@vibgrate/cli 2026.814.2 → 2026.817.1

package/dist/{chunk-N6ZMZ5AI.js → chunk-ANYL7SUI.js}

@@ -5447,59 +5447,362 @@ async function fetchTerraformVersionsBulk(items, manifest, offline = false) {
   await Promise.all(promises);
   return results;
 }
+
+// src/core-open/scanners/hcl-blocks.ts
+function parseHclBlocks(source) {
+  const blocks = [];
+  let i = 0;
+  const n = source.length;
+  while (i < n) {
+    const headerStart = skipTrivia(source, i);
+    if (headerStart >= n) break;
+    const header = readBlockHeader(source, headerStart);
+    if (!header) {
+      const nextLine = source.indexOf("\n", headerStart);
+      if (nextLine === -1) break;
+      i = nextLine + 1;
+      continue;
+    }
+    const bodyEnd = matchBrace(source, header.braceIndex);
+    if (bodyEnd === -1) break;
+    blocks.push({
+      type: header.type,
+      labels: header.labels,
+      body: source.slice(header.braceIndex + 1, bodyEnd),
+      start: headerStart,
+      end: bodyEnd + 1
+    });
+    i = bodyEnd + 1;
+  }
+  return blocks;
+}
+function parseHclAttributes(body) {
+  const out = [];
+  let i = 0;
+  const n = body.length;
+  while (i < n) {
+    i = skipTrivia(body, i);
+    if (i >= n) break;
+    const nameMatch = /^([A-Za-z_][A-Za-z0-9_-]*)\s*=(?!=)/.exec(body.slice(i));
+    if (!nameMatch) {
+      const header = readBlockHeader(body, i);
+      if (header) {
+        const end = matchBrace(body, header.braceIndex);
+        if (end === -1) break;
+        i = end + 1;
+        continue;
+      }
+      const nextLine = body.indexOf("\n", i);
+      if (nextLine === -1) break;
+      i = nextLine + 1;
+      continue;
+    }
+    const valueStart = i + nameMatch[0].length;
+    const valueEnd = readValueEnd(body, valueStart);
+    out.push({
+      name: nameMatch[1],
+      value: body.slice(valueStart, valueEnd).trim()
+    });
+    i = valueEnd;
+    const afterValue = skipInlineTrivia(body, i);
+    i = body[afterValue] === "," ? afterValue + 1 : i;
+  }
+  return out;
+}
+function hclStringAttribute(body, name) {
+  for (const attribute of parseHclAttributes(body)) {
+    if (attribute.name !== name) continue;
+    const quoted = /^"((?:[^"\\]|\\.)*)"$/.exec(attribute.value);
+    if (quoted) return quoted[1];
+  }
+  return void 0;
+}
+function readBlockHeader(source, i) {
+  const typeMatch = /^([A-Za-z_][A-Za-z0-9_-]*)/.exec(source.slice(i));
+  if (!typeMatch) return null;
+  let cursor = i + typeMatch[0].length;
+  const labels = [];
+  for (; ; ) {
+    cursor = skipInlineTrivia(source, cursor);
+    if (cursor >= source.length) return null;
+    const ch = source[cursor];
+    if (ch === "{") return { type: typeMatch[1], labels, braceIndex: cursor };
+    if (ch === '"') {
+      const end = readStringEnd(source, cursor);
+      if (end === -1) return null;
+      labels.push(source.slice(cursor + 1, end));
+      cursor = end + 1;
+      continue;
+    }
+    const identifier = /^([A-Za-z_][A-Za-z0-9_-]*)/.exec(source.slice(cursor));
+    if (identifier) {
+      labels.push(identifier[1]);
+      cursor += identifier[0].length;
+      continue;
+    }
+    return null;
+  }
+}
+function matchBrace(source, open) {
+  let depth = 0;
+  let i = open;
+  let mode = "code";
+  let heredocTag = "";
+  while (i < source.length) {
+    const ch = source[i];
+    if (mode === "string") {
+      if (ch === "\\") i += 2;
+      else if (ch === '"') {
+        mode = "code";
+        i++;
+      } else i++;
+      continue;
+    }
+    if (mode === "line-comment") {
+      if (ch === "\n") mode = "code";
+      i++;
+      continue;
+    }
+    if (mode === "block-comment") {
+      if (ch === "*" && source[i + 1] === "/") {
+        mode = "code";
+        i += 2;
+      } else i++;
+      continue;
+    }
+    if (mode === "heredoc") {
+      if (ch === "\n") {
+        const lineEnd = source.indexOf("\n", i + 1);
+        const line = source.slice(i + 1, lineEnd === -1 ? source.length : lineEnd);
+        if (line.trim() === heredocTag) {
+          mode = "code";
+          heredocTag = "";
+          i = lineEnd === -1 ? source.length : lineEnd;
+          continue;
+        }
+      }
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      mode = "string";
+      i++;
+      continue;
+    }
+    if (ch === "#") {
