@shriyanss/js-recon 1.4.1-alpha.3 → 1.4.1-alpha.5

package/CLAUDE.md

@@ -35,6 +35,7 @@ npm run start -- <subcommand> [options]
 | `api-gateway` | Manage AWS API Gateway for IP rotation                                             |
 | `mcp`         | AI-powered CLI / one-shot chat (`-c`) / Model Context Protocol server (`--server`) |
 | `cs-mast`     | Compute CS-MAST structural hashes for downloaded JS files; find hash collisions    |
+| `sourcemaps`  | Extract source files from `.map` sourcemap file(s)                                 |
 
 ## Key source files
 
@@ -76,9 +77,9 @@ npm run start -- <subcommand> [options]
 1. **Lazyload** — downloads initial JS chunks via Puppeteer; detects framework; sets `globalsUtil.getTech()` to `"next"`
 2. **Strings** — scans downloaded JS for strings, extracts URL paths → `extracted_urls.json`
 3. **Lazyload (subsequent requests)** — re-crawls using the extracted paths to fetch dynamically loaded chunks; also fetches `buildId`
-4. **Strings (pass 2)** — re-runs strings on the expanded chunk set; generates `extracted_urls.txt` (permuted) and `extracted_urls-openapi.json`; optionally scans secrets (`--secrets`)
+4. **Strings (pass 2)** — re-runs strings on the expanded chunk set; generates `extracted_urls.txt` (permuted) and `extracted_urls-openapi.json`; optionally scans secrets (`--secrets`); optionally runs TruffleHog (`--trufflehog`)
 5. **Lazyload re-pass (step 4.5)** — a second subsequent-requests crawl to pick up chunks for dynamic routes discovered in pass 2
-6. **Strings re-pass (step 4.6)** — strings pass over the re-pass chunks
+6. **Strings re-pass (step 4.6)** — strings pass over the re-pass chunks; also runs `--secrets` / `--trufflehog` if those flags are set
 7. **Map** — parses webpack/turbopack bundles; resolves `fetch()` calls and axios usage; generates `mapped.json` and `mapped-openapi.json`; CDN-aware: if JS was served from a different host, `getCdnDir` finds the CDN output dir and passes that to map instead of `outputDir/host`
 8. **Endpoints** — extracts client-side route paths; uses `___subsequent_requests` directory presence to decide whether to pass a JS directory
 9. **Analyze** — loads YAML rules (from `-r/--rules` if provided, otherwise default rules cache); runs AST engine and request engine; writes `analyze.json`
@@ -106,7 +107,7 @@ npm run start -- <subcommand> [options]
 
 **SvelteKit `adapter-static` (SSG/SPA) boot pattern**: The static builds produce a shell HTML file (`404.html` for SSG, `index.html` for SPA) that contains both `<link rel="modulepreload">` tags for all initial chunks AND the same inline `import()` boot script as adapter-node. `svelte_getFromPageSource` picks up 17+ JS URLs from the modulepreload links plus 2 from the inline script, giving a much larger seed set than the adapter-node case.
 
-**`__vite_mapDeps` path formats**: SvelteKit emits `m.f = ["../nodes/0.js", "../chunks/x.js", ...]` (file-relative paths) inside entry chunks at `_app/immutable/entry/`. Vue and React emit `m.f = ["/assets/chunk.js", ...]` (root-relative paths). `react_followImports` differentiates by checking `p.startsWith("/")` — absolute paths resolve against the origin (`baseUrl`), relative paths resolve against the chunk's own URL (`fileUrl`). See `src/lazyload/react/CLAUDE.md` for details.
+**`__vite_mapDeps` path formats**: SvelteKit emits `m.f = ["../nodes/0.js", "../chunks/x.js", ...]` (explicit file-relative paths) inside entry chunks at `_app/immutable/entry/`. Vue and React can emit either `m.f = ["/assets/chunk.js", ...]` (absolute root-relative) or `m.f = ["assets/chunk.js", ...]` (bare root-relative, no leading `/`). `react_followImports` differentiates by checking for a `./` or `../` prefix: only explicitly relative paths resolve against the chunk's own URL (`fileUrl`); all others (absolute `/` or bare names) resolve against the origin (`baseUrl`). Bare names like `assets/x.js` must NOT be resolved against `fileUrl` — when the chunk is inside `assets/`, that would produce a double-directory path. See `src/lazyload/react/CLAUDE.md` for details.
 
 ### Batch mode
 
@@ -199,6 +200,7 @@ Rule categories:
 
 - `ast/` — AST-based pattern matching against chunk code (uses `@babel/parser` + `esquery`)
 - `request/` — OpenAPI/request-level checks against the resolved endpoint list
+- `cs-mast-s/` — CS-MAST-S structural signature matching; each step embeds a PHC string and fires if that node-level hash is found anywhere in the chunk AST. Suitable for regression detection after a vulnerability is confirmed via AST rules. See `src/analyze/engine/csMastSEngine.ts` and `src/analyze/CLAUDE.md` for details.
 
 When `-r` points to a single file, only that rule is loaded. When it points to a directory, all `.yml`/`.yaml` files are loaded recursively.
 
@@ -206,11 +208,137 @@ When `-r` points to a single file, only that rule is loaded. When it points to a
 
 **Testing is mandatory for every change.** Before reporting a task complete:
 
-1. Run `npm run cleanup` to rebuild TypeScript.
-2. Run the `run` subcommand against the target the user provides. Do not use `analyze` or other individual subcommands as a substitute — the `run` subcommand must be used to validate end-to-end behavior.
-3. If the user has not provided a target, ask for one before proceeding.
+1. Run `npm test` to execute the unit test suite (Vitest).
+2. Run `npm run cleanup` to rebuild TypeScript.
+3. Run the `run` subcommand against the target the user provides. Do not use `analyze` or other individual subcommands as a substitute — the `run` subcommand must be used to validate end-to-end behavior.
+4. If the user has not provided a target, ask for one before proceeding.
 
