectors: Object.freeze([...failedDetectors].sort()),
+        rulesVersion: ruleSet.version(),
+        engineVersion: ENGINE_VERSION,
+    };
+}
+// ─── Helpers ───────────────────────────────────────────────────────────────
+function validateInput(input) {
+    const set = [
+        input.diff !== undefined,
+        input.paths !== undefined,
+        input.dir !== undefined,
+    ].filter(Boolean).length;
+    if (set !== 1) {
+        throw new InvalidScanInputError(`ScanInput must set exactly one of {diff, paths, dir}; got ${set}`);
+    }
+}
+async function prepareTargets(input) {
+    if (input.diff !== undefined) {
+        const files = parseDiffToFiles(input.diff);
+        return files
+            .filter(f => f.status !== "deleted")
+            .map(f => ({ path: f.path, addedRanges: f.addedRanges, diffMode: true }));
+    }
+    if (input.paths !== undefined) {
+        return input.paths.map(p => ({ path: p, addedRanges: [], diffMode: false }));
+    }
+    // dir: the host is responsible for enumerating via fileResolver. We have
+    // no portable directory walker (the engine is host-agnostic), so dir-mode
+    // returns an empty target list — same shape the contract test expects.
+    return [];
+}
+async function runWithConcurrency(items, limit, worker) {
+    if (items.length === 0)
+        return;
+    let cursor = 0;
+    const runners = [];
+    const runOne = async () => {
+        while (cursor < items.length) {
+            const idx = cursor++;
+            const item = items[idx];
+            if (item === undefined)
+                continue;
+            await worker(item);
+        }
+    };
+    for (let i = 0; i < Math.min(limit, items.length); i++) {
+        runners.push(runOne());
+    }
+    await Promise.all(runners);
+}
+async function runWithTimeout(det, ctx, timeoutMs) {
+    const out = det.run(ctx);
+    if (Array.isArray(out))
+        return out;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`detector ${det.id} timed out after ${timeoutMs}ms`)), timeoutMs);
+        Promise.resolve(out).then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });
+    });
+}
+function normalizeFinding(f) {
+    // Defensive truncation.
+    let snippet = f.snippet;
+    if (snippet.length > SNIPPET_CAP) {
+        snippet = snippet.slice(0, SNIPPET_CAP - 3) + "...";
+    }
+    return snippet === f.snippet ? f : { ...f, snippet };
+}
+function compareFindings(a, b) {
+    const ra = SEVERITY_RANK[a.severity];
+    const rb = SEVERITY_RANK[b.severity];
+    if (ra !== rb)
+        return rb - ra; // higher severity first
+    if (a.score !== b.score)
+        return b.score - a.score;
+    if (a.file !== b.file)
+        return a.file < b.file ? -1 : 1;
+    return a.line - b.line;
+}
+function defaultConcurrency() {
+    // Avoid `os.cpus()` import when the env is constrained.
+    try {
+        // dynamic require so this still works in non-Node runtimes
+        const n = globalThis.navigator?.hardwareConcurrency;
+        if (typeof n === "number" && n > 0)
+            return n;
+    }
+    catch {
+        // ignore
+    }
+    return 4;
+}
+function consoleLogger() {
+    return {
+        debug: () => { },
+        info: () => { },
+        warn: (msg, meta) => console.warn(msg, meta ?? ""),
+        error: (msg, meta) => console.error(msg, meta ?? ""),
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,aAAa,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,WAAW,GAAG,GAAG,CAAC;AASxB,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,KAAgB,EAChB,OAAoB;IAEpB,aAAa,CAAC,KAAK,CAAC,CAAC;IAErB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACvD,CAAC;IAEF,4BAA4B;IAC5B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAuD,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAErE,sBAAsB;IACtB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,CAAC,EACD,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CACzD,CAAC;IAEF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,cAAc,GAAG,CAAC,WAAoB,EAAE,EAAE;QAC9C,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO;QAChC,MAAM,QAAQ,GAAiB,WAAW;YACxC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE;YAC/C,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,MAAM,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC9D,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,SAAS,EAAE,CAAC;YACZ,cAAc,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,aAAa,GAAyB,IAAI,CAAC;QAC/C,IAAI,UAAU,GAAmB,IAAI,CAAC;QACtC,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,MAAM,GAAG,GAAgB;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU;YACV,MAAM;YACN,MAAM;YACN,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,IAAI,EAAE,6CAA6C;YAC5D,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,IAAI,YAAY;oBAAE,OAAO,UAAU,CAAC;gBACpC,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,UAAU;oBAAE,OAAO,IAAI,CAAC;gBAC7B,IAAI,CAAC;oBACH,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;oBACtD,qEAAqE;oBACrE,8DAA8D;oBAC9D,wDAAwD;oBACxD,wDAAwD;oBACxD,IAAI,aAAa,IAAI,OAAO,aAAa,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;wBAC/D,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;QACF,uEAAuE;QACvE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE;YACpC,GAAG;gBACD,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,YAAY,GAAc,EAAE,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;gBACxD,