@skaleagents/swarm 0.6.15 → 0.6.16

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm" | "gitlab" | "azure-pipelines" | "cloudbuild" | "tfvars" | "serverless" | "iam";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm" | "gitlab" | "azure-pipelines" | "cloudbuild" | "tfvars" | "serverless" | "iam" | "package";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -32,7 +32,14 @@ export declare function looksLikeTerraformHcl(content: string): boolean;
 export declare function looksLikeBicep(content: string): boolean;
 export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
-export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;
+export type CloudFormationTables = {
+    defaults: Map<string, string | boolean | number>;
+    secretNames: Set<string>;
+    mappings: Map<string, Record<string, Record<string, string | number | boolean>>>;
+};
+export declare function parseIac(content: string, requested?: IacFormat | "auto", shared?: CloudFormationTables): ParsedIac;
+export declare function readCloudFormationTables(content: string): CloudFormationTables;
 export declare function terraformJsonencodeValue(expression: string): unknown | undefined;
 export declare function looksLikeServerless(content: string): boolean;
+export declare function looksLikePackage(content: string): boolean;
 export declare function looksLikeIamPolicy(content: string): boolean;

package/dist/iac/parse.js

@@ -32,6 +32,8 @@ export function looksLikeIac(content) {
                 return true;
             if (looksLikeIamPolicy(content))
                 return true;
+            if (looksLikePackage(content))
+                return true;
         }
         catch {
             /* Other format detection still applies to incomplete input. */
@@ -139,10 +141,12 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
-const terraformExpressionWarning = "Same-file variable and local literals are resolved. A string of those references and format of known literals are resolved. Other functions and expressions are not evaluated.";
-export function parseIac(content, requested = "auto") {
+const terraformExpressionWarning = "Variable and local literals from the submitted files are resolved. A string of those references, format of known literals, and join of known literals are resolved. Other functions and expressions are not evaluated.";
+export function parseIac(content, requested = "auto", shared) {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
+    if (requested === "package" || (requested === "auto" && looksLikePackage(content)))
+        return parsePackage(content);
     // Detect these before HCL or a failing YAML parse so a Dockerfile is not classified as Terraform.
     if (requested === "dockerfile" ||
         ((requested === "auto" || requested === "terraform") &&
@@ -412,12 +416,28 @@ export function parseIac(content, requested = "auto") {
                 Array.isArray(root.Resources) ||
                 typeof root.Resources !== "object")
                 throw new ScanInputError("CloudFormation requires a Resources mapping.");
-            const parameters = cloudFormationParameterLiterals(root);
+            const localParameters = cloudFormationParameterLiterals(root);
+            const localMappings = cloudFormationMappings(root);
+            const parameters = {
+                defaults: new Map(shared?.defaults ?? localParameters.defaults),
+                secretNames: new Set(shared?.secretNames ?? localParameters.secretNames),
+            };
+            const mappings = new Map(shared?.mappings ?? localMappings);
+            if (shared) {
+                for (const [name, value] of localParameters.defaults)
+                    if (!parameters.defaults.has(name))
+                        parameters.defaults.set(name, value);
+                for (const name of localParameters.secretNames)
+                    parameters.secretNames.add(name);
+                for (const [name, value] of localMappings)
+                    if (!mappings.has(name))
+                        mappings.set(name, value);
+            }
             for (const [name, raw] of Object.entries(object(root.Resources))) {
                 const value = object(raw);
                 if (typeof value.Type !== "string")
                     throw new ScanInputError("Each CloudFormation resource requires a Type.");
-                add(name, value.Type, resolveCloudFormationRefs(value, parameters), ["Resources", name]);
+                add(name, value.Type, resolveCloudFormationRefs(value, parameters, mappings), ["Resources", name]);
             }
         }
         else if (format === "terraform") {
@@ -465,12 +485,12 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, or a standalone IAM policy.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, a standalone IAM policy, or a package.json.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (format === "cloudformation" &&