-Typical test invocation:
+### Rules smoke test (CI)
+
+The `rules-smoke-test` GitHub Actions workflow (`.github/workflows/rules-smoke-test.yaml`) runs on every non-main push. It:
+
+1. Checks out `shriyanss/js-recon-labs` and `shriyanss/js-recon-rules` alongside js-recon.
+2. Builds js-recon and the `next_js/vuln-all-rules` lab app.
+3. Starts the lab app on port 3001.
+4. Runs `node build/index.js run -u http://localhost:3001 -r ./js-recon-rules --no-sandbox -y -k`.
+5. Runs `node scripts/smoke-test.js` which reads `output/localhost:3001/analyze.json` and asserts that all 22 expected rule IDs are present.
+
+**`scripts/smoke-test.js`** maintains the `EXPECTED_RULES` list. When a new rule is added to js-recon-rules:
+
+- The `next_js/vuln-all-rules` app in js-recon-labs must be updated to seed the new vulnerability.
+- The new rule ID must be appended to `EXPECTED_RULES` in `scripts/smoke-test.js`.
+
+The lab app seeds:
+
+- 19 AST rules for the `next` tech stack
+- 3 request rules (`api_path`, `admin_api`, `missing_authorization_header`)
+- The Angular-only rule (`detect_angular_bypass_security_trust`) is intentionally excluded.
+
+### Unit tests
+
+Unit tests live in `src/__tests__/` and cover pure-logic components. Test framework is **Vitest** (ESM-native, TypeScript-native — no compilation step needed).
+
+```bash
+npm test          # run all unit tests once
+npm run test:watch  # watch mode
+npm run test:build  # legacy build smoke test (node build/index.js -h)
+```
+
+Test files follow the pattern `src/__tests__/<component>/<name>.test.ts`.
+
+Covered components:
+
+| File                                                                                     | Tests in                                               |
+| ---------------------------------------------------------------------------------------- | ------------------------------------------------------ |
+| `utility/urlUtils.ts` — `getURLDirectory`                                                | `src/__tests__/utility/urlUtils.test.ts`               |
+| `utility/replaceUrlPlaceholders.ts` — `replacePlaceholders`                              | `src/__tests__/utility/replaceUrlPlaceholders.test.ts` |
+| `utility/resolvePath.ts` — `resolvePath`                                                 | `src/__tests__/utility/resolvePath.test.ts`            |
+| `strings/index.ts` — `extractStrings`                                                    | `src/__tests__/strings/extractStrings.test.ts`         |
+| `analyze/helpers/validate.ts` — `parseVersion`, `compareVersions`, `isVersionCompatible` | `src/__tests__/analyze/versionCompat.test.ts`          |
+| `map/next_js/utils.ts` — `memberChainToString`                                           | `src/__tests__/map/memberChainToString.test.ts`        |
+| `fingerprint/index.ts` — `deriveOutputPath`                                              | `src/__tests__/fingerprint/deriveOutputPath.test.ts`   |
+
+When adding new pure-logic helpers, add a corresponding test file. Components that require Puppeteer, network I/O, or the full pipeline are still validated through the `run` subcommand.
+
+### Writing unit tests
+
+**What to test.** Test pure functions: anything that takes plain inputs and returns a value without I/O. The standard pattern for I/O-bound modules is to extract the parse/transform step into an exported pure function and test that. Leave the orchestrator (Puppeteer, `makeRequest`, file writes) untested at the unit level.
+
+**Extracting testable functions.** When a function mixes I/O with logic, split it:
+
+```typescript
+// Exported pure function — testable
+export const parseThings = (content: string, baseUrl: string): string[] => { ... };
+
+// Orchestrator — not unit-tested
+const myModule = async (url: string): Promise<string[]> => {
+    const resp = await makeRequest(url);
+    const content = await resp.text();
+    return parseThings(content, url);
+};
+```
+
+**Test file structure.** Use `describe` + `it` blocks. Group by function name. Cover: happy path, edge cases (empty input, malformed input), and threshold boundaries (e.g. "fewer than N entries returns []").
+
+```typescript
+import { describe, it, expect } from "vitest";
+import { myPureFunction } from "../../path/to/module.js"; // .js extension required
+
+describe("myPureFunction", () => {
+    it("extracts X from valid input", () => {
+        const result = myPureFunction("...");
+        expect(result).toContain("expected");
+    });
+
+    it("returns [] for empty input", () => {
+        expect(myPureFunction("")).toEqual([]);
+    });
+
+    it("returns [] for invalid JS", () => {
+        expect(myPureFunction("{{{{ not valid")).toEqual([]);
+    });
+});
+```
+
+**Imports always use `.js` extension** for local files (ESM project with `"module": "node16"`):
+
+```typescript
+import { fn } from "../../lazyLoad/next_js/myModule.js";
+```
+
+**Constructing Babel AST nodes for tests.** When a function under test requires real Babel AST nodes (with `scope`, `path`, correct `start`/`end` offsets), parse a code snippet in the test and capture the node via a traverse visitor — do not construct AST nodes by hand. Wrap the expression in a `const _x = <expr>;` declaration so `start`/`end` offsets are preserved for any `code.slice()` calls inside the function:
+
+```typescript
+import parser from "@babel/parser";
+import _traverse from "@babel/traverse";
+const traverse = (_traverse.default ?? _traverse) as typeof _traverse.default;
+
+function parseExpr(code: string) {
+    const src = `const _x = ${code};`;
+    const ast = parser.parse(src, { sourceType: "unambiguous", plugins: ["jsx", "typescript"] });
+    let node: any;
+    traverse(ast, {
+        VariableDeclarator(p) {
+            node = p.node.init;
+            p.stop();
+        },
+    });
+    return { node, src };
+}
+```
+
+**Avoiding GitHub secret scanning.** Strings that look like real secrets (Slack webhook URLs, Stripe keys, etc.) will be blocked by GitHub push protection even in test files. Construct them at runtime from parts arrays:
+
+```typescript
+// BAD — blocked by secret scanner
+const url = "https://hooks.slack.com/services/TABCDEF/BABCDEF/xxxxxxxxxxxx";
+
+// GOOD — assembled at runtime
+const parts = ["https://hooks.slack.com/services/T", "ABCDEF/B", "ABCDEF/xxxx"];
+const url = parts.join("");
+```
+
+Typical full test invocation:
 
 ```bash
 npm run cleanup && npm run start -- run -u <target-url> -y -k