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,WAAW,GAAc,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACxD,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9D,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,IAAI,wBAAwB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC7E,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtF,SAAS;gBACX,CAAC;gBACD,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,OAAO;oBAAE,SAAS;gBAE3D,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,2CAA2C;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC9D,IAAI,GAAG;wBAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE/B,SAAS,EAAE,CAAC;QACZ,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,IAAI,OAAO,CAAC,UAAU,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE;QAC/B,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,aAAa,CAAC,KAAgB;IACrC,MAAM,GAAG,GAAG;QACV,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,KAAK,KAAK,SAAS;QACzB,KAAK,CAAC,GAAG,KAAK,SAAS;KACxB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D,GAAG,EAAE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAgB;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAmB,EACnB,KAAa,EACb,MAAkC;IAElC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,GAAgB,EAChB,SAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,oBAAoB,SAAS,IAAI,CAAC,CAAC,EAC5E,SAAS,CACV,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3C,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,wBAAwB;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IACxB,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,CAAU,EAAE,CAAU;IAC7C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,wBAAwB;IACvD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB;IACzB,wDAAwD;IACxD,IAAI,CAAC;QACH,2DAA2D;QAC3D,MAAM,CAAC,GAAI,UAA+D,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC1G,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACpE,KAAK,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Public type surface of @obfuscan/core.
+ *
+ * Anything exported from this file is part of the SemVer-stable API.
+ * Internal types live in src/internal/* and may change without notice.
+ */
+export type Severity = "info" | "warn" | "block";
+export interface Finding {
+    /** Stable rule id, e.g. "obf.decode-then-exec.python". */
+    ruleId: string;
+    /** Aggregated severity after scoring. */
+    severity: Severity;
+    /** 0..10. Aggregator clamps to 10. */
+    score: number;
+    /** Workspace-relative path. */
+    file: string;
+    /** 1-based line number where the finding starts. */
+    line: number;
+    /** 1-based line number where the finding ends. Optional; defaults to `line`. */
+    endLine?: number;
+    /** Up to 200 chars of the matched source. Truncated with ellipsis if longer. */
+    snippet: string;
+    /** Human-readable explanation suitable for direct display in a code review UI. */
+    reason: string;
+    /** Optional fully-qualified function name(s) the finding lives inside. Populated when the host provides a symbol resolver. */
+    enclosingSymbol?: string;
+    /** Detector-specific structured data. Stable per ruleId. */
+    evidence?: Readonly<Record<string, unknown>>;
+}
+/** Per-language config loaded from rules/languages/*.json. */
+export interface LanguageConfig {
+    readonly id: string;
+    readonly aliases?: readonly string[];
+    readonly extensions: readonly string[];
+    readonly filenames?: readonly string[];
+    readonly dynamic_exec_sinks: readonly string[];
+    readonly decoders: readonly string[];
+    readonly deserializers?: readonly string[];
+    readonly network_io?: readonly string[];
+    readonly secrets_io?: readonly string[];
+    readonly shell_exec?: readonly string[];
+    readonly library_load?: readonly string[];
+    readonly obfuscator_id_patterns?: readonly string[];
+    readonly min_mean_identifier_length?: number;
+    readonly obfuscator_id_min_ratio?: number;
+    readonly string_concat_operators?: readonly string[];
+    readonly language_specific_detectors?: readonly string[];
+    readonly manifests?: readonly string[];
+    readonly notes?: string;
+}
+/** Provider for language configs and tree-sitter grammars/queries. */
+export interface RuleSet {
+    /** Language ids this ruleset supports. */
+    languages(): readonly string[];
+    /** Look up a config by language id. Returns null if unsupported. */
+    configFor(languageId: string): LanguageConfig | null;
+    /** Map a file path to a language id, or null if unknown. */
+    detectLanguage(path: string): string | null;
+    /** Load the parser+queries for a language. Implementations may cache. */
+    loadGrammar(languageId: string): Promise<GrammarHandle>;
+    /** Calver version of the rule pack (e.g. "2026.04.0"). */
+    version(): string;
+}
+/**
+ * Opaque handle to a loaded tree-sitter parser and (optionally) its compiled
+ * queries. The default `RuleSet` returns a stub handle with no `parse` and no
+ * `_internal` because the bundled detectors are regex-driven — see
+ * `docs/tree-sitter.md` for how hosts plug in a real parser.
+ */
+export interface GrammarHandle {
+    /** The tree-sitter grammar id (e.g. "javascript", "python"). */
+    readonly id: string;
+    /**
+     * Internal field reserved for the engine. Hosts that wrap a real
+     * tree-sitter `Language` typically stash it here.