         /(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\bRef\s*:)/.test(content))
-        warnings.push("Same-file parameter defaults are resolved. A simple Fn::Sub of those parameters is resolved. Other functions are not evaluated.");
+        warnings.push("Same-file and cross-file parameter defaults are resolved. A simple Fn::Sub, Fn::Join, and Fn::FindInMap of known literals are resolved. Other functions are not evaluated.");
     else if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
@@ -1413,6 +1433,58 @@ function parameterNameIsSecret(name) {
         /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized) ||
         /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key|token)$/i.test(name));
 }
+function cloudFormationMappings(root) {
+    const mappings = new Map();
+    for (const [mapName, top] of Object.entries(object(root.Mappings))) {
+        const levels = {};
+        for (const [topKey, second] of Object.entries(object(top))) {
+            const entries = {};
+            for (const [secondKey, raw] of Object.entries(object(second))) {
+                if (typeof raw === "string" || typeof raw === "number" || typeof raw === "boolean")
+                    entries[secondKey] = raw;
+            }
+            levels[topKey] = entries;
+        }
+        mappings.set(mapName, levels);
+    }
+    return mappings;
+}
+export function readCloudFormationTables(content) {
+    const empty = () => ({
+        defaults: new Map(),
+        secretNames: new Set(),
+        mappings: new Map(),
+    });
+    const trimmed = content.trim();
+    if (!trimmed)
+        return empty();
+    let root;
+    try {
+        if (trimmed.startsWith("{"))
+            root = object(JSON.parse(trimmed));
+        else {
+            const docs = parseAllDocuments(trimmed, { prettyErrors: false });
+            const doc = docs[0];
+            if (!doc || doc.errors.length)
+                return empty();
+            root = object(doc.toJS({ maxAliasCount: 0 }));
+        }
+    }
+    catch {
+        return empty();
+    }
+    if (!root.Parameters &&
+        !root.Mappings &&
+        !root.Resources &&
+        typeof root.AWSTemplateFormatVersion !== "string")
+        return empty();
+    const parameters = cloudFormationParameterLiterals(root);
+    return {
+        defaults: parameters.defaults,
+        secretNames: parameters.secretNames,
+        mappings: cloudFormationMappings(root),
+    };
+}
 function cloudFormationParameterLiterals(root) {
     const defaults = new Map();
     const secretNames = new Set();
@@ -1459,6 +1531,7 @@ function cloudFormationSubTemplate(value) {
 function substituteKnownParameters(template, parameters) {
     let unresolved = false;
     let secret = false;
+    const names = [];
     const text = template.replace(/\$\{(!?)([^}]*)\}/g, (full, literalMark, rawName) => {
         if (literalMark === "!")
             return `\${${rawName}}`;
@@ -1467,30 +1540,70 @@ function substituteKnownParameters(template, parameters) {
             unresolved = true;
             return full;
         }
+        names.push(name);
         if (parameters.secretNames.has(name))
             secret = true;
         return String(parameters.defaults.get(name));
     });
     if (unresolved)
         return undefined;
-    return { text, secret };
+    return { text, secret, names };
 }
-function resolveCloudFormationRefs(value, parameters) {
+function cloudFormationJoin(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets" && key !== "__valueOrigins");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, body] = entries[0];
+    if (key !== "Fn::Join" || !Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1]))
+        return undefined;
+    return [body[0], body[1]];
+}
+function cloudFormationFindInMap(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets" && key !== "__valueOrigins");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, body] = entries[0];
+    if (key !== "Fn::FindInMap" || !Array.isArray(body) || body.length !== 3)
+        return undefined;
+    return [body[0], body[1], body[2]];
+}
+function knownLiteral(value) {
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return undefined;
+}
+function recordSingleOrigin(origins, path, names) {
+    const unique = [...new Set(names)];
+    if (unique.length === 1)
+        origins.set(path.join("."), unique[0]);
+}
+function resolveCloudFormationRefs(value, parameters, mappings) {
     const secretPaths = [];
-    const resolved = resolveCloudFormationValue(value, parameters, [], secretPaths);
-    if (secretPaths.length > 0 &&
-        resolved &&
-        typeof resolved === "object" &&
-        !Array.isArray(resolved)) {
-        Object.defineProperty(resolved, "__referencedSecrets", {
-            enumerable: false,
-            configurable: true,
-            value: secretPaths,
-        });
+    const origins = new Map();