@@ -250,9 +378,10 @@ Before writing any files, gather the current state:
 5. **Push** `js-recon` dev branch: `git push origin dev`
 
 6. **Open PR** using `gh pr create`:
-   | Repo | Source | Target | Title | Body |
-   |------|--------|--------|-------|------|
-   | `shriyanss/js-recon` | `dev` | `main` | bare version string (e.g. `v1.3.1-alpha.4`) | raw `## <version>` changelog section |
+
+    | Repo                 | Source | Target | Title                                       | Body                                 |
+    | -------------------- | ------ | ------ | ------------------------------------------- | ------------------------------------ |
+    | `shriyanss/js-recon` | `dev`  | `main` | bare version string (e.g. `v1.3.1-alpha.4`) | raw `## <version>` changelog section |
 
 7. **Monitor js-recon CI** — use `gh pr checks <pr-number> --repo shriyanss/js-recon` and poll until all checks complete. Handle CodeRabbit suggestions (see below). Do NOT merge — wait for user approval.
 
@@ -274,6 +403,24 @@ Before writing any files, gather the current state:
 
 9. **Wait for npm publish** — monitor the release pipeline: `gh run list --repo shriyanss/js-recon --workflow release`. Confirm the npm package is live at the new version before proceeding to Phase 2.
 
+### Homebrew tap (automatic, runs in parallel with Phase 2)
+
+After `publish-npm` succeeds, the `update-homebrew-tap` job in `publish-js-recon.yml` runs automatically. It:
+
+1. Computes the SHA256 of the published npm tarball from the public npmjs.org URL (no auth)
+2. Checks out `shriyanss/homebrew-tap` using `HOMEBREW_TAP_TOKEN` (a fine-grained PAT stored in `shriyanss/js-recon` secrets, scoped to `homebrew-tap` repo `Contents: Read and write` only — automatically masked in all log output, never echoed)
+3. Updates `version`, `url`, and `sha256` in `Formula/js-recon.rb` via anchored `sed`
+4. Commits `chore: update js-recon formula to <version>` and pushes
+
+Monitor: `gh run list --repo shriyanss/homebrew-tap --workflow ci.yml`
+
+**If the job fails:** The npm package is already live. Manually update: compute `curl -fsSL <tarball-url> | sha256sum`, edit `Formula/js-recon.rb`, commit, and push to `shriyanss/homebrew-tap`.
+
+**One-time setup** (must be done before the first release, already completed):
+
+- `shriyanss/homebrew-tap` is a public GitHub repo with the formula at `Formula/js-recon.rb`
+- `HOMEBREW_TAP_TOKEN` is a fine-grained PAT stored in `shriyanss/js-recon` → Settings → Secrets → Actions, scoped exclusively to the `homebrew-tap` repo
+
 ### Phase 2 — js-recon-docs (after npm is live)
 
 10. **Fix doc gaps** — cross-check `docs/docs/modules/*.md` against `src/index.ts` and the new CHANGELOG entries. Add or update any missing flags, options, or command descriptions.
@@ -316,6 +463,31 @@ For each suggestion: apply a fix commit to `dev` for correctness bugs or convent
 
 Do NOT merge any PR. Once all CI checks pass and CodeRabbit suggestions are addressed, present a summary to the user: what changed in each repo, PR links, CI status, CodeRabbit disposition. Wait for explicit merge approval.
 
+## Resolving a GitHub issue
+
+When a user asks to fix or implement a GitHub issue, follow these steps:
+
+1. **Read the issue** — `gh issue view <number> --repo shriyanss/js-recon`
+
+2. **Implement** — make the code, docs, and exit-code changes required. Follow all existing conventions (subcommand structure, CHANGELOG format, README Commands table, js-recon-docs modules page, exit_codes.md). Document new exit codes in both `CLAUDE.md` and `js-recon-docs/docs/docs/exit_codes.md`.
+
+3. **Test** — run `npm run cleanup` and exercise the new/changed functionality manually (see "Testing a change" section). Verify error paths and exit codes.
+
+4. **Commit and push to `dev`** — use a `feat(...)` or `fix(...)` commit message. Push to `origin dev`.
+
+5. **Monitor CI** — `gh run list --repo shriyanss/js-recon --branch dev --limit 3`. Watch the `Build & Prettify Code` run. If the `version_check` job fails because `CHANGELOG.md` top version doesn't match `package.json`, bump `package.json` and `src/globalConfig.ts` to match (with a `chore: bump version to <X>` commit) and repush.
+
+6. **Pull prettifier commit** — after CI passes, `git pull origin dev` to pick up the `chore: prettify code` auto-commit.
+
+7. **Close the issue** — once all CI checks pass:
+
+    ```bash
+    gh issue close <number> --repo shriyanss/js-recon --comment \
+      "Implemented in commit <short-sha> on the \`dev\` branch. Will be released in **v<version>**."
+    ```
+
+    Use the short commit hash of the feature commit (not the prettifier chore). The target release version comes from the unreleased CHANGELOG entry.
+
 ## cs-mast
 
 `cs-mast` computes CS-MAST-S (Context-Stratified Merkelized Abstract Syntax Tree) signatures for every `.js` file found recursively under an output directory, then optionally finds and reports structural collisions — files sharing the same root signature.
@@ -339,6 +511,11 @@ Do NOT merge any PR. Once all CI checks pass and CodeRabbit suggestions are addr
 - `--min-collisions <n>` — minimum occurrences to report (default: 2)
 - `--co / --collision-output <file>` — write collision data to a file (independent of `--ct`)
 - `--cf / --collision-format json|csv` — output format (default: csv)
+- `--scat <categories>` — comma-separated scat categories to use (default: `lit,decl,loop,cond`). Overrides the fixed config for this run.
+- `--sinc <nodes>` — comma-separated exact node types to include via sinc (e.g. `IfStatement`).
+- `--all-scat-permutations` — run all 511 non-empty scat subsets and write one collision file per subset to `--perm-output`.
+- `--perm-output <dir>` — output directory for per-permutation files (required with `--all-scat-permutations`).
+- `--perm-concurrency <n>` — parallel permutation workers (default: half of CPU count).
 
 **`--co` path resolution:** if the given path is a directory or has no extension, the file is written as `collisions.<fmt>` in the current working directory.
 
@@ -350,15 +527,28 @@ Do NOT merge any PR. Once all CI checks pass and CodeRabbit suggestions are addr
 npm run build
 node build/index.js cs-mast -o output --ct --min-collisions 2
 node build/index.js cs-mast -o output --co output --cf csv   # writes ./collisions.csv
+node build/index.js cs-mast -o output --all-scat-permutations --perm-output ./perm-out --cf json
 ```
 
