@oculum/scanner 1.0.0

package/dist/layer2/index.js

@@ -0,0 +1,380 @@
+"use strict";
+/**
+ * Layer 2: Structural Scan
+ * Contextual analysis using variable heuristics, logic gate detection,
+ * dangerous functions, risky imports, auth anti-patterns, framework checks,
+ * and AI code fingerprinting
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAISchemaValidation = exports.detectAIEndpointProtection = exports.detectRAGSafetyIssues = exports.detectAIAgentTools = exports.detectAIExecutionSinks = exports.detectAIPromptHygiene = exports.detectBYOKPatterns = exports.detectDataExposure = exports.detectAIFingerprints = exports.detectFrameworkIssues = exports.detectAuthAntipatterns = exports.detectRiskyImports = exports.detectDangerousFunctions = exports.detectLogicGates = exports.detectSensitiveVariables = void 0;
+exports.runLayer2Scan = runLayer2Scan;
+const auth_helper_detector_1 = require("../utils/auth-helper-detector");
+const path_exclusions_1 = require("../utils/path-exclusions");
+const variables_1 = require("./variables");
+const logic_gates_1 = require("./logic-gates");
+const dangerous_functions_1 = require("./dangerous-functions");
+const risky_imports_1 = require("./risky-imports");
+const auth_antipatterns_1 = require("./auth-antipatterns");
+const framework_checks_1 = require("./framework-checks");
+const ai_fingerprinting_1 = require("./ai-fingerprinting");
+const data_exposure_1 = require("./data-exposure");
+const byok_patterns_1 = require("./byok-patterns");
+// Story B: AI-specific detection modules
+const ai_prompt_hygiene_1 = require("./ai-prompt-hygiene");
+const ai_execution_sinks_1 = require("./ai-execution-sinks");
+const ai_agent_tools_1 = require("./ai-agent-tools");
+// M5: New AI-era detectors
+const ai_rag_safety_1 = require("./ai-rag-safety");
+const ai_endpoint_protection_1 = require("./ai-endpoint-protection");
+const ai_schema_validation_1 = require("./ai-schema-validation");
+// Tier system imports
+const tiers_1 = require("../tiers");
+async function runLayer2Scan(files, options = {}) {
+    const startTime = Date.now();
+    const vulnerabilities = [];
+    const stats = {
+        variables: 0,
+        logicGates: 0,
+        dangerousFunctions: 0,
+        riskyImports: 0,
+        authAntipatterns: 0,
+        frameworkIssues: 0,
+        aiFingerprints: 0,
+        dataExposure: 0,
+        byokPatterns: 0,
+        promptHygiene: 0,
+        executionSinks: 0,
+        agentTools: 0,
+        // M5: New AI-era detectors
+        ragSafety: 0,
+        endpointProtection: 0,
+        schemaValidation: 0,
+    };
+    // Detect auth helpers once for all files (if not already provided)
+    const authHelperContext = options.authHelperContext || (0, auth_helper_detector_1.detectAuthHelpers)(files);
+    for (const file of files) {
+        // Only scan code files for Layer 2 (skip configs, etc.)
+        if (isCodeFile(file.path)) {
+            // Existing scanners
+            const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path);
+            const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path);
+            // New Layer 2 scanners
+            const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path);
+            const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path);
+            const authFindings = (0, auth_antipatterns_1.detectAuthAntipatterns)(file.content, file.path, {
+                middlewareConfig: options.middlewareConfig,
+                authHelpers: authHelperContext,
+                fileAuthImports: options.fileAuthImports,
+            });
+            const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path);
+            const aiFindings = (0, ai_fingerprinting_1.detectAIFingerprints)(file.content, file.path);
+            const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path);
+            const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig);
+            // Story B: AI-specific detection (prompt hygiene, execution sinks, agent tools)
+            const promptHygieneFindings = (0, ai_prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path);
+            const executionSinkFindings = (0, ai_execution_sinks_1.detectAIExecutionSinks)(file.content, file.path);
+            const agentToolFindings = (0, ai_agent_tools_1.detectAIAgentTools)(file.content, file.path);
+            // M5: New AI-era detectors
+            const ragSafetyFindings = (0, ai_rag_safety_1.detectRAGSafetyIssues)(file.content, file.path);
+            const endpointProtectionFindings = (0, ai_endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
+                middlewareConfig: options.middlewareConfig,
+            });
+            const schemaValidationFindings = (0, ai_schema_validation_1.detectAISchemaValidation)(file.content, file.path);
+            stats.variables += variableFindings.length;
+            stats.logicGates += logicFindings.length;
+            stats.dangerousFunctions += dangerousFuncFindings.length;
+            stats.riskyImports += riskyImportFindings.length;
+            stats.authAntipatterns += authFindings.length;
+            stats.frameworkIssues += frameworkFindings.length;
+            stats.aiFingerprints += aiFindings.length;
+            stats.dataExposure += dataExposureFindings.length;
+            stats.byokPatterns += byokFindings.length;
+            stats.promptHygiene += promptHygieneFindings.length;
+            stats.executionSinks += executionSinkFindings.length;
+            stats.agentTools += agentToolFindings.length;
+            stats.ragSafety += ragSafetyFindings.length;
+            stats.endpointProtection += endpointProtectionFindings.length;
+            stats.schemaValidation += schemaValidationFindings.length;
+            vulnerabilities.push(...variableFindings, ...logicFindings, ...dangerousFuncFindings, ...riskyImportFindings, ...authFindings, ...frameworkFindings, ...aiFindings, ...dataExposureFindings, ...byokFindings, ...promptHygieneFindings, ...executionSinkFindings, ...agentToolFindings, ...ragSafetyFindings, ...endpointProtectionFindings, ...schemaValidationFindings);
+        }
+    }
+    // Deduplicate findings
+    const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
+    // Apply path exclusions (test files, seed files, etc.)
