@oculum/scanner 1.0.12 → 1.0.13

package/dist/detect/structural/xxe-detection.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * Layer 2: XXE (XML External Entity) Detector
+ * Detects XML parsing without entity expansion protection
+ *
+ * OWASP A02:2021 - Cryptographic Failures (was A04 in 2017)
+ * CWE-611: Improper Restriction of XML External Entity Reference
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectXXEPatterns = detectXXEPatterns;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.55;
+const XXE_PATTERNS = [
+    // ==================== Node.js ====================
+    {
+        pattern: /xml2js\.parseString|new\s+xml2js\.Parser/,
+        lang: 'node',
+        lib: 'xml2js',
+        safe: /explicitCharkey|xmlMode/,
+        severity: 'medium', // xml2js v0.5+ doesn't expand entities by default
+        extensions: ['.js', '.ts', '.mjs', '.cjs', '.jsx', '.tsx'],
+    },
+    {
+        pattern: /libxmljs\.parseXml/,
+        lang: 'node',
+        lib: 'libxmljs',
+        safe: /noent\s*:\s*false/,
+        severity: 'high',
+        extensions: ['.js', '.ts', '.mjs', '.cjs'],
+    },
+    {
+        pattern: /new\s+DOMParser\(\)\.parseFromString/,
+        lang: 'node',
+        lib: 'DOMParser',
+        severity: 'low', // Browsers block XXE by default
+        extensions: ['.js', '.ts', '.jsx', '.tsx'],
+    },
+    {
+        pattern: /(?:xmldom|@xmldom\/xmldom)/,
+        lang: 'node',
+        lib: 'xmldom',
+        safe: /entityExpansionEnabled\s*:\s*false/,
+        severity: 'medium',
+        extensions: ['.js', '.ts', '.mjs', '.cjs'],
+    },
+    {
+        pattern: /(?:fast-xml-parser|XMLParser)/,
+        lang: 'node',
+        lib: 'fast-xml-parser',
+        safe: /processEntities\s*:\s*false/,
+        severity: 'medium',
+        extensions: ['.js', '.ts', '.mjs', '.cjs'],
+    },
+    // ==================== Python ====================
+    {
+        pattern: /xml\.etree\.ElementTree\.parse|ET\.parse|etree\.parse/,
+        lang: 'python',
+        lib: 'xml.etree.ElementTree',
+        safe: /defusedxml/,
+        severity: 'high',
+        extensions: ['.py'],
+    },
+    {
+        pattern: /lxml\.etree\.parse|etree\.fromstring/,
+        lang: 'python',
+        lib: 'lxml.etree',
+        safe: /resolve_entities\s*=\s*False|defusedxml/,
+        severity: 'high',
+        extensions: ['.py'],
+    },
+    {
+        pattern: /xml\.sax\.parse|xml\.dom\.minidom\.parse/,
+        lang: 'python',
+        lib: 'xml.sax/minidom',
+        safe: /defusedxml/,
+        severity: 'high',
+        extensions: ['.py'],
+    },
+    {
+        pattern: /xml\.dom\.pulldom/,
+        lang: 'python',
+        lib: 'xml.dom.pulldom',
+        safe: /defusedxml/,
+        severity: 'high',
+        extensions: ['.py'],
+    },
+    // ==================== Java ====================
+    {
+        pattern: /DocumentBuilderFactory\.newInstance/,
+        lang: 'java',
+        lib: 'DocumentBuilderFactory',
+        safe: /disallow-doctype-decl|FEATURE_SECURE_PROCESSING/,
+        severity: 'high',
+        extensions: ['.java'],
+    },
+    {
+        pattern: /SAXParserFactory\.newInstance/,
+        lang: 'java',
+        lib: 'SAXParserFactory',
+        safe: /disallow-doctype-decl|external-general-entities/,
+        severity: 'high',
+        extensions: ['.java'],
+    },
+    {
+        pattern: /XMLInputFactory\.newInstance/,
+        lang: 'java',
+        lib: 'XMLInputFactory',
+        safe: /IS_SUPPORTING_EXTERNAL_ENTITIES|SUPPORT_DTD/,
+        severity: 'high',
+        extensions: ['.java'],
+    },
+    {
+        pattern: /TransformerFactory\.newInstance/,
+        lang: 'java',
+        lib: 'TransformerFactory',
+        safe: /ACCESS_EXTERNAL_DTD|ACCESS_EXTERNAL_STYLESHEET/,
+        severity: 'high',
+        extensions: ['.java'],
+    },
+    // ==================== PHP ====================
+    {
+        pattern: /simplexml_load_string|simplexml_load_file/,
+        lang: 'php',
+        lib: 'simplexml',
+        safe: /libxml_disable_entity_loader\s*\(\s*true\s*\)|LIBXML_NOENT/,
+        severity: 'high',
+        extensions: ['.php'],
+    },
