codesentry 0.1.2

package/dist/index.js

@@ -0,0 +1,2502 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+import figlet from "figlet";
+import gradient from "gradient-string";
+
+// src/parser/source-file.ts
+import { parse } from "@babel/parser";
+var isJsxFile = (filePath) => /\.(tsx|jsx)$/.test(filePath);
+var parseSourceFile = (filePath, content) => {
+  return parse(content, {
+    sourceFilename: filePath,
+    sourceType: "unambiguous",
+    plugins: isJsxFile(filePath) ? ["jsx", "typescript", "decorators-legacy"] : ["typescript", "decorators-legacy"],
+    errorRecovery: true
+  });
+};
+var isSourceNode = (value) => {
+  return typeof value === "object" && value !== null && "type" in value;
+};
+var visitSourceNodes = (node, visitor, parent) => {
+  visitor(node, parent);
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      value.filter(isSourceNode).forEach((child) => visitSourceNodes(child, visitor, node));
+    } else if (isSourceNode(value)) {
+      visitSourceNodes(value, visitor, node);
+    }
+  }
+};
+
+// src/rules/command-injection.rule.ts
+var EXEC_METHOD_NAMES = /* @__PURE__ */ new Set(["exec", "execSync"]);
+var CHILD_PROCESS_MODULE_NAMES = /* @__PURE__ */ new Set(["child_process", "node:child_process"]);
+var isChildProcessModuleSpecifier = (node) => node?.type === "StringLiteral" && CHILD_PROCESS_MODULE_NAMES.has(node.value);
+var collectFromImportDeclaration = (node, bindings) => {
+  if (!isChildProcessModuleSpecifier(node.source)) {
+    return;
+  }
+  for (const specifier of node.specifiers ?? []) {
+    const local = specifier.local;
+    if (local?.type !== "Identifier") {
+      continue;
+    }
+    if (specifier.type === "ImportSpecifier") {
+      const imported = specifier.imported;
+      if (imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name)) {
+        bindings.directCalls.add(local.name);
+      }
+    } else if (specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier") {
+      bindings.namespaces.add(local.name);
+    }
+  }
+};
+var isRequireCall = (node) => node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require" && isChildProcessModuleSpecifier(node.arguments?.[0]);
+var collectFromVariableDeclarator = (node, bindings) => {
+  if (!isRequireCall(node.init)) {
+    return;
+  }
+  const id = node.id;
+  if (id?.type === "Identifier") {
+    bindings.namespaces.add(id.name);
+    return;
+  }
+  if (id?.type !== "ObjectPattern") {
+    return;
+  }
+  for (const property of id.properties ?? []) {
+    const key = property.key;
+    const value = property.value;
+    if (key?.type === "Identifier" && EXEC_METHOD_NAMES.has(key.name) && value?.type === "Identifier") {
+      bindings.directCalls.add(value.name);
+    }
+  }
+};
+var collectChildProcessBindings = (sourceFile) => {
+  const bindings = { directCalls: /* @__PURE__ */ new Set(), namespaces: /* @__PURE__ */ new Set() };
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type === "ImportDeclaration") {
+      collectFromImportDeclaration(node, bindings);
+    } else if (node.type === "VariableDeclarator") {
+      collectFromVariableDeclarator(node, bindings);
+    }
+  });
+  return bindings;
+};
+var isKnownChildProcessCallee = (callee, bindings) => {
+  if (callee?.type === "Identifier") {
+    return bindings.directCalls.has(callee.name);
+  }
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const object = callee.object;
+  const property = callee.property;
+  const methodName = property?.type === "Identifier" ? property.name : void 0;
+  return !!methodName && EXEC_METHOD_NAMES.has(methodName) && object?.type === "Identifier" && bindings.namespaces.has(object.name);
+};
+var isDynamicCommandArgument = (argument) => argument?.type === "StringLiteral" ? false : argument?.type === "TemplateLiteral" ? (argument.expressions?.length ?? 0) > 0 : argument !== void 0;
+var isCommandInjectionCall = (node, bindings) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (!isKnownChildProcessCallee(callee, bindings)) {
+    return false;
+  }
+  const args = node.arguments;
+  return isDynamicCommandArgument(args?.[0]);
+};
+var findCommandInjectionLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  const bindings = collectChildProcessBindings(sourceFile);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isCommandInjectionCall(node, bindings) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var commandInjectionRule = {
+  id: "command-injection",
+  description: "Detecta child_process.exec()/execSync() (confirmado via import/require do m\xF3dulo) recebendo um comando constru\xEDdo dinamicamente",
+  check(filePath, content) {
+    return findCommandInjectionLines(filePath, content).map((line) => ({
+      ruleId: "command-injection",
+      message: "Comando de shell constru\xEDdo dinamicamente \u2014 risco de command injection",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/scan/scan-runner.ts
+import { writeFile } from "fs/promises";
+import { join as join2 } from "path";
+import chalk2 from "chalk";
+import { Listr } from "listr2";
+
+// src/reporters/console.reporter.ts
+import chalk from "chalk";
+import Table from "cli-table3";
+var SEVERITY_COLOR = {
+  low: (text2) => chalk.gray(text2),
+  medium: (text2) => chalk.yellow(text2),
+  high: (text2) => chalk.red(text2),
+  critical: (text2) => chalk.bgRed.white(text2)
+};
+var printConsoleReport = (result) => {
+  const coverage = result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+  if (result.findings.length === 0) {
+    console.log(
+      chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`)
+    );
+    return;
+  }
+  const table = new Table({
+    head: ["Severity", "Rule", "File", "Line", "Message"]
+  });
+  for (const finding of result.findings) {
+    const colorize = SEVERITY_COLOR[finding.severity];
+    table.push([
+      colorize(finding.severity),
+      finding.ruleId,
+      finding.file,
+      String(finding.line),
+      finding.message
+    ]);
+  }
+  console.log(table.toString());
+  console.log(
+    chalk.bold(
+      `
+${result.findings.length} problema(s) encontrado(s) em ${result.scannedFiles} arquivo(s) (${result.durationMs}ms).${coverage}`
+    )
+  );
+};
+
+// src/reporters/json.reporter.ts
+var toJsonReport = (result) => {
+  return JSON.stringify(result, null, 2);
+};
+
+// src/reporters/markdown.reporter.ts
+var SEVERITY_ORDER = ["critical", "high", "medium", "low"];
+var SEVERITY_LABEL = {
+  critical: "Critical",
+  high: "High",
+  medium: "Medium",
+  low: "Low"
+};
+var escapeCell = (text2) => text2.replaceAll("|", "\\|");
+var groupBy = (items, keyOf) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = keyOf(item);
+    map.set(key, [...map.get(key) ?? [], item]);
+  }
+  return map;
+};
+var findingsTable = (findings) => {
+  const sorted = [...findings].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+  const lines = ["| Arquivo | Linha | Mensagem |", "| --- | --- | --- |"];
+  for (const f of sorted) {
+    lines.push(`| ${escapeCell(f.file)} | ${f.line} | ${escapeCell(f.message)} |`);
+  }
+  return lines;
+};
+var severitySection = (severity, findings) => {
+  const lines = [`## ${SEVERITY_LABEL[severity]} (${findings.length})`, ""];
+  const byRule = groupBy(findings, (f) => f.ruleId);
+  for (const ruleId of [...byRule.keys()].sort()) {
+    const ruleFindings = byRule.get(ruleId) ?? [];
+    lines.push(`### ${ruleId} (${ruleFindings.length})`, "", ...findingsTable(ruleFindings), "");
+  }
+  return lines;
+};
+var reportHeader = (result, generatedAt) => [
+  "# Relat\xF3rio CodeSentry",
+  "",
+  `- **Gerado em:** ${generatedAt.toISOString()}`,
+  `- **Arquivos analisados:** ${result.scannedFiles}`,
+  ...result.engines?.semgrep === void 0 ? [] : [
+    `- **Cobertura por motor:** CodeSentry ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep ${result.engines.semgrep} arquivos`
+  ],
+  `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
+  `- **Total de problemas:** ${result.findings.length}`,
+  ""
+];
+var summaryTable = (bySeverity) => {
+  const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
+  for (const severity of SEVERITY_ORDER) {
+    lines.push(`| ${SEVERITY_LABEL[severity]} | ${(bySeverity.get(severity) ?? []).length} |`);
+  }
+  lines.push("");
+  return lines;
+};
+var severitySections = (bySeverity) => {
+  const lines = [];