+      mode = "line-comment";
+      i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "/") {
+      mode = "line-comment";
+      i += 2;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      mode = "block-comment";
+      i += 2;
+      continue;
+    }
+    if (ch === "<" && source[i + 1] === "<") {
+      const heredoc = /^<<[-~]?([A-Za-z_][A-Za-z0-9_]*)/.exec(source.slice(i));
+      if (heredoc) {
+        mode = "heredoc";
+        heredocTag = heredoc[1];
+        i += heredoc[0].length;
+        continue;
+      }
+    }
+    if (ch === "{") {
+      depth++;
+      i++;
+      continue;
+    }
+    if (ch === "}") {
+      depth--;
+      if (depth === 0) return i;
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return -1;
+}
+function readStringEnd(source, open) {
+  let i = open + 1;
+  while (i < source.length) {
+    if (source[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (source[i] === '"') return i;
+    i++;
+  }
+  return -1;
+}
+function readValueEnd(source, start) {
+  const i = skipInlineTrivia(source, start);
+  if (source[i] === "{") {
+    const close = matchBrace(source, i);
+    if (close !== -1) return close + 1;
+  }
+  if (source[i] === "[") {
+    const close = matchBracket(source, i);
+    if (close !== -1) return close + 1;
+  }
+  const heredoc = /^<<[-~]?([A-Za-z_][A-Za-z0-9_]*)/.exec(source.slice(i));
+  if (heredoc) {
+    const tag = heredoc[1];
+    let cursor2 = i;
+    while (cursor2 < source.length) {
+      const lineEnd = source.indexOf("\n", cursor2 + 1);
+      const line = source.slice(cursor2 + 1, lineEnd === -1 ? source.length : lineEnd);
+      if (line.trim() === tag) return lineEnd === -1 ? source.length : lineEnd;
+      if (lineEnd === -1) break;
+      cursor2 = lineEnd;
+    }
+    return source.length;
+  }
+  let cursor = i;
+  let depth = 0;
+  let inString = false;
+  while (cursor < source.length) {
+    const ch = source[cursor];
+    if (inString) {
+      if (ch === "\\") cursor += 2;
+      else {
+        if (ch === '"') inString = false;
+        cursor++;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      cursor++;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") {
+      depth++;
+      cursor++;
+      continue;
+    }
+    if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) return cursor;
+      depth--;
+      cursor++;
+      continue;
+    }
+    if (depth === 0) {
+      if (ch === "\n" || ch === ",") return cursor;
+      if (ch === " " || ch === "	") {
+        if (/^\s+[A-Za-z_][A-Za-z0-9_-]*\s*=(?!=)/.test(source.slice(cursor))) return cursor;
+      }
+      if (ch === "#") return cursor;
+      if (ch === "/" && (source[cursor + 1] === "/" || source[cursor + 1] === "*")) return cursor;
+    }
+    cursor++;
+  }
+  return source.length;
+}
+function matchBracket(source, open) {
+  let depth = 0;
+  let i = open;
+  let inString = false;
+  while (i < source.length) {
+    const ch = source[i];
+    if (inString) {
+      if (ch === "\\") i += 2;
+      else {
+        if (ch === '"') inString = false;
+        i++;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      i++;
+      continue;
+    }
+    if (ch === "[") depth++;
+    else if (ch === "]") {
+      depth--;
+      if (depth === 0) return i;
+    }
+    i++;
+  }
+  return -1;
+}
+function skipTrivia(source, i) {
+  for (; ; ) {
+    while (i < source.length && /\s/.test(source[i])) i++;
+    if (source[i] === "#" || source[i] === "/" && source[i + 1] === "/") {
+      const nextLine = source.indexOf("\n", i);
+      if (nextLine === -1) return source.length;
+      i = nextLine + 1;
+      continue;
+    }
+    if (source[i] === "/" && source[i + 1] === "*") {
+      const close = source.indexOf("*/", i + 2);
+      if (close === -1) return source.length;
+      i = close + 2;
+      continue;
+    }
+    return i;
+  }
+}
+function skipInlineTrivia(source, i) {
+  while (i < source.length && (source[i] === " " || source[i] === "	")) i++;
+  return i;
+}
+
+// src/core-open/scanners/terraform-scanner.ts
 async function parseTerraformFile(filePath, cache) {
   const content = cache ? await cache.readTextFile(filePath) : await readTextFile(filePath);
+  return extractTerraformRequirements(content);
+}
+function extractTerraformRequirements(content) {
   const providers = [];
