cleartoship 0.4.0

package/dist/utils/sql.js

@@ -0,0 +1,157 @@
+export function splitStatements(source) {
+    const out = [];
+    let buf = '';
+    let line = 1;
+    let startLine = 1;
+    let pendingStart = true;
+    let i = 0;
+    // Statements are separated by blank lines and comments, so the recorded line
+    // has to be the first line carrying an actual token.
+    const emit = (text) => {
+        if (pendingStart && text.trim()) {
+            startLine = line;
+            pendingStart = false;
+        }
+        buf += text;
+    };
+    const flush = () => {
+        if (buf.trim())
+            out.push({ text: buf.trim(), line: startLine });
+        buf = '';
+        pendingStart = true;
+    };
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        if (ch === '-' && next === '-') {
+            while (i < source.length && source[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            i += 2;
+            while (i < source.length && !(source[i] === '*' && source[i + 1] === '/')) {
+                if (source[i] === '\n')
+                    line++;
+                i++;
+            }
+            i += 2;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            const quote = ch;
+            emit(ch);
+            i++;
+            while (i < source.length) {
+                if (source[i] === '\n')
+                    line++;
+                if (source[i] === quote) {
+                    if (source[i + 1] === quote) {
+                        emit(quote + quote);
+                        i += 2;
+                        continue;
+                    }
+                    emit(quote);
+                    i++;
+                    break;
+                }
+                emit(source[i]);
+                i++;
+            }
+            continue;
+        }
+        if (ch === '$') {
+            const tag = /^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/.exec(source.slice(i));
+            if (tag) {
+                const marker = tag[0];
+                const end = source.indexOf(marker, i + marker.length);
+                const chunk = end === -1 ? source.slice(i) : source.slice(i, end + marker.length);
+                emit(chunk);
+                for (const c of chunk)
+                    if (c === '\n')
+                        line++;
+                i += chunk.length;
+                continue;
+            }
+        }
+        if (ch === ';') {
+            flush();
+            i++;
+            continue;
+        }
+        if (ch === '\n') {
+            emit(ch);
+            line++;
+            i++;
+            continue;
+        }
+        emit(ch);
+        i++;
+    }
+    flush();
+    return out;
+}
+/** Reads a parenthesised group starting at `open` (index of the `(`). */
+export function readBalanced(text, open) {
+    if (text[open] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (ch === inString) {
+                if (text[i + 1] === inString) {
+                    i++;
+                    continue;
+                }
+                inString = null;
+            }
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0)
+                return text.slice(open + 1, i);
+        }
+    }
+    return null;
+}
+/** Grabs the expression after a keyword such as USING or WITH CHECK. */
+export function clauseAfter(text, keyword) {
+    const m = keyword.exec(text);
+    if (!m)
+        return null;
+    let i = m.index + m[0].length;
+    while (i < text.length && /\s/.test(text[i]))
+        i++;
+    return readBalanced(text, i);
+}
+/** Normalises `"public"."posts"` / `public.posts` / `posts` to `public.posts`. */
+export function normaliseTable(raw) {
+    const parts = raw
+        .trim()
+        .split('.')
+        .map((p) => p.replace(/^"(.*)"$/, '$1').trim())
+        .filter(Boolean);
+    if (parts.length === 0)
+        return '';
+    if (parts.length === 1)
+        return `public.${parts[0]}`;
+    return `${parts[parts.length - 2]}.${parts[parts.length - 1]}`;
+}
+const IDENT = `(?:"[^"]+"|[A-Za-z_][A-Za-z0-9_$]*)`;
+export const QUALIFIED_NAME = `${IDENT}(?:\\s*\\.\\s*${IDENT})*`;
+/** True when a policy predicate lets everything through. */
+export function isAlwaysTrue(expr) {
+    if (expr === null)
+        return false;
+    const cleaned = expr.replace(/\s+/g, ' ').replace(/[()]/g, ' ').trim().toLowerCase();
+    return cleaned === 'true' || cleaned === '1' || cleaned === 'true::boolean';
+}