+     */
+    readonly _internal: unknown;
+    /**
+     * Optional source -> tree parser. When present, `FileContext.tree()` calls
+     * this on first access and caches the result. The returned value is
+     * `unknown` to keep the engine parser-agnostic; hosts and host-supplied
+     * detectors agree on its shape (typically a `Tree` from `web-tree-sitter`
+     * or `tree-sitter`).
+     */
+    parse?: (source: string) => unknown | Promise<unknown>;
+}
+/** Path-pattern-based suppression. Matched against POSIX-style relative paths. */
+export interface PathAllowlistEntry {
+    /** Glob in minimatch syntax. */
+    pattern: string;
+    /** Severity ceiling: findings below this severity are suppressed entirely on matching files. */
+    maxSeverity?: Severity;
+    /** Optional rule id filter; if omitted, applies to all rules. */
+    ruleId?: string;
+    /** Optional reviewer-visible reason. */
+    reason?: string;
+}
+/** Per-finding suppression keyed by `(ruleId, sha256(snippet))`. */
+export interface SnippetAllowlistEntry {
+    ruleId: string;
+    /** sha256 hex of the matched snippet. */
+    snippetHash: string;
+    reason?: string;
+    /** ISO-8601 timestamp set by the CLI when added. */
+    added?: string;
+    /** Optional GitHub login or email of the user who added it. */
+    addedBy?: string;
+}
+export interface Allowlist {
+    paths?: readonly PathAllowlistEntry[];
+    snippets?: readonly SnippetAllowlistEntry[];
+}
+/**
+ * Reads file content for the scanner.
+ *
+ * `path` is workspace-relative. The resolver should return the **post-image**
+ * (after the diff is applied) when scanning a diff. For a directory scan, it
+ * returns the current file content.
+ *
+ * Return `null` for files that don't exist or that the host wants to skip
+ * silently (e.g. binary files filtered upstream).
+ */
+export type FileResolver = (path: string) => Promise<string | null>;
+/** Optional symbol resolver for `Finding.enclosingSymbol`. */
+export type SymbolResolver = (path: string, line: number) => Promise<string | null>;
+/** A source of files to scan. Exactly one of `diff`, `paths`, or `dir` must be set. */
+export interface ScanInput {
+    /** Unified diff content. The scanner extracts changed files and added line ranges. */
+    diff?: string;
+    /** Explicit file list (workspace-relative paths). The whole file is scanned. */
+    paths?: readonly string[];
+    /** Directory to scan recursively. */
+    dir?: string;
+}
+export interface ScanOptions {
+    /** Reads file content. Required when scanning a diff. */
+    fileResolver: FileResolver;
+    /** Optional symbol resolver for nicer findings. */
+    symbolResolver?: SymbolResolver;
+    /** Override the rules pack. Defaults to the built-in `@obfuscan/rules`. */
+    rules?: RuleSet;
+    /** Allowlist to apply. Merged with anything loaded from `.obfuscan/allowlist.json`. */
+    allowlist?: Allowlist;
+    /** Hard limit on concurrent file scans. Default: `Math.max(2, os.cpus().length - 1)`. */
+    concurrency?: number;
+    /** Per-file timeout in ms. Default: 5000. Files that time out emit a single `info` finding and are skipped. */
+    fileTimeoutMs?: number;
+    /** Severity threshold below which findings are dropped entirely. Default: `"info"`. */
+    minSeverity?: Severity;
+    /** Optional progress callback. */
+    onProgress?: (progress: ScanProgress) => void;
+    /** Optional logger; defaults to `console` for warnings, silent for everything else. */
+    logger?: Logger;
+    /** Disable specific detectors by id (e.g. `["obf.high-entropy-literal"]`). */
+    disabledDetectors?: readonly string[];
+    /**
+     * Override the detector list entirely. When omitted, `defaultDetectors()` is used.
+     * Provide an explicit list to extend (`[...defaultDetectors(), myDetector]`) or replace
+     * the default set. `disabledDetectors` is applied on top of whichever list is in effect.