+    const resolved = resolveCloudFormationValue(value, parameters, mappings, [], secretPaths, origins);
+    if (resolved && typeof resolved === "object" && !Array.isArray(resolved)) {
+        if (secretPaths.length > 0) {
+            Object.defineProperty(resolved, "__referencedSecrets", {
+                enumerable: false,
+                configurable: true,
+                value: secretPaths,
+            });
+        }
+        if (origins.size > 0) {
+            Object.defineProperty(resolved, "__valueOrigins", {
+                enumerable: false,
+                configurable: true,
+                value: origins,
+            });
+        }
     }
     return object(resolved);
 }
-function resolveCloudFormationValue(value, parameters, path, secretPaths) {
+function resolveCloudFormationValue(value, parameters, mappings, path, secretPaths, origins) {
     const ref = cloudFormationRefName(value);
     if (ref) {
         if (!parameters.defaults.has(ref))
@@ -1500,6 +1613,7 @@ function resolveCloudFormationValue(value, parameters, path, secretPaths) {
             typeof literal === "string" &&
             literal.trim() !== "")
             secretPaths.push(path);
+        origins.set(path.join("."), `parameter ${ref}`);
         return literal;
     }
     const subTemplate = cloudFormationSubTemplate(value);
@@ -1509,18 +1623,46 @@ function resolveCloudFormationValue(value, parameters, path, secretPaths) {
             return value;
         if (substituted.secret)
             secretPaths.push(path);
+        recordSingleOrigin(origins, path, substituted.names.map((name) => `parameter ${name}`));
         return substituted.text;
     }
+    const join = cloudFormationJoin(value);
+    if (join) {
+        const [separator, list] = join;
+        const resolvedSeparator = resolveCloudFormationValue(separator, parameters, mappings, [...path, 0], secretPaths, origins);
+        const separatorText = knownLiteral(resolvedSeparator);
+        if (separatorText === undefined)
+            return value;
+        const parts = [];
+        for (const [index, item] of list.entries()) {
+            const resolved = resolveCloudFormationValue(item, parameters, mappings, [...path, 1, index], secretPaths, origins);
+            const text = knownLiteral(resolved);
+            if (text === undefined)
+                return value;
+            parts.push(text);
+        }
+        return parts.join(separatorText);
+    }
+    const find = cloudFormationFindInMap(value);
+    if (find) {
+        const [mapName, topKey, secondKey] = find.map((key) => knownLiteral(key));
+        if (!mapName || !topKey || !secondKey)
+            return value;
+        const mapped = mappings.get(mapName)?.[topKey]?.[secondKey];
+        if (mapped === undefined)
+            return value;
+        return mapped;
+    }
     if (cloudFormationIntrinsic(value))
         return value;
     if (Array.isArray(value))
-        return value.map((item, index) => resolveCloudFormationValue(item, parameters, [...path, index], secretPaths));
+        return value.map((item, index) => resolveCloudFormationValue(item, parameters, mappings, [...path, index], secretPaths, origins));
     if (value && typeof value === "object") {
         const out = {};
         for (const [key, child] of Object.entries(value)) {
-            if (key === "__referencedSecrets")
+            if (key === "__referencedSecrets" || key === "__valueOrigins")
                 continue;
-            out[key] = resolveCloudFormationValue(child, parameters, [...path, key], secretPaths);
+            out[key] = resolveCloudFormationValue(child, parameters, mappings, [...path, key], secretPaths, origins);
         }
         return out;
     }
@@ -1558,6 +1700,86 @@ export function looksLikeServerless(content) {
         return false;
     return topLevelKey(content, "functions") || topLevelKey(content, "plugins");
 }
+function plainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function looksLikePackage(content) {
+    const trimmed = content.trim();
+    if (!trimmed.startsWith("{"))
+        return false;
+    let value;
+    try {
+        value = JSON.parse(trimmed);
+    }
+    catch {
+        return false;
+    }
+    const root = object(value);
+    if (typeof root.name !== "string" || root.name.trim() === "")
+        return false;
+    if ("resource" in root || "Resources" in root || typeof root.AWSTemplateFormatVersion === "string")
+        return false;
+    if (looksLikeIamPolicy(trimmed))
+        return false;
+    return (plainObject(root.dependencies) ||
+        plainObject(root.devDependencies) ||
+        plainObject(root.scripts));
+}
+function scriptPipesDownload(command) {
+    return /\b(?:curl|wget)\b[\s\S]*\|\s*(?:ba)?sh\b/.test(command);
+}
+function jsonKeyLine(content, key) {
+    const match = new RegExp(`"${escapeRegex(key)}"\\s*:`).exec(content);
+    if (!match)
+        return 1;