+  for (const severity of SEVERITY_ORDER) {
+    const findings = bySeverity.get(severity) ?? [];
+    if (findings.length > 0) {
+      lines.push(...severitySection(severity, findings));
+    }
+  }
+  return lines;
+};
+var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
+  const bySeverity = groupBy(result.findings, (f) => f.severity);
+  return [...reportHeader(result, generatedAt), ...summaryTable(bySeverity), ...severitySections(bySeverity)].join(
+    "\n"
+  );
+};
+
+// src/scanner/scan-result.ts
+var mergeScanResults = (nativeResult, semgrepResult) => ({
+  scannedFiles: nativeResult.scannedFiles,
+  findings: [...nativeResult.findings, ...semgrepResult.findings],
+  durationMs: nativeResult.durationMs + semgrepResult.durationMs,
+  engines: {
+    codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
+    semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
+  }
+});
+
+// src/scanner/scanner.ts
+import { readFile } from "fs/promises";
+import { availableParallelism } from "os";
+
+// src/scanner/file-finder.ts
+import { readdir } from "fs/promises";
+import { join, sep } from "path";
+var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
+var IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next"]);
+var isInsideIgnoredDir = (relativePath) => {
+  return relativePath.split(sep).some((segment) => IGNORED_DIRS.has(segment));
+};
+var findFiles = async (targetDir) => {
+  try {
+    const entries = await readdir(targetDir, { recursive: true, withFileTypes: true });
+    return entries.filter((entry) => entry.isFile()).map((entry) => join(entry.parentPath, entry.name)).filter((filePath) => !isInsideIgnoredDir(filePath)).filter((filePath) => SCANNABLE_EXTENSIONS.some((ext) => filePath.endsWith(ext)));
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel listar os arquivos em "${targetDir}".`, { cause: error });
+  }
+};
+
+// src/scanner/run-with-concurrency-limit.ts
+import pLimit from "p-limit";
+var runWithConcurrencyLimit = async (items, concurrency, task) => {
+  const limit = pLimit(concurrency);
+  return Promise.all(items.map((item) => limit(() => task(item))));
+};
+
+// src/scanner/scanner.ts
+var DEFAULT_SCAN_CONCURRENCY = Math.max(1, Math.min(8, availableParallelism()));
+var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var parseErrorFinding = (filePath, error) => ({
+  ruleId: "parse-error",
+  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage(error)}`,
+  file: filePath,
+  line: 1,
+  severity: "low"
+});
+var readFileContent = async (filePath) => {
+  try {
+    return await readFile(filePath, "utf-8");
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
+  }
+};
+var scanFile = async (filePath, rules) => {
+  const content = await readFileContent(filePath);
+  const findings = [];
+  let hasParseError = false;
+  for (const rule of rules) {
+    try {
+      findings.push(...rule.check(filePath, content));
+    } catch (error) {
+      if (!hasParseError) {
+        findings.push(parseErrorFinding(filePath, error));
+        hasParseError = true;
+      }
+    }
+  }
+  return findings;
+};
+var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY) => {
+  try {
+    const startedAt = Date.now();
+    const files = await findFiles(targetDir);
+    const findings = (await runWithConcurrencyLimit(files, concurrency, (filePath) => scanFile(filePath, rules))).flat();
+    return {
+      scannedFiles: files.length,
+      findings,
+      durationMs: Date.now() - startedAt,
+      engines: { codesentry: files.length }
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel concluir a an\xE1lise de "${targetDir}".`, { cause: error });
+  }
+};
+
+// src/scanner/semgrep.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+// src/scanner/semgrep-runtime.ts
+import { existsSync, readFileSync } from "fs";
+import { createRequire } from "module";
+import { dirname, resolve } from "path";
+var require2 = createRequire(import.meta.url);
+var packageForPlatform = (platform, architecture) => {
+  if (platform === "linux" && architecture === "x64") {
+    return "codesentry-semgrep-linux-x64";
+  }
+  if (platform === "win32" && architecture === "x64") {
+    return "codesentry-semgrep-win32-x64";
+  }
+  return void 0;
+};
+var unsupportedRuntimeMessage = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var resolveBundledSemgrepRuntime = (platform = process.platform, architecture = process.arch, resolveManifestPath = (packageName) => require2.resolve(`${packageName}/runtime.json`)) => {
+  const packageName = packageForPlatform(platform, architecture);
+  if (!packageName) {
+    throw new Error(unsupportedRuntimeMessage(platform, architecture));
+  }
+  try {
+    const manifestPath = resolveManifestPath(packageName);
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+    const runtime = {
+      semgrep: resolve(dirname(manifestPath), manifest.semgrep)
+    };
+    if (!existsSync(runtime.semgrep)) {
+      throw new Error("artefatos do runtime ausentes");
+    }
+    return runtime;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "erro desconhecido";
+    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${reason}`, { cause: error });
+  }
+};
+
+// src/scanner/semgrep-rules.ts
+import { existsSync as existsSync2 } from "fs";
+import { createRequire as createRequire2 } from "module";
+var require3 = createRequire2(import.meta.url);
+var resolveBundledSemgrepRuleset = () => {
+  try {
+    const ruleset = require3.resolve("codesentry-semgrep-rules/rules/owasp.yml");
+    if (!existsSync2(ruleset)) {
+      throw new Error("ruleset ausente");
+    }
+    return ruleset;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "erro desconhecido";
+    throw new Error(`N\xE3o foi poss\xEDvel carregar o ruleset OWASP embutido: ${reason}`, { cause: error });
+  }
+};
+
+// src/scanner/semgrep.ts
+var execFileAsync = promisify(execFile);
+var SEMGREP_SEVERITIES = {
+  INFO: "low",
+  WARNING: "medium",
+  ERROR: "high",
+  CRITICAL: "critical"
+};
+var parseSemgrepReport = (stdout) => {
+  try {
+    const report = JSON.parse(stdout);
+    if (!Array.isArray(report.results)) {
+      throw new Error('campo "results" ausente');
+    }
+    return { results: report.results, paths: report.paths };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "erro desconhecido";
+    throw new Error(`Semgrep retornou JSON inv\xE1lido: ${reason}`, { cause: error });
+  }
+};
+var mapSemgrepReportToFindings = (report) => report.results.map((finding) => ({
+  ruleId: `semgrep/${finding.check_id}`,
+  message: finding.extra.message,
+  file: finding.path,
+  line: finding.start.line,
+  severity: SEMGREP_SEVERITIES[finding.extra.severity] ?? "medium"
+}));
+var outputFromError = (error) => typeof error.stdout === "string" ? error.stdout : void 0;
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync) => {
+  const startedAt = Date.now();
+  const args = [
+    "scan",
+    "--config",
+    ruleset,
+    "--metrics=off",
+    "--json",
+    "--quiet",
+    "--exclude",
+    "node_modules",
+    "--exclude",
+    ".git",
+    "--exclude",
+    "dist",
+    "--exclude",
+    ".next",
+    targetDir
+  ];
+  let stdout;
+  try {
+    ({ stdout } = await execute(runtime.semgrep, args, { cwd: targetDir, maxBuffer: 20 * 1024 * 1024 }));
+  } catch (error) {
+    const output = outputFromError(error);
+    if (!output) {
+      throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
+    }
+    stdout = output;
+  }
+  const report = parseSemgrepReport(stdout);
+  const scannedFiles = report.paths?.scanned.length ?? 0;
+  return {
+    scannedFiles,
+    findings: mapSemgrepReportToFindings(report),
+    durationMs: Date.now() - startedAt,
+    engines: { semgrep: scannedFiles }
+  };
+};
+
+// src/commands/scan/report-filename.ts
+var MARKDOWN_REPORT_FINDINGS_THRESHOLD = 20;
+var generateMarkdownReportFilename = (date = /* @__PURE__ */ new Date()) => {
+  const timestamp = date.toISOString().replace(/[:.]/g, "-");
+  return `codesentry-report-${timestamp}.md`;
+};
+
+// src/commands/scan/scan-runner.ts
+var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var reportScanFailure = (error) => {
+  process.exitCode = 1;
+  console.error(`Falha ao executar o scan: ${errorMessage2(error)}`);
+};
+var printResult = (result, options) => {
+  if (options.json) {
+    console.log(toJsonReport(result));