 ## refactor
 
-The `refactor` command supports three techs:
+The `refactor` command supports the following techs:
 
 - **`react-webpack`** — webpack 5 React bundles. Splits a numeric module map into per-module ES files, rewrites require→import, recovers JSX. See `src/refactor/react/CLAUDE.md`.
 - **`react-vite`** — Vite (rolldown) React bundles. Removes CJS interop wrappers, rewrites vendor imports to canonical library imports (`react`, `react/jsx-runtime`, etc.), recovers JSX. Runs a Vite build check after writing output. See `src/refactor/react-vite/CLAUDE.md`.
 - **`next`** — Next.js bundles (legacy).
+- **`next-turbopack`** — Next.js Turbopack chunks. Handles both turbopack 3-param `func_NNN=(runtime,module,exports)=>{}` and 1-param `func_NNN=(runtime)=>{}` formats plus webpack-style coexisting chunks. See `src/refactor/next/CLAUDE.md`.
+- **`next-webpack`** — Next.js webpack chunks. Input format from `mapped.json`: `NNN:(module,exports,require)=>{}`. Recovers named exports (ODP, require.d), default exports (module.exports=V), re-exports (module.exports=require(N)→export*), and require hoisting. 277/280 modules recovered on a real bundle. Param order: params[0]=module, params[1]=exports, params[2]=require. See `src/refactor/next/CLAUDE.md`.
+- **`vue-webpack`** — Vue.js webpack 4/5 chunks. Container format: `(window.webpackJsonp||[]).push([[chunkIds],{moduleId:function(t,e,r){...}}])`. Each chunk file may contain multiple module functions; each is extracted and transformed. Reuses the Next.js webpack transform (same module param semantics: params[0]=module, params[1]=exports, params[2]=require). See `src/refactor/vue/index.ts`.
+- **`vue-vite`** — Vue 3 + Vite page chunks. The main index chunk (contains `__vccOpts`, all of Vue runtime) is analysed to build an export-alias→canonical-name map. Lazy page chunks then have their index imports rewritten to canonical `import {...} from 'vue'` statements. The `_export_sfc` compiler helper is inlined as a local const. See `src/refactor/vue/vite.ts` and `src/refactor/vue/vendor-analyze-vue.ts`.
+
+### Known react-vite bugs (discovered 2026-07-01, test against js-recon-research/react/20-cve-app)
+
+**Multi-chunk file overwrite** — `map` segments each Vite chunk into multiple sub-chunks (one per top-level function). The refactor write path processes sub-chunks sequentially, each overwriting the previous output file. Only the last sub-chunk survives. For chunks with inlined library code followed by the component function (e.g. `ApiProxy`, `Editor`, `Search`), this means the component is the survivor (last in the map order), which is the correct and useful result — but any app-specific helper functions in the same chunk are also lost.
+
+**Rename race** — When JSX is detected in a sub-chunk, the write path renames the output file `.js` → `.jsx`. When the same file is written by multiple sub-chunks, the rename is attempted on each JSX-containing chunk; all attempts after the first throw `ENOENT` because the `.js` file was already renamed. The `.jsx` file is correct; the unhandled rejection is noise. Fix: track which output files have already been renamed.
+
+**Remote signatures** — The `react/vite/large` HuggingFace bucket is currently empty. The tool falls back gracefully with a warning but remote library stripping is disabled. Symptom: `[!] No remote collisions files found for scat "lit-decl-loop-cond" in branch "react/vite/large"`. Fix: populate the bucket by running CS-MAST-S generation against a corpus of large Vite apps.
 
