@oculum/scanner 1.0.11 → 1.0.13

package/dist/utils/parsed-file.d.ts

@@ -0,0 +1,51 @@
+/**
+ * ParsedFile - Shared file representation for all detectors
+ *
+ * Provides lazy-cached line splitting and common context-extraction
+ * operations, eliminating duplicated content.split('\n') calls across 26+ detectors.
+ */
+export declare class ParsedFile {
+    readonly content: string;
+    readonly filePath: string;
+    private _lines;
+    constructor(content: string, filePath: string);
+    /** Lazy-cached array of lines from content.split('\n') */
+    get lines(): string[];
+    /** Number of lines in the file */
+    get lineCount(): number;
+    /** Get a single line by 0-based index. Returns '' for out-of-bounds. */
+    line(index: number): string;
+    /**
+     * Get surrounding lines around a center index, clamped to file bounds.
+     * @param lineIndex 0-based center line
+     * @param windowSize number of lines before and after center
+     */
+    getSurroundingLines(lineIndex: number, windowSize: number): {
+        lines: string[];
+        startIndex: number;
+        endIndex: number;
+        text: string;
+    };
+    /**
+     * Get a range of lines as a joined string.
+     * @param start 0-based start (inclusive), clamped to bounds
+     * @param end 0-based end (inclusive), clamped to bounds
+     */
+    getLineRange(start: number, end: number): string;
+    /** Construct from a ScanFile-like object with content and path */
+    static from(file: {
+        content: string;
+        path: string;
+    }): ParsedFile;
+}
+/**
+ * Numeric rank for severity comparisons.
+ * Only relative ordering matters — used for keeping the higher-severity finding
+ * during deduplication and merge operations.
+ */
+export declare function severityRank(severity: string): number;
+/**
+ * Numeric rank for confidence comparisons.
+ */
+export declare function confidenceRank(confidence: string): number;
+//# sourceMappingURL=parsed-file.d.ts.map

package/dist/utils/parsed-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/utils/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,MAAM,CAAwB;gBAE1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAK7C,0DAA0D;IAC1D,IAAI,KAAK,IAAI,MAAM,EAAE,CAKpB;IAED,kCAAkC;IAClC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK3B;;;;OAIG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAC1D,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;KACb;IAYD;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAOhD,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;CAGjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOzD"}

package/dist/utils/parsed-file.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * ParsedFile - Shared file representation for all detectors
+ *
+ * Provides lazy-cached line splitting and common context-extraction
+ * operations, eliminating duplicated content.split('\n') calls across 26+ detectors.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParsedFile = void 0;
+exports.severityRank = severityRank;
+exports.confidenceRank = confidenceRank;
+class ParsedFile {
+    constructor(content, filePath) {
+        this._lines = null;
+        this.content = content;
+        this.filePath = filePath;
+    }
+    /** Lazy-cached array of lines from content.split('\n') */
+    get lines() {
+        if (this._lines === null) {
+            this._lines = this.content.split('\n');
+        }
+        return this._lines;
+    }
+    /** Number of lines in the file */
+    get lineCount() {
+        return this.lines.length;
+    }
+    /** Get a single line by 0-based index. Returns '' for out-of-bounds. */
+    line(index) {
+        if (index < 0 || index >= this.lines.length)
+            return '';
+        return this.lines[index];
+    }
+    /**
+     * Get surrounding lines around a center index, clamped to file bounds.
+     * @param lineIndex 0-based center line
+     * @param windowSize number of lines before and after center
+     */
+    getSurroundingLines(lineIndex, windowSize) {
+        const startIndex = Math.max(0, lineIndex - windowSize);
+        const endIndex = Math.min(this.lines.length - 1, lineIndex + windowSize);
+        const slice = this.lines.slice(startIndex, endIndex + 1);
+        return {
+            lines: slice,
+            startIndex,
+            endIndex,
+            text: slice.join('\n'),
+        };
+    }
+    /**
+     * Get a range of lines as a joined string.
+     * @param start 0-based start (inclusive), clamped to bounds
+     * @param end 0-based end (inclusive), clamped to bounds
+     */
+    getLineRange(start, end) {
+        const s = Math.max(0, start);
+        const e = Math.min(this.lines.length - 1, end);
+        if (s > e)
+            return '';
+        return this.lines.slice(s, e + 1).join('\n');
+    }
+    /** Construct from a ScanFile-like object with content and path */
+    static from(file) {
+        return new ParsedFile(file.content, file.path);
+    }
+}
+exports.ParsedFile = ParsedFile;
+/**
+ * Numeric rank for severity comparisons.
+ * Only relative ordering matters — used for keeping the higher-severity finding
+ * during deduplication and merge operations.
+ */
+function severityRank(severity) {
+    const ranks = {
+        critical: 5,
+        high: 4,
+        medium: 3,
+        low: 2,
+        info: 1,
+    };
+    return ranks[severity] || 0;
+}
+/**
+ * Numeric rank for confidence comparisons.
+ */
+function confidenceRank(confidence) {
+    const ranks = {
+        high: 3,
+        medium: 2,
+        low: 1,
+    };
+    return ranks[confidence] || 0;
+}
+//# sourceMappingURL=parsed-file.js.map