   const modules = [];
   let terraformVersion;
-  const tfVersionMatch = content.match(/terraform\s*\{[^}]*required_version\s*=\s*"([^"]+)"/s);
-  if (tfVersionMatch) {
-    terraformVersion = tfVersionMatch[1];
-  }
-  const requiredProvidersMatch = content.match(/required_providers\s*\{([^}]+)\}/s);
-  if (requiredProvidersMatch) {
-    const providersBlock = requiredProvidersMatch[1];
-    const providerRegex = /(\w+)\s*=\s*\{([^}]+)\}/g;
-    let match;
-    while ((match = providerRegex.exec(providersBlock)) !== null) {
-      const providerBlock = match[2];
-      const sourceMatch = providerBlock.match(/source\s*=\s*"([^"]+)"/);
-      if (!sourceMatch) continue;
-      const source = sourceMatch[1];
-      const versionMatch = providerBlock.match(/version\s*=\s*"([^"]+)"/);
-      const version = versionMatch ? versionMatch[1] : void 0;
-      providers.push({ source, version });
-    }
-  }
-  const providerBlockRegex = /provider\s+"(\w+)"\s*\{([^}]+)\}/g;
-  let providerMatch;
-  while ((providerMatch = providerBlockRegex.exec(content)) !== null) {
-    const providerName = providerMatch[1];
-    const block = providerMatch[2];
-    const versionMatch = block.match(/version\s*=\s*"([^"]+)"/);
-    if (versionMatch) {
-      const existingProvider = providers.find((p) => p.source.endsWith(`/${providerName}`));
-      if (!existingProvider) {
-        providers.push({
-          source: `hashicorp/${providerName}`,
-          version: versionMatch[1]
-        });
+  for (const block of parseHclBlocks(content)) {
+    if (block.type === "terraform") {
+      terraformVersion ??= hclStringAttribute(block.body, "required_version");
+      for (const inner of parseHclBlocks(block.body)) {
+        if (inner.type !== "required_providers") continue;
+        for (const entry of parseHclAttributes(inner.body)) {
+          const objectBody = /^\{([\s\S]*)\}$/.exec(entry.value);
+          if (objectBody) {
+            const source2 = hclStringAttribute(objectBody[1], "source");
+            if (!source2) continue;
+            providers.push({ source: source2, version: hclStringAttribute(objectBody[1], "version") });
+            continue;
+          }
+          const version = /^"((?:[^"\\]|\\.)*)"$/.exec(entry.value)?.[1];
+          if (!version) continue;
+          const source = `hashicorp/${entry.name}`;
+          if (providers.some((p) => p.source === source)) continue;
+          providers.push({ source, version });
+        }
       }
+      continue;
     }
-  }
-  const moduleRegex = /module\s+"[^"]+"\s*\{([^}]+)\}/g;
-  let moduleMatch;
-  while ((moduleMatch = moduleRegex.exec(content)) !== null) {
-    const block = moduleMatch[1];
-    const sourceMatch = block.match(/source\s*=\s*"([^"]+)"/);
-    if (!sourceMatch) continue;
-    const source = sourceMatch[1];
-    if (source.startsWith("./") || source.startsWith("../") || source.startsWith("git::")) {
+    if (block.type === "provider") {
+      const name = block.labels[0];
+      if (!name) continue;
+      const version = hclStringAttribute(block.body, "version");
+      if (!version) continue;
+      if (providers.some((p) => p.source.endsWith(`/${name}`))) continue;
+      providers.push({ source: `hashicorp/${name}`, version });
       continue;
     }
-    const versionMatch = block.match(/version\s*=\s*"([^"]+)"/);
-    const version = versionMatch ? versionMatch[1] : void 0;
-    modules.push({ source, version });
+    if (block.type === "module") {
+      const source = hclStringAttribute(block.body, "source");
+      if (!source) continue;
+      if (source.startsWith("./") || source.startsWith("../") || source.startsWith("git::")) {
+        continue;
+      }
+      modules.push({ source, version: hclStringAttribute(block.body, "version") });
+    }
   }
   return { terraformVersion, providers, modules };
 }
@@ -11697,5 +12000,5 @@ async function computeTreeMetadataHash(rootDir, options) {
 }
 
 export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, perDependencyDrift, prepareCompressedUpload, projectTypeToVulnEcosystem, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig };
-//# sourceMappingURL=chunk-N6ZMZ5AI.js.map
-//# sourceMappingURL=chunk-N6ZMZ5AI.js.map
+//# sourceMappingURL=chunk-ANYL7SUI.js.map
+//# sourceMappingURL=chunk-ANYL7SUI.js.map