@oculum/scanner 1.0.12 → 1.0.13

package/dist/shared/intent-detector.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Intent Detector Utility
+ * Detects the INTENT of code patterns, not just keywords
+ *
+ * This addresses false positives where:
+ * - setState() is flagged as a redirect (it's React state, not navigation)
+ * - Error codes like 'SAME_PASSWORD' are flagged as password exposure
+ * - Signed URLs are flagged as token exposure
+ * - React Hook Form's shouldValidate: false is flagged as bypass
+ */
+/**
+ * Check if a line contains a React state setter (NOT a redirect)
+ */
+export declare function isReactStateSetter(line: string): boolean;
+/**
+ * Check if a line contains an actual redirect/navigation
+ */
+export declare function isActualRedirect(line: string): boolean;
+/**
+ * Determine if user input to this function is a security concern
+ * State setters with user input are NOT redirects
+ *
+ * @param line - The line content
+ * @returns 'state_setter' | 'redirect' | 'unknown'
+ */
+export declare function classifyNavigationIntent(line: string): 'state_setter' | 'redirect' | 'unknown';
+/**
+ * Check if a string in an error is a CODE (like 'SAME_PASSWORD')
+ * vs an actual VALUE that might expose data
+ */
+export declare function isErrorCodeString(line: string): boolean;
+/**
+ * Check if an error message might contain actual password/secret value
+ */
+export declare function hasPasswordValueInError(line: string): boolean;
+/**
+ * Check if "password" in error message is actually an error code/type
+ */
+export declare function isPasswordErrorCode(line: string): boolean;
+/**
+ * Check if a URL pattern is an intentional signed/presigned URL
+ * These are FEATURES, not vulnerabilities
+ */
+export declare function isSignedUrlPattern(line: string): boolean;
+/**
+ * Check if shouldValidate: false is in a React Hook Form context
+ * In RHF, this is a PERFORMANCE optimization, not a security bypass
+ */
+export declare function isReactHookFormContext(content: string, lineNumber: number): boolean;
+/**
+ * Check if validation: false / validate: false is form library optimization
+ */
+export declare function isFormLibraryOptimization(line: string, content: string, lineNumber: number): boolean;
+export interface IntentAnalysis {
+    /** The detected intent */
+    intent: 'security_concern' | 'safe_pattern' | 'unknown';
+    /** Reason for classification */
+    reason: string;
+    /** Suggested action */
+    action: 'flag' | 'skip' | 'downgrade';
+}
+/**
+ * Analyze a line for security intent based on multiple heuristics
+ */
+export declare function analyzeSecurityIntent(line: string, content: string, lineNumber: number, patternType: 'redirect' | 'password_error' | 'token_url' | 'validation_bypass'): IntentAnalysis;
+//# sourceMappingURL=intent-detector.d.ts.map

package/dist/shared/intent-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-detector.d.ts","sourceRoot":"","sources":["../../src/shared/intent-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA0CH;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,cAAc,GAAG,UAAU,GAAG,SAAS,CAQzC;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAYvD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAc7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAezD;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBxD;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAwBnF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAmBpG;AAMD,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,MAAM,EAAE,kBAAkB,GAAG,cAAc,GAAG,SAAS,CAAA;IACvD,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,uBAAuB;IACvB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAA;CACtC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,UAAU,GAAG,gBAAgB,GAAG,WAAW,GAAG,mBAAmB,GAC7E,cAAc,CA8DhB"}