 ### refactor `--collisions <file>` (react-webpack only)
 
@@ -368,6 +558,37 @@ Plumbing: `src/index.ts` (CLI) → `src/refactor/index.ts` (resolves the path vi
 
 The baseline files live in the sibling `js-recon-cs-mast-s/` repo (`baselines/<tech>/<scat>/collisions.json`). See its `README.md` for layout and provenance.
 
+### refactor `--detect-version` (react-webpack, react-vite)
+
+`refactor -t react-webpack` and `refactor -t react-vite` accept a `--detect-version` flag that uses CS-MAST signatures to detect the React version used in the bundle.
+
+**Related flags:**
+
+- `--detect-version-config <config>` — `"dynamic"` (default) or comma-separated scat categories (e.g. `lit,decl,loop,cond`).
+- `--detect-version-dynamic-threshold <n>` — number of scat configs to use in dynamic mode (default: 3).
+- `--detect-version-dynamic-conf-purge` — clears the cached dynamic scat config and recomputes.
+
+**How it works:**
+
+1. **Scat config resolution** (`resolveVersionDetectionScatDirs()` in `src/refactor/index.ts`):
+    - `dynamic` mode: reads cached scat configs from `~/.js-recon/refactor/config.json`. If absent (or purged), calls `selectDynamicScatConfigs()` which lists scat dirs from the HF bucket for a reference version, then validates that each scat dir has non-empty `reliable_signatures.json` for ALL versions. Saves the result to `config.json`.
+    - Static mode: parses the user's comma-separated categories, converts to a bucket dir name via `scatToDir()`, validates against all versions, and exits with code 26 if any version's file is empty.
+2. `generateBundleSignatures()` in `src/refactor/remote/version-detect.ts` runs `cs_mast_init` on every chunk + optional extra code snippets for each selected scat config. This produces a separate signature set per scat.
+3. For each available React version, `fetchReliableSignatures()` downloads (or loads from cache) the `reliable_signatures.json` per scat config. Match counts are **summed across all scat configs** per version.
+4. The version with the highest total match count is returned as the detected version.
+5. The detected version's npm semver is used to pin `react` and `react-dom` in the refactored output's `package.json`.
+
+**Caches:**
+
+- Signature cache: `~/.js-recon/refactor/version_sigs_cache/<bundler>/<version>/<scatDir>/reliable_signatures.json` + `.cached_at` (7-day TTL).
+- Dynamic config cache: `~/.js-recon/refactor/config.json` (`dynamicVersionDetectionScatConfig` field).
+
+**Dataset coverage:** webpack (react-0.12 through react-19), vite (react-16 through react-19).
+
+**Important:** the version detection data in the HF bucket was generated with `@shriyanss/cs-mast` v0.1.8. The tool requires cs-mast 0.1.8 or later to produce matching signatures. Using an older cs-mast version will result in zero matches.
+
+**Important:** the version detection data in the HF bucket was generated with `@shriyanss/cs-mast` v0.1.8. The tool requires cs-mast 0.1.8 or later to produce matching signatures. Using an older cs-mast version will result in zero matches.
+
 ## Security / confidentiality
 
 When a change is informed by behavior observed on a real target (URLs, endpoint names, response shapes, finding details, etc.):

package/README.md

@@ -14,6 +14,23 @@ It can also reconstruct HTTP requests that the app makes to the server, and outp
 
 ## Installation
 
+### Homebrew (macOS and Linux)
+
+```bash
+brew tap shriyanss/tap
+brew install js-recon
+```
+
+To update:
+
+```bash
+brew update && brew upgrade js-recon
+```
+
+> **Note:** After installing via Homebrew, the `lazyload` subcommand requires a Chromium browser. Run `brew info js-recon` for setup instructions.
+
+### npm (all platforms)
+
 This tool requires Node.JS and `npm` to be installed. The [official download page](https://nodejs.org/en/download) can be referred. Please install **22.17.0 (LTS)** or later. Downloading older versions might break the tool.
 
 To install the tool globally, run:
@@ -52,27 +69,29 @@ js-recon run -u https://app.example.com
 
 `js-recon` provides a suite of commands for comprehensive JavaScript analysis. For detailed usage and examples, please refer to its full documentation.
 