+    // By default, exclude test and seed files unless explicitly disabled
+    const excludeTestFiles = options.excludeTestFiles !== false;
+    const excludeSeedFiles = options.excludeSeedFiles !== false;
+    // Build exclusion config based on options
+    const exclusionConfig = {};
+    if (!excludeTestFiles) {
+        exclusionConfig.testPatterns = [];
+    }
+    if (!excludeSeedFiles) {
+        exclusionConfig.seedPatterns = [];
+    }
+    if (options.customExclusions) {
+        // Add custom exclusions to all pattern types
+        exclusionConfig.testPatterns = [
+            ...(exclusionConfig.testPatterns || []),
+            ...options.customExclusions,
+        ];
+    }
+    const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities, Object.keys(exclusionConfig).length > 0 ? exclusionConfig : undefined);
+    // Log suppressed findings
+    if (suppressed.length > 0) {
+        console.log(`[Layer 2] Suppressed ${suppressed.length} findings in test/seed/example files:`);
+        const byReason = new Map();
+        for (const { reason } of suppressed) {
+            byReason.set(reason || 'unknown', (byReason.get(reason || 'unknown') || 0) + 1);
+        }
+        for (const [reason, count] of byReason) {
+            console.log(`  - ${reason}: ${count}`);
+        }
+    }
+    // Build raw stats map for logging
+    const rawStats = {
+        sensitive_variables: stats.variables,
+        logic_gates: stats.logicGates,
+        dangerous_functions: stats.dangerousFunctions,
+        risky_imports: stats.riskyImports,
+        auth_antipatterns: stats.authAntipatterns,
+        framework_issues: stats.frameworkIssues,
+        ai_fingerprints: stats.aiFingerprints,
+        data_exposure: stats.dataExposure,
+        byok_patterns: stats.byokPatterns,
+        ai_prompt_hygiene: stats.promptHygiene,
+        ai_execution_sinks: stats.executionSinks,
+        ai_agent_tools: stats.agentTools,
+        // M5: New AI-era detectors
+        ai_rag_safety: stats.ragSafety,
+        ai_endpoint_protection: stats.endpointProtection,
+        ai_schema_validation: stats.schemaValidation,
+    };
+    // Compute deduped counts per category
+    const dedupedStats = {};
+    for (const vuln of uniqueVulnerabilities) {
+        const cat = vuln.category;
+        dedupedStats[cat] = (dedupedStats[cat] || 0) + 1;
+    }
+    // Compute severity distribution
+    const severityStats = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const vuln of uniqueVulnerabilities) {
+        severityStats[vuln.severity] = (severityStats[vuln.severity] || 0) + 1;
+    }
+    // Compute tier breakdown (all Layer 2 findings have layer: 2)
+    const tierStats = (0, tiers_1.computeTierStats)(uniqueVulnerabilities.map(v => ({ category: v.category, layer: 2 })));
+    // Map raw stats keys to detector names for tier lookup
+    const detectorNameMap = {
+        sensitive_variables: 'variables',
+        logic_gates: 'logic_gates',
+        dangerous_functions: 'dangerous_functions',
+        risky_imports: 'risky_imports',
+        auth_antipatterns: 'auth_antipatterns',
+        framework_issues: 'framework_checks',
+        ai_fingerprints: 'ai_fingerprinting',
+        data_exposure: 'data_exposure',
+        byok_patterns: 'byok_patterns',
+        ai_prompt_hygiene: 'ai_prompt_hygiene',
+        ai_execution_sinks: 'ai_execution_sinks',
+        ai_agent_tools: 'ai_agent_tools',
+        // M5: New AI-era detectors
+        ai_rag_safety: 'ai_rag_safety',
+        ai_endpoint_protection: 'ai_endpoint_protection',
+        ai_schema_validation: 'ai_schema_validation',
+    };
+    // Log heuristic breakdown (raw findings before dedupe) with tier info
+    console.log('[Layer 2] Heuristic breakdown (raw findings before dedupe):');
+    for (const [name, count] of Object.entries(rawStats)) {
+        if (count > 0) {
+            const detectorName = detectorNameMap[name];
+            const tier = detectorName ? (0, tiers_1.getLayer2DetectorTier)(detectorName) : 'unknown';
+            console.log(`  - ${name}: ${count} (${tier})`);
+        }
+    }
+    console.log(`[Layer 2] Tier breakdown (after dedupe): ${(0, tiers_1.formatTierStats)(tierStats)}`);
+    return {
+        vulnerabilities: uniqueVulnerabilities,
+        filesScanned: files.filter(f => isCodeFile(f.path)).length,
+        duration: Date.now() - startTime,
+        stats: {
+            raw: rawStats,
+            deduped: dedupedStats,
+            bySeverity: severityStats,
+            tiers: tierStats,
+            suppressedByPath: suppressed.length,
+        },
+    };
+}
+// Check if file is a code file (not config/data)
+function isCodeFile(filePath) {
+    const codeExtensions = [
+        '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+        '.py', '.rb', '.php', '.go', '.java', '.cs',
+        '.rs', '.swift', '.kt', '.scala',
+    ];
+    return codeExtensions.some(ext => filePath.endsWith(ext));