package/dist/utils/parsed-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsed-file.js","sourceRoot":"","sources":["../../src/utils/parsed-file.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA4EH,oCASC;AAKD,wCAOC;AA/FD,MAAa,UAAU;IAKrB,YAAY,OAAe,EAAE,QAAgB;QAFrC,WAAM,GAAoB,IAAI,CAAA;QAGpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,kCAAkC;IAClC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAa;QAChB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,SAAiB,EAAE,UAAkB;QAMvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAA;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU;YACV,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACvB,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAa,EAAE,GAAW;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAA;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,IAAuC;QACjD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;CACF;AAnED,gCAmEC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAA2B;QACpC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAA2B;QACpC,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;KACP,CAAA;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC"}

package/dist/utils/route-hierarchy.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Route Hierarchy Utility
+ * Understands framework-specific route hierarchy conventions
+ *
+ * This addresses false positives where routes inside authenticated layouts
+ * are flagged for "missing auth" when they inherit protection from parents.
+ *
+ * Key insight: Modern frameworks use layouts/middleware that protect entire
+ * route subtrees - child routes inherit this protection.
+ */
+export interface RouteProtectionContext {
+    /** Whether this route is in a protected hierarchy */
+    isInProtectedHierarchy: boolean;
+    /** Sources of protection (e.g., ["Remix _authenticated+ layout"]) */
+    protectionSource: string[];
+    /** Framework detected */
+    framework?: 'remix' | 'nextjs' | 'sveltekit' | 'nuxt' | 'unknown';
+    /** Whether this is in an admin section */
+    isAdminRoute: boolean;
+}
+/**
+ * Get route protection context for a file path
+ *
+ * @param filePath - The full file path to analyze
+ * @returns RouteProtectionContext with protection information
+ */
+export declare function getRouteProtectionContext(filePath: string): RouteProtectionContext;
+/**
+ * Check if a file path is inside a protected route hierarchy
+ *
+ * @param filePath - The full file path
+ * @returns true if the route is protected by its hierarchy
+ */
+export declare function isProtectedByRouteHierarchy(filePath: string): boolean;
+/**
+ * Check if a file path is inside an admin route section
+ *
+ * @param filePath - The full file path
+ * @returns true if this is an admin route
+ */
+export declare function isAdminRoute(filePath: string): boolean;
+/**
+ * Check if a component is likely used only within authenticated routes
+ * Useful for components in /components/admin/ or similar
+ *
+ * @param filePath - The full file path
+ * @returns true if this component is likely only used in authenticated contexts
+ */
+export declare function isAuthenticatedOnlyComponent(filePath: string): boolean;
+//# sourceMappingURL=route-hierarchy.d.ts.map