+    {
+        pattern: /DOMDocument.*(?:loadXML|load)\b/,
+        lang: 'php',
+        lib: 'DOMDocument',
+        safe: /libxml_disable_entity_loader\s*\(\s*true\s*\)/,
+        severity: 'high',
+        extensions: ['.php'],
+    },
+    {
+        pattern: /XMLReader.*open/,
+        lang: 'php',
+        lib: 'XMLReader',
+        safe: /setParserProperty.*LOADDTD.*false/,
+        severity: 'high',
+        extensions: ['.php'],
+    },
+];
+/**
+ * Check if the file extension matches the expected language
+ */
+function matchesLanguageExtension(filePath, extensions) {
+    if (!extensions)
+        return true;
+    return extensions.some(ext => filePath.endsWith(ext));
+}
+/**
+ * Check surrounding context for safe configuration
+ */
+function hasSafeConfig(content, lines, lineIndex, safePattern, lang) {
+    if (!safePattern)
+        return false;
+    // For Python: check entire file for defusedxml import
+    if (lang === 'python' && /defusedxml/.test(safePattern.source)) {
+        if (/import\s+defusedxml|from\s+defusedxml/.test(content)) {
+            return true;
+        }
+    }
+    // Check surrounding context (±20 lines for Java setFeature, ±10 for others)
+    const windowSize = lang === 'java' ? 20 : 10;
+    const start = Math.max(0, lineIndex - windowSize);
+    const end = Math.min(lines.length, lineIndex + windowSize + 1);
+    const context = lines.slice(start, end).join('\n');
+    return safePattern.test(context);
+}
+/**
+ * Detect XXE patterns in code
+ */
+function detectXXEPatterns(content, filePath, options) {
+    const vulnerabilities = [];
+    if ((0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return vulnerabilities;
+    const isTestFile = (0, file_classifier_1.isTestOrMockFile)(filePath);
+    const lines = options?.parsed?.lines ?? content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if ((0, file_classifier_1.isComment)(line))
+            continue;
+        for (const xxePattern of XXE_PATTERNS) {
+            // Check language extension match
+            if (!matchesLanguageExtension(filePath, xxePattern.extensions))
+                continue;
+            if (!xxePattern.pattern.test(line))
+                continue;
+            // Check for safe configuration
+            if (hasSafeConfig(content, lines, i, xxePattern.safe, xxePattern.lang))
+                continue;
+            let severity = xxePattern.severity || 'high';
+            // Downgrade for test files
+            if (isTestFile) {
+                severity = 'info';
+            }
+            // DOMParser in .tsx client files is inherently safe
+            if (xxePattern.lib === 'DOMParser' && (filePath.endsWith('.tsx') || filePath.endsWith('.jsx'))) {
+                severity = 'info';
+            }
+            vulnerabilities.push({
+                id: `xxe-${filePath}-${i + 1}-${xxePattern.lib}`,
+                filePath,
+                lineNumber: i + 1,
+                lineContent: line.trim(),
+                severity,
+                category: 'xxe',
+                title: `XXE risk: ${xxePattern.lib} XML parser without entity protection`,
+                description: `${xxePattern.lib} XML parser is used without disabling external entity processing. An attacker could supply malicious XML to read server files, perform SSRF, or cause denial-of-service.`,
+                suggestedFix: getSuggestedFix(xxePattern.lang, xxePattern.lib),
+                confidence: severity === 'high' ? 'high' : 'medium',
+                baseConfidence: BASE_CONFIDENCE,
+                layer: 2,
+                source: 'structural',
+                requiresAIValidation: severity !== 'high',
+            });
+            break; // One finding per line
+        }
+    }
+    return vulnerabilities;
+}
+function getSuggestedFix(lang, lib) {
+    switch (lang) {
+        case 'python':
+            return 'Use defusedxml instead of the standard xml library: pip install defusedxml && from defusedxml.ElementTree import parse';
+        case 'java':
+            return 'Disable external entities: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)';
+        case 'php':