+}
+// Remove duplicate findings on the same line and merge related findings
+function deduplicateFindings(vulnerabilities) {
+    // First pass: exact deduplication by file:line:category
+    const seen = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.lineNumber}:${vuln.category}`;
+        const existing = seen.get(key);
+        // Keep the higher severity finding
+        if (!existing || severityRank(vuln.severity) > severityRank(existing.severity)) {
+            seen.set(key, vuln);
+        }
+    }
+    // Second pass: merge findings on adjacent lines (within 3 lines) with same category
+    const dedupedList = Array.from(seen.values());
+    const merged = mergeAdjacentFindings(dedupedList);
+    // Third pass: subsume related categories (e.g., specific finding subsumes generic)
+    return subsumeRelatedFindings(merged);
+}
+// Merge findings on adjacent lines with the same category
+function mergeAdjacentFindings(vulnerabilities) {
+    if (vulnerabilities.length <= 1)
+        return vulnerabilities;
+    // Group by file and category
+    const groups = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.category}`;
+        const group = groups.get(key) || [];
+        group.push(vuln);
+        groups.set(key, group);
+    }
+    const result = [];
+    for (const [, group] of groups) {
+        if (group.length === 1) {
+            result.push(group[0]);
+            continue;
+        }
+        // Sort by line number
+        group.sort((a, b) => a.lineNumber - b.lineNumber);
+        // Merge adjacent findings (within 3 lines)
+        let current = group[0];
+        let mergedCount = 1;
+        for (let i = 1; i < group.length; i++) {
+            const next = group[i];
+            if (next.lineNumber - current.lineNumber <= 3) {
+                // Merge: keep higher severity, note the merge
+                mergedCount++;
+                if (severityRank(next.severity) > severityRank(current.severity)) {
+                    current = {
+                        ...next,
+                        title: current.title,
+                        description: current.description,
+                    };
+                }
+            }
+            else {
+                // Not adjacent - emit current and start new
+                if (mergedCount > 1) {
+                    current = {
+                        ...current,
+                        title: `${current.title} (${mergedCount} occurrences)`,
+                    };
+                }
+                result.push(current);
+                current = next;
+                mergedCount = 1;
+            }
+        }
+        // Emit last
+        if (mergedCount > 1) {
+            current = {
+                ...current,
+                title: `${current.title} (${mergedCount} occurrences)`,
+            };
+        }
+        result.push(current);
+    }
+    return result;
+}
+// Subsume related findings where a more specific finding covers a generic one
+function subsumeRelatedFindings(vulnerabilities) {
+    // Define subsumption rules: specific category subsumes generic
+    const subsumptionRules = {
+        // SQL injection subsumes generic dangerous function
+        sql_injection: ['dangerous_function'],
+        // Command injection subsumes generic dangerous function
+        command_injection: ['dangerous_function'],
+        // XSS subsumes generic dangerous function
+        xss: ['dangerous_function'],
+        // Specific auth issues subsume generic missing auth
+        missing_auth: ['auth_antipattern'],
+    };
+    // Group by file and line
+    const byLocation = new Map();
+    for (const vuln of vulnerabilities) {
+        const key = `${vuln.filePath}:${vuln.lineNumber}`;
+        const group = byLocation.get(key) || [];
+        group.push(vuln);
+        byLocation.set(key, group);
+    }
+    const result = [];
+    for (const [, group] of byLocation) {
+        if (group.length === 1) {
+            result.push(group[0]);
+            continue;
+        }
+        // Check for subsumption
+        const toKeep = new Set(group);
+        for (const vuln of group) {
+            const subsumes = subsumptionRules[vuln.category];
+            if (subsumes) {
+                for (const other of group) {
+                    if (subsumes.includes(other.category) && other !== vuln) {
+                        toKeep.delete(other);
+                    }
+                }
+            }
+        }
+        result.push(...toKeep);
+    }
+    return result;
+}
+function severityRank(severity) {
+    const ranks = {
+        critical: 4,
+        high: 3,
+        medium: 2,
+        low: 1,
+        info: 0,
+    };
+    return ranks[severity] || 0;
+}
+var variables_2 = require("./variables");
+Object.defineProperty(exports, "detectSensitiveVariables", { enumerable: true, get: function () { return variables_2.detectSensitiveVariables; } });
+var logic_gates_2 = require("./logic-gates");