package/dist/utils/route-hierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hierarchy.d.ts","sourceRoot":"","sources":["../../src/utils/route-hierarchy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,sBAAsB,EAAE,OAAO,CAAA;IAC/B,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,yBAAyB;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,CAAA;IACjE,0CAA0C;IAC1C,YAAY,EAAE,OAAO,CAAA;CACtB;AAiHD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CA8DlF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiBtE"}

package/dist/utils/route-hierarchy.js

@@ -0,0 +1,226 @@
+"use strict";
+/**
+ * Route Hierarchy Utility
+ * Understands framework-specific route hierarchy conventions
+ *
+ * This addresses false positives where routes inside authenticated layouts
+ * are flagged for "missing auth" when they inherit protection from parents.
+ *
+ * Key insight: Modern frameworks use layouts/middleware that protect entire
+ * route subtrees - child routes inherit this protection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRouteProtectionContext = getRouteProtectionContext;
+exports.isProtectedByRouteHierarchy = isProtectedByRouteHierarchy;
+exports.isAdminRoute = isAdminRoute;
+exports.isAuthenticatedOnlyComponent = isAuthenticatedOnlyComponent;
+/**
+ * Framework-specific route conventions
+ */
+const FRAMEWORK_ROUTE_CONVENTIONS = {
+    remix: {
+        // Pathless layout routes - children inherit from parent
+        protectedLayouts: [
+            { pattern: /_authenticated\+/, name: 'Remix _authenticated+ layout' },
+            { pattern: /\(authenticated\)/, name: 'Remix (authenticated) route group' },
+            { pattern: /_protected\+/, name: 'Remix _protected+ layout' },
+            { pattern: /\(protected\)/, name: 'Remix (protected) route group' },
+            { pattern: /__authenticated/, name: 'Remix __authenticated layout' },
+            { pattern: /_auth\+/, name: 'Remix _auth+ layout' },
+        ],
+        adminLayouts: [
+            { pattern: /admin\+/, name: 'Remix admin+ layout' },
+            { pattern: /\(admin\)/, name: 'Remix (admin) route group' },
+            { pattern: /_admin\+/, name: 'Remix _admin+ layout' },
+            { pattern: /__admin/, name: 'Remix __admin layout' },
+        ],
+        // Detection pattern for Remix routes
+        routeDetection: /routes\//,
+    },
+    nextjs: {
+        protectedGroups: [
+            { pattern: /\(authenticated\)/, name: 'Next.js (authenticated) route group' },
+            { pattern: /\(protected\)/, name: 'Next.js (protected) route group' },
+            { pattern: /\(dashboard\)/, name: 'Next.js (dashboard) route group' },
+            { pattern: /\(private\)/, name: 'Next.js (private) route group' },
+            { pattern: /\(secure\)/, name: 'Next.js (secure) route group' },
+            { pattern: /\(user\)/, name: 'Next.js (user) route group' },
+            { pattern: /\(account\)/, name: 'Next.js (account) route group' },
+            { pattern: /\(app\)/, name: 'Next.js (app) route group' },
+        ],
+        adminGroups: [
+            { pattern: /\(admin\)/, name: 'Next.js (admin) route group' },
+        ],
+        // Detection pattern for Next.js App Router
+        routeDetection: /\/app\//,
+    },
+    sveltekit: {
+        protectedGroups: [
+            { pattern: /\(authenticated\)/, name: 'SvelteKit (authenticated) group' },
+            { pattern: /\(protected\)/, name: 'SvelteKit (protected) group' },
+            { pattern: /\(authed\)/, name: 'SvelteKit (authed) group' },
+        ],
+        adminGroups: [
+            { pattern: /\(admin\)/, name: 'SvelteKit (admin) group' },
+        ],
+        routeDetection: /\/routes\//,
+    },
+};
+/**
+ * Generic protected path patterns (framework-agnostic)
+ */
+const GENERIC_PROTECTED_PATTERNS = [
+    // Dashboard sections typically require auth
+    { pattern: /\/dashboard\//, name: 'Dashboard section' },
+    // Account/settings sections
+    { pattern: /\/account\//, name: 'Account section' },
+    { pattern: /\/settings\//, name: 'Settings section' },
+    { pattern: /\/profile\//, name: 'Profile section' },
+    // Admin sections
+    { pattern: /\/admin\//, name: 'Admin section' },
+    // User-specific routes with dynamic segments
+    { pattern: /\/users\/\[/, name: 'User-specific route' },
+    { pattern: /\/user\/\[/, name: 'User-specific route' },
+    // My-* routes (personal content)
+    { pattern: /\/my-/, name: 'Personal content route' },
+];
+/**
+ * Admin path patterns
+ */