package/dist/shared/intent-detector.js

@@ -0,0 +1,282 @@
+"use strict";
+/**
+ * Intent Detector Utility
+ * Detects the INTENT of code patterns, not just keywords
+ *
+ * This addresses false positives where:
+ * - setState() is flagged as a redirect (it's React state, not navigation)
+ * - Error codes like 'SAME_PASSWORD' are flagged as password exposure
+ * - Signed URLs are flagged as token exposure
+ * - React Hook Form's shouldValidate: false is flagged as bypass
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isReactStateSetter = isReactStateSetter;
+exports.isActualRedirect = isActualRedirect;
+exports.classifyNavigationIntent = classifyNavigationIntent;
+exports.isErrorCodeString = isErrorCodeString;
+exports.hasPasswordValueInError = hasPasswordValueInError;
+exports.isPasswordErrorCode = isPasswordErrorCode;
+exports.isSignedUrlPattern = isSignedUrlPattern;
+exports.isReactHookFormContext = isReactHookFormContext;
+exports.isFormLibraryOptimization = isFormLibraryOptimization;
+exports.analyzeSecurityIntent = analyzeSecurityIntent;
+// ============================================================================
+// Redirect vs State Setter Detection
+// ============================================================================
+/**
+ * React state setter patterns - these are NOT redirects
+ */
+const REACT_STATE_SETTER_PATTERNS = [
+    // useState setters: setFoo(value)
+    /\bset[A-Z][a-zA-Z]*\s*\(/,
+    // Zustand/state manager: store.setFoo()
+    /\.\s*set[A-Z][a-zA-Z]*\s*\(/,
+    // Redux dispatch pattern
+    /dispatch\s*\(/,
+    // Recoil/Jotai
+    /\buseSetRecoilState\b/,
+    /\bsetAtom\b/,
+];
+/**
+ * Actual redirect/navigation patterns
+ */
+const REDIRECT_PATTERNS = [
+    // Framework redirect functions
+    /\bredirect\s*\(/i,
+    /\bnavigate\s*\(/i,
+    // Next.js router
+    /router\.(push|replace)\s*\(/i,
+    /useRouter\(\)\.(push|replace)/i,
+    // React Router
+    /\buseNavigate\b/i,
+    // Window location
+    /window\.location\s*(=|\.href|\.assign|\.replace)/i,
+    // Response redirect
+    /Response\.redirect\s*\(/i,
+    /NextResponse\.redirect\s*\(/i,
+    // HTTP redirect
+    /res\.(redirect|send|status\(\d{3}\))/i,
+];
+/**
+ * Check if a line contains a React state setter (NOT a redirect)
+ */
+function isReactStateSetter(line) {
+    return REACT_STATE_SETTER_PATTERNS.some(pattern => pattern.test(line));
+}
+/**
+ * Check if a line contains an actual redirect/navigation
+ */
+function isActualRedirect(line) {
+    return REDIRECT_PATTERNS.some(pattern => pattern.test(line));
+}
+/**
+ * Determine if user input to this function is a security concern
+ * State setters with user input are NOT redirects
+ *
+ * @param line - The line content
+ * @returns 'state_setter' | 'redirect' | 'unknown'
+ */
+function classifyNavigationIntent(line) {
+    if (isReactStateSetter(line)) {
+        return 'state_setter';
+    }
+    if (isActualRedirect(line)) {
+        return 'redirect';
+    }
+    return 'unknown';
+}
+// ============================================================================
+// Error Code vs Error Value Detection
+// ============================================================================
+/**
+ * Check if a string in an error is a CODE (like 'SAME_PASSWORD')
+ * vs an actual VALUE that might expose data
+ */
+function isErrorCodeString(line) {
+    // Error codes are SCREAMING_CASE strings
+    const errorCodePatterns = [
+        // throw new Error('SAME_PASSWORD')
+        /Error\s*\(\s*['"][A-Z][A-Z_0-9]*['"]\s*\)/,
+        // throw new Error('USER_NOT_FOUND')
+        /throw\s+.*['"][A-Z][A-Z_0-9]*['"]/,
+        // ChatSDKError('unauthorized:INVALID_TOKEN')
+        /Error\s*\(\s*['"][a-z]+:[A-Z_]+['"]\s*\)/,
+    ];
+    return errorCodePatterns.some(pattern => pattern.test(line));
+}
+/**
+ * Check if an error message might contain actual password/secret value
+ */
+function hasPasswordValueInError(line) {
+    // Only flag if actual password variable is concatenated into error
+    const dangerousPatterns = [
+        // Error('Password is: ' + password)
+        /Error\s*\([^)]*\+\s*password[^)]*\)/i,
+        // Error(`Password is: ${password}`)
+        /Error\s*\([^)]*\$\{\s*password\s*\}[^)]*\)/i,
+        // Error(JSON.stringify({...password}))
+        /Error\s*\(\s*JSON\.stringify\s*\([^)]*password/i,
+        // Error(secret)
+        /Error\s*\(\s*(password|secret|token|apiKey)\s*\)/i,
+    ];
+    return dangerousPatterns.some(pattern => pattern.test(line));
+}
+/**
+ * Check if "password" in error message is actually an error code/type
+ */
+function isPasswordErrorCode(line) {
+    // These are error CODES about passwords, not password VALUES
+    const passwordCodePatterns = [
+        /['"]SAME_PASSWORD['"]/i,
+        /['"]INVALID_PASSWORD['"]/i,
+        /['"]WEAK_PASSWORD['"]/i,
+        /['"]PASSWORD_REQUIRED['"]/i,
+        /['"]PASSWORD_MISMATCH['"]/i,
+        /['"]PASSWORD_TOO_SHORT['"]/i,
+        /['"]PASSWORD_TOO_LONG['"]/i,
+        /['"]PASSWORD_EXPIRED['"]/i,
+        /['"]password:[\w_]+['"]/i, // password:INVALID, password:MISMATCH
