@snovon/solast 0.2.0

package/dist/semantic/types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * SemanticModel data types — shapes shared across `contracts.ts`,
+ * `imports.ts`, `inheritance.ts`, and `model.ts`.
+ *
+ * Conventions:
+ *   - `ContractId` is `<absolutePath>::<contractName>` so two contracts
+ *     of the same name in different files coexist without collision.
+ *     This format is internal; detectors should not parse it.
+ *   - All ASTs are the raw `@solidity-parser/parser` shape, untouched.
+ *     The model does not normalise nodes — it just builds an index over
+ *     them.
+ *   - Function and modifier infos carry the AST node so a detector that
+ *     does cross-file analysis can run its own predicates against the
+ *     same node shape it uses for in-file analysis.
+ */
+export type SourcePath = string;
+export type ContractId = string;
+export type SymbolName = string;
+export type ContractKind = 'contract' | 'library' | 'interface' | 'abstract';
+export interface ImportInfo {
+    /** Raw path as written in the `import` directive. */
+    rawPath: string;
+    /** Resolved absolute path; undefined when resolution failed. */
+    resolvedPath?: SourcePath;
+    /** Shape of the import. */
+    kind: 'glob' | 'namespace' | 'named';
+    /** Namespace alias for `import "x" as X;` form. */
+    namespace?: string;
+    /** Named imports for `import {A, B as C} from "x";` form. Local name in `local`, source-unit name in `imported`. */
+    named?: Array<{
+        imported: SymbolName;
+        local: SymbolName;
+    }>;
+}
+export interface FunctionInfo {
+    /** Stable id: `<contractId>::<functionName>`. */
+    id: string;
+    contractId: ContractId;
+    name: SymbolName;
+    visibility?: 'public' | 'external' | 'internal' | 'private' | 'default';
+    mutability?: 'view' | 'pure' | 'payable' | 'nonpayable' | 'constant';
+    isConstructor?: boolean;
+    isReceiveEther?: boolean;
+    isFallback?: boolean;
+    isVirtual?: boolean;
+    /** Names of base contracts this override refers to (from the `override(...)` annotation). */
+    overrideBases?: string[];
+    /** Names of modifiers applied to this function. */
+    modifiers: SymbolName[];
+    /** The AST node, untouched. */
+    node: any;
+}
+export interface ModifierInfo {
+    id: string;
+    contractId: ContractId;
+    name: SymbolName;
+    isVirtual?: boolean;
+    /** The AST node, untouched. */
+    node: any;
+}
+export interface StateVariableInfo {
+    contractId: ContractId;
+    name: SymbolName;
+    visibility?: 'public' | 'internal' | 'private' | 'default';
+    /** The AST node, untouched. */
+    node: any;
+}
+export interface BaseSpecifier {
+    /** Raw name as written: may be `Base`, `Lib.Base`, etc. */
+    name: string;
+    /** Resolved ContractId; undefined when the base couldn't be resolved (cross-file alias or unknown contract). */
+    resolved?: ContractId;
+}
+export interface ContractInfo {
+    id: ContractId;
+    name: SymbolName;
+    sourcePath: SourcePath;
+    kind: ContractKind;
+    /**
+     * Base contracts in **source order** — i.e., the order written in
+     * `contract D is X, Y, Z`. Per the Solidity docs, the leftmost
+     * (`X`) is the most-base-like and the rightmost (`Z`) is the
+     * most-derived. The `linearize()` algorithm in `inheritance.ts`
+     * REVERSES this list before feeding it to standard C3 so the
+     * resulting MRO has rightmost-first precedence (matching Solidity's
+     * dispatch order).
+     */
+    bases: BaseSpecifier[];
+    functions: FunctionInfo[];
+    modifiers: ModifierInfo[];
+    stateVariables: StateVariableInfo[];
+    /** The full `ContractDefinition` AST node, untouched. */
+    node: any;
+}
+export interface ExportedSymbol {
+    /** ContractId for contracts/libraries/interfaces. */
+    contractId: ContractId;
+    name: SymbolName;
+}
+export interface SourceUnitInfo {
+    path: SourcePath;
+    ast: any;
+    imports: ImportInfo[];
+    /** Map of locally-visible symbol name → exported contract reference. */
+    visibleSymbols: Map<SymbolName, ExportedSymbol>;
+    /** Contracts declared in this source unit (not the ones imported). */
+    declaredContracts: ContractId[];
+}
+export interface LinearizedContract {
+    contractId: ContractId;
+    /**
+     * Most-derived first, matching Solidity's function-lookup order. For
+     * `contract D is B, C` (where C is rightmost = most-derived in
+     * Solidity), the MRO begins with `D, C, B, ...`, so a detector that
+     * walks the MRO looking for a function `f` checks `D.f` first, then
+     * `C.f`, then `B.f` — matching `super.f()` resolution.
+     */
+    mro: ContractId[];
+}

package/dist/semantic/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * SemanticModel data types — shapes shared across `contracts.ts`,
+ * `imports.ts`, `inheritance.ts`, and `model.ts`.
+ *
+ * Conventions:
+ *   - `ContractId` is `<absolutePath>::<contractName>` so two contracts
+ *     of the same name in different files coexist without collision.
+ *     This format is internal; detectors should not parse it.
+ *   - All ASTs are the raw `@solidity-parser/parser` shape, untouched.
+ *     The model does not normalise nodes — it just builds an index over
+ *     them.
+ *   - Function and modifier infos carry the AST node so a detector that
+ *     does cross-file analysis can run its own predicates against the
+ *     same node shape it uses for in-file analysis.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/severity.d.ts