+    return;
+  }
+  printConsoleReport(result);
+};
+var writeMarkdownReportIfNeeded = async (result, targetDir) => {
+  if (result.findings.length <= MARKDOWN_REPORT_FINDINGS_THRESHOLD) {
+    return;
+  }
+  const filePath = join2(targetDir, generateMarkdownReportFilename());
+  try {
+    await writeFile(filePath, toMarkdownReport(result), "utf-8");
+    console.log(chalk2.cyan(`
+Relat\xF3rio detalhado gerado em: ${filePath}`));
+  } catch (error) {
+    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage2(error)}`));
+  }
+};
+var createScanTasks = (path, rules, taskTitle, options, onResult) => new Listr([
+  {
+    title: taskTitle,
+    task: () => runScan(path, rules, options.concurrency).then((nativeResult) => {
+      if (!options.semgrep) {
+        onResult(nativeResult);
+        return void 0;
+      }
+      return runBundledSemgrep(path, void 0, options.config).then((semgrepResult) => {
+        onResult(mergeScanResults(nativeResult, semgrepResult));
+      });
+    }).catch((error) => {
+      throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, {
+        cause: error
+      });
+    })
+  }
+]);
+var scanAndReport = async (path, rules, taskTitle, options) => {
+  let result;
+  const tasks = createScanTasks(path, rules, taskTitle, options, (scanResult) => {
+    result = scanResult;
+  });
+  try {
+    await tasks.run();
+    if (result) {
+      printResult(result, options);
+      await writeMarkdownReportIfNeeded(result, path);
+    }
+  } catch (error) {
+    reportScanFailure(error);
+  }
+};
+
+// src/commands/command-injection/command-injection.command.ts
+var registerCommandInjectionCommand = (program) => {
+  program.command("command-injection").description("Detecta child_process.exec()/execSync() recebendo entrada externa").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [commandInjectionRule], "Checking command injection...", options)
+  );
+};
+
+// src/rules/deep-nesting.rule.ts
+var MAX_NESTING_DEPTH = 3;
+var NESTING_TYPES = /* @__PURE__ */ new Set([
+  "ForStatement",
+  "ForInStatement",
+  "ForOfStatement",
+  "WhileStatement",
+  "DoWhileStatement",
+  "SwitchStatement",
+  "TryStatement"
+]);
+var FUNCTION_TYPES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression",
+  "ObjectMethod",
+  "ClassMethod",
+  "ClassPrivateMethod"
+]);
+var isSourceNode2 = (value) => {
+  return typeof value === "object" && value !== null && "type" in value;
+};
+var walkChildren = (node, depth, results) => {
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      value.filter(isSourceNode2).forEach((child) => walk(child, depth, results));
+    } else if (isSourceNode2(value)) {
+      walk(value, depth, results);
+    }
+  }
+};
+var checkDepth = (newDepth, line, results) => {
+  if (newDepth > MAX_NESTING_DEPTH && line !== void 0) {
+    results.push({ line, depth: newDepth });
+  }
+};
+var walkIfChild = (value, depth, results) => {
+  if (isSourceNode2(value)) {
+    walk(value, depth, results);
+  }
+};
+var walkIfAlternate = (alternate, depth, results) => {
+  if (!isSourceNode2(alternate)) {
+    return;
+  }
+  if (alternate.type === "IfStatement") {
+    walkIfChain(alternate, depth, results);
+    return;
+  }
+  walk(alternate, depth + 1, results);
+};
+var walkIfChain = (node, depth, results) => {
+  const chainDepth = depth + 1;
+  checkDepth(chainDepth, node.loc?.start.line, results);
+  walkIfChild(node.test, chainDepth, results);
+  walkIfChild(node.consequent, chainDepth, results);
+  walkIfAlternate(node.alternate, depth, results);
+};
+var walkFunction = (node, _depth, results) => {
+  walkChildren(node, 0, results);
+};
+var walkNestingBlock = (node, depth, results) => {
+  const newDepth = depth + 1;
+  checkDepth(newDepth, node.loc?.start.line, results);
+  walkChildren(node, newDepth, results);
+};
+var selectWalker = (node) => {
+  return FUNCTION_TYPES.has(node.type) ? walkFunction : node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+};
+var walk = (node, depth, results) => {
+  selectWalker(node)(node, depth, results);
+};
+var findDeepNesting = (filePath, content) => {
+  const results = [];
+  const sourceFile = parseSourceFile(filePath, content);
+  walk(sourceFile, 0, results);
+  return results;
+};
+var deepNestingRule = {
+  id: "deep-nesting",
+  description: "Detecta blocos aninhados al\xE9m do limite recomendado",
+  check(filePath, content) {
+    return findDeepNesting(filePath, content).map(({ line, depth }) => ({
+      ruleId: "deep-nesting",
+      message: `Bloco aninhado em profundidade ${depth} (limite recomendado: ${MAX_NESTING_DEPTH}) \u2014 considere extrair para uma fun\xE7\xE3o ou simplificar a condi\xE7\xE3o.`,
+      file: filePath,
+      line,
+      severity: "low"
+    }));
+  }
+};
+
+// src/commands/deep-nesting/deep-nesting.command.ts
+var registerDeepNestingCommand = (program) => {
+  program.command("deep-nesting").description("Detecta blocos aninhados al\xE9m do limite recomendado").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [deepNestingRule], "Checking nesting depth...", options)
+  );
+};
+
+// src/scanner/dependency-audit.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var SEVERITY_MAP = {
+  info: "low",
+  low: "low",
+  moderate: "medium",
+  high: "high",
+  critical: "critical"
+};
+var vulnerabilityTitle = (vulnerability) => {
+  const firstVia = vulnerability.via[0];
+  if (typeof firstVia === "object" && firstVia?.title) {
+    return firstVia.title;
+  }
+  return 'ver "npm audit" para detalhes';
+};
+var mapAuditReportToFindings = (report) => {
+  return Object.values(report.vulnerabilities).map((vulnerability) => ({
+    ruleId: "dependency-audit",
+    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)}`,
+    file: "package.json",
+    line: 1,
+    severity: SEVERITY_MAP[vulnerability.severity]
+  }));
+};
+var runDependencyAudit = async (targetDir) => {
+  const startedAt = Date.now();
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync2("npm", ["audit", "--json"], {
+      cwd: targetDir,
+      maxBuffer: 10 * 1024 * 1024
+    }));
+  } catch (error) {
+    const stdoutFromError = error.stdout;
+    if (!stdoutFromError) {
+      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
+    }
+    stdout = stdoutFromError;
+  }
+  const report = JSON.parse(stdout);
+  return {
+    scannedFiles: 1,
+    findings: mapAuditReportToFindings(report),
+    durationMs: Date.now() - startedAt
+  };
+};
+
+// src/commands/dependency-audit/dependency-audit.command.ts
+var printAuditResult = (result, json) => {
+  if (json) {
+    console.log(toJsonReport(result));
+    return;
+  }
+  printConsoleReport(result);
+};
+var auditAndReport = async (path, options) => {
+  try {
+    printAuditResult(await runDependencyAudit(path), options.json ?? false);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "erro desconhecido";
+    process.exitCode = 1;
+    console.error(`Falha ao auditar depend\xEAncias: ${message}`);
+  }
+};
+var registerDependencyAuditCommand = (program) => {
+  program.command("dependency-audit").description(
+    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit"; requer npm no PATH e acesso \xE0 rede)'
+  ).argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").action((path, options) => auditAndReport(path, options));
+};
+
+// src/rules/empty-catch.rule.ts
+var isEmptyCatchClause = (node) => {
+  if (node.type !== "CatchClause") {
+    return false;
+  }
+  const body = node.body;
+  return typeof body === "object" && body !== null && "type" in body && body.type === "BlockStatement" && Array.isArray(body.body) && body.body.length === 0;
+};
+var findEmptyCatchLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isEmptyCatchClause(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines];
+};
+var emptyCatchRule = {
+  id: "empty-catch",
+  description: "Detecta blocos catch vazios, que escondem erros silenciosamente",
+  check(filePath, content) {
+    return findEmptyCatchLines(filePath, content).map((line) => ({
+      ruleId: "empty-catch",
+      message: "Bloco catch vazio \u2014 o erro est\xE1 sendo engolido silenciosamente",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/commands/empty-catch/empty-catch.command.ts
+var registerEmptyCatchCommand = (program) => {