+    ];
+    return passwordCodePatterns.some(pattern => pattern.test(line));
+}
+// ============================================================================
+// Signed URL Detection
+// ============================================================================
+/**
+ * Check if a URL pattern is an intentional signed/presigned URL
+ * These are FEATURES, not vulnerabilities
+ */
+function isSignedUrlPattern(line) {
+    const signedUrlPatterns = [
+        // AWS S3 presigned URLs
+        /presign/i,
+        /getSignedUrl/i,
+        /presignedUrl/i,
+        /presigned/i,
+        // Azure SAS tokens
+        /sasToken/i,
+        /SharedAccessSignature/i,
+        // GCP signed URLs
+        /generateSignedUrl/i,
+        /signedUrl/i,
+        // Generic signed URL patterns
+        /signature\s*[=:]/i,
+        /signed\s*[=:]/i,
+        /token\s*=.*&expires/i,
+        /expires\s*=.*&signature/i,
+    ];
+    return signedUrlPatterns.some(pattern => pattern.test(line));
+}
+// ============================================================================
+// Form Library Context Detection
+// ============================================================================
+/**
+ * Check if shouldValidate: false is in a React Hook Form context
+ * In RHF, this is a PERFORMANCE optimization, not a security bypass
+ */
+function isReactHookFormContext(content, lineNumber) {
+    const lines = content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 20);
+    const contextEnd = Math.min(lines.length, lineNumber + 5);
+    const context = lines.slice(contextStart, contextEnd).join('\n');
+    const rhfPatterns = [
+        // useForm hook
+        /useForm\s*[<(]/,
+        /useForm\(\)/,
+        // react-hook-form import
+        /from\s+['"]react-hook-form['"]/,
+        // Form methods
+        /\bform\.(setValue|watch|reset|getValues|trigger|clearErrors)\b/,
+        /\.(setValue|watch|reset|getValues|trigger|clearErrors)\s*\(/,
+        // Register pattern
+        /register\s*\(/,
+        // FormProvider
+        /FormProvider/,
+        // Control pattern
+        /control\s*=/,
+    ];
+    return rhfPatterns.some(pattern => pattern.test(context));
+}
+/**
+ * Check if validation: false / validate: false is form library optimization
+ */
+function isFormLibraryOptimization(line, content, lineNumber) {
+    // If in React Hook Form context, it's optimization
+    if (isReactHookFormContext(content, lineNumber)) {
+        return true;
+    }
+    // Check for other form library contexts
+    const formLibraryPatterns = [
+        /formik/i,
+        /react-final-form/i,
+        /vee-validate/i,
+        /vuelidate/i,
+    ];
+    const lines = content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 20);
+    const context = lines.slice(contextStart, lineNumber + 5).join('\n');
+    return formLibraryPatterns.some(pattern => pattern.test(context));
+}
+/**
+ * Analyze a line for security intent based on multiple heuristics
+ */
+function analyzeSecurityIntent(line, content, lineNumber, patternType) {
+    switch (patternType) {
+        case 'redirect':
+            if (isReactStateSetter(line)) {
+                return {
+                    intent: 'safe_pattern',
+                    reason: 'React state setter, not a redirect',
+                    action: 'skip',
+                };
+            }
+            if (isActualRedirect(line)) {
+                return {
+                    intent: 'security_concern',
+                    reason: 'Actual redirect/navigation function',
+                    action: 'flag',
+                };
+            }
+            break;
+        case 'password_error':
+            if (isErrorCodeString(line) || isPasswordErrorCode(line)) {
+                return {
+                    intent: 'safe_pattern',
+                    reason: 'Error code string, not actual password value',
+                    action: 'skip',
+                };
+            }
+            if (hasPasswordValueInError(line)) {
+                return {
+                    intent: 'security_concern',
+                    reason: 'Actual password value in error message',
+                    action: 'flag',
+                };
+            }
+            break;
+        case 'token_url':
+            if (isSignedUrlPattern(line)) {
+                return {
+                    intent: 'safe_pattern',
+                    reason: 'Intentional signed/presigned URL pattern',
+                    action: 'skip',
+                };
+            }
+            break;
+        case 'validation_bypass':
+            if (isFormLibraryOptimization(line, content, lineNumber)) {
+                return {
+                    intent: 'safe_pattern',
+                    reason: 'Form library performance optimization',
+                    action: 'skip',
+                };
+            }
+            break;
+    }
+    return {
+        intent: 'unknown',
+        reason: 'Could not determine intent',
+        action: 'flag', // Conservative: flag if unknown
+    };
+}
+//# sourceMappingURL=intent-detector.js.map