+Object.defineProperty(exports, "detectLogicGates", { enumerable: true, get: function () { return logic_gates_2.detectLogicGates; } });
+var dangerous_functions_2 = require("./dangerous-functions");
+Object.defineProperty(exports, "detectDangerousFunctions", { enumerable: true, get: function () { return dangerous_functions_2.detectDangerousFunctions; } });
+var risky_imports_2 = require("./risky-imports");
+Object.defineProperty(exports, "detectRiskyImports", { enumerable: true, get: function () { return risky_imports_2.detectRiskyImports; } });
+var auth_antipatterns_2 = require("./auth-antipatterns");
+Object.defineProperty(exports, "detectAuthAntipatterns", { enumerable: true, get: function () { return auth_antipatterns_2.detectAuthAntipatterns; } });
+var framework_checks_2 = require("./framework-checks");
+Object.defineProperty(exports, "detectFrameworkIssues", { enumerable: true, get: function () { return framework_checks_2.detectFrameworkIssues; } });
+var ai_fingerprinting_2 = require("./ai-fingerprinting");
+Object.defineProperty(exports, "detectAIFingerprints", { enumerable: true, get: function () { return ai_fingerprinting_2.detectAIFingerprints; } });
+var data_exposure_2 = require("./data-exposure");
+Object.defineProperty(exports, "detectDataExposure", { enumerable: true, get: function () { return data_exposure_2.detectDataExposure; } });
+var byok_patterns_2 = require("./byok-patterns");
+Object.defineProperty(exports, "detectBYOKPatterns", { enumerable: true, get: function () { return byok_patterns_2.detectBYOKPatterns; } });
+// Story B: AI-specific detectors
+var ai_prompt_hygiene_2 = require("./ai-prompt-hygiene");
+Object.defineProperty(exports, "detectAIPromptHygiene", { enumerable: true, get: function () { return ai_prompt_hygiene_2.detectAIPromptHygiene; } });
+var ai_execution_sinks_2 = require("./ai-execution-sinks");
+Object.defineProperty(exports, "detectAIExecutionSinks", { enumerable: true, get: function () { return ai_execution_sinks_2.detectAIExecutionSinks; } });
+var ai_agent_tools_2 = require("./ai-agent-tools");
+Object.defineProperty(exports, "detectAIAgentTools", { enumerable: true, get: function () { return ai_agent_tools_2.detectAIAgentTools; } });
+// M5: New AI-era detectors
+var ai_rag_safety_2 = require("./ai-rag-safety");
+Object.defineProperty(exports, "detectRAGSafetyIssues", { enumerable: true, get: function () { return ai_rag_safety_2.detectRAGSafetyIssues; } });
+var ai_endpoint_protection_2 = require("./ai-endpoint-protection");
+Object.defineProperty(exports, "detectAIEndpointProtection", { enumerable: true, get: function () { return ai_endpoint_protection_2.detectAIEndpointProtection; } });
+var ai_schema_validation_2 = require("./ai-schema-validation");
+Object.defineProperty(exports, "detectAISchemaValidation", { enumerable: true, get: function () { return ai_schema_validation_2.detectAISchemaValidation; } });
+//# sourceMappingURL=index.js.map

package/dist/layer2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/layer2/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAqEH,sCA0NC;AA3RD,wEAAyF;AAEzF,8DAGiC;AACjC,2CAAsD;AACtD,+CAAgD;AAChD,+DAAgE;AAChE,mDAAoD;AACpD,2DAA4D;AAC5D,yDAA0D;AAC1D,2DAA0D;AAC1D,mDAAoD;AACpD,mDAAoD;AACpD,yCAAyC;AACzC,2DAA2D;AAC3D,6DAA6D;AAC7D,qDAAqD;AACrD,2BAA2B;AAC3B,mDAAuD;AACvD,qEAAqE;AACrE,iEAAiE;AACjE,sBAAsB;AACtB,oCAMiB;AAmCV,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,UAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;QACb,kBAAkB,EAAE,CAAC;QACrB,YAAY,EAAE,CAAC;QACf,gBAAgB,EAAE,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,2BAA2B;QAC3B,SAAS,EAAE,CAAC;QACZ,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE,CAAC;KACpB,CAAA;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAA,wCAAiB,EAAC,KAAK,CAAC,CAAA;IAE/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,wDAAwD;QACxD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,oBAAoB;YACpB,MAAM,gBAAgB,GAAG,IAAA,oCAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1E,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAE/D,uBAAuB;YACvB,MAAM,qBAAqB,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/E,MAAM,mBAAmB,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACvE,MAAM,YAAY,GAAG,IAAA,0CAAsB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;gBACnE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC,CAAA;YACF,MAAM,iBAAiB,GAAG,IAAA,wCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACxE,MAAM,UAAU,GAAG,IAAA,wCAAoB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAChE,MAAM,oBAAoB,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACxE,MAAM,YAAY,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;YAE1F,gFAAgF;YAChF,MAAM,qBAAqB,GAAG,IAAA,yCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5E,MAAM,qBAAqB,GAAG,IAAA,2CAAsB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC7E,MAAM,iBAAiB,GAAG,IAAA,mCAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAErE,2BAA2B;YAC3B,MAAM,iBAAiB,GAAG,IAAA,qCAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACxE,MAAM,0BAA0B,GAAG,IAAA,mDAA0B,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;gBACrF,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,CAAC,CAAA;YACF,MAAM,wBAAwB,GAAG,IAAA,+CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAElF,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAA;YAC1C,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,MAAM,CAAA;YACxC,KAAK,CAAC,kBAAkB,IAAI,qBAAqB,CAAC,MAAM,CAAA;YACxD,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,MAAM,CAAA;YAChD,KAAK,CAAC,gBAAgB,IAAI,YAAY,CAAC,MAAM,CAAA;YAC7C,KAAK,CAAC,eAAe,IAAI,iBAAiB,CAAC,MAAM,CAAA;YACjD,KAAK,CAAC,cAAc,IAAI,UAAU,CAAC,MAAM,CAAA;YACzC,KAAK,CAAC,YAAY,IAAI,oBAAoB,CAAC,MAAM,CAAA;YACjD,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,CAAA;YACzC,KAAK,CAAC,aAAa,IAAI,qBAAqB,CAAC,MAAM,CAAA;YACnD,KAAK,CAAC,cAAc,IAAI,qBAAqB,CAAC,MAAM,CAAA;YACpD,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC,MAAM,CAAA;YAC5C,KAAK,CAAC,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAA;YAC3C,KAAK,CAAC,kBAAkB,IAAI,0BAA0B,CAAC,MAAM,CAAA;YAC7D,KAAK,CAAC,gBAAgB,IAAI,wBAAwB,CAAC,MAAM,CAAA;YAEzD,eAAe,CAAC,IAAI,CAClB,GAAG,gBAAgB,EACnB,GAAG,aAAa,EAChB,GAAG,qBAAqB,EACxB,GAAG,mBAAmB,EACtB,GAAG,YAAY,EACf,GAAG,iBAAiB,EACpB,GAAG,UAAU,EACb,GAAG,oBAAoB,EACvB,GAAG,YAAY,EACf,GAAG,qBAAqB,EACxB,GAAG,qBAAqB,EACxB,GAAG,iBAAiB,EACpB,GAAG,iBAAiB,EACpB,GAAG,0BAA0B,EAC7B,GAAG,wBAAwB,CAC5B,CAAA;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAA;IAEnE,uDAAuD;IACvD,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAA;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAA;IAE3D,0CAA0C;IAC1C,MAAM,eAAe,GAA6B,EAAE,CAAA;IACpD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAe,CAAC,YAAY,GAAG,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAe,CAAC,YAAY,GAAG,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,6CAA6C;QAC7C,eAAe,CAAC,YAAY,GAAG;YAC7B,GAAG,CAAC,eAAe,CAAC,YAAY,IAAI,EAAE,CAAC;YACvC,GAAG,OAAO,CAAC,gBAAgB;SAC5B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,IAAA,sCAAoB,EACtE,sBAAsB,EACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CACtE,CAAA;IAED,0BAA0B;IAC1B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,UAAU,CAAC,MAAM,uCAAuC,CAAC,CAAA;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC1C,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACjF,CAAC;QACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,KAAK,KAAK,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,QAAQ,GAA2B;QACvC,mBAAmB,EAAE,KAAK,CAAC,SAAS;QACpC,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;QAC7C,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,iBAAiB,EAAE,KAAK,CAAC,aAAa;QACtC,kBAAkB,EAAE,KAAK,CAAC,cAAc;QACxC,cAAc,EAAE,KAAK,CAAC,UAAU;QAChC,2BAA2B;QAC3B,aAAa,EAAE,KAAK,CAAC,SAAS;QAC9B,sBAAsB,EAAE,KAAK,CAAC,kBAAkB;QAChD,oBAAoB,EAAE,KAAK,CAAC,gBAAgB;KAC7C,CAAA;IAED,sCAAsC;IACtC,MAAM,YAAY,GAA2B,EAAE,CAAA;IAC/C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAA;QACzB,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,gCAAgC;IAChC,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IAClG,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,8DAA8D;IAC9D,MAAM,SAAS,GAAG,IAAA,wBAAgB,EAChC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAU,EAAE,CAAC,CAAC,CAC9E,CAAA;IAED,uDAAuD;IACvD,MAAM,eAAe,GAAuC;QAC1D,mBAAmB,EAAE,WAAW;QAChC,WAAW,EAAE,aAAa;QAC1B,mBAAmB,EAAE,qBAAqB;QAC1C,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,mBAAmB;QACtC,gBAAgB,EAAE,kBAAkB;QACpC,eAAe,EAAE,mBAAmB;QACpC,aAAa,EAAE,eAAe;QAC9B,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,mBAAmB;QACtC,kBAAkB,EAAE,oBAAoB;QACxC,cAAc,EAAE,gBAAgB;QAChC,2BAA2B;QAC3B,aAAa,EAAE,eAAe;QAC9B,sBAAsB,EAAE,wBAAwB;QAChD,oBAAoB,EAAE,sBAAsB;KAC7C,CAAA;IAED,sEAAsE;IACtE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAA,6BAAqB,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3E,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,IAAA,uBAAe,EAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAErF,OAAO;QACL,eAAe,EAAE,qBAAqB;QACtC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC1D,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAChC,KAAK,EAAE;YACL,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,aAAa;YACzB,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,UAAU,CAAC,MAAM;SACpC;KACF,CAAA;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,cAAc,GAAG;QACrB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAC5C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;QAC3C,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;KACjC,CAAA;IAED,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,eAAgC;IAC3D,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE7C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAE9B,mCAAmC;QACnC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IAEjD,mFAAmF;IACnF,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;AACvC,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,eAAgC;IAC7D,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAA;IAEvD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACnC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,sBAAsB;QACtB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAA;QAEjD,2CAA2C;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,WAAW,GAAG,CAAC,CAAA;QAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;gBAC9C,8CAA8C;gBAC9C,WAAW,EAAE,CAAA;gBACb,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjE,OAAO,GAAG;wBACR,GAAG,IAAI;wBACP,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,OAAO,GAAG;wBACR,GAAG,OAAO;wBACV,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,KAAK,WAAW,eAAe;qBACvD,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,GAAG,IAAI,CAAA;gBACd,WAAW,GAAG,CAAC,CAAA;YACjB,CAAC;QACH,CAAC;QAED,YAAY;QACZ,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,KAAK,WAAW,eAAe;aACvD,CAAA;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,sBAAsB,CAAC,eAAgC;IAC9D,+DAA+D;IAC/D,MAAM,gBAAgB,GAA6B;QACjD,oDAAoD;QACpD,aAAa,EAAE,CAAC,oBAAoB,CAAC;QACrC,wDAAwD;QACxD,iBAAiB,EAAE,CAAC,oBAAoB,CAAC;QACzC,0CAA0C;QAC1C,GAAG,EAAE,CAAC,oBAAoB,CAAC;QAC3B,oDAAoD;QACpD,YAAY,EAAE,CAAC,kBAAkB,CAAC;KACnC,CAAA;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAA;IACrD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAA;IAElC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAC1B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;IACxB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,KAAK,GAA2B;QACpC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,yCAAsD;AAA7C,qHAAA,wBAAwB,OAAA;AACjC,6CAAgD;AAAvC,+GAAA,gBAAgB,OAAA;AACzB,6DAAgE;AAAvD,+HAAA,wBAAwB,OAAA;AACjC,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,yDAA4D;AAAnD,2HAAA,sBAAsB,OAAA;AAC/B,uDAA0D;AAAjD,yHAAA,qBAAqB,OAAA;AAC9B,yDAA0D;AAAjD,yHAAA,oBAAoB,OAAA;AAC7B,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,iDAAoD;AAA3C,mHAAA,kBAAkB,OAAA;AAC3B,iCAAiC;AACjC,yDAA2D;AAAlD,0HAAA,qBAAqB,OAAA;AAC9B,2DAA6D;AAApD,4HAAA,sBAAsB,OAAA;AAC/B,mDAAqD;AAA5C,oHAAA,kBAAkB,OAAA;AAC3B,2BAA2B;AAC3B,iDAAuD;AAA9C,sHAAA,qBAAqB,OAAA;AAC9B,mEAAqE;AAA5D,oIAAA,0BAA0B,OAAA;AACnC,+DAAiE;AAAxD,gIAAA,wBAAwB,OAAA"}

package/dist/layer2/logic-gates.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Layer 2: Logic Gates Detection
+ * Identifies security bypass patterns and dangerous logic flows
+ */
+import type { Vulnerability } from '../types';
+export declare function detectLogicGates(content: string, filePath: string): Vulnerability[];
+//# sourceMappingURL=logic-gates.d.ts.map

package/dist/layer2/logic-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logic-gates.d.ts","sourceRoot":"","sources":["../../src/layer2/logic-gates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA8H7C,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CA0CjB"}

package/dist/layer2/logic-gates.js

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * Layer 2: Logic Gates Detection
+ * Identifies security bypass patterns and dangerous logic flows
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectLogicGates = detectLogicGates;
+// Patterns for security bypass logic
+const LOGIC_PATTERNS = [
+    // Development mode bypasses
+    {
+        name: 'Development mode security bypass',
+        pattern: /if\s*\(\s*process\.env\.NODE_ENV\s*[!=]==?\s*['"]production['"]\s*\)\s*(return\s+true|return\s*;|continue|break)/gi,
+        severity: 'high',
+        description: 'Security check bypassed in non-production environments',
+        suggestedFix: 'Remove development-only bypasses or ensure they cannot be triggered in production',
+    },
+    {
+        name: 'Development mode auth skip',
+        pattern: /if\s*\(\s*process\.env\.NODE_ENV\s*[!=]==?\s*['"]development['"]\s*\)/gi,
+        severity: 'medium',
+        description: 'Code path that only runs in development - verify no security implications',
+        suggestedFix: 'Ensure this development-only code does not bypass security controls',
+    },
+    // Auth bypasses
+    {
+        name: 'Authentication bypass pattern',
+        pattern: /if\s*\(\s*(true|1|!false)\s*\)\s*{\s*(return|next|resolve)/gi,
+        severity: 'critical',
+        description: 'Hardcoded truthy condition may bypass authentication',
+        suggestedFix: 'Remove hardcoded bypass and implement proper authentication check',
+    },
+    {
+        name: 'Commented auth check',
+        pattern: /\/\/\s*(if|await|return).*auth|\/\/.*verify.*token|\/\/.*check.*permission/gi,
+        severity: 'high',
+        description: 'Commented out authentication/authorization code detected',
+        suggestedFix: 'Remove commented code or restore the security check',
+    },
+    // Skip validation patterns
+    {
+        name: 'Validation skip',
+        pattern: /skipValidation\s*[=:]\s*true|validate\s*[=:]\s*false|noValidate\s*[=:]\s*true/gi,
+        severity: 'high',
+        description: 'Input validation explicitly disabled',
+        suggestedFix: 'Enable validation or ensure this is intentional and documented',