+  program.command("empty-catch").description("Detecta blocos catch vazios").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [emptyCatchRule], "Checking empty catch blocks...", options)
+  );
+};
+
+// src/rules/express-missing-body-limit.rule.ts
+var BODY_PARSER_OBJECTS = /* @__PURE__ */ new Set(["express", "bodyParser"]);
+var BODY_PARSER_METHODS = /* @__PURE__ */ new Set(["json", "urlencoded"]);
+var hasLimitOption = (options) => {
+  if (options?.type !== "ObjectExpression") {
+    return false;
+  }
+  const properties = options.properties;
+  return properties?.some((property) => {
+    const key = property.key;
+    return key?.type === "Identifier" && key.name === "limit";
+  }) ?? false;
+};
+var isBodyParserWithoutLimit = (node) => {
+  const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const object = callee?.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const isBodyParserCall = object?.type === "Identifier" && BODY_PARSER_OBJECTS.has(object.name) && property?.type === "Identifier" && BODY_PARSER_METHODS.has(property.name);
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  return isBodyParserCall && !hasLimitOption(args?.[0]);
+};
+var findMissingBodyLimitLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isBodyParserWithoutLimit(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var expressMissingBodyLimitRule = {
+  id: "express-missing-body-limit",
+  description: "Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o",
+  check(filePath, content) {
+    return findMissingBodyLimitLines(filePath, content).map((line) => ({
+      ruleId: "express-missing-body-limit",
+      message: 'Body parser sem "limit" configurado \u2014 risco de nega\xE7\xE3o de servi\xE7o por payload grande',
+      file: filePath,
+      line,
+      severity: "low"
+    }));
+  }
+};
+
+// src/commands/express-missing-body-limit/express-missing-body-limit.command.ts
+var registerExpressMissingBodyLimitCommand = (program) => {
+  program.command("express-missing-body-limit").description("Detecta middlewares de body parsing do Express sem limite de tamanho de requisi\xE7\xE3o").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [expressMissingBodyLimitRule], "Checking Express body limits...", options)
+  );
+};
+
+// src/commands/help/help.command.ts
+import Table2 from "cli-table3";
+var buildHelpTable = (commands) => {
+  const table = new Table2({ head: ["Comando", "Descri\xE7\xE3o"] });
+  for (const command of commands) {
+    table.push([command.name, command.description]);
+  }
+  return table.toString();
+};
+var registerHelpCommand = (program) => {
+  program.command("help").description("Lista os comandos dispon\xEDveis").action(() => {
+    const commands = program.commands.filter((command) => command.name() !== "help").map((command) => ({ name: command.name(), description: command.description() }));
+    console.log(buildHelpTable(commands));
+  });
+};
+
+// src/rules/lib/function-info.ts
+var FUNCTION_TYPES2 = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression",
+  "ObjectMethod",
+  "ClassMethod",
+  "ClassPrivateMethod"
+]);
+var isNodeRecord = (value) => {
+  return typeof value === "object" && value !== null;
+};
+var nameValue = (node) => {
+  return typeof node.name === "string" ? node.name : void 0;
+};
+var literalValue = (node) => {
+  return typeof node.value === "string" || typeof node.value === "number" ? String(node.value) : void 0;
+};
+var nodeName = (node) => {
+  if (!isNodeRecord(node)) {
+    return void 0;
+  }
+  return nameValue(node) ?? literalValue(node) ?? nodeName(node.id);
+};
+var PARENT_NAME_KEYS = {
+  VariableDeclarator: "id",
+  ObjectProperty: "key",
+  AssignmentExpression: "left"
+};
+var parentFunctionName = (parent) => {
+  const nameKey = parent ? PARENT_NAME_KEYS[parent.type] : void 0;
+  return nameKey ? nodeName(parent?.[nameKey]) : void 0;
+};
+var isConstructor = (node) => {
+  return node.type === "ClassMethod" && node.kind === "constructor";
+};
+var getFunctionName = (node, parent) => {
+  const ownName = nodeName(node.id) ?? nodeName(node.key);
+  return isConstructor(node) ? "constructor" : ownName ?? parentFunctionName(parent);
+};
+var getFunctionStartLine = (node, parent) => {
+  if (node.type === "ArrowFunctionExpression" && parent?.type === "VariableDeclarator") {
+    return parent.loc?.start.line;
+  }
+  return node.loc?.start.line;
+};
+
+// src/rules/lib/statement-count-rule.ts
+var isSourceNode3 = (value) => {
+  return typeof value === "object" && value !== null && "type" in value;
+};
+var createContext = (node, parent) => {
+  return {
+    startLine: getFunctionStartLine(node, parent) ?? node.loc?.start.line ?? 0,
+    count: 0,
+    name: getFunctionName(node, parent)
+  };
+};
+var appendOverLimitContext = (context, state) => {
+  if (context.count > state.config.maxCount) {
+    state.results.push(context);
+  }
+};
+var walkChild = (value, parent, context, state) => {
+  if (Array.isArray(value)) {
+    value.filter(isSourceNode3).forEach((child) => walk2(child, parent, context, state));
+  } else if (isSourceNode3(value)) {
+    walk2(value, parent, context, state);
+  }
+};
+var walkChildren2 = (node, context, state) => {
+  for (const value of Object.values(node)) {
+    walkChild(value, node, context, state);
+  }
+};
+var walkFunction2 = (node, parent, state) => {
+  const context = createContext(node, parent);
+  walkChildren2(node, context, state);
+  appendOverLimitContext(context, state);
+};
+var incrementStatementCount = (node, context, state) => {
+  if (context && state.config.statementTypes.has(node.type)) {
+    context.count += 1;
+  }
+};
+var walk2 = (node, parent, context, state) => {
+  if (FUNCTION_TYPES2.has(node.type)) {
+    walkFunction2(node, parent, state);
+    return;
+  }
+  incrementStatementCount(node, context, state);
+  walkChildren2(node, context, state);
+};
+var findFunctionStatementCounts = (filePath, content, config) => {
+  const state = { config, results: [] };
+  walkChildren2(parseSourceFile(filePath, content), void 0, state);
+  return state.results;
+};
+var toFinding = (filePath, config, result) => {
+  const subject = result.name ? `Fun\xE7\xE3o "${result.name}"` : "Fun\xE7\xE3o an\xF4nima";
+  return {
+    ruleId: config.id,
+    message: `${subject} tem ${result.count} ${config.unitLabel} \u2014 complexidade alta, considere refatorar (limite recomendado: ${config.maxCount})`,
+    file: filePath,
+    line: result.startLine,
+    severity: "low"
+  };
+};
+var createFunctionStatementCountRule = (config) => ({
+  id: config.id,
+  description: config.description,
+  check(filePath, content) {
+    return findFunctionStatementCounts(filePath, content, config).map(
+      (result) => toFinding(filePath, config, result)
+    );
+  }
+});
+
+// src/rules/high-complexity.rule.ts
+var highComplexityRule = createFunctionStatementCountRule({
+  id: "high-complexity",
+  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)",
+  statementTypes: /* @__PURE__ */ new Set([
+    "IfStatement",
+    "ForStatement",
+    "ForInStatement",
+    "ForOfStatement",
+    "WhileStatement",
+    "DoWhileStatement",
+    "SwitchCase",
+    "CatchClause"
+  ]),
+  maxCount: 5,
+  unitLabel: "condicionais/loops"
+});
+
+// src/commands/high-complexity/high-complexity.command.ts
+var registerHighComplexityCommand = (program) => {
+  program.command("high-complexity").description("Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [highComplexityRule], "Checking function complexity...", options)
+  );
+};
+
+// src/commands/init/init.command.ts
+import { confirm, intro, isCancel, outro, text } from "@clack/prompts";
+import chalk3 from "chalk";
+var collectAnswers = async () => {
+  try {
+    const include = await text({
+      message: "Quais extens\xF5es de arquivo devem ser analisadas?",
+      placeholder: ".ts,.js",
+      defaultValue: ".ts,.js"
+    });
+    if (isCancel(include)) {
+      return void 0;
+    }
+    const shouldSave = await confirm({ message: "Salvar essa configura\xE7\xE3o?" });
+    if (isCancel(shouldSave)) {
+      return void 0;
+    }
+    return { include, shouldSave };
+  } catch (error) {
+    throw new Error("N\xE3o foi poss\xEDvel coletar as op\xE7\xF5es de configura\xE7\xE3o.", { cause: error });
+  }
+};
+var printOutcome = ({ include, shouldSave }) => {