@@ -0,0 +1,10 @@
+export declare const CANONICAL_SEVERITIES: readonly ["critical", "high", "medium", "low", "informational"];
+export type SeverityLabel = typeof CANONICAL_SEVERITIES[number];
+export type ColorChoice = 'auto' | 'always' | 'never';
+export declare const SEVERITY_RANK: Record<string, number>;
+export declare function atOrAboveThreshold(severity: string, threshold: SeverityLabel): boolean;
+export declare function normalizeSeverity(severity: string): SeverityLabel;
+export declare function toSarifLevel(severity: string): 'error' | 'warning' | 'note' | 'none';
+export declare function severityColor(severity: string): string;
+export declare function shouldUseColor(choice?: ColorChoice, stdoutIsTTY?: boolean, env?: Record<string, string | undefined>): boolean;
+export declare function formatSeverity(severity: string, useColor: boolean): string;

package/dist/severity.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEVERITY_RANK = exports.CANONICAL_SEVERITIES = void 0;
+exports.atOrAboveThreshold = atOrAboveThreshold;
+exports.normalizeSeverity = normalizeSeverity;
+exports.toSarifLevel = toSarifLevel;
+exports.severityColor = severityColor;
+exports.shouldUseColor = shouldUseColor;
+exports.formatSeverity = formatSeverity;
+exports.CANONICAL_SEVERITIES = ['critical', 'high', 'medium', 'low', 'informational'];
+const RESET = '\x1b[0m';
+const RED = '\x1b[31m';
+const YELLOW = '\x1b[33m';
+const BLUE = '\x1b[34m';
+exports.SEVERITY_RANK = {
+    critical: 5,
+    high: 4,
+    medium: 3,
+    low: 2,
+    informational: 1,
+    error: 4,
+    warning: 3,
+    info: 2,
+};
+function atOrAboveThreshold(severity, threshold) {
+    const sevRank = exports.SEVERITY_RANK[severity] ?? 0;
+    const threshRank = exports.SEVERITY_RANK[threshold] ?? 0;
+    return sevRank >= threshRank;
+}
+function normalizeSeverity(severity) {
+    switch (severity) {
+        case 'critical':
+        case 'high':
+        case 'medium':
+        case 'low':
+        case 'informational':
+            return severity;
+        case 'warning':
+            return 'medium';
+        case 'info':
+            return 'informational';
+        case 'error':
+        default:
+            return 'high';
+    }
+}
+function toSarifLevel(severity) {
+    const normalized = normalizeSeverity(severity);
+    if (normalized === 'critical' || normalized === 'high')
+        return 'error';
+    if (normalized === 'medium')
+        return 'warning';
+    if (normalized === 'low' || normalized === 'informational')
+        return 'note';
+    return 'none';
+}
+function severityColor(severity) {
+    const normalized = normalizeSeverity(severity);
+    if (normalized === 'critical' || normalized === 'high')
+        return RED;
+    if (normalized === 'medium')
+        return YELLOW;
+    return BLUE;
+}
+function shouldUseColor(choice = 'auto', stdoutIsTTY = Boolean(process.stdout.isTTY), env = process.env) {
+    if (choice === 'never')
+        return false;
+    if (choice === 'always')
+        return true;
+    if (env.NO_COLOR !== undefined)
+        return false;
+    return stdoutIsTTY;
+}
+function formatSeverity(severity, useColor) {
+    const label = normalizeSeverity(severity);
+    return useColor ? `${severityColor(label)}${label}${RESET}` : label;
+}
+//# sourceMappingURL=severity.js.map

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@snovon/solast",
+  "version": "0.2.0",
+  "description": "A static-analysis CLI for Solidity smart contracts.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "solast": "dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc && node -e \"require('fs').copyFileSync('src/fp-rates.json','dist/fp-rates.json')\"",
+    "lint": "tsc --noEmit",
+    "start": "node dist/cli.js",
+    "pretest": "npm run build",
+    "test": "node --test test/*.test.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "solidity",
+    "static-analysis",
+    "security",
+    "reentrancy",
+    "smart-contracts"
+  ],
+  "author": "Snovon",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Snovon/SolAST.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Snovon/SolAST/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@solidity-parser/parser": "^0.20.2",
+    "commander": "^12.0.0",
+    "js-sha3": "^0.9.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.39",
+    "typescript": "^5.4.0"
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/fp-rates.json"
+  ],
+  "homepage": "https://snovon.com/"
+}