+    },
+    // Debug/test bypasses
+    {
+        name: 'Debug bypass',
+        pattern: /if\s*\(\s*(DEBUG|TEST|SKIP_AUTH|BYPASS|DISABLE_AUTH)\s*\)/gi,
+        severity: 'high',
+        description: 'Debug/test flag may bypass security controls',
+        suggestedFix: 'Remove debug bypasses before deploying to production',
+    },
+    // Unsafe defaults
+    {
+        name: 'Unsafe default allow',
+        pattern: /default\s*:\s*(return\s+true|allow|permit|grant)/gi,
+        severity: 'medium',
+        description: 'Default case allows access - should default to deny',
+        suggestedFix: 'Change default behavior to deny access (fail-safe defaults)',
+    },
+    // Empty catch blocks
+    {
+        name: 'Empty error handler',
+        pattern: /catch\s*\([^)]*\)\s*{\s*(\/\/.*)?}/gi,
+        severity: 'medium',
+        description: 'Empty catch block may hide security errors',
+        suggestedFix: 'Log the error or handle it appropriately',
+    },
+    // Disabled security features
+    {
+        name: 'Disabled CSRF protection',
+        pattern: /csrf\s*[=:]\s*false|disableCsrf|csrfProtection\s*[=:]\s*false/gi,
+        severity: 'high',
+        description: 'CSRF protection explicitly disabled',
+        suggestedFix: 'Enable CSRF protection for state-changing requests',
+    },
+    {
+        name: 'Disabled SSL verification',
+        pattern: /rejectUnauthorized\s*[=:]\s*false|verify\s*[=:]\s*false|ssl\s*[=:]\s*false|NODE_TLS_REJECT_UNAUTHORIZED/gi,
+        severity: 'critical',
+        description: 'SSL/TLS certificate verification disabled',
+        suggestedFix: 'Enable SSL verification to prevent man-in-the-middle attacks',
+    },
+    // Insecure comparisons
+    {
+        name: 'Timing attack vulnerable comparison',
+        pattern: /===?\s*['"][^'"]{20,}['"]|password\s*===?\s*|token\s*===?\s*|secret\s*===?\s*/gi,
+        severity: 'medium',
+        description: 'Direct string comparison may be vulnerable to timing attacks',
+        suggestedFix: 'Use constant-time comparison for secrets (e.g., crypto.timingSafeEqual)',
+    },
+    // Unsafe redirects
+    {
+        name: 'Open redirect vulnerability',
+        pattern: /redirect\s*\(\s*(req\.(query|params|body)\.|request\.|url\.)/gi,
+        severity: 'high',
+        description: 'Redirect URL from user input may allow open redirect attacks',
+        suggestedFix: 'Validate redirect URLs against an allowlist of trusted domains',
+    },
+    // Admin/superuser bypasses
+    {
+        name: 'Admin bypass pattern',
+        pattern: /if\s*\(\s*(isAdmin|isSuperUser|isRoot|role\s*===?\s*['"]admin['"])\s*\)\s*(return|continue|break)/gi,
+        severity: 'medium',
+        description: 'Admin role bypasses normal security checks',
+        suggestedFix: 'Ensure admin bypass is intentional and properly audited',
+    },
+];
+// Check if line is a comment
+function isComment(line) {
+    const trimmed = line.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*'));
+}
+function detectLogicGates(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    // Check each line against patterns
+    lines.forEach((line, index) => {
+        // Don't skip comments for the "commented auth check" pattern
+        const shouldSkipComments = !line.trim().startsWith('//');
+        for (const logicPattern of LOGIC_PATTERNS) {
+            // Skip comment lines for most patterns
+            if (shouldSkipComments && isComment(line) &&
+                logicPattern.name !== 'Commented auth check') {
+                continue;
+            }
+            const regex = new RegExp(logicPattern.pattern.source, logicPattern.pattern.flags);
+            if (regex.test(line)) {
+                vulnerabilities.push({
+                    id: `logic-${filePath}-${index + 1}-${logicPattern.name}`,
+                    filePath,
+                    lineNumber: index + 1,
+                    lineContent: line.trim(),
+                    severity: logicPattern.severity,
+                    category: 'security_bypass',
+                    title: logicPattern.name,
+                    description: logicPattern.description,
+                    suggestedFix: logicPattern.suggestedFix,
+                    confidence: 'medium',
+                    layer: 2,
+                });
+                break; // Only report once per line
+            }
+        }
+    });
+    // Multi-line pattern detection (for more complex patterns)
+    const multiLineFindings = detectMultiLinePatterns(content, filePath);
+    vulnerabilities.push(...multiLineFindings);
+    return vulnerabilities;
+}
+// Detect patterns that span multiple lines
+function detectMultiLinePatterns(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    // Detect try-catch with empty or minimal error handling
+    const tryCatchPattern = /try\s*{[\s\S]*?}\s*catch\s*\([^)]*\)\s*{\s*(\n\s*)*(\/\/[^\n]*)?\s*}/g;
+    let match;