+            return 'Disable entity loading: libxml_disable_entity_loader(true) before parsing XML';
+        case 'node':
+            if (lib === 'fast-xml-parser') {
+                return 'Disable entity processing: new XMLParser({ processEntities: false })';
+            }
+            if (lib === 'xml2js') {
+                return 'Consider upgrading to xml2js v0.5+ which has safer defaults, or use fast-xml-parser with processEntities: false';
+            }
+            return 'Disable external entity processing in the XML parser configuration';
+        default:
+            return 'Disable external entity processing in the XML parser configuration';
+    }
+}
+//# sourceMappingURL=xxe-detection.js.map

package/dist/detect/structural/xxe-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xxe-detection.js","sourceRoot":"","sources":["../../../src/detect/structural/xxe-detection.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA+MH,8CA4DC;AAvQD,iEAIoC;AAEpC,MAAM,eAAe,GAAG,IAAI,CAAA;AAqB5B,MAAM,YAAY,GAAiB;IACjC,oDAAoD;IACpD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,QAAQ,EAAE,kDAAkD;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3D;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3C;IACD;QACE,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,KAAK,EAAE,gCAAgC;QACjD,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3C;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3C;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;KAC3C;IAED,mDAAmD;IACnD;QACE,OAAO,EAAE,uDAAuD;QAChE,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,uBAAuB;QAC5B,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,KAAK,CAAC;KACpB;IACD;QACE,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,yCAAyC;QAC/C,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,KAAK,CAAC;KACpB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,KAAK,CAAC;KACpB;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,KAAK,CAAC;KACpB;IAED,iDAAiD;IACjD;QACE,OAAO,EAAE,qCAAqC;QAC9C,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,iDAAiD;QACvD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,iDAAiD;QACvD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,6CAA6C;QACnD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,gDAAgD;QACtD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB;IAED,gDAAgD;IAChD;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,4DAA4D;QAClE,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,MAAM,CAAC;KACrB;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,+CAA+C;QACrD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,MAAM,CAAC;KACrB;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,MAAM,CAAC;KACrB;CACF,CAAA;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAAgB,EAAE,UAAqB;IACvE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,OAAe,EACf,KAAe,EACf,SAAiB,EACjB,WAA+B,EAC/B,IAAY;IAEZ,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAE9B,sDAAsD;IACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,IAAI,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAElD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,OAAe,EACf,QAAgB,EAChB,OAAoB;IAEpB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAE5D,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAA,2BAAS,EAAC,IAAI,CAAC;YAAE,SAAQ;QAE7B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;YACtC,iCAAiC;YACjC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAQ;YAExE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAE5C,+BAA+B;YAC/B,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAEhF,IAAI,QAAQ,GAA0B,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAA;YAEnE,2BAA2B;YAC3B,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,GAAG,MAAM,CAAA;YACnB,CAAC;YAED,oDAAoD;YACpD,IAAI,UAAU,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/F,QAAQ,GAAG,MAAM,CAAA;YACnB,CAAC;YAED,eAAe,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,OAAO,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE;gBAChD,QAAQ;gBACR,UAAU,EAAE,CAAC,GAAG,CAAC;gBACjB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,QAAQ;gBACR,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,aAAa,UAAU,CAAC,GAAG,uCAAuC;gBACzE,WAAW,EACT,GAAG,UAAU,CAAC,GAAG,0KAA