+    return content.slice(0, match.index).split("\n").length;
+}
+function parsePackage(content) {
+    if (!looksLikePackage(content))
+        throw new ScanInputError("A package.json requires a top-level name plus dependencies, devDependencies, or scripts.");
+    const root = object(JSON.parse(content));
+    const resources = [];
+    resources.push({
+        id: String(root.name),
+        type: "package:manifest",
+        value: { name: root.name },
+        locate: () => ({ line: jsonKeyLine(content, "name"), column: 1, path: "name" }),
+    });
+    const scripts = object(root.scripts);
+    for (const name of ["preinstall", "install", "postinstall"]) {
+        if (typeof scripts[name] !== "string")
+            continue;
+        resources.push({
+            id: `scripts.${name}`,
+            type: "package:script",
+            value: { name, command: scripts[name], pipes: scriptPipesDownload(scripts[name]) },
+            locate: () => ({
+                line: jsonKeyLine(content, name),
+                column: 1,
+                path: `scripts.${name}`,
+            }),
+        });
+    }
+    for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+        if (!plainObject(root[field]))
+            continue;
+        for (const [dep, range] of Object.entries(root[field])) {
+            if (range !== "*" && range !== "latest")
+                continue;
+            resources.push({
+                id: `${field}.${dep}`,
+                type: "package:dependency",
+                value: { field, name: dep, range },
+                locate: () => ({
+                    line: jsonKeyLine(content, dep),
+                    column: 1,
+                    path: `${field}.${dep}`,
+                }),
+            });
+        }
+    }
+    return { format: "package", resources, warnings: [] };
+}
 export function looksLikeIamPolicy(content) {
     const trimmed = content.trim();
     if (!trimmed.startsWith("{"))

package/dist/iac/rules.d.ts

@@ -9,7 +9,13 @@ type Rule = {
     remediation: string;
 };
 export declare const rules: Record<string, Rule>;
-export declare function resourceFindings(resources: Resource[], format: string): {
+export type TerraformLiterals = {
+    vars: Map<string, string | boolean | number>;
+    locals: Map<string, string | boolean | number>;
+    declaredSecrets: Set<string>;
+};
+export declare function terraformLiterals(resources: Resource[]): TerraformLiterals;
+export declare function resourceFindings(resources: Resource[], format: string, shared?: TerraformLiterals): {
     findings: Finding[];
     checked: Set<string>;
 };

package/dist/iac/rules.js

@@ -372,13 +372,31 @@ export const rules = {
         detail: "A Serverless Framework environment entry assigns a non-empty literal to a secret-like name.",
         remediation: "Reference the value with a Serverless variable such as ${env:TOKEN}. Do not commit a literal secret.",
     },
+    PKG001: {
+        category: "security",
+        severity: "high",
+        title: "Package script pipes a download to a shell",
+        detail: "A package install script downloads with curl or wget and pipes the result to a shell.",
+        remediation: "Run a reviewed local script instead of piping a remote download to a shell.",
+    },
+    PKG002: {
+        category: "security",
+        severity: "medium",
+        title: "Dependency range is floating",
+        detail: "A dependency range is * or latest.",
+        remediation: "Pin the dependency to a reviewed version.",
+    },
 };
-export function resourceFindings(resources, format) {
+export function terraformLiterals(resources) {
+    return collectSameFileLiterals(resources);
+}
+export function resourceFindings(resources, format, shared) {
     const findings = [];
     const checked = new Set();
-    const sameFile = collectSameFileLiterals(resources);
+    const sameFile = shared ?? collectSameFileLiterals(resources);
     const suppressedSecrets = new WeakMap();
     const moduleSecrets = new WeakMap();
+    const valueOrigins = new WeakMap();
     if (format === "terraform") {
         for (const resource of resources) {
             if (resource.type === "terraform:variable" ||
@@ -387,18 +405,22 @@ export function resourceFindings(resources, format) {
                 continue;
             const suppressed = new Set();
             const referenced = new Set();
-            resolveSameFileRefs(resource.value, sameFile, [], suppressed, referenced);
+            const origins = new Map();
+            resolveSameFileRefs(resource.value, sameFile, [], suppressed, referenced, origins);
             suppressedSecrets.set(resource, suppressed);
             moduleSecrets.set(resource, referenced);
+            valueOrigins.set(resource, origins);
         }
     }
     for (const resource of resources) {
+        const origins = valueOrigins.get(resource) ?? cloudFormationOrigins(resource);
         const check = (id, condition, path = []) => {