+  const message = shouldSave ? chalk3.green(`Configura\xE7\xE3o recebida (${include}). Persist\xEAncia em arquivo ainda n\xE3o implementada.`) : "Configura\xE7\xE3o descartada.";
+  outro(message);
+};
+var runInit = () => {
+  intro(chalk3.cyan("CodeSentry \u2014 configura\xE7\xE3o inicial"));
+  return collectAnswers().then((answers) => {
+    if (!answers) {
+      outro("Cancelado.");
+      return;
+    }
+    printOutcome(answers);
+  }).catch((error) => {
+    const message = error instanceof Error ? error.message : "erro desconhecido";
+    outro(chalk3.red(`Falha ao configurar o CodeSentry: ${message}`));
+    process.exitCode = 1;
+  });
+};
+var registerInitCommand = (program) => {
+  program.command("init").description("Configura o CodeSentry no projeto atual (interativo)").action(() => runInit());
+};
+
+// src/rules/insecure-random-token.rule.ts
+var TOKEN_NAME_PATTERN = /token|secret|password|senha|session|csrf|nonce|otp/i;
+var isMathRandomCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const object = callee.object;
+  const property = callee.property;
+  return object?.type === "Identifier" && object.name === "Math" && property?.type === "Identifier" && property.name === "random";
+};
+var HASH_LIKE_NAME_PATTERN = /hash|md5|sha1/i;
+var calleeName = (callee) => {
+  if (callee?.type === "Identifier") {
+    return callee.name;
+  }
+  if (callee?.type === "MemberExpression") {
+    const property = callee.property;
+    return property?.type === "Identifier" ? property.name : void 0;
+  }
+  return void 0;
+};
+var isDateNowOrGetTimeCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const property = callee.property;
+  const propertyName = property?.type === "Identifier" ? property.name : void 0;
+  if (propertyName === "getTime") {
+    return true;
+  }
+  const object = callee.object;
+  return object?.type === "Identifier" && object.name === "Date" && propertyName === "now";
+};
+var TIMESTAMP_NAME_PATTERN = /timestamp|^now$/i;
+var containsPredictableTimestamp = (node) => {
+  if (!node) {
+    return false;
+  }
+  let found = false;
+  visitSourceNodes(node, (child) => {
+    if (isDateNowOrGetTimeCall(child)) {
+      found = true;
+    } else if (child.type === "Identifier" && TIMESTAMP_NAME_PATTERN.test(child.name)) {
+      found = true;
+    }
+  });
+  return found;
+};
+var isPredictableHashCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const name = calleeName(node.callee);
+  if (!name || !HASH_LIKE_NAME_PATTERN.test(name)) {
+    return false;
+  }
+  const args = node.arguments;
+  return containsPredictableTimestamp(args?.[0]);
+};
+var containsInsecureValueGeneration = (node) => {
+  if (!node) {
+    return false;
+  }
+  let found = false;
+  visitSourceNodes(node, (child) => {
+    if (isMathRandomCall(child) || isPredictableHashCall(child)) {
+      found = true;
+    }
+  });
+  return found;
+};
+var findInsecureRandomTokenLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type !== "VariableDeclarator") {
+      return;
+    }
+    const id = node.id;
+    const init = node.init;
+    if (id?.type === "Identifier" && TOKEN_NAME_PATTERN.test(id.name) && containsInsecureValueGeneration(init) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var insecureRandomTokenRule = {
+  id: "insecure-random-token",
+  description: "Detecta tokens/segredos gerados de forma previs\xEDvel (Math.random(), ou hash de um valor previs\xEDvel como um timestamp)",
+  check(filePath, content) {
+    return findInsecureRandomTokenLines(filePath, content).map((line) => ({
+      ruleId: "insecure-random-token",
+      message: "Token gerado de forma previs\xEDvel \u2014 use crypto.randomBytes()/randomUUID() em vez de Math.random() ou hash de um timestamp",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
+// src/commands/insecure-random-token/insecure-random-token.command.ts
+var registerInsecureRandomTokenCommand = (program) => {
+  program.command("insecure-random-token").description("Detecta o uso de Math.random() para gerar tokens/segredos previs\xEDveis").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [insecureRandomTokenRule], "Checking insecure random tokens...", options)
+  );
+};
+
+// src/rules/jwt-decode-without-verify.rule.ts
+var isBufferFromBase64Call = (node) => {
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const object = callee.object;
+  const property = callee.property;
+  const isBufferFrom = object?.type === "Identifier" && object.name === "Buffer" && property?.type === "Identifier" && property.name === "from";
+  if (!isBufferFrom) {
+    return false;
+  }
+  const args = node.arguments;
+  return args?.[1]?.type === "StringLiteral" && args[1].value === "base64";
+};
+var isBase64DecodeCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type === "Identifier" && callee.name === "atob") {
+    return true;
+  }
+  return isBufferFromBase64Call(node);
+};
+var isJsonParseCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  return callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === "JSON" && callee.property?.type === "Identifier" && callee.property.name === "parse";
+};
+var isSignatureVerificationCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  return callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && callee.property.name === "verify";
+};
+var analyzeFile = (sourceFile) => {
+  const analysis = {
+    base64DecodeLines: [],
+    hasJsonParse: false,
+    hasSignatureVerification: false
+  };
+  visitSourceNodes(sourceFile, (node) => {
+    if (isBase64DecodeCall(node) && node.loc) {
+      analysis.base64DecodeLines.push(node.loc.start.line);
+    } else if (isJsonParseCall(node)) {
+      analysis.hasJsonParse = true;
+    } else if (isSignatureVerificationCall(node)) {
+      analysis.hasSignatureVerification = true;
+    }
+  });
+  return analysis;
+};
+var findJwtDecodeWithoutVerifyLines = (filePath, content) => {
+  const sourceFile = parseSourceFile(filePath, content);
+  const analysis = analyzeFile(sourceFile);
+  if (!analysis.hasJsonParse || analysis.hasSignatureVerification) {
+    return [];
+  }
+  return [...new Set(analysis.base64DecodeLines)].sort((a, b) => a - b);
+};
+var jwtDecodeWithoutVerifyRule = {
+  id: "jwt-decode-without-verify",
+  description: "Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem nenhuma verifica\xE7\xE3o de assinatura no arquivo",
+  check(filePath, content) {
+    return findJwtDecodeWithoutVerifyLines(filePath, content).map((line) => ({
+      ruleId: "jwt-decode-without-verify",
+      message: "Token decodificado (base64 + JSON.parse) sem verificar a assinatura \u2014 claims n\xE3o confi\xE1veis podem ser forjadas",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/jwt-decode-without-verify/jwt-decode-without-verify.command.ts
+var registerJwtDecodeWithoutVerifyCommand = (program) => {
+  program.command("jwt-decode-without-verify").description("Detecta decodifica\xE7\xE3o manual de um token (base64 + JSON.parse) sem verificar a assinatura").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
+    await scanAndReport(
+      path,
+      [jwtDecodeWithoutVerifyRule],
+      "Checking JWT decode without verification...",
+      options
+    );
+  });
+};
+
+// src/rules/jwt-no-expiration.rule.ts
+var objectHasProperty = (object, propertyName) => {
+  if (object?.type !== "ObjectExpression") {
+    return false;
+  }
+  const properties = object.properties;
+  return properties?.some((property) => {
+    const key = property.key;
+    return key?.type === "Identifier" && key.name === propertyName;
+  }) ?? false;
+};
+var isJwtSignWithoutExpiration = (node) => {
+  const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const object = callee?.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const isJwtSignCall = object?.type === "Identifier" && object.name === "jwt" && property?.type === "Identifier" && property.name === "sign";
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  const payload = args?.[0];
+  const options = args?.[2];
+  const hasExpInPayload = objectHasProperty(payload, "exp");
+  const hasExpiresInOption = objectHasProperty(options, "expiresIn");
+  return isJwtSignCall && !hasExpInPayload && !hasExpiresInOption;
+};
+var findJwtNoExpirationLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isJwtSignWithoutExpiration(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var jwtNoExpirationRule = {
+  id: "jwt-no-expiration",