0K;gBAC7L,YAAY,EAAE,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;gBAC9D,UAAU,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACnD,cAAc,EAAE,eAAe;gBAC/B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,YAAqB;gBAC7B,oBAAoB,EAAE,QAAQ,KAAK,MAAM;aAC1C,CAAC,CAAA;YAEF,MAAK,CAAC,uBAAuB;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,wHAAwH,CAAA;QACjI,KAAK,MAAM;YACT,OAAO,6GAA6G,CAAA;QACtH,KAAK,KAAK;YACR,OAAO,+EAA+E,CAAA;QACxF,KAAK,MAAM;YACT,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;gBAC9B,OAAO,sEAAsE,CAAA;YAC/E,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,OAAO,iHAAiH,CAAA;YAC1H,CAAC;YACD,OAAO,oEAAoE,CAAA;QAC7E;YACE,OAAO,oEAAoE,CAAA;IAC/E,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,68 +1,21 @@
 /**
- * Scanner Orchestrator
- * Coordinates all three scanning layers and produces final results
- */
-import type { ScanFile, ScanResult, Vulnerability, SeverityCounts, CategoryCounts, ScanMode, ScanModeConfig, ScanDepth, CancellationToken } from './types';
-export interface ScanOptions {
-    /** Enable AI-powered validation and analysis */
-    enableAI?: boolean;
-    /** Maximum files to scan */
-    maxFiles?: number;
-    /** Branch being scanned */
-    branch?: string;
-    /** Scan mode configuration (full vs incremental) */
-    scanMode?: ScanMode | ScanModeConfig;
-    /** Scan depth (cheap/validated/deep) - controls AI usage */
-    scanDepth?: ScanDepth;
-    /** Suppress console.log output (for interactive CLI mode) */
-    quiet?: boolean;
-    /** Cancellation token for aborting scans gracefully */
-    cancellationToken?: CancellationToken;
-    /** Project path for loading suppression config (defaults to cwd) */
-    projectPath?: string;
-    /** Include suppressed findings in output (for --show-suppressed) */
-    showSuppressed?: boolean;
-    /** Include filter audit trail in output (for debugging/explaining dismissals) */
-    includeFilterAudit?: boolean;
-}
-export interface ScanProgress {
-    status: 'fetching' | 'layer1' | 'layer2' | 'layer3' | 'validating' | 'complete' | 'failed';
-    message: string;
-    filesProcessed: number;
-    totalFiles: number;
-    vulnerabilitiesFound: number;
-}
-export type ProgressCallback = (progress: ScanProgress) => void;
-/**
- * Run a complete security scan on the provided files
+ * Scanner Public API
  *
- * Supports two scan modes:
- * - full: Complete scan with AI validation on all files (initial onboarding, deep audits)
- * - incremental: Focused scan on changed files only (CI/CD, fast feedback)
- */
-export declare function runScan(files: ScanFile[], repoInfo: {
-    name: string;
-    url: string;
-    branch: string;
-}, options?: ScanOptions, onProgress?: ProgressCallback): Promise<ScanResult>;
-/**
- * Helper to compute counts from vulnerabilities (for backfilling legacy scans)
+ * Re-exports from stage modules. All prior exports preserved.
  */
-export declare function computeIssueMixFromVulnerabilities(vulnerabilities: Vulnerability[]): {
-    severityCounts: SeverityCounts;
-    categoryCounts: CategoryCounts;
-    hasBlockingIssues: boolean;
-};
-export * from './types';
-export { runLayer1Scan } from './layer1';
-export { runLayer2Scan } from './layer2';
-export { runLayer3Scan } from './layer3';
-export { buildProjectContext, type ProjectContext } from './utils/project-context-builder';
-export { validateFindingsWithAI, type ValidationStats, type AIValidationResult } from './layer3/anthropic';
-export { createCancellationToken } from './types';
-export { SuppressionManager, computeFindingHash, loadSuppressionConfig, addFindingSuppression, removeFindingSuppression, addRuleSuppression, listSuppressions, parseInlineSuppressions, generateSuppressionComment, isValidHash, type SuppressionConfig, type FindingSuppression, type RuleSuppression, type SuppressionResult, type SuppressedVulnerability, } from './suppression';
-export { BaselineManager, computeDiff, hasNewBlockingIssues, formatDiffSummary, BASELINE_FILE_PATH, OCULUM_DIR, type BaselineData, type BaselineFinding, type DiffResult, type BaselineDiff, type BaselineManagerOptions, type LoadBaselineResult, type SaveBaselineResult, type ClearBaselineResult, } from './baseline';