             checked.add(id);
             if (condition)
                 findings.push({
                     ruleId: id,
                     ...rules[id],
+                    detail: `${rules[id].detail}${originSentence(origins, path)}`,
                     resource: resource.id,
                     location: resource.locate(path),
                 });
@@ -438,6 +460,10 @@ export function resourceFindings(resources, format) {
             check("NET001", resource.value.openSourceIp === true, ["Condition"]);
             continue;
         }
+        if (format === "package") {
+            checkPackage(resource, check);
+            continue;
+        }
         if (resource.type === "terraform:local") {
             checkTerraformLiterals(resource.value, "local", check, []);
             continue;
@@ -592,6 +618,7 @@ function resolveInterpolationString(value, sameFile) {
     const trimmed = value.trim();
     if (!interpolationOnly.test(trimmed))
         return undefined;
+    const sources = [];
     let count = 0;
     let failed = false;
     const text = trimmed.replace(interpolationPiece, (_full, kind, name) => {
@@ -601,11 +628,12 @@ function resolveInterpolationString(value, sameFile) {
             failed = true;
             return "";
         }
+        sources.push(`${kind}.${name}`);
         return part;
     });
     if (failed || count < 2)
         return undefined;
-    return text;
+    return { text, sources };
 }
 function splitCallArguments(source) {
     const args = [];
@@ -668,14 +696,27 @@ function unquoteHcl(token) {
 }
 function resolveFormatArgument(token, sameFile) {
     const literal = unquoteHcl(token);
-    if (literal !== undefined)
-        return literal;
+    if (literal !== undefined) {
+        const ref = exactSameFileRef.exec(literal.trim());
+        if (!ref) {
+            if (literal.includes("${"))
+                return undefined;
+            return { text: literal };
+        }
+        const text = sameFileText(ref[1], ref[2], sameFile);
+        if (text === undefined)
+            return undefined;
+        return { text, source: `${ref[1]}.${ref[2]}` };
+    }
     if (/^-?\d+(?:\.\d+)?$/.test(token) || token === "true" || token === "false")
-        return token;
+        return { text: token };
     const ref = /^(var|local)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(token);
     if (!ref)
         return undefined;
-    return sameFileText(ref[1], ref[2], sameFile);
+    const text = sameFileText(ref[1], ref[2], sameFile);
+    if (text === undefined)
+        return undefined;
+    return { text, source: `${ref[1]}.${ref[2]}` };
 }
 function applyPercentS(format, args) {
     let index = 0;
@@ -707,13 +748,59 @@ function resolveFormatCall(value, sameFile) {
     if (!args || args.length === 0)
         return undefined;
     const resolved = [];
+    const sources = [];
     for (const arg of args) {
         const part = resolveFormatArgument(arg, sameFile);
         if (part === undefined)
             return undefined;
-        resolved.push(part);
+        resolved.push(part.text);
+        if (part.source)
+            sources.push(part.source);
     }
-    return applyPercentS(resolved[0], resolved.slice(1));
+    const text = applyPercentS(resolved[0], resolved.slice(1));
+    if (text === undefined)
+        return undefined;
+    return { text, sources };
+}
+function parseHclList(token) {
+    const trimmed = token.trim();
+    if (!trimmed.startsWith("[") || !trimmed.endsWith("]"))
+        return undefined;
+    return splitCallArguments(trimmed.slice(1, -1)) ?? [];
+}
+function resolveJoinCall(value, sameFile, depth = 0) {
+    if (depth > 8)
+        return undefined;
+    const wrapped = /^\$\{join\(([\s\S]*)\)\}$/.exec(value.trim());
+    const bare = /^join\(([\s\S]*)\)$/.exec(value.trim());
+    const source = wrapped?.[1] ?? bare?.[1];
+    if (source === undefined)
+        return undefined;
+    const args = splitCallArguments(source);
+    if (!args || args.length !== 2)
+        return undefined;
+    const separator = resolveJoinPiece(args[0], sameFile, depth);
+    const list = parseHclList(args[1]);
+    if (!separator || !list)
+        return undefined;
+    const parts = [];
+    const sources = [...separator.sources];
+    for (const element of list) {
+        const resolved = resolveJoinPiece(element, sameFile, depth);
+        if (!resolved)
+            return undefined;
+        parts.push(resolved.text);
+        sources.push(...resolved.sources);
+    }
+    return { text: parts.join(separator.text), sources };
+}
+function resolveJoinPiece(token, sameFile, depth) {
+    if (/^join\(/.test(token.trim()))
+        return resolveJoinCall(`\${${token.trim()}}`, sameFile, depth + 1);
+    const resolved = resolveFormatArgument(token, sameFile);
+    if (!resolved)
+        return undefined;
+    return { text: resolved.text, sources: resolved.source ? [resolved.source] : [] };