+  description: "Detecta jwt.sign() sem expira\xE7\xE3o configurada",
+  check(filePath, content) {
+    return findJwtNoExpirationLines(filePath, content).map((line) => ({
+      ruleId: "jwt-no-expiration",
+      message: "jwt.sign() sem expira\xE7\xE3o \u2014 o token nunca expira",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/commands/jwt-no-expiration/jwt-no-expiration.command.ts
+var registerJwtNoExpirationCommand = (program) => {
+  program.command("jwt-no-expiration").description("Detecta jwt.sign() sem expira\xE7\xE3o configurada").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [jwtNoExpirationRule], "Checking JWT expiration...", options)
+  );
+};
+
+// src/rules/long-function.rule.ts
+var MAX_LINES = 30;
+var toLongFunction = (node, parent) => {
+  const startLine = getFunctionStartLine(node, parent);
+  const endLine = node.loc?.end.line;
+  if (startLine === void 0 || endLine === void 0) {
+    return void 0;
+  }
+  const totalLines = endLine - startLine + 1;
+  if (totalLines <= MAX_LINES) {
+    return void 0;
+  }
+  return { startLine, totalLines, name: getFunctionName(node, parent) };
+};
+var findLongFunctions = (filePath, content) => {
+  const results = [];
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node, parent) => {
+    if (FUNCTION_TYPES2.has(node.type)) {
+      const longFunction = toLongFunction(node, parent);
+      if (longFunction) {
+        results.push(longFunction);
+      }
+    }
+  });
+  return results;
+};
+var toFinding2 = (filePath, longFunction) => {
+  const { startLine, totalLines, name } = longFunction;
+  const subject = name ? `Fun\xE7\xE3o "${name}"` : "Fun\xE7\xE3o an\xF4nima";
+  return {
+    ruleId: "long-function",
+    message: `${subject} com ${totalLines} linhas \u2014 considere dividir em fun\xE7\xF5es menores (limite recomendado: ${MAX_LINES})`,
+    file: filePath,
+    line: startLine,
+    severity: "low"
+  };
+};
+var longFunctionRule = {
+  id: "long-function",
+  description: "Detecta fun\xE7\xF5es com mais de 30 linhas",
+  check(filePath, content) {
+    return findLongFunctions(filePath, content).map((longFunction) => toFinding2(filePath, longFunction));
+  }
+};
+
+// src/commands/long-functions/long-functions.command.ts
+var registerLongFunctionsCommand = (program) => {
+  program.command("long-functions").description("Detecta fun\xE7\xF5es com mais de 30 linhas").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [longFunctionRule], "Checking function length...", options)
+  );
+};
+
+// src/rules/no-any.rule.ts
+var findAnyUsageLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (node.type === "TSAnyKeyword" && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var noAnyRule = {
+  id: "no-any",
+  description: 'Detecta o uso do tipo "any", que enfraquece a seguran\xE7a de tipos do TypeScript',
+  check(filePath, content) {
+    return findAnyUsageLines(filePath, content).map((line) => ({
+      ruleId: "no-any",
+      message: 'Uso do tipo "any" encontrado \u2014 considere um tipo mais espec\xEDfico',
+      file: filePath,
+      line,
+      severity: "low"
+    }));
+  }
+};
+
+// src/commands/no-any/no-any.command.ts
+var registerNoAnyCommand = (program) => {
+  program.command("no-any").description('Detecta o uso do tipo "any" no TypeScript').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [noAnyRule], "Checking any usage...", options)
+  );
+};
+
+// src/rules/no-eval.rule.ts
+var isNamed = (node, name) => {
+  return typeof node === "object" && node !== null && "type" in node && "name" in node && node.type === "Identifier" && node.name === name;
+};
+var isEvalCall = (node) => {
+  if (node.type !== "CallExpression" && node.type !== "OptionalCallExpression") {
+    return false;
+  }
+  if (isNamed(node.callee, "eval")) {
+    return true;
+  }
+  const callee = node.callee;
+  return typeof callee === "object" && callee !== null && "type" in callee && (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression") && "property" in callee && isNamed(callee.property, "eval");
+};
+var isNewFunctionCall = (node) => {
+  return node.type === "NewExpression" && isNamed(node.callee, "Function");
+};
+var findEvalCallLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if ((isEvalCall(node) || isNewFunctionCall(node)) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines];
+};
+var noEvalRule = {
+  id: "no-eval",
+  description: "Detecta o uso de eval() ou new Function(), que podem executar c\xF3digo arbitr\xE1rio",
+  check(filePath, content) {
+    return findEvalCallLines(filePath, content).map((line) => ({
+      ruleId: "no-eval",
+      message: "Uso de eval()/new Function() encontrado \u2014 evite executar c\xF3digo arbitr\xE1rio",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
+// src/commands/no-eval/no-eval.command.ts
+var registerNoEvalCommand = (program) => {
+  program.command("no-eval").description("Detecta o uso de eval() ou new Function()").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [noEvalRule], "Checking eval/new Function usage...", options)
+  );
+};
+
+// src/rules/no-hardcoded-secret.rule.ts
+var SECRET_NAME_PATTERN = /password|senha|secret|token|apikey|api_key|private_key|access_key/i;
+var PUBLIC_METADATA_NAME_PATTERN = /scope|issuer|ttl|expir/i;
+var isNonEmptyStringLiteral = (node) => {
+  return node?.type === "StringLiteral" && node.value.trim().length > 0;
+};
+var nameFromKeyLike = (node) => {
+  if (node?.type === "Identifier") {
+    return node.name;
+  }
+  if (node?.type === "StringLiteral") {
+    return node.value;
+  }
+  return void 0;
+};
+var assignmentNodes = (node) => {
+  switch (node.type) {
+    case "VariableDeclarator":
+      return { nameNode: node.id, valueNode: node.init };
+    case "ObjectProperty":
+      return { nameNode: node.key, valueNode: node.value };
+    case "AssignmentExpression": {
+      const left = node.left;
+      return {
+        nameNode: left.type === "MemberExpression" ? left.property : left,
+        valueNode: node.right
+      };
+    }
+    default:
+      return {};
+  }
+};
+var isHardcodedSecretAssignment = (node) => {
+  const { nameNode, valueNode } = assignmentNodes(node);
+  const name = nameFromKeyLike(nameNode);
+  return !!name && SECRET_NAME_PATTERN.test(name) && !PUBLIC_METADATA_NAME_PATTERN.test(name) && isNonEmptyStringLiteral(valueNode);
+};
+var findHardcodedSecretLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isHardcodedSecretAssignment(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var noHardcodedSecretRule = {
+  id: "no-hardcoded-secret",
+  description: "Detecta segredos/credenciais hardcoded no c\xF3digo-fonte",
+  check(filePath, content) {
+    return findHardcodedSecretLines(filePath, content).map((line) => ({
+      ruleId: "no-hardcoded-secret",
+      message: "Poss\xEDvel segredo/credencial hardcoded no c\xF3digo-fonte",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/commands/no-hardcoded-secret/no-hardcoded-secret.command.ts
+var registerNoHardcodedSecretCommand = (program) => {
+  program.command("no-hardcoded-secret").description("Detecta segredos/credenciais hardcoded no c\xF3digo-fonte").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [noHardcodedSecretRule], "Checking hardcoded secrets...", options)
+  );
+};
+
+// src/rules/permissive-cors.rule.ts
+var HEADER_SETTER_METHODS = /* @__PURE__ */ new Set(["setHeader", "header"]);
+var isWildcardOriginOption = (options) => {
+  if (options?.type !== "ObjectExpression") {
+    return false;
+  }
+  const properties = options.properties;
+  return properties?.some((property) => {
+    const key = property.key;
+    const value = property.value;
+    return key?.type === "Identifier" && key.name === "origin" && value?.type === "StringLiteral" && value.value === "*";
+  }) ?? false;
+};
+var isPermissiveCorsCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type !== "Identifier" || callee.name !== "cors") {
+    return false;
+  }
+  const args = node.arguments;
+  return (args?.length ?? 0) === 0 || isWildcardOriginOption(args?.[0]);
+};
+var isWildcardOriginHeader = (node) => {
+  const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  const headerName = args?.[0];
+  const headerValue = args?.[1];