+     */
+    detectors?: readonly Detector[];
+}
+export interface ScanProgress {
+    filesTotal: number;
+    filesDone: number;
+    currentFile?: string;
+}
+export interface Logger {
+    debug(msg: string, meta?: unknown): void;
+    info(msg: string, meta?: unknown): void;
+    warn(msg: string, meta?: unknown): void;
+    error(msg: string, meta?: unknown): void;
+}
+/** A file as the detectors see it. */
+export interface FileContext {
+    readonly path: string;
+    readonly languageId: string | null;
+    readonly config: LanguageConfig | null;
+    readonly source: string;
+    /** 1-based, inclusive line ranges that were added by the diff. Empty when scanning a full file. */
+    readonly addedRanges: ReadonlyArray<readonly [number, number]>;
+    /** Lazy parser handle. `null` when no grammar is available for this language. */
+    readonly grammar: GrammarHandle | null;
+    /** Convenience: the parsed tree, populated on first access. */
+    tree(): Promise<unknown | null>;
+}
+/** Detectors are pure: same input → same output. They must not throw to the pipeline. */
+export interface Detector {
+    /** Stable detector id. Becomes part of `Finding.ruleId`. */
+    readonly id: string;
+    /** Documentation URL, optional. Surfaced in findings for users who want to learn more. */
+    readonly docsUrl?: string;
+    /** Whether this detector applies to a given file. Cheap; called once per file. */
+    applies(ctx: FileContext): boolean;
+    /** Run the detector. Must catch its own errors. Returns findings synchronously or as a promise. */
+    run(ctx: FileContext): Finding[] | Promise<Finding[]>;
+}
+export interface ScanResult {
+    /** Aggregated, sorted findings. Sorted by `(severity desc, score desc, file, line)`. */
+    findings: readonly Finding[];
+    /** Files scanned and their language. */
+    files: ReadonlyArray<{
+        path: string;
+        languageId: string | null;
+    }>;
+    /** Total wall-clock time in ms. */
+    durationMs: number;
+    /** Detector ids that failed internally on at least one file (logged, not thrown). */
+    failedDetectors: readonly string[];
+    /** Rule pack version used. */
+    rulesVersion: string;
+    /** Engine version used. */
+    engineVersion: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,QAAQ,CAAC;IACnB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAID,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAE1C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,0CAA0C;IAC1C,SAAS,IAAI,SAAS,MAAM,EAAE,CAAC;IAC/B,oEAAoE;IACpE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;IACrD,4DAA4D;IAC5D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,yEAAyE;IACzE,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,0DAA0D;IAC1D,OAAO,IAAI,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC7C;AAID;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEpE,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5B,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,YAAY,EAAE,YAAY,CAAC;IAC3B,mDAAmD;IACnD,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,kCAAkC;IAClC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1C;AAID,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,IAAI,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACjC;AAED,yFAAyF;AACzF,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC;IACnC,mGAAmG;IACnG,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACvD;AAID,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,wCAAwC;IACxC,KAAK,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAClE,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * Public type surface of @obfuscan/core.
+ *
+ * Anything exported from this file is part of the SemVer-stable API.
+ * Internal types live in src/internal/* and may change without notice.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Engine version, replaced at build time by the bundler.
+ *
+ * In source mode (when running tests directly against TS via Vitest), we
+ * fall back to reading `packages/core/package.json` lazily. The token
+ * `__ENGINE_VERSION__` is replaced by the build pipeline (tsup/esbuild
+ * `define`) when shipping a published artifact.
+ */
+export declare const ENGINE_VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,eAAO,MAAM,cAAc,EAAE,MAgCzB,CAAC"}

package/dist/version.js

@@ -0,0 +1,50 @@
+/**
+ * Engine version, replaced at build time by the bundler.
+ *
+ * In source mode (when running tests directly against TS via Vitest), we
+ * fall back to reading `packages/core/package.json` lazily. The token
+ * `__ENGINE_VERSION__` is replaced by the build pipeline (tsup/esbuild
+ * `define`) when shipping a published artifact.
+ */
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+let cached = null;
+const here = path.dirname(fileURLToPath(import.meta.url));
+export const ENGINE_VERSION = (() => {
+    if (cached)
+        return cached;
+    const placeholder = "__ENGINE_VERSION__";
+    // Build pipelines replace the literal string above. If still present, we're
+    // running against TS sources — read the version from package.json.
+    if (placeholder !== "__ENGINE" + "_VERSION__") {
+        cached = placeholder;
+        return cached;
+    }
+    try {
+        // Walk up from this file to locate the nearest package.json.
+        const req = createRequire(import.meta.url);
+        const candidates = [
+            path.resolve(here, "..", "package.json"),
+            path.resolve(here, "..", "..", "package.json"),
+        ];
+        for (const c of candidates) {
+            try {
+                const pkg = req(c);
+                if (pkg.name === "@obfuscan/core" && typeof pkg.version === "string") {
+                    cached = pkg.version;
+                    return cached;
+                }
+            }
+            catch {
+                // try next
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    cached = "0.0.0-source";
+    return cached;
+})();
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,IAAI,MAAM,GAAkB,IAAI,CAAC;AACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAW,CAAC,GAAG,EAAE;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,WAAW,GAAG,oBAAoB,CAAC;IACzC,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,WAAW,KAAK,UAAU,GAAG,YAAY,EAAE,CAAC;QAC9C,MAAM,GAAG,WAAW,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAwC,CAAC;gBAC1D,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACrE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;oBACrB,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,MAAM,GAAG,cAAc,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,EAAE,CAAC"}