 }
 function noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets) {
     if (literal.trim() === "")
@@ -758,7 +845,12 @@ function collectSameFileLiterals(resources) {
     }
     return { vars, locals, declaredSecrets };
 }
-function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets) {
+function recordResolvedSources(origins, path, sources) {
+    const unique = [...new Set(sources)];
+    if (unique.length === 1)
+        origins.set(path.join("."), unique[0]);
+}
+function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets, origins) {
     if (typeof value === "string") {
         const match = exactSameFileRef.exec(value.trim());
         if (match) {
@@ -767,35 +859,67 @@ function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecret
                 return value;
             if (typeof literal === "string")
                 noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets);
+            origins.set(path.join("."), `${match[1]}.${match[2]}`);
             return literal;
         }
         const concatenated = resolveInterpolationString(value, sameFile);
         if (concatenated !== undefined) {
-            noteResolvedLiteral(concatenated, path, sameFile, suppressed, referencedSecrets);
-            return concatenated;
+            noteResolvedLiteral(concatenated.text, path, sameFile, suppressed, referencedSecrets);
+            recordResolvedSources(origins, path, concatenated.sources);
+            return concatenated.text;
         }
         const formatted = resolveFormatCall(value, sameFile);
         if (formatted !== undefined) {
-            noteResolvedLiteral(formatted, path, sameFile, suppressed, referencedSecrets);
-            return formatted;
+            noteResolvedLiteral(formatted.text, path, sameFile, suppressed, referencedSecrets);
+            recordResolvedSources(origins, path, formatted.sources);
+            return formatted.text;
+        }
+        const joined = resolveJoinCall(value, sameFile);
+        if (joined !== undefined) {
+            noteResolvedLiteral(joined.text, path, sameFile, suppressed, referencedSecrets);
+            recordResolvedSources(origins, path, joined.sources);
+            return joined.text;
         }
         return value;
     }
     if (Array.isArray(value)) {
         value.forEach((item, index) => {
-            value[index] = resolveSameFileRefs(item, sameFile, [...path, index], suppressed, referencedSecrets);
+            value[index] = resolveSameFileRefs(item, sameFile, [...path, index], suppressed, referencedSecrets, origins);
         });
         return value;
     }
     if (value && typeof value === "object") {
         for (const [key, child] of Object.entries(value)) {
-            if (key === "__referencedSecrets")
+            if (key === "__referencedSecrets" || key === "__valueOrigins")
                 continue;
-            value[key] = resolveSameFileRefs(child, sameFile, [...path, key], suppressed, referencedSecrets);
+            value[key] = resolveSameFileRefs(child, sameFile, [...path, key], suppressed, referencedSecrets, origins);
         }
     }
     return value;
 }
+function cloudFormationOrigins(resource) {
+    const stored = Object.getOwnPropertyDescriptor(resource.value, "__valueOrigins")?.value;
+    return stored instanceof Map ? stored : new Map();
+}
+function originSentence(origins, path) {
+    if (origins.size === 0)
+        return "";
+    const prefix = path.join(".");
+    const sources = new Set();
+    for (const [key, source] of origins) {
+        if (key === prefix || key.startsWith(`${prefix}.`))
+            sources.add(source);
+    }
+    if (sources.size !== 1)
+        return "";
+    return ` Value comes from ${[...sources][0]}.`;
+}
+function checkPackage(resource, check) {
+    if (resource.type === "package:script")
+        check("PKG001", resource.value.pipes === true, ["command"]);
+    else if (resource.type === "package:dependency")
+        check("PKG002", resource.value.range === "*" || resource.value.range === "latest", ["range"]);
+}
 function dedupeSecretFindings(findings) {
     const seen = new Set();
     return findings.filter((finding) => {

package/dist/iac/scan.d.ts

@@ -16,7 +16,7 @@ export declare function summarize(findings: Finding[]): {
 };
 export declare function filterFindings(findings: Finding[], options: ScanOptions): Finding[];
 export declare function scanIac(content: string, options?: ScanOptions): {
-    status: string;
+    status: "completed";
     engineVersion: string;
     format: IacFormat;
     focus: "security" | "reliability" | "cost" | "general";

package/dist/iac/scan.js

@@ -1,5 +1,5 @@
-import { parseIac } from "./parse.js";
-import { resourceFindings } from "./rules.js";
+import { parseIac, readCloudFormationTables, ScanInputError } from "./parse.js";
+import { resourceFindings, terraformLiterals } from "./rules.js";