+  return property?.type === "Identifier" && HEADER_SETTER_METHODS.has(property.name) && headerName?.type === "StringLiteral" && headerName.value === "Access-Control-Allow-Origin" && headerValue?.type === "StringLiteral" && headerValue.value === "*";
+};
+var findPermissiveCorsLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if ((isPermissiveCorsCall(node) || isWildcardOriginHeader(node)) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var permissiveCorsRule = {
+  id: "permissive-cors",
+  description: "Detecta CORS configurado para permitir qualquer origem",
+  check(filePath, content) {
+    return findPermissiveCorsLines(filePath, content).map((line) => ({
+      ruleId: "permissive-cors",
+      message: 'CORS permitindo qualquer origem ("*") \u2014 restrinja para as origens confi\xE1veis',
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/commands/permissive-cors/permissive-cors.command.ts
+var registerPermissiveCorsCommand = (program) => {
+  program.command("permissive-cors").description("Detecta CORS configurado para permitir qualquer origem").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [permissiveCorsRule], "Checking permissive CORS...", options)
+  );
+};
+
+// src/rules/public-env-var-secret.rule.ts
+var PUBLIC_ENV_PREFIX_PATTERN = /^(NEXT_PUBLIC_|VITE_|REACT_APP_)/;
+var SENSITIVE_NAME_PATTERN = /secret|key|token|password|senha/i;
+var isPublicSecretEnvAccess = (node) => {
+  if (node.type !== "MemberExpression") {
+    return false;
+  }
+  const property = node.property;
+  if (property?.type !== "Identifier") {
+    return false;
+  }
+  const name = property.name;
+  return PUBLIC_ENV_PREFIX_PATTERN.test(name) && SENSITIVE_NAME_PATTERN.test(name);
+};
+var findPublicEnvVarSecretLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isPublicSecretEnvAccess(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var publicEnvVarSecretRule = {
+  id: "public-env-var-secret",
+  description: "Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo",
+  check(filePath, content) {
+    return findPublicEnvVarSecretLines(filePath, content).map((line) => ({
+      ruleId: "public-env-var-secret",
+      message: "Vari\xE1vel de ambiente p\xFAblica com nome de segredo \u2014 o prefixo faz o valor ser inclu\xEDdo no bundle enviado ao navegador, nunca pode ser secreto",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
+// src/commands/public-env-var-secret/public-env-var-secret.command.ts
+var registerPublicEnvVarSecretCommand = (program) => {
+  program.command("public-env-var-secret").description("Detecta uma vari\xE1vel de ambiente p\xFAblica (NEXT_PUBLIC_/VITE_/REACT_APP_) com nome de segredo").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
+    await scanAndReport(path, [publicEnvVarSecretRule], "Checking public env var secrets...", options);
+  });
+};
+
+// src/commands/rules/rules.command.ts
+import Table3 from "cli-table3";
+
+// src/rules/lib/ast-ancestors.ts
+var isSourceNode4 = (value) => {
+  return typeof value === "object" && value !== null && "type" in value;
+};
+var walkWithAncestors = (node, visitor, ancestors = []) => {
+  visitor(node, ancestors);
+  const nextAncestors = [node, ...ancestors];
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      value.filter(isSourceNode4).forEach((child) => walkWithAncestors(child, visitor, nextAncestors));
+    } else if (isSourceNode4(value)) {
+      walkWithAncestors(value, visitor, nextAncestors);
+    }
+  }
+};
+
+// src/rules/await-no-try-catch.rule.ts
+var CLASS_TYPES = /* @__PURE__ */ new Set(["ClassDeclaration", "ClassExpression"]);
+var TEST_FILE_PATH = /(^|[\\/])(?:__tests__|tests?)[\\/]|\.(?:spec|test)\.[cm]?[jt]sx?$/;
+var isNestedInsideClass = (ancestors) => {
+  return ancestors.some((ancestor) => CLASS_TYPES.has(ancestor.type));
+};
+var isInsideTryBlockBeforeFunctionBoundary = (awaitNode, ancestors) => {
+  let child = awaitNode;
+  for (const ancestor of ancestors) {
+    if (FUNCTION_TYPES2.has(ancestor.type)) {
+      return false;
+    }
+    if (ancestor.type === "TryStatement" && ancestor.block === child) {
+      return true;
+    }
+    child = ancestor;
+  }
+  return false;
+};
+var findUnprotectedAwaitLines = (filePath, content) => {
+  if (TEST_FILE_PATH.test(filePath)) {
+    return [];
+  }
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  walkWithAncestors(sourceFile, (node, ancestors) => {
+    const location = node.loc;
+    const isUnprotectedAwait = node.type === "AwaitExpression" && location && !isNestedInsideClass(ancestors) && !isInsideTryBlockBeforeFunctionBoundary(node, ancestors);
+    if (isUnprotectedAwait) {
+      lines.add(location.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var awaitNoTryCatchRule = {
+  id: "await-no-try-catch",
+  description: "Detecta await fora de try/catch em c\xF3digo de produ\xE7\xE3o (arquivos de teste e m\xE9todos de classe s\xE3o ignorados)",
+  check(filePath, content) {
+    return findUnprotectedAwaitLines(filePath, content).map((line) => ({
+      ruleId: "await-no-try-catch",
+      message: "await fora de um bloco try/catch \u2014 uma rejei\xE7\xE3o da promise n\xE3o seria tratada",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/rules/floating-promise.rule.ts
+var PROMISE_STATIC_METHODS = /* @__PURE__ */ new Set(["all", "race", "allSettled", "any"]);
+var asyncFunctionName = (node) => {
+  const declarationId = node.type === "FunctionDeclaration" ? node.id : void 0;
+  const declarationName = declarationId?.type === "Identifier" ? declarationId.name : void 0;
+  const id = node.type === "VariableDeclarator" ? node.id : void 0;
+  const init = node.type === "VariableDeclarator" ? node.init : void 0;
+  const hasAsyncFunctionValue = (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
+  return declarationName ?? (id?.type === "Identifier" && hasAsyncFunctionValue ? id.name : void 0);
+};
+var collectAsyncFunctionNames = (sourceFile) => {
+  const names = /* @__PURE__ */ new Set();
+  visitSourceNodes(sourceFile, (node) => {
+    const name = asyncFunctionName(node);
+    if (name && (node.type !== "FunctionDeclaration" || node.async)) {
+      names.add(name);
+    }
+  });
+  return names;
+};
+var isKnownPromiseReturningCall = (call, asyncFunctionNames) => {
+  const callee = call.callee;
+  if (!callee) {
+    return false;
+  }
+  const isKnownFunction = callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
+  const object = callee.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee.type === "MemberExpression" ? callee.property : void 0;
+  const isPromiseStaticMethod = object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
+  return isKnownFunction || isPromiseStaticMethod;
+};
+var findFloatingPromiseLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  const asyncFunctionNames = collectAsyncFunctionNames(sourceFile);
+  visitSourceNodes(sourceFile, (node) => {
+    const expression = node.type === "ExpressionStatement" ? node.expression : void 0;
+    const isFloatingPromise = expression?.type === "CallExpression" && isKnownPromiseReturningCall(expression, asyncFunctionNames);
+    if (isFloatingPromise && expression.loc) {
+      lines.add(expression.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var floatingPromiseRule = {
+  id: "floating-promise",
+  description: 'Detecta uma promise "solta", chamada sem await, .then/.catch, atribui\xE7\xE3o ou return',
+  check(filePath, content) {
+    return findFloatingPromiseLines(filePath, content).map((line) => ({
+      ruleId: "floating-promise",
+      message: "Promise n\xE3o tratada \u2014 nem await, .then/.catch, atribui\xE7\xE3o ou return foram usados",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/rules/promise-no-catch.rule.ts
+var memberPropertyName = (member) => {
+  const property = member.property;
+  return property?.type === "Identifier" ? property.name : void 0;
+};
+var isCallOf = (call, callee) => {
+  return call !== void 0 && call.type === "CallExpression" && call.callee === callee;
+};
+var isThenCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  const args = node.arguments;
+  return callee?.type === "MemberExpression" && memberPropertyName(callee) === "then" && (args?.length ?? 0) < 2;
+};
+var chainReachesCatch = (thenCall, ancestors) => {
+  let currentCall = thenCall;
+  let i = 0;
+  while (i < ancestors.length) {
+    const member = ancestors[i];
+    const nextCall = ancestors[i + 1];