package/dist/utils/suppress.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Honours inline suppressions:
+ *   // cleartoship-ignore CTS001  (same line, or anywhere in the comment block
+ *                                 directly above)
+ *   // cts-ignore                 (suppresses every rule at that location)
+ *
+ * The directive is looked for on the finding's own line and then upward through
+ * the contiguous comment lines above it, so a directive can sit at the top of a
+ * multi-line explanation — which is where anyone writing a real justification
+ * naturally puts it.
+ */
+export declare class Suppressions {
+    private readonly lines;
+    /** How far above a finding a comment block may start. */
+    private static readonly MAX_LOOKBACK;
+    constructor(source: string);
+    suppressed(line: number, ruleId: string): boolean;
+    private check;
+}

package/dist/utils/suppress.js

@@ -0,0 +1,56 @@
+/**
+ * Honours inline suppressions:
+ *   // cleartoship-ignore CTS001  (same line, or anywhere in the comment block
+ *                                 directly above)
+ *   // cts-ignore                 (suppresses every rule at that location)
+ *
+ * The directive is looked for on the finding's own line and then upward through
+ * the contiguous comment lines above it, so a directive can sit at the top of a
+ * multi-line explanation — which is where anyone writing a real justification
+ * naturally puts it.
+ */
+export class Suppressions {
+    lines;
+    /** How far above a finding a comment block may start. */
+    static MAX_LOOKBACK = 6;
+    constructor(source) {
+        this.lines = source.split('\n');
+    }
+    suppressed(line, ruleId) {
+        if (this.check(line, ruleId))
+            return true;
+        for (let i = 1; i <= Suppressions.MAX_LOOKBACK; i++) {
+            const candidate = line - i;
+            if (candidate < 1)
+                break;
+            const text = this.lines[candidate - 1];
+            if (text === undefined)
+                break;
+            const trimmed = text.trim();
+            // Only walk upward through comments; any real code ends the block.
+            if (!/^(\/\/|\/\*|\*|#|--)/.test(trimmed) && trimmed !== '')
+                break;
+            if (this.check(candidate, ruleId))
+                return true;
+            if (trimmed === '')
+                break;
+        }
+        return false;
+    }
+    check(line, ruleId) {
+        const text = this.lines[line - 1];
+        if (!text)
+            return false;
+        const m = /(?:cleartoship|cts)-ignore(?:\s+([A-Z0-9,\s]+))?/i.exec(text);
+        if (!m)
+            return false;
+        const ids = m[1];
+        if (!ids || !ids.trim())
+            return true;
+        return ids
+            .split(/[,\s]+/)
+            .map((s) => s.trim().toUpperCase())
+            .filter(Boolean)
+            .includes(ruleId.toUpperCase());
+    }
+}

package/dist/utils/traverse.d.ts

@@ -0,0 +1,2 @@
+export type Visitor = Record<string, (path: any) => void>;
+export declare const traverse: (node: any, visitor: Visitor) => void;

package/dist/utils/traverse.js

@@ -0,0 +1,14 @@
+import * as babelTraverse from '@babel/traverse';
+// @babel/traverse ships CommonJS compiled with Babel's own esModule interop, so
+// under Node16 ESM resolution the callable can sit one or two `.default` hops
+// deep depending on how the CJS named exports were detected.
+const ns = babelTraverse;
+const resolved = typeof ns === 'function'
+    ? ns
+    : typeof ns.default === 'function'
+        ? ns.default
+        : ns.default?.default;
+if (typeof resolved !== 'function') {
+    throw new Error('could not resolve @babel/traverse to a callable');
+}
+export const traverse = resolved;

package/dist/vendor/gitleaks/rules.d.ts

@@ -0,0 +1,13 @@
+export interface GitleaksRule {
+    id: string;
+    description: string;
+    pattern: RegExp;
+    /** Minimum Shannon entropy of the captured secret, when upstream sets one. */
+    entropy: number | null;
+    /** Cheap substring prefilter: skip the regex unless one of these appears. */
+    keywords: string[];
+}
+export declare const GITLEAKS_ATTRIBUTION = "gitleaks (github.com/gitleaks/gitleaks), Copyright (c) 2019 Zachary Rice, MIT";
+/** Words that mark a match as a documentation placeholder rather than a secret. */
+export declare const GITLEAKS_STOPWORDS: string[];
+export declare const GITLEAKS_RULES: GitleaksRule[];