+const ADMIN_PATH_PATTERNS = [
+    /\/admin\//i,
+    /\(admin\)/i,
+    /_admin\+/i,
+    /admin\+/i,
+    /\/backoffice\//i,
+    /\/management\//i,
+];
+/**
+ * Detect which framework this file belongs to
+ */
+function detectFramework(filePath) {
+    // Check for Remix patterns
+    if (FRAMEWORK_ROUTE_CONVENTIONS.remix.routeDetection.test(filePath)) {
+        // Remix uses routes/ directory
+        if (/_authenticated\+|_\w+\+/.test(filePath)) {
+            return 'remix';
+        }
+    }
+    // Check for Next.js App Router patterns
+    if (FRAMEWORK_ROUTE_CONVENTIONS.nextjs.routeDetection.test(filePath)) {
+        return 'nextjs';
+    }
+    // Check for SvelteKit patterns
+    if (FRAMEWORK_ROUTE_CONVENTIONS.sveltekit.routeDetection.test(filePath)) {
+        return 'sveltekit';
+    }
+    return 'unknown';
+}
+/**
+ * Get route protection context for a file path
+ *
+ * @param filePath - The full file path to analyze
+ * @returns RouteProtectionContext with protection information
+ */
+function getRouteProtectionContext(filePath) {
+    const sources = [];
+    const framework = detectFramework(filePath);
+    let isAdminRoute = false;
+    // Check Remix conventions
+    for (const layout of FRAMEWORK_ROUTE_CONVENTIONS.remix.protectedLayouts) {
+        if (layout.pattern.test(filePath)) {
+            sources.push(layout.name);
+        }
+    }
+    for (const layout of FRAMEWORK_ROUTE_CONVENTIONS.remix.adminLayouts) {
+        if (layout.pattern.test(filePath)) {
+            sources.push(layout.name);
+            isAdminRoute = true;
+        }
+    }
+    // Check Next.js conventions
+    for (const group of FRAMEWORK_ROUTE_CONVENTIONS.nextjs.protectedGroups) {
+        if (group.pattern.test(filePath)) {
+            sources.push(group.name);
+        }
+    }
+    for (const group of FRAMEWORK_ROUTE_CONVENTIONS.nextjs.adminGroups) {
+        if (group.pattern.test(filePath)) {
+            sources.push(group.name);
+            isAdminRoute = true;
+        }
+    }
+    // Check SvelteKit conventions
+    for (const group of FRAMEWORK_ROUTE_CONVENTIONS.sveltekit.protectedGroups) {
+        if (group.pattern.test(filePath)) {
+            sources.push(group.name);
+        }
+    }
+    for (const group of FRAMEWORK_ROUTE_CONVENTIONS.sveltekit.adminGroups) {
+        if (group.pattern.test(filePath)) {
+            sources.push(group.name);
+            isAdminRoute = true;
+        }
+    }
+    // Check generic protected patterns
+    for (const pattern of GENERIC_PROTECTED_PATTERNS) {
+        if (pattern.pattern.test(filePath)) {
+            sources.push(pattern.name);
+        }
+    }
+    // Check if this is an admin route
+    if (!isAdminRoute) {
+        isAdminRoute = ADMIN_PATH_PATTERNS.some(pattern => pattern.test(filePath));
+    }
+    return {
+        isInProtectedHierarchy: sources.length > 0,
+        protectionSource: sources,
+        framework,
+        isAdminRoute,
+    };
+}
+/**
+ * Check if a file path is inside a protected route hierarchy
+ *
+ * @param filePath - The full file path
+ * @returns true if the route is protected by its hierarchy
+ */
+function isProtectedByRouteHierarchy(filePath) {
+    const context = getRouteProtectionContext(filePath);
+    return context.isInProtectedHierarchy;
+}
+/**
+ * Check if a file path is inside an admin route section
+ *
+ * @param filePath - The full file path
+ * @returns true if this is an admin route
+ */
+function isAdminRoute(filePath) {
+    const context = getRouteProtectionContext(filePath);
+    return context.isAdminRoute;
+}
+/**
+ * Check if a component is likely used only within authenticated routes
+ * Useful for components in /components/admin/ or similar
+ *
+ * @param filePath - The full file path
+ * @returns true if this component is likely only used in authenticated contexts
+ */
+function isAuthenticatedOnlyComponent(filePath) {
+    const authenticatedComponentPatterns = [
+        /\/components\/admin\//i,
+        /\/components\/dashboard\//i,
+        /\/components\/user\//i,
+        /\/components\/account\//i,
+        /\/components\/settings\//i,
+        /\/components\/protected\//i,
+        /\/components\/private\//i,
+        /\/components\/authenticated\//i,
+        // Features that are inherently authenticated
+        /\/features\/dashboard\//i,
+        /\/features\/admin\//i,
+        /\/features\/account\//i,
+    ];
+    return authenticatedComponentPatterns.some(pattern => pattern.test(filePath));
+}
+//# sourceMappingURL=route-hierarchy.js.map