package/dist/shared/intent-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-detector.js","sourceRoot":"","sources":["../../src/shared/intent-detector.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AA6CH,gDAEC;AAKD,4CAEC;AASD,4DAUC;AAUD,8CAYC;AAKD,0DAcC;AAKD,kDAeC;AAUD,gDAqBC;AAUD,wDAwBC;AAKD,8DAmBC;AAkBD,sDAmEC;AAlTD,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,kCAAkC;IAClC,0BAA0B;IAC1B,wCAAwC;IACxC,6BAA6B;IAC7B,yBAAyB;IACzB,eAAe;IACf,eAAe;IACf,uBAAuB;IACvB,aAAa;CACd,CAAA;AAED;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,+BAA+B;IAC/B,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,8BAA8B;IAC9B,gCAAgC;IAChC,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,mDAAmD;IACnD,oBAAoB;IACpB,0BAA0B;IAC1B,8BAA8B;IAC9B,gBAAgB;IAChB,uCAAuC;CACxC,CAAA;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxE,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,IAAY;IAEZ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,yCAAyC;IACzC,MAAM,iBAAiB,GAAG;QACxB,mCAAmC;QACnC,2CAA2C;QAC3C,oCAAoC;QACpC,mCAAmC;QACnC,6CAA6C;QAC7C,0CAA0C;KAC3C,CAAA;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,mEAAmE;IACnE,MAAM,iBAAiB,GAAG;QACxB,oCAAoC;QACpC,sCAAsC;QACtC,oCAAoC;QACpC,6CAA6C;QAC7C,uCAAuC;QACvC,iDAAiD;QACjD,gBAAgB;QAChB,mDAAmD;KACpD,CAAA;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG;QAC3B,wBAAwB;QACxB,2BAA2B;QAC3B,wBAAwB;QACxB,4BAA4B;QAC5B,4BAA4B;QAC5B,6BAA6B;QAC7B,4BAA4B;QAC5B,2BAA2B;QAC3B,0BAA0B,EAAG,sCAAsC;KACpE,CAAA;IAED,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,iBAAiB,GAAG;QACxB,wBAAwB;QACxB,UAAU;QACV,eAAe;QACf,eAAe;QACf,YAAY;QACZ,mBAAmB;QACnB,WAAW;QACX,wBAAwB;QACxB,kBAAkB;QAClB,oBAAoB;QACpB,YAAY;QACZ,8BAA8B;QAC9B,mBAAmB;QACnB,gBAAgB;QAChB,sBAAsB;QACtB,0BAA0B;KAC3B,CAAA;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAG;QAClB,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,yBAAyB;QACzB,gCAAgC;QAChC,eAAe;QACf,gEAAgE;QAChE,6DAA6D;QAC7D,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;KACd,CAAA;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;IACzF,mDAAmD;IACnD,IAAI,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wCAAwC;IACxC,MAAM,mBAAmB,GAAG;QAC1B,SAAS;QACT,mBAAmB;QACnB,eAAe;QACf,YAAY;KACb,CAAA;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEpE,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACnE,CAAC;AAeD;;GAEG;AACH,SAAgB,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,UAAkB,EAClB,WAA8E;IAE9E,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,oCAAoC;oBAC5C,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,qCAAqC;oBAC7C,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,gBAAgB;YACnB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,8CAA8C;oBACtD,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,wCAAwC;oBAChD,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,WAAW;YACd,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,0CAA0C;oBAClD,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,mBAAmB;YACtB,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,uCAAuC;oBAC/C,MAAM,EAAE,MAAM;iBACf,CAAA;YACH,CAAC;YACD,MAAK;IACT,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,MAAM,EAAE,gCAAgC;KACjD,CAAA;AACH,CAAC"}

package/dist/shared/parsed-file.d.ts

@@ -0,0 +1,51 @@
+/**
+ * ParsedFile - Shared file representation for all detectors
+ *
+ * Provides lazy-cached line splitting and common context-extraction
+ * operations, eliminating duplicated content.split('\n') calls across 26+ detectors.
+ */
+export declare class ParsedFile {
+    readonly content: string;
+    readonly filePath: string;
+    private _lines;
+    constructor(content: string, filePath: string);
+    /** Lazy-cached array of lines from content.split('\n') */
+    get lines(): string[];
+    /** Number of lines in the file */
+    get lineCount(): number;
+    /** Get a single line by 0-based index. Returns '' for out-of-bounds. */
+    line(index: number): string;
+    /**
+     * Get surrounding lines around a center index, clamped to file bounds.
+     * @param lineIndex 0-based center line
+     * @param windowSize number of lines before and after center
+     */
+    getSurroundingLines(lineIndex: number, windowSize: number): {
+        lines: string[];
+        startIndex: number;
+        endIndex: number;
+        text: string;
+    };
+    /**
+     * Get a range of lines as a joined string.
+     * @param start 0-based start (inclusive), clamped to bounds
+     * @param end 0-based end (inclusive), clamped to bounds
+     */
+    getLineRange(start: number, end: number): string;
+    /** Construct from a ScanFile-like object with content and path */
+    static from(file: {
+        content: string;
+        path: string;
+    }): ParsedFile;
+}
+/**
+ * Numeric rank for severity comparisons.
+ * Only relative ordering matters — used for keeping the higher-severity finding
+ * during deduplication and merge operations.
+ */
+export declare function severityRank(severity: string): number;
+/**
+ * Numeric rank for confidence comparisons.
+ */
+export declare function confidenceRank(confidence: string): number;
+//# sourceMappingURL=parsed-file.d.ts.map

package/dist/shared/parsed-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsed-file.d.ts","sourceRoot":"","sources":["../../src/shared/parsed-file.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,MAAM,CAAwB;gBAE1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAK7C,0DAA0D;IAC1D,IAAI,KAAK,IAAI,MAAM,EAAE,CAKpB;IAED,kCAAkC;IAClC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK3B;;;;OAIG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAC1D,KAAK,EAAE,MAAM,EAAE,CAAA;QACf,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;KACb;IAYD;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAOhD,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;CAGjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOzD"}

package/dist/shared/parsed-file.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * ParsedFile - Shared file representation for all detectors
+ *
+ * Provides lazy-cached line splitting and common context-extraction
+ * operations, eliminating duplicated content.split('\n') calls across 26+ detectors.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParsedFile = void 0;
+exports.severityRank = severityRank;
+exports.confidenceRank = confidenceRank;
+class ParsedFile {
+    constructor(content, filePath) {
+        this._lines = null;
+        this.content = content;
+        this.filePath = filePath;
+    }
+    /** Lazy-cached array of lines from content.split('\n') */
+    get lines() {
+        if (this._lines === null) {
+            this._lines = this.content.split('\n');
+        }
+        return this._lines;
+    }
+    /** Number of lines in the file */
+    get lineCount() {
+        return this.lines.length;
+    }
+    /** Get a single line by 0-based index. Returns '' for out-of-bounds. */
+    line(index) {
+        if (index < 0 || index >= this.lines.length)
+            return '';
+        return this.lines[index];
+    }
+    /**
+     * Get surrounding lines around a center index, clamped to file bounds.
+     * @param lineIndex 0-based center line
+     * @param windowSize number of lines before and after center
+     */
+    getSurroundingLines(lineIndex, windowSize) {
+        const startIndex = Math.max(0, lineIndex - windowSize);
+        const endIndex = Math.min(this.lines.length - 1, lineIndex + windowSize);
+        const slice = this.lines.slice(startIndex, endIndex + 1);
+        return {
+            lines: slice,
+            startIndex,
+            endIndex,
+            text: slice.join('\n'),
+        };
+    }
+    /**
+     * Get a range of lines as a joined string.
+     * @param start 0-based start (inclusive), clamped to bounds
+     * @param end 0-based end (inclusive), clamped to bounds
+     */
+    getLineRange(start, end) {
+        const s = Math.max(0, start);
+        const e = Math.min(this.lines.length - 1, end);
+        if (s > e)
+            return '';
+        return this.lines.slice(s, e + 1).join('\n');
+    }
+    /** Construct from a ScanFile-like object with content and path */
+    static from(file) {
+        return new ParsedFile(file.content, file.path);
+    }
+}
+exports.ParsedFile = ParsedFile;
+/**
+ * Numeric rank for severity comparisons.
+ * Only relative ordering matters — used for keeping the higher-severity finding
+ * during deduplication and merge operations.
+ */
+function severityRank(severity) {
+    const ranks = {
+        critical: 5,
+        high: 4,
+        medium: 3,
+        low: 2,
+        info: 1,
+    };
+    return ranks[severity] || 0;
+}
+/**
+ * Numeric rank for confidence comparisons.
+ */
+function confidenceRank(confidence) {
+    const ranks = {
+        high: 3,
+        medium: 2,
+        low: 1,
+    };
+    return ranks[confidence] || 0;
+}
+//# sourceMappingURL=parsed-file.js.map

package/dist/shared/parsed-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsed-file.js","sourceRoot":"","sources":["../../src/shared/parsed-file.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA4EH,oCASC;AAKD,wCAOC;AA/FD,MAAa,UAAU;IAKrB,YAAY,OAAe,EAAE,QAAgB;QAFrC,WAAM,GAAoB,IAAI,CAAA;QAGpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,kCAAkC;IAClC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAa;QAChB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,SAAiB,EAAE,UAAkB;QAMvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAA;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU;YACV,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACvB,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAa,EAAE,GAAW;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAA;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,IAAuC;QACjD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;CACF;AAnED,gCAmEC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAA2B;QACpC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAA2B;QACpC,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;KACP,CAAA;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC"}

package/dist/shared/registry-clients.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Registry Clients for Package Metadata
+ * Fetches package information from npm and PyPI registries
+ * Used by the Hallucination Firewall (Story C) to assess dependency risk
+ */
+/**
+ * NPM Package Metadata Interface
+ */
+export interface NPMPackageMetadata {
+    name: string;
+    version: string;
+    description?: string;
+    maintainers: Array<{
+        name: string;
+        email?: string;
+    }>;
+    time: {
+        created: string;
+        modified: string;
+        [version: string]: string;
+    };
+    repository?: {
+        type: string;
+        url: string;
+    };
+    homepage?: string;
+    license?: string;
+    downloads?: {
+        weekly: number;
+    };
+}
+/**
+ * PyPI Package Metadata Interface
+ */
+export interface PyPIPackageMetadata {
+    name: string;
+    version: string;
+    summary?: string;
+    author?: string;
+    authorEmail?: string;
+    license?: string;
+    projectUrls?: Record<string, string>;
+    releaseDate?: string;
+    requiresPython?: string;
+}
+/**
+ * Extracted dependency information
+ */
+export interface ExtractedDependency {
+    name: string;
+    version?: string;
+    source: 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies' | 'requirements';
+    line: number;
+}
+/**
+ * Fetch package metadata from npm registry
+ * Returns null if package doesn't exist
+ */
+export declare function fetchNPMMetadata(packageName: string): Promise<NPMPackageMetadata | null>;
+/**
+ * Fetch package metadata from PyPI registry
+ * Returns null if package doesn't exist
+ */
+export declare function fetchPyPIMetadata(packageName: string): Promise<PyPIPackageMetadata | null>;
+/**
+ * Extract dependencies from package.json content
+ */
+export declare function extractNpmDependencies(content: string): ExtractedDependency[];
+/**
+ * Extract dependencies from requirements.txt content
+ */
+export declare function extractPythonRequirements(content: string): ExtractedDependency[];
+/**
+ * Extract dependencies from pyproject.toml content
+ */
+export declare function extractPyprojectDependencies(content: string): ExtractedDependency[];
+/**
+ * Determine the package file type from path
+ */
+export declare function getPackageFileType(filePath: string): 'npm' | 'python' | null;
+/**
+ * Calculate package age in days from creation date
+ */
+export declare function calculatePackageAgeDays(createdDate: string | undefined): number;
+/**
+ * Rate limiter helper - adds delay between registry requests
+ */
+export declare function rateLimitDelay(): Promise<void>;
+/**
+ * Clear all caches (useful for testing)
+ */
+export declare function clearRegistryCaches(): void;
+//# sourceMappingURL=registry-clients.d.ts.map

package/dist/shared/registry-clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-clients.d.ts","sourceRoot":"","sources":["../../src/shared/registry-clients.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;KAC1B,CAAA;IACD,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE;QACV,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,cAAc,CAAA;IACzG,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA8D9F;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAqDhG;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiC7E;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAyBhF;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAoCnF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,CAkB5E;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW/E;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}