+    while ((match = tryCatchPattern.exec(content)) !== null) {
+        const lineNumber = content.substring(0, match.index).split('\n').length;
+        vulnerabilities.push({
+            id: `logic-multiline-${filePath}-${lineNumber}`,
+            filePath,
+            lineNumber,
+            lineContent: lines[lineNumber - 1]?.trim() || 'try {',
+            severity: 'medium',
+            category: 'security_bypass',
+            title: 'Silent error handling',
+            description: 'Try-catch block with minimal error handling may hide security issues',
+            suggestedFix: 'Log errors appropriately and handle them based on type',
+            confidence: 'low',
+            layer: 2,
+        });
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=logic-gates.js.map

package/dist/layer2/logic-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logic-gates.js","sourceRoot":"","sources":["../../src/layer2/logic-gates.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAgIH,4CA6CC;AAjKD,qCAAqC;AACrC,MAAM,cAAc,GAAmB;IACrC,4BAA4B;IAC5B;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,oHAAoH;QAC7H,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,wDAAwD;QACrE,YAAY,EAAE,mFAAmF;KAClG;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,yEAAyE;QAClF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2EAA2E;QACxF,YAAY,EAAE,qEAAqE;KACpF;IACD,gBAAgB;IAChB;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sDAAsD;QACnE,YAAY,EAAE,mEAAmE;KAClF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0DAA0D;QACvE,YAAY,EAAE,qDAAqD;KACpE;IACD,2BAA2B;IAC3B;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,sCAAsC;QACnD,YAAY,EAAE,gEAAgE;KAC/E;IACD,sBAAsB;IACtB;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8CAA8C;QAC3D,YAAY,EAAE,sDAAsD;KACrE;IACD,kBAAkB;IAClB;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,qDAAqD;QAClE,YAAY,EAAE,6DAA6D;KAC5E;IACD,qBAAqB;IACrB;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,4CAA4C;QACzD,YAAY,EAAE,0CAA0C;KACzD;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qCAAqC;QAClD,YAAY,EAAE,oDAAoD;KACnE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,2GAA2G;QACpH,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2CAA2C;QACxD,YAAY,EAAE,8DAA8D;KAC7E;IACD,uBAAuB;IACvB;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,8DAA8D;QAC3E,YAAY,EAAE,yEAAyE;KACxF;IACD,mBAAmB;IACnB;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8DAA8D;QAC3E,YAAY,EAAE,gEAAgE;KAC/E;IACD,2BAA2B;IAC3B;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,qGAAqG;QAC9G,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,4CAA4C;QACzD,YAAY,EAAE,yDAAyD;KACxE;CACF,CAAA;AAED,6BAA6B;AAC7B,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAA;AACH,CAAC;AAED,SAAgB,gBAAgB,CAC9B,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,mCAAmC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,6DAA6D;QAC7D,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAExD,KAAK,MAAM,YAAY,IAAI,cAAc,EAAE,CAAC;YAC1C,uCAAuC;YACvC,IAAI,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC;gBACrC,YAAY,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACjD,SAAQ;YACV,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAEjF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,SAAS,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE;oBACzD,QAAQ;oBACR,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,QAAQ,EAAE,iBAAiB;oBAC3B,KAAK,EAAE,YAAY,CAAC,IAAI;oBACxB,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,UAAU,EAAE,QAAQ;oBACpB,KAAK,EAAE,CAAC;iBACT,CAAC,CAAA;gBACF,MAAK,CAAC,4BAA4B;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACpE,eAAe,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAA;IAE1C,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,2CAA2C;AAC3C,SAAS,uBAAuB,CAAC,OAAe,EAAE,QAAgB;IAChE,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,wDAAwD;IACxD,MAAM,eAAe,GAAG,uEAAuE,CAAA;IAC/F,IAAI,KAAK,CAAA;IAET,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;QACvE,eAAe,CAAC,IAAI,CAAC;YACnB,EAAE,EAAE,mBAAmB,QAAQ,IAAI,UAAU,EAAE;YAC/C,QAAQ;YACR,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO;YACrD,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,sEAAsE;YACnF,YAAY,EAAE,wDAAwD;YACtE,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,CAAC;SACT,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/layer2/risky-imports.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Layer 2: Risky Import/Package Analysis
+ * Detects imports of packages known to have security concerns or deprecated
+ */
+import type { Vulnerability } from '../types';
+export declare function detectRiskyImports(content: string, filePath: string): Vulnerability[];
+//# sourceMappingURL=risky-imports.d.ts.map

package/dist/layer2/risky-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risky-imports.d.ts","sourceRoot":"","sources":["../../src/layer2/risky-imports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,UAAU,CAAA;AAkJpE,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CA+BjB"}