 import { VERSION } from "../version.js";
 export const severityRank = {
     info: 0,
@@ -8,6 +8,7 @@ export const severityRank = {
     high: 3,
     critical: 4,
 };
+const markerLine = /^----- skaleagents-file: (.+) -----$/;
 export function summarize(findings) {
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
     for (const finding of findings)
@@ -24,29 +25,89 @@ export function filterFindings(findings, options) {
         (a.location?.line ?? 0) - (b.location?.line ?? 0) ||
         (a.ruleId ?? "").localeCompare(b.ruleId ?? ""));
 }
-export function scanIac(content, options = {}) {
-    const parsed = parseIac(content, options.format);
-    const result = resourceFindings(parsed.resources, parsed.format);
-    const findings = filterFindings(result.findings, options);
+function fileBasename(name) {
+    const trimmed = name.trim();
+    const base = trimmed.split(/[/\\]/).filter((part) => part.length > 0).pop() ?? "";
+    return base.trim();
+}
+function splitSubmittedFiles(content) {
+    const lines = content.split("\n");
+    const markers = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index].endsWith("\r") ? lines[index].slice(0, -1) : lines[index];
+        const match = markerLine.exec(line);
+        if (!match)
+            continue;
+        const name = fileBasename(match[1]);
+        if (!name || name.includes("----- skaleagents-file:"))
+            continue;
+        markers.push({ index, name });
+    }
+    if (markers.length === 0)
+        return undefined;
+    const parts = [];
+    const preamble = lines.slice(0, markers[0].index).join("\n");
+    if (preamble.trim())
+        parts.push({ name: "", text: preamble });
+    for (let index = 0; index < markers.length; index += 1) {
+        const start = markers[index].index + 1;
+        const end = index + 1 < markers.length ? markers[index + 1].index : lines.length;
+        parts.push({ name: markers[index].name, text: lines.slice(start, end).join("\n") });
+    }
+    return parts;
+}
+function labelResource(resource, fileName) {
+    if (!fileName)
+        return resource;
+    return {
+        id: `${fileName}:${resource.id}`,
+        type: resource.type,
+        value: resource.value,
+        locate: (path) => {
+            const location = resource.locate(path);
+            return { ...location, path: `${fileName}:${location.path}` };
+        },
+    };
+}
+function mergeTables(parts) {
+    const defaults = new Map();
+    const secretNames = new Set();
+    const mappings = new Map();
+    for (const part of parts) {
+        for (const [name, value] of part.defaults)
+            if (!defaults.has(name))
+                defaults.set(name, value);
+        for (const name of part.secretNames)
+            secretNames.add(name);
+        for (const [name, value] of part.mappings)
+            if (!mappings.has(name))
+                mappings.set(name, value);
+    }
+    return { defaults, secretNames, mappings };
+}
+const sharedResolutionLimit = "Files in one audit share variable defaults, locals, and parameter defaults. join, Fn::Join, Fn::FindInMap, format, and a simple Fn::Sub resolve when every piece is a known literal. Other functions and module sources do not. A finding names var, local, or parameter when the value came from one.";
+function presentScan(parsed, findings, checked, options) {
+    const visible = filterFindings(findings, options);
     const limit = options.maxFindings ?? 100;
+    const sharesResolution = parsed.format === "terraform" || parsed.format === "cloudformation";
     return {
         status: "completed",
         engineVersion: VERSION,
         format: parsed.format,
         focus: options.focus ?? "general",
-        summary: `Scanned ${parsed.resources.length} resources; ${findings.length} findings match the selected filters.`,
+        summary: `Scanned ${parsed.resources.length} resources; ${visible.length} findings match the selected filters.`,
         parsedResourceCount: parsed.resources.length,
         resources: parsed.resources.map((r) => ({
             id: r.id,
             type: r.type,
             location: r.locate(),
         })),
-        findings: findings.slice(0, limit),
-        totals: summarize(findings),
-        totalFindings: findings.length,
-        truncated: findings.length > limit,
-        rulesEvaluated: [...result.checked].sort(),
-        warnings: parsed.warnings,
+        findings: visible.slice(0, limit),
+        totals: summarize(visible),
+        totalFindings: visible.length,
+        truncated: visible.length > limit,
+        rulesEvaluated: [...checked].sort(),
+        warnings: [...new Set(parsed.warnings)],
         limitations: [
             "Static configuration review only. No cloud credentials, deployments, external modules, or runtime state are inspected.",
             "Resource-specific checks cover Kubernetes workloads, RBAC and Secrets, plus AWS networking, IAM, S3, RDS, EC2 and EBS. Other resources receive literal credential and URL checks only.",