+    const isChainMember = member?.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
+    const methodName = isChainMember ? memberPropertyName(member) : void 0;
+    const continuesChain = methodName === "then" || methodName === "finally";
+    if (methodName === "catch") {
+      return true;
+    }
+    if (!continuesChain) {
+      return false;
+    }
+    currentCall = nextCall;
+    i += 2;
+  }
+  return false;
+};
+var findUnhandledThenLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  walkWithAncestors(sourceFile, (node, ancestors) => {
+    if (isThenCall(node) && node.loc && !chainReachesCatch(node, ancestors)) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var promiseNoCatchRule = {
+  id: "promise-no-catch",
+  description: "Detecta uma cadeia .then() que nunca chega a um .catch()",
+  check(filePath, content) {
+    return findUnhandledThenLines(filePath, content).map((line) => ({
+      ruleId: "promise-no-catch",
+      message: "Promise com .then() sem .catch() \u2014 erros da promise n\xE3o est\xE3o sendo tratados",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/rules/security-lint.rule.ts
+import securityPlugin from "eslint-plugin-security";
+
+// src/rules/lib/eslint-linter.ts
+import { createRequire as createRequire3 } from "module";
+import { basename } from "path";
+import { Linter } from "eslint";
+import babelParser from "@babel/eslint-parser";
+var require4 = createRequire3(import.meta.url);
+var SYNTAX_TYPESCRIPT_PLUGIN_PATH = require4.resolve("@babel/plugin-syntax-typescript");
+var SYNTAX_JSX_PLUGIN_PATH = require4.resolve("@babel/plugin-syntax-jsx");
+var isJsxFile2 = (filePath) => /\.(tsx|jsx)$/.test(filePath);
+var SCANNABLE_FILE_GLOBS = ["**/*.js", "**/*.mjs", "**/*.cjs", "**/*.ts", "**/*.jsx", "**/*.tsx"];
+var createConfig = (filePath, rules, plugins) => [
+  {
+    files: SCANNABLE_FILE_GLOBS,
+    languageOptions: {
+      parser: babelParser,
+      ecmaVersion: "latest",
+      sourceType: "module",
+      parserOptions: {
+        requireConfigFile: false,
+        babelOptions: {
+          plugins: isJsxFile2(filePath) ? [SYNTAX_JSX_PLUGIN_PATH, SYNTAX_TYPESCRIPT_PLUGIN_PATH] : [SYNTAX_TYPESCRIPT_PLUGIN_PATH]
+        }
+      }
+    },
+    plugins,
+    rules
+  }
+];
+var verify = (content, config, filename) => {
+  try {
+    return new Linter().verify(content, config, filename);
+  } catch {
+    return [];
+  }
+};
+var toFindings = (messages) => messages.filter(
+  (message) => message.ruleId !== null && typeof message.line === "number"
+).map((message) => ({
+  ruleId: message.ruleId,
+  message: message.message,
+  line: message.line
+}));
+var runEslintRules = (filePath, content, rules, plugins) => {
+  const syntheticFilename = basename(filePath) || "source.js";
+  return toFindings(verify(content, createConfig(syntheticFilename, rules, plugins), syntheticFilename));
+};
+
+// src/rules/security-lint.rule.ts
+var RULES = {
+  "security/detect-object-injection": "error",
+  "security/detect-non-literal-regexp": "error",
+  "security/detect-non-literal-fs-filename": "error",
+  "security/detect-unsafe-regex": "error",
+  "security/detect-buffer-noassert": "error",
+  "security/detect-disable-mustache-escape": "error",
+  "security/detect-no-csrf-before-method-override": "error",
+  "security/detect-pseudoRandomBytes": "error",
+  "security/detect-possible-timing-attacks": "error",
+  "security/detect-new-buffer": "error"
+};
+var PLUGINS = { security: securityPlugin };
+var securityLintRule = {
+  id: "security-lint",
+  description: "Detecta padr\xF5es de seguran\xE7a gen\xE9ricos (object injection, regex n\xE3o literal, fs n\xE3o literal, etc.) via eslint-plugin-security",
+  check(filePath, content) {
+    return runEslintRules(filePath, content, RULES, PLUGINS).map((finding) => ({
+      ruleId: finding.ruleId,
+      message: `Padr\xE3o inseguro detectado (${finding.ruleId}): ${finding.message}`,
+      file: filePath,
+      line: finding.line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/rules/sensitive-data-in-logs.rule.ts
+var LOG_METHOD_NAMES = /* @__PURE__ */ new Set(["log", "warn", "error", "info", "debug"]);
+var SENSITIVE_NAME_PATTERN2 = /password|senha|secret|token|apikey|api_key|private_key|access_key/i;
+var looksLikeLoggerObject = (object) => object?.type === "Identifier" && (object.name === "console" || /log/i.test(object.name));
+var isLogCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const property = callee.property;
+  return looksLikeLoggerObject(callee.object) && property?.type === "Identifier" && LOG_METHOD_NAMES.has(property.name);
+};
+var propertyKeyName = (property) => {
+  const key = property.key;
+  if (key?.type === "Identifier") {
+    return key.name;
+  }
+  if (key?.type === "StringLiteral") {
+    return key.value;
+  }
+  return void 0;
+};
+var argumentContainsSensitiveData = (argument) => {
+  let found = false;
+  visitSourceNodes(argument, (node) => {
+    if (node.type === "Identifier" && SENSITIVE_NAME_PATTERN2.test(node.name)) {
+      found = true;
+    } else if (node.type === "ObjectProperty") {
+      const keyName = propertyKeyName(node);
+      if (keyName && SENSITIVE_NAME_PATTERN2.test(keyName)) {
+        found = true;
+      }
+    }
+  });
+  return found;
+};
+var isSensitiveLogCall = (node) => {
+  if (!isLogCall(node)) {
+    return false;
+  }
+  const args = node.arguments ?? [];
+  return args.some((argument) => argumentContainsSensitiveData(argument));
+};
+var findSensitiveLogLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isSensitiveLogCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var sensitiveDataInLogsRule = {
+  id: "sensitive-data-in-logs",
+  description: "Detecta senhas/segredos/tokens sendo passados para chamadas de log",
+  check(filePath, content) {
+    return findSensitiveLogLines(filePath, content).map((line) => ({
+      ruleId: "sensitive-data-in-logs",
+      message: "Dado sens\xEDvel (senha/segredo/token) sendo registrado em log",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
+// src/rules/tls-validation-disabled.rule.ts
+var isRejectUnauthorizedFalse = (node) => {
+  if (node.type !== "ObjectProperty") {
+    return false;
+  }
+  const key = node.key;
+  const value = node.value;
+  return key?.type === "Identifier" && key.name === "rejectUnauthorized" && value?.type === "BooleanLiteral" && value.value === false;
+};
+var isNodeTlsRejectUnauthorizedDisabled = (node) => {
+  if (node.type !== "AssignmentExpression") {
+    return false;
+  }
+  const left = node.left;
+  const right = node.right;
+  if (left?.type !== "MemberExpression") {
+    return false;
+  }
+  const property = left.property;
+  const object = left.object;
+  const isEnvVar = property?.type === "Identifier" && property.name === "NODE_TLS_REJECT_UNAUTHORIZED" && object?.type === "MemberExpression" && object.property?.type === "Identifier" && object.property.name === "env";
+  return isEnvVar && right?.type === "StringLiteral" && right.value === "0";
+};
+var findDisabledTlsValidationLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if ((isRejectUnauthorizedFalse(node) || isNodeTlsRejectUnauthorizedDisabled(node)) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var tlsValidationDisabledRule = {
+  id: "tls-validation-disabled",
+  description: "Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS",
+  check(filePath, content) {
+    return findDisabledTlsValidationLines(filePath, content).map((line) => ({
+      ruleId: "tls-validation-disabled",
+      message: "Valida\xE7\xE3o de certificado TLS desativada \u2014 risco de ataque man-in-the-middle",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/rules/too-many-for-loops.rule.ts
+var tooManyForLoopsRule = createFunctionStatementCountRule({
+  id: "too-many-for-loops",
+  description: 'Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"',
+  statementTypes: /* @__PURE__ */ new Set(["ForStatement", "ForInStatement", "ForOfStatement"]),
+  maxCount: 1,
+  unitLabel: "loops for"
+});
+
+// src/rules/too-many-ifs.rule.ts
+var tooManyIfsRule = createFunctionStatementCountRule({
+  id: "too-many-ifs",
+  description: 'Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")',
+  statementTypes: /* @__PURE__ */ new Set(["IfStatement"]),
+  maxCount: 2,
+  unitLabel: "declara\xE7\xF5es if (incluindo else if)"
+});
+
+// src/rules/too-many-switch-