@oculum/scanner 1.0.12 → 1.0.13

package/dist/shared/registry-clients.js

@@ -0,0 +1,273 @@
+"use strict";
+/**
+ * Registry Clients for Package Metadata
+ * Fetches package information from npm and PyPI registries
+ * Used by the Hallucination Firewall (Story C) to assess dependency risk
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchNPMMetadata = fetchNPMMetadata;
+exports.fetchPyPIMetadata = fetchPyPIMetadata;
+exports.extractNpmDependencies = extractNpmDependencies;
+exports.extractPythonRequirements = extractPythonRequirements;
+exports.extractPyprojectDependencies = extractPyprojectDependencies;
+exports.getPackageFileType = getPackageFileType;
+exports.calculatePackageAgeDays = calculatePackageAgeDays;
+exports.rateLimitDelay = rateLimitDelay;
+exports.clearRegistryCaches = clearRegistryCaches;
+// Cache for package metadata to avoid repeated requests
+const npmMetadataCache = new Map();
+const pypiMetadataCache = new Map();
+// Rate limiting configuration
+const RATE_LIMIT_DELAY_MS = 100;
+/**
+ * Fetch package metadata from npm registry
+ * Returns null if package doesn't exist
+ */
+async function fetchNPMMetadata(packageName) {
+    // Check cache first
+    if (npmMetadataCache.has(packageName)) {
+        return npmMetadataCache.get(packageName) || null;
+    }
+    try {
+        // Fetch package info from npm registry
+        const registryResponse = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+            headers: {
+                'Accept': 'application/json',
+            },
+        });
+        if (!registryResponse.ok) {
+            if (registryResponse.status === 404) {
+                npmMetadataCache.set(packageName, null);
+                return null;
+            }
+            // Non-404 error - don't cache, might be transient
+            console.warn(`[Registry] npm registry error for ${packageName}: ${registryResponse.status}`);
+            return null;
+        }
+        const data = await registryResponse.json();
+        // Fetch download counts separately (different API)
+        let weeklyDownloads = 0;
+        try {
+            const downloadsResponse = await fetch(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}`);
+            if (downloadsResponse.ok) {
+                const downloadsData = await downloadsResponse.json();
+                weeklyDownloads = downloadsData.downloads || 0;
+            }
+        }
+        catch {
+            // Download count is optional, don't fail
+        }
+        const metadata = {
+            name: data.name,
+            version: (data['dist-tags']?.latest) || '',
+            description: data.description,
+            maintainers: data.maintainers || [],
+            time: data.time || { created: '', modified: '' },
+            repository: data.repository,
+            homepage: data.homepage,
+            license: data.license,
+            downloads: { weekly: weeklyDownloads },
+        };
+        npmMetadataCache.set(packageName, metadata);
+        return metadata;
+    }
+    catch (error) {
+        console.warn(`[Registry] Failed to fetch npm metadata for ${packageName}:`, error);
+        // Don't cache network errors
+        return null;
+    }
+}
+/**
+ * Fetch package metadata from PyPI registry
+ * Returns null if package doesn't exist
+ */
+async function fetchPyPIMetadata(packageName) {
+    // Check cache first
+    if (pypiMetadataCache.has(packageName)) {
+        return pypiMetadataCache.get(packageName) || null;
+    }
+    try {
+        const response = await fetch(`https://pypi.org/pypi/${encodeURIComponent(packageName)}/json`, {
+            headers: {
+                'Accept': 'application/json',
+            },
+        });
+        if (!response.ok) {
+            if (response.status === 404) {
+                pypiMetadataCache.set(packageName, null);
+                return null;
+            }
+            console.warn(`[Registry] PyPI registry error for ${packageName}: ${response.status}`);
+            return null;
+        }
+        const data = await response.json();
+        const info = (data.info || {});
+        // Get release date from the latest version
+        let releaseDate;
+        const releases = data.releases?.[info.version];
+        if (releases && releases.length > 0) {
+            releaseDate = releases[0].upload_time;
+        }
+        const metadata = {
+            name: info.name,
+            version: info.version,
+            summary: info.summary,
+            author: info.author,
+            authorEmail: info.author_email,
+            license: info.license,
+            projectUrls: info.project_urls,
+            releaseDate,
+            requiresPython: info.requires_python,
+        };
+        pypiMetadataCache.set(packageName, metadata);
+        return metadata;
+    }
+    catch (error) {
+        console.warn(`[Registry] Failed to fetch PyPI metadata for ${packageName}:`, error);
+        return null;
+    }
+}
+/**
+ * Extract dependencies from package.json content
+ */
+function extractNpmDependencies(content) {
+    try {
+        const pkg = JSON.parse(content);
+        const deps = [];
+        const lines = content.split('\n');
+        const depSections = [
+            { key: 'dependencies', source: 'dependencies' },
+            { key: 'devDependencies', source: 'devDependencies' },
+            { key: 'peerDependencies', source: 'peerDependencies' },
+            { key: 'optionalDependencies', source: 'optionalDependencies' },
+        ];
+        for (const { key, source } of depSections) {
+            const depsObj = pkg[key];
+            if (!depsObj || typeof depsObj !== 'object')
+                continue;
+            for (const [name, version] of Object.entries(depsObj)) {
+                // Find the line number for this dependency
+                const lineIndex = lines.findIndex(l => l.includes(`"${name}"`));
+                deps.push({
+                    name,
+                    version: version,
+                    source,
+                    line: lineIndex >= 0 ? lineIndex + 1 : 1,
+                });
+            }
+        }
+        return deps;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Extract dependencies from requirements.txt content
+ */
+function extractPythonRequirements(content) {
+    const deps = [];
+    const lines = content.split('\n');
+    lines.forEach((line, index) => {
+        // Skip comments and empty lines
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('-')) {
+            return;
+        }
+        // Parse package name and optional version
+        // Formats: package, package==1.0.0, package>=1.0.0, package[extra], etc.
+        const match = trimmed.match(/^([a-zA-Z0-9_-]+)(?:\[.*?\])?(?:[=<>~!]+(.+))?/);
+        if (match) {
+            deps.push({
+                name: match[1],
+                version: match[2],
+                source: 'requirements',
+                line: index + 1,
+            });
+        }
+    });
+    return deps;
+}
+/**
+ * Extract dependencies from pyproject.toml content
+ */
+function extractPyprojectDependencies(content) {
+    const deps = [];
+    const lines = content.split('\n');
+    let inDependencies = false;
+    lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        // Check for dependencies section
+        if (trimmed === '[project.dependencies]' || trimmed === 'dependencies = [') {
+            inDependencies = true;
+            return;
+        }
+        // Exit dependencies section
+        if (inDependencies && (trimmed.startsWith('[') || trimmed === ']')) {
+            inDependencies = false;
+            return;
+        }
+        if (inDependencies) {
+            // Parse dependency line: "package>=1.0.0", or package = ">=1.0.0"
+            const match = trimmed.match(/^["']?([a-zA-Z0-9_-]+)(?:\[.*?\])?(?:[=<>~!]+)?/);
+            if (match && match[1]) {
+                deps.push({
+                    name: match[1],
+                    version: undefined,
+                    source: 'requirements',
+                    line: index + 1,
+                });
+            }
+        }
+    });
+    return deps;
+}
+/**
+ * Determine the package file type from path
+ */
+function getPackageFileType(filePath) {
+    const fileName = filePath.split('/').pop()?.toLowerCase() || '';
+    if (fileName === 'package.json' ||
+        fileName === 'package-lock.json' ||
+        fileName === 'yarn.lock' ||
+        fileName === 'pnpm-lock.yaml') {
+        return 'npm';
+    }
+    if (fileName === 'requirements.txt' ||
+        fileName === 'pyproject.toml' ||
+        fileName === 'pipfile' ||
+        fileName === 'pipfile.lock') {
+        return 'python';
+    }
+    return null;
+}
+/**
+ * Calculate package age in days from creation date
+ */
+function calculatePackageAgeDays(createdDate) {
+    if (!createdDate)
+        return Infinity; // Unknown age, treat as old (safe)
+    try {
+        const created = new Date(createdDate);
+        const now = new Date();
+        const diffMs = now.getTime() - created.getTime();
+        return Math.floor(diffMs / (1000 * 60 * 60 * 24));
+    }
+    catch {
+        return Infinity;
+    }
+}
+/**
+ * Rate limiter helper - adds delay between registry requests
+ */
+async function rateLimitDelay() {
+    return new Promise(resolve => setTimeout(resolve, RATE_LIMIT_DELAY_MS));
+}
+/**
+ * Clear all caches (useful for testing)
+ */
+function clearRegistryCaches() {
+    npmMetadataCache.clear();
+    pypiMetadataCache.clear();
+}
+//# sourceMappingURL=registry-clients.js.map

package/dist/shared/registry-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-clients.js","sourceRoot":"","sources":["../../src/shared/registry-clients.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AA8DH,4CA8DC;AAMD,8CAqDC;AAKD,wDAiCC;AAKD,8DAyBC;AAKD,oEAoCC;AAKD,gDAkBC;AAKD,0DAWC;AAKD,wCAEC;AAKD,kDAGC;AAxVD,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAqC,CAAA;AACrE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsC,CAAA;AAEvE,8BAA8B;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAmD/B;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,oBAAoB;IACpB,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;IAClD,CAAC;IAED,IAAI,CAAC;QACH,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAClC,8BAA8B,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAC/D;YACE,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;aAC7B;SACF,CACF,CAAA;QAED,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,IAAI,gBAAgB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;gBACvC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,kDAAkD;YAClD,OAAO,CAAC,IAAI,CAAC,qCAAqC,WAAW,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5F,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAA6B,CAAA;QAErE,mDAAmD;QACnD,IAAI,eAAe,GAAG,CAAC,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,KAAK,CACnC,mDAAmD,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACrF,CAAA;YACD,IAAI,iBAAiB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAA6B,CAAA;gBAC/E,eAAe,GAAI,aAAa,CAAC,SAAoB,IAAI,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,OAAO,EAAE,CAAE,IAAI,CAAC,WAAW,CAA4B,EAAE,MAAM,CAAC,IAAI,EAAE;YACtE,WAAW,EAAE,IAAI,CAAC,WAAiC;YACnD,WAAW,EAAG,IAAI,CAAC,WAAuD,IAAI,EAAE;YAChF,IAAI,EAAG,IAAI,CAAC,IAAmC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChF,UAAU,EAAE,IAAI,CAAC,UAA8C;YAC/D,QAAQ,EAAE,IAAI,CAAC,QAA8B;YAC7C,OAAO,EAAE,IAAI,CAAC,OAA6B;YAC3C,SAAS,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;SACvC,CAAA;QAED,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC3C,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,+CAA+C,WAAW,GAAG,EAAE,KAAK,CAAC,CAAA;QAClF,6BAA6B;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IACzD,oBAAoB;IACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,OAAO,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;IACnD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,yBAAyB,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAC/D;YACE,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;aAC7B;SACF,CACF,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;gBACxC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,sCAAsC,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAA;QAC7D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;QAEzD,2CAA2C;QAC3C,IAAI,WAA+B,CAAA;QACnC,MAAM,QAAQ,GAAI,IAAI,CAAC,QAA4D,EAAE,CAAC,IAAI,CAAC,OAAiB,CAAC,CAAA;QAC7G,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QACvC,CAAC;QAED,MAAM,QAAQ,GAAwB;YACpC,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,OAAO,EAAE,IAAI,CAAC,OAA6B;YAC3C,MAAM,EAAE,IAAI,CAAC,MAA4B;YACzC,WAAW,EAAE,IAAI,CAAC,YAAkC;YACpD,OAAO,EAAE,IAAI,CAAC,OAA6B;YAC3C,WAAW,EAAE,IAAI,CAAC,YAAkD;YACpE,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,eAAqC;SAC3D,CAAA;QAED,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC5C,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,WAAW,GAAG,EAAE,KAAK,CAAC,CAAA;QACnF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/B,MAAM,IAAI,GAA0B,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEjC,MAAM,WAAW,GAAG;YAClB,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,cAAuB,EAAE;YACxD,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAA0B,EAAE;YAC9D,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAA2B,EAAE;YAChE,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAA+B,EAAE;SACzE,CAAA;QAED,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACxB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,SAAQ;YAErD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAA;gBAC/D,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI;oBACJ,OAAO,EAAE,OAAiB;oBAC1B,MAAM;oBACN,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;iBACzC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CAAC,OAAe;IACvD,MAAM,IAAI,GAA0B,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,OAAM;QACR,CAAC;QAED,0CAA0C;QAC1C,yEAAyE;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAC7E,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,KAAK,GAAG,CAAC;aAChB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAAC,OAAe;IAC1D,MAAM,IAAI,GAA0B,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,IAAI,cAAc,GAAG,KAAK,CAAA;IAE1B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE3B,iCAAiC;QACjC,IAAI,OAAO,KAAK,wBAAwB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;YAC3E,cAAc,GAAG,IAAI,CAAA;YACrB,OAAM;QACR,CAAC;QAED,4BAA4B;QAC5B,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACnE,cAAc,GAAG,KAAK,CAAA;YACtB,OAAM;QACR,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,kEAAkE;YAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;YAC9E,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;oBACd,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,cAAc;oBACtB,IAAI,EAAE,KAAK,GAAG,CAAC;iBAChB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAE/D,IAAI,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,gBAAgB;QAC7B,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,WAA+B;IACrE,IAAI,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAA,CAAC,mCAAmC;IAErE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc;IAClC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB;IACjC,gBAAgB,CAAC,KAAK,EAAE,CAAA;IACxB,iBAAiB,CAAC,KAAK,EAAE,CAAA;AAC3B,CAAC"}

package/dist/shared/rules/framework-fixes.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Framework-Aware Fix Suggestions Registry (PRO-83)
+ *
+ * Provides framework-specific fix suggestions that transform generic advice
+ * into actionable guidance based on the user's detected tech stack.
+ *
+ * When a Next.js + Prisma project has a SQL injection finding, this registry
+ * provides Prisma-specific fixes instead of generic SQL advice.
+ *
+ * Falls back gracefully to generic fixes (from metadata.ts) when no match.
+ */
+import type { VulnerabilityCategory } from '../types';
+import type { FrameworkContext, DataAccessContext } from '../../model/project-context';
+export type FrameworkKey = 'nextjs' | 'express' | 'fastify' | 'nestjs' | 'prisma' | 'drizzle' | 'supabase' | 'mongoose' | 'knex' | 'react' | 'vue';
+export interface FrameworkFix {
+    /** Step-by-step fix instructions specific to this framework */
+    fixSteps: string[];
+    /** Optional code example demonstrating the fix */
+    codeExample?: string;
+}
+/**
+ * Registry mapping vulnerability categories to framework-specific fixes.
+ *
+ * Structure: category -> framework -> fix
+ *
+ * Priority categories (Tier 1):
+ * - sql_injection: Fixes vary dramatically by ORM
+ * - missing_auth: Framework-specific middleware patterns
+ * - xss: React/Vue/vanilla have different approaches
+ * - hardcoded_secret: Framework-specific env handling
+ * - cors_misconfiguration: Very framework-specific
+ */
+export declare const FRAMEWORK_FIX_REGISTRY: Partial<Record<VulnerabilityCategory, Partial<Record<FrameworkKey, FrameworkFix>>>>;
+/**
+ * Get framework-specific fix for a vulnerability category.
+ *
+ * Priority order for ORM-related categories (sql_injection):
+ * 1. ORM (prisma, drizzle, supabase, mongoose, knex)
+ * 2. Backend framework (nextjs, express, fastify, nestjs)
+ *
+ * Priority order for other categories:
+ * 1. Frontend framework for XSS (react, vue)
+ * 2. Backend framework for auth/cors/secrets
+ *
+ * @returns FrameworkFix if a match is found, undefined otherwise (falls back to generic)
+ */
+export declare function getFrameworkFix(category: VulnerabilityCategory, frameworks: FrameworkContext, dataAccess?: DataAccessContext): FrameworkFix | undefined;
+//# sourceMappingURL=framework-fixes.d.ts.map

package/dist/shared/rules/framework-fixes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-fixes.d.ts","sourceRoot":"","sources":["../../../src/shared/rules/framework-fixes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAMtF,MAAM,MAAM,YAAY,GACpB,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAC3C,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GACvD,OAAO,GAAG,KAAK,CAAA;AAEnB,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CA+WtH,CAAA;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAC/B,UAAU,EAAE,gBAAgB,EAC5B,UAAU,CAAC,EAAE,iBAAiB,GAC7B,YAAY,GAAG,SAAS,CAgC1B"}