@@ -55,11 +116,61 @@ export function scanIac(content, options = {}) {
                     "HCL locations point to resource declarations; property paths identify the affected setting.",
                 ]
                 : []),
-            ...(parsed.format === "terraform" || parsed.format === "cloudformation"
-                ? [
-                    "Same-file var, local, and CloudFormation parameter defaults are resolved. Functions, Fn::Sub, and module sources are not.",
-                ]
-                : []),
+            ...(sharesResolution ? [sharedResolutionLimit] : []),
         ],
     };
 }
+function scanDocument(content, options) {
+    const parsed = parseIac(content, options.format);
+    const result = resourceFindings(parsed.resources, parsed.format);
+    return presentScan(parsed, result.findings, result.checked, options);
+}
+function scanMarked(parts, options) {
+    const tables = mergeTables(parts.map((part) => readCloudFormationTables(part.text)));
+    const parsedParts = [];
+    let lastError;
+    for (const part of parts) {
+        if (!part.text.trim())
+            continue;
+        try {
+            parsedParts.push({ name: part.name, parsed: parseIac(part.text, "auto", tables) });
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    if (parsedParts.length === 0) {
+        if (lastError instanceof Error)
+            throw lastError;
+        throw new ScanInputError("Content must not be empty or whitespace.");
+    }
+    const literals = terraformLiterals(parsedParts.flatMap((part) => part.parsed.resources));
+    const resources = [];
+    const findings = [];
+    const checked = new Set();
+    const warnings = [];
+    const formats = new Set();
+    for (const part of parsedParts) {
+        const labeled = part.parsed.resources.map((resource) => labelResource(resource, part.name));
+        const result = resourceFindings(labeled, part.parsed.format, literals);
+        resources.push(...labeled);
+        findings.push(...result.findings);
+        for (const id of result.checked)
+            checked.add(id);
+        warnings.push(...part.parsed.warnings);
+        formats.add(part.parsed.format);
+    }
+    const format = formats.size === 1 ? [...formats][0] : parsedParts[0].parsed.format;
+    const presented = presentScan({ format, resources, warnings }, findings, checked, options);
+    if (formats.has("terraform") || formats.has("cloudformation")) {
+        if (!presented.limitations.includes(sharedResolutionLimit))
+            presented.limitations.push(sharedResolutionLimit);
+    }
+    return presented;
+}
+export function scanIac(content, options = {}) {
+    const parts = splitSubmittedFiles(content);
+    if (!parts)
+        return scanDocument(content, options);
+    return scanMarked(parts, options);
+}

package/dist/server.js

@@ -85,12 +85,13 @@ export function createServer(remote = false) {
                 "tfvars",
                 "serverless",
                 "iam",
+                "package",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, gitlab, azure-pipelines, cloudbuild, tfvars, serverless, iam, application, auto."),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, gitlab, azure-pipelines, cloudbuild, tfvars, serverless, iam, package, application, auto."),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -138,7 +139,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy. Helm templates, Ansible facts, Bicep modules, ARM expressions, pipelines, Serverless Framework config, and IAM policies are not executed. Conditions are not evaluated. Terraform module sources are not fetched. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, a standalone IAM policy, and package.json. Helm templates, Ansible facts, Bicep modules, ARM expressions, pipelines, Serverless Framework config, and IAM policies are not executed. Conditions are not evaluated. Terraform module sources are not fetched. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -146,7 +147,7 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy."),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, a standalone IAM policy, and package.json."),
                 format: z
                     .enum([
                     "terraform",
@@ -166,6 +167,7 @@ export function createServer(remote = false) {
                     "tfvars",
                     "serverless",
                     "iam",
+                    "package",
                     "auto",
                 ])
                     .default("auto"),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.15";
+export declare const VERSION = "0.6.16";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.15";
+export const VERSION = "0.6.16";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.15",
+  "version": "0.6.16",
   "private": false,
   "publishConfig": {
     "access": "public"