-| Command       | Description                                                                   | Documentation                                                  |
-| ------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------- |
-| `lazyload`    | Downloads dynamically loaded JavaScript files from a target.                  | [Read Docs](https://js-recon.io/docs/docs/modules/lazyload)    |
-| `endpoints`   | Extracts API endpoints and client-side paths from JS files.                   | [Read Docs](https://js-recon.io/docs/docs/modules/endpoints)   |
-| `strings`     | Extracts strings, URLs, and potential secrets from JS files.                  | [Read Docs](https://js-recon.io/docs/docs/modules/strings)     |
-| `map`         | Maps function calls and analyzes code, with optional AI-powered descriptions. | [Read Docs](https://js-recon.io/docs/docs/modules/map)         |
-| `api-gateway` | Manages AWS API Gateway for IP rotation to bypass rate limits.                | [Read Docs](https://js-recon.io/docs/docs/modules/api-gateway) |
-| `run`         | Runs all analysis modules automatically on a target.                          | [Read Docs](https://js-recon.io/docs/docs/modules/run)         |
-| `analyze`     | Analyzes the code.                                                            | [Read Docs](https://js-recon.io/docs/docs/modules/analyze)     |
-| `report`      | Generates a report from the analysis modules.                                 | [Read Docs](https://js-recon.io/docs/docs/modules/report)      |
-| `mcp`         | AI-powered interactive CLI, one-shot chat, and MCP stdio server.              | [Read Docs](https://js-recon.io/docs/docs/modules/mcp)         |
-| `fingerprint` | Detects the JavaScript framework used by a target URL (JSON/JSONL output).    | [Read Docs](https://js-recon.io/docs/docs/modules/fingerprint) |
-| `refactor`    | Refactors and deobfuscates webpack modules from a mapped JSON file.           | [Read Docs](https://js-recon.io/docs/docs/modules/refactor)    |
-| `load`        | Populates the response cache from a Caido or Burp Suite export.               | [Read Docs](https://js-recon.io/docs/docs/modules/load)        |
-| `cs-mast`     | Computes CS-MAST structural hashes for JS files and finds hash collisions.    | [Read Docs](https://js-recon.io/docs/docs/modules/cs-mast)     |
+| Command       | Description                                                                      | Documentation                                                  |
+| ------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `lazyload`    | Downloads dynamically loaded JavaScript files from a target.                     | [Read Docs](https://js-recon.io/docs/docs/modules/lazyload)    |
+| `endpoints`   | Extracts API endpoints and client-side paths from JS files.                      | [Read Docs](https://js-recon.io/docs/docs/modules/endpoints)   |
+| `strings`     | Extracts strings, URLs, and potential secrets from JS files.                     | [Read Docs](https://js-recon.io/docs/docs/modules/strings)     |
+| `map`         | Maps function calls and analyzes code, with optional AI-powered descriptions.    | [Read Docs](https://js-recon.io/docs/docs/modules/map)         |
+| `api-gateway` | Manages AWS API Gateway for IP rotation to bypass rate limits.                   | [Read Docs](https://js-recon.io/docs/docs/modules/api-gateway) |
+| `run`         | Runs all analysis modules automatically on a target.                             | [Read Docs](https://js-recon.io/docs/docs/modules/run)         |
+| `analyze`     | Analyzes the code.                                                               | [Read Docs](https://js-recon.io/docs/docs/modules/analyze)     |
+| `report`      | Generates a report from the analysis modules.                                    | [Read Docs](https://js-recon.io/docs/docs/modules/report)      |
+| `mcp`         | AI-powered interactive CLI, one-shot chat, and MCP stdio server.                 | [Read Docs](https://js-recon.io/docs/docs/modules/mcp)         |
+| `fingerprint` | Detects the JavaScript framework used by a target URL (JSON/JSONL output).       | [Read Docs](https://js-recon.io/docs/docs/modules/fingerprint) |
+| `refactor`    | Recovers readable JSX and strips library code from React (webpack/Vite) bundles. | [Read Docs](https://js-recon.io/docs/docs/modules/refactor)    |
+| `load`        | Populates the response cache from a Caido or Burp Suite export.                  | [Read Docs](https://js-recon.io/docs/docs/modules/load)        |
+| `cs-mast`     | Computes CS-MAST structural hashes for JS files and finds hash collisions.       | [Read Docs](https://js-recon.io/docs/docs/modules/cs-mast)     |
+| `sourcemaps`  | Extracts original source files from `.map` sourcemap files.                      | [Read Docs](https://js-recon.io/docs/docs/modules/sourcemaps)  |
+| `completion`  | Generates shell completion scripts for bash, zsh, or fish.                       | [Read Docs](https://js-recon.io/docs/docs/modules/completion)  |
 
 ## Key Features
 
 - Downloads all dynamically loaded JS files (refered as `lazyload`) from website with supported frameworks
 - Use API gateway to rotate IP addresses to bypass firewall
-- Extract strings from the discovered JS files, and extract potential secrets, endpoints, etc. from them
+- Extract strings from the discovered JS files, and extract potential secrets, endpoints, etc. from them (built-in scanner via `--secrets`; TruffleHog integration via `--trufflehog`)
 - Endpoints modules extracts client-side paths from the app
 - Map feature analyzes the JS files and outputs it to a JSON file. An interactive mode can be then used to analyze it
 - Reconstruct HTTP requests that the app makes to the server, and output them to the OpenAPI spec