-export { RULE_REGISTRY, getRuleMetadata, getAllCategories, hasMetadata, type RuleMetadata, } from './rules';
-export { AIContextManager, AI_CONTEXT_FILE, AI_CONTEXT_PATH, type AIContextManagerOptions, type SaveContextResult, type LoadContextResult, type ClearContextResult, } from './ai-context';
-export { CATEGORY_GROUPS, ALL_CATEGORIES, normalizeCategory, expandCategoryPattern, matchesAnyCategory, shouldFailOnCategories, getMatchingCategories, parseCategoryList, validateCategories, getAvailableCategoryGroups, getCategoryGroupCounts, } from './category-filter';
+export { runScan, type ScanOptions } from './pipeline';
+export { computeIssueMixFromVulnerabilities } from './report/summary';
+export * from './shared/types';
+export { runLayer1Scan } from './detect/secrets';
+export { runLayer2Scan } from './detect/structural';
+export { buildProjectContext, type ProjectContext } from './model/project-context';
+export { validateFindingsWithAI, type ValidationStats, type AIValidationResult } from './validate';
+export { createCancellationToken } from './shared/types';
+export { scoreFindings, buildAdjustmentContext, buildConfidenceLog, DEPTH_CONFIGS, type ScoredFinding, type ConfidenceComputation, type ConfidenceAdjustment, type ConfidenceLog, type AdjustmentRule, type AdjustmentContext, type DepthConfig, } from './score';
+export type { ContextEngineResult } from './model/taint-types';
+export { SuppressionManager, computeFindingHash, loadSuppressionConfig, addFindingSuppression, removeFindingSuppression, addRuleSuppression, listSuppressions, parseInlineSuppressions, generateSuppressionComment, isValidHash, type SuppressionConfig, type FindingSuppression, type RuleSuppression, type SuppressionResult, type SuppressedVulnerability, } from './postprocess/suppression';
+export { BaselineManager, computeDiff, hasNewBlockingIssues, formatDiffSummary, BASELINE_FILE_PATH, OCULUM_DIR, type BaselineData, type BaselineFinding, type DiffResult, type BaselineDiff, type BaselineManagerOptions, type LoadBaselineResult, type SaveBaselineResult, type ClearBaselineResult, } from './shared/baseline';
+export { RULE_REGISTRY, getRuleMetadata, getAllCategories, hasMetadata, type RuleMetadata, } from './shared/rules';
+export { AIContextManager, AI_CONTEXT_FILE, AI_CONTEXT_PATH, type AIContextManagerOptions, type SaveContextResult, type LoadContextResult, type ClearContextResult, } from './shared/ai-context';
+export { CATEGORY_GROUPS, ALL_CATEGORIES, normalizeCategory, expandCategoryPattern, matchesAnyCategory, shouldFailOnCategories, getMatchingCategories, parseCategoryList, validateCategories, getAvailableCategoryGroups, getCategoryGroupCounts, } from './shared/category-filter';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EAEd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,iBAAiB,EAGlB,MAAM,SAAS,CAAA;AAuRhB,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IACpC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAA;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAA;AA8C/D;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,KAAK,EAAE,QAAQ,EAAE,EACjB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACvD,OAAO,GAAE,WAAgB,EACzB,UAAU,CAAC,EAAE,gBAAgB,GAC5B,OAAO,CAAC,UAAU,CAAC,CA8erB;AAyYD;;GAEG;AACH,wBAAgB,kCAAkC,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG;IACpF,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,iBAAiB,EAAE,OAAO,CAAA;CAC3B,CAMA;AAGD,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAC1F,OAAO,EAAE,sBAAsB,EAAE,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AAGjD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,KAAK,YAAY,GAClB,MAAM,SAAS,CAAA;AAGhB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAGtD,OAAO,EAAE,kCAAkC,EAAE,MAAM,kBAAkB,CAAA;AAMrE,cAAc,gBAAgB,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAAE,sBAAsB,EAAE,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAGxD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,SAAS,CAAA;AAGhB,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAG9D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,2BAA2B,CAAA;AAGlC,OAAO,EACL,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0BAA0B,CAAA"}