package/dist/utils/route-hierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hierarchy.js","sourceRoot":"","sources":["../../src/utils/route-hierarchy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAkIH,8DA8DC;AAQD,kEAGC;AAQD,oCAGC;AASD,oEAiBC;AAnOD;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,KAAK,EAAE;QACL,wDAAwD;QACxD,gBAAgB,EAAE;YAChB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,8BAA8B,EAAE;YACrE,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAC3E,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,+BAA+B,EAAE;YACnE,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,8BAA8B,EAAE;YACpE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE;SACpD;QACD,YAAY,EAAE;YACZ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACnD,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,2BAA2B,EAAE;YAC3D,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE;YACrD,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACrD;QACD,qCAAqC;QACrC,cAAc,EAAE,UAAU;KAC3B;IAED,MAAM,EAAE;QACN,eAAe,EAAE;YACf,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,qCAAqC,EAAE;YAC7E,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACrE,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACrE,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,+BAA+B,EAAE;YACjE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE;YAC/D,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,4BAA4B,EAAE;YAC3D,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,+BAA+B,EAAE;YACjE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE;SAC1D;QACD,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,6BAA6B,EAAE;SAC9D;QACD,2CAA2C;QAC3C,cAAc,EAAE,SAAS;KAC1B;IAED,SAAS,EAAE;QACT,eAAe,EAAE;YACf,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,iCAAiC,EAAE;YACzE,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,6BAA6B,EAAE;YACjE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,0BAA0B,EAAE;SAC5D;QACD,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,yBAAyB,EAAE;SAC1D;QACD,cAAc,EAAE,YAAY;KAC7B;CACF,CAAA;AAED;;GAEG;AACH,MAAM,0BAA0B,GAAG;IACjC,4CAA4C;IAC5C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACvD,4BAA4B;IAC5B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACnD,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACrD,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACnD,iBAAiB;IACjB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC/C,6CAA6C;IAC7C,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACvD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtD,iCAAiC;IACjC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE;CACrD,CAAA;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,iBAAiB;CAClB,CAAA;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,2BAA2B;IAC3B,IAAI,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,+BAA+B;QAC/B,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,2BAA2B,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,+BAA+B;IAC/B,IAAI,2BAA2B,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAA;IAExB,0BAA0B;IAC1B,KAAK,MAAM,MAAM,IAAI,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,2BAA2B,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACpE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACzB,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxB,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,2BAA2B,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxB,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO;QACL,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC1C,gBAAgB,EAAE,OAAO;QACzB,SAAS;QACT,YAAY;KACb,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAA;IACnD,OAAO,OAAO,CAAC,sBAAsB,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAgB;IAC3C,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAA;IACnD,OAAO,OAAO,CAAC,YAAY,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,8BAA8B,GAAG;QACrC,wBAAwB;QACxB,4BAA4B;QAC5B,uBAAuB;QACvB,0BAA0B;QAC1B,2BAA2B;QAC3B,4BAA4B;QAC5B,0BAA0B;QAC1B,gCAAgC;QAChC,6CAA6C;QAC7C,0BAA0B;QAC1B,sBAAsB;QACtB,wBAAwB;KACzB,CAAA;IAED,OAAO,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC/E,CAAC"}

package/dist/utils/schema-semantics.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Schema Semantics Utility
+ * Understands validation schema logic, particularly Zod/Yup/Joi patterns
+ *
+ * This addresses false positives where OR validation (either A or B required)
+ * is flagged as "bypass" when individual fields are marked optional.
+ *
+ * Key insight: `.optional()` + `.refine()` = OR validation, not bypass
+ */
+export interface SchemaAnalysis {
+    /** Whether the schema has cross-field refinement/validation */
+    hasRefinement: boolean;
+    /** Type of refinement detected */
+    refinementType?: 'or_logic' | 'super_refine' | 'custom_validation' | 'none';
+    /** Number of optional fields in the schema */
+    optionalFieldCount: number;
+    /** Whether this looks like legitimate OR validation */
+    isOrValidation: boolean;
+}
+/**
+ * Analyze a validation schema for OR-logic refinement patterns
+ *
+ * @param content - The full file content
+ * @param lineNumber - The 0-indexed line number where the pattern was found
+ * @returns SchemaAnalysis with refinement information
+ */
+export declare function analyzeSchemaSemantics(content: string, lineNumber: number): SchemaAnalysis;
+/**
+ * Check if a line with .optional() is part of legitimate OR validation
+ *
+ * @param content - The full file content
+ * @param lineNumber - The 0-indexed line number where .optional() was found
+ * @returns true if this is part of OR validation (not a bypass)
+ */
+export declare function isLegitimateOrValidation(content: string, lineNumber: number): boolean;
+/**
+ * Check if a 2FA-related field with .optional() has proper OR validation
+ * Specifically for 2FA patterns where either totpCode OR backupCode is required
+ *
+ * @param content - The full file content
+ * @param lineNumber - The 0-indexed line number
+ * @returns true if this is legitimate 2FA OR validation
+ */
+export declare function is2FAOrValidation(content: string, lineNumber: number): boolean;
+//# sourceMappingURL=schema-semantics.d.ts.map

package/dist/utils/schema-semantics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-semantics.d.ts","sourceRoot":"","sources":["../../src/utils/schema-semantics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,aAAa,EAAE,OAAO,CAAA;IACtB,kCAAkC;IAClC,cAAc,CAAC,EAAE,UAAU,GAAG,cAAc,GAAG,mBAAmB,GAAG,MAAM,CAAA;IAC3E,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,cAAc,EAAE,OAAO,CAAA;CACxB;AAuGD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,cAAc,CAuChB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAiCT"}