package/build/analyze/engine/csMastSEngine.js

@@ -0,0 +1,129 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import { cs_mast_init, parseSignature, ParseError } from "@shriyanss/cs-mast";
+/**
+ * Walk all AdapterNode descendants post-order and check if any node's
+ * computedHash equals the target hex hash. The _signatureMap built by
+ * cs_mast_init only stores leaf-level node signatures; to match the
+ * compound (internal-node) signatures produced by the experiment scripts
+ * (buildSignatureFromConfig on a specific subtree), we must walk the tree
+ * and compare computedHash directly.
+ */
+function treeContainsHash(node, targetHashHex) {
+    var _a;
+    if (node.computedHash === targetHashHex)
+        return true;
+    for (const child of (_a = node.children) !== null && _a !== void 0 ? _a : []) {
+        if (treeContainsHash(child, targetHashHex))
+            return true;
+    }
+    return false;
+}
+/**
+ * CS-MAST-S analysis engine. Checks whether a CS-MAST-S signature (PHC string)
+ * exists anywhere in a chunk's AST. Suitable for regression detection: once a
+ * vulnerability is confirmed via the AST engine, its signature can be embedded
+ * in a cs-mast-s rule to track whether the same code reappears in future builds.
+ *
+ * Each step must contain a `csMastS.signature` (PHC string). The scat config is
+ * derived automatically from the signature — no separate config field is needed.
+ * All steps must match in the same chunk for a finding to fire.
+ *
+ * @param rule - The cs-mast-s rule with signature steps
+ * @param mappedJsonData - Code chunks from mapped.json
+ * @returns Array of findings
+ */
+const csMastSEngine = (rule, mappedJsonData) => __awaiter(void 0, void 0, void 0, function* () {
+    const findings = [];
+    for (const chunk of Object.values(mappedJsonData)) {
+        // Cache cs_mast trees by config fingerprint to avoid redundant parses when
+        // multiple steps share the same scat config.
+        const treeCache = new Map();
+        const completedSteps = new Set();
+        for (const step of rule.steps) {
+            // Honor requires: skip if any prerequisite step didn't match.
+            if (step.requires && step.requires.length > 0) {
+                const allMet = step.requires.every((r) => completedSteps.has(r));
+                if (!allMet)
+                    continue;
+            }
+            if (!step.csMastS)
+                continue;
+            const { signature } = step.csMastS;
+            const parsed = parseSignature(signature);
+            if (!parsed) {
+                console.log(chalk.yellow(`[!] cs-mast-s step "${step.name}" in rule "${rule.id}" has an invalid signature — skipping`));
+                continue;
+            }
+            const config = {
+                hash: parsed.hash,
+                lang: parsed.lang,
+                prsr: parsed.prsr,
+                scat: parsed.scat,
+                sinc: parsed.sinc,
+                sourceType: "unambiguous",
+            };
+            // Build a stable cache key from the config fields that affect the hash tree.
+            const configKey = `${config.hash}:${config.lang}:${config.prsr}:${config.scat.join("_")}:${config.sinc.join("_")}`;
+            let tree;
+            if (treeCache.has(configKey)) {
+                tree = treeCache.get(configKey);
+            }
+            else {
+                try {
+                    tree = cs_mast_init(chunk.code, config);
+                    treeCache.set(configKey, tree);
+                }
+                catch (e) {
+                    if (e instanceof ParseError) {
+                        // Chunk is unparseable — skip silently (mirrors astEngine behavior).
+                        break;
+                    }
+                    throw e;
+                }
+            }
+            if (treeContainsHash(tree.root, parsed.hashHex)) {
+                completedSteps.add(step.name);
+            }
+        }
+        // Fire only if every step in the rule completed (matched).
+        if (completedSteps.size === rule.steps.length) {
+            const matchedSigs = rule.steps.filter((s) => s.csMastS).map((s) => s.csMastS.signature);
+            const message = `[+] "${rule.name}" found in chunk ${chunk.id}`;
+            if (rule.severity === "info") {
+                console.log(chalk.cyan(message));
+            }
+            else if (rule.severity === "low") {
+                console.log(chalk.yellow(message));
+            }
+            else if (rule.severity === "medium") {
+                console.log(chalk.magenta(message));
+            }
+            else if (rule.severity === "high") {
+                console.error(chalk.red(message));
+            }
+            findings.push({
+                ruleId: rule.id,
+                ruleName: rule.name,
+                ruleType: rule.type,
+                ruleDescription: rule.description,
+                ruleAuthor: rule.author,
+                ruleTech: rule.tech,
+                severity: rule.severity,
+                message,
+                findingLocation: `// chunk: ${chunk.id}\n// CS-MAST-S signature: ${matchedSigs.join(", ")}`,
+            });
+        }
+    }
+    return findings;
+});
+export default csMastSEngine;
+//# sourceMappingURL=csMastSEngine.js.map

package/build/analyze/engine/csMastSEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csMastSEngine.js","sourceRoot":"","sources":["../../../src/analyze/engine/csMastSEngine.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAM9E;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAiB,EAAE,aAAqB;;IAC9D,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,MAAA,IAAI,CAAC,QAAQ,mCAAI,EAAE,EAAE,CAAC;QACtC,IAAI,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAAG,CAAO,IAAU,EAAE,cAAsB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QAErE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM;oBAAE,SAAS;YAC1B,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAE5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YACnC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACP,KAAK,CAAC,MAAM,CACR,uBAAuB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,uCAAuC,CAC/F,CACJ,CAAC;gBACF,SAAS;YACb,CAAC;YAED,MAAM,MAAM,GAAiB;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAgB;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAsB;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAsB;gBACnC,UAAU,EAAE,aAAa;aAC5B,CAAC;YAEF,6EAA6E;YAC7E,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAEnH,IAAI,IAAqC,CAAC;YAC1C,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACxC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC;wBAC1B,qEAAqE;wBACrE,MAAM;oBACV,CAAC;oBACD,MAAM,CAAC,CAAC;gBACZ,CAAC;YACL,CAAC;YAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,IAAI,cAAc,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAQ,CAAC,SAAS,CAAC,CAAC;YAEzF,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,IAAI,oBAAoB,KAAK,CAAC,EAAE,EAAE,CAAC;YAEhE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,eAAe,EAAE,IAAI,CAAC,WAAW;gBACjC,UAAU,EAAE,IAAI,CAAC,MAAM;gBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO;gBACP,eAAe,EAAE,aAAa,KAAK,CAAC,EAAE,6BAA6B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC9F,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/build/analyze/engine/index.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import requestEngine from "./requestEngine.js";
 import astEngine from "./astEngine.js";
+import csMastSEngine from "./csMastSEngine.js";
 /**
  * Main analysis engine that routes rules to appropriate sub-engines based on rule type.
  *
@@ -53,6 +54,20 @@ export const engine = (rule, mappedJsonData, openapiData, tech) => __awaiter(voi
             findings.push(...(yield astEngine(rule, mappedJsonData)));
         }
     }
+    else if (rule.type === "cs-mast-s") {
+        if (!mappedJsonData) {
+            return;
+        }
+        let techValid = true;
+        for (const t of rule.tech) {
+            if (!rule.tech.includes(tech)) {
+                techValid = false;
+            }
+        }
+        if (techValid || tech === "all" || rule.tech.includes("all")) {
+            findings.push(...(yield csMastSEngine(rule, mappedJsonData)));
+        }
+    }
     return findings;
 });
 export default engine;

package/build/analyze/engine/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyze/engine/index.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,SAAS,MAAM,gBAAgB,CAAC;AAGvC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAClB,IAAU,EACV,cAAkC,EAClC,WAAoC,EACpC,IAA6D,EAC1B,EAAE;IACrC,yGAAyG;IAEzG,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyze/engine/index.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAG/C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAClB,IAAU,EACV,cAAkC,EAClC,WAAoC,EACpC,IAA6D,EAC1B,EAAE;IACrC,yGAAyG;IAEzG,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,KAAK,CAAC;YACtB,CAAC;QACL,CAAC;QAED,IAAI,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/build/analyze/helpers/engineHelpers/findDirectAssignment.js

@@ -1,5 +1,6 @@
+var _a;
 import _traverse from "@babel/traverse";
-const traverse = _traverse.default;
+const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
 /**
  * Finds direct assignment expressions or variable declarations for a given identifier node.
  *

package/build/analyze/helpers/engineHelpers/findDirectAssignment.js.map

@@ -1 +1 @@
-{"version":3,"file":"findDirectAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findDirectAssignment.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAGxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgB,EAAE,KAAW;IAC9D,IAAI,cAAc,GAAgB,IAAI,CAAC;IAEvC,QAAQ,CAAC,KAAK,EAAE;QACZ,oBAAoB,CAAC,IAAI;YACrB,uEAAuE;YACvE,IACI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;gBACpC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACzC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI;YACnB,8DAA8D;YAC9D,IACI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY;gBAClC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACvC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"findDirectAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findDirectAssignment.ts"],"names":[],"mappings":";AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAGxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgB,EAAE,KAAW;IAC9D,IAAI,cAAc,GAAgB,IAAI,CAAC;IAEvC,QAAQ,CAAC,KAAK,EAAE;QACZ,oBAAoB,CAAC,IAAI;YACrB,uEAAuE;YACvE,IACI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;gBACpC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACzC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI;YACnB,8DAA8D;YAC9D,IACI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY;gBAClC,UAAU,CAAC,IAAI,KAAK,YAAY;gBAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EACvC,CAAC;gBACC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC3B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YAC7C,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AAC1B,CAAC"}

package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js

@@ -1,5 +1,6 @@
+var _a;
 import _traverse from "@babel/traverse";
-const traverse = _traverse.default;
+const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
 /**
  * Finds an assignment expression where the left side is a member expression with a property that matches the given name.
  * Traverses the given node and its children to find a match.

package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map

@@ -1 +1 @@
-{"version":3,"file":"findMemberExpressionAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findMemberExpressionAssignment.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,IAAU,EAAE,OAAe,EAAE,KAAU,EAAoB,EAAE;IACxG,IAAI,SAA2B,CAAC;IAEhC,QAAQ,CACJ,IAAI,EACJ;QACI,oBAAoB,CAAC,IAAI;;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;YAEjC,IACI,CAAA,MAAA,cAAc,CAAC,IAAI,0CAAE,IAAI,MAAK,kBAAkB;gBAChD,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,IAAI,MAAK,kBAAkB;gBACjD,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,YAAY;gBAC5D,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,OAAO,EACzD,CAAC;gBACC,SAAS,GAAG,cAAc,CAAC;gBAC3B,+CAA+C;gBAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACL,CAAC;KACJ,EACD,KAAK,CACR,CAAC;IAEF,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"findMemberExpressionAssignment.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/findMemberExpressionAssignment.ts"],"names":[],"mappings":";AACA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,IAAU,EAAE,OAAe,EAAE,KAAU,EAAoB,EAAE;IACxG,IAAI,SAA2B,CAAC;IAEhC,QAAQ,CACJ,IAAI,EACJ;QACI,oBAAoB,CAAC,IAAI;;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC;YAEjC,IACI,CAAA,MAAA,cAAc,CAAC,IAAI,0CAAE,IAAI,MAAK,kBAAkB;gBAChD,CAAA,MAAA,cAAc,CAAC,KAAK,0CAAE,IAAI,MAAK,kBAAkB;gBACjD,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,YAAY;gBAC5D,CAAA,MAAC,cAAc,CAAC,IAAY,CAAC,QAAQ,0CAAE,IAAI,MAAK,OAAO,EACzD,CAAC;gBACC,SAAS,GAAG,cAAc,CAAC;gBAC3B,+CAA+C;gBAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACL,CAAC;KACJ,EACD,KAAK,CACR,CAAC;IAEF,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC"}

package/build/analyze/helpers/engineHelpers/resolveFunctionIdentifier.js

@@ -1,5 +1,6 @@
+var _a;
 import _traverse from "@babel/traverse";
-const traverse = _traverse.default;
+const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
 /**
  * Resolves a function identifier to its declaration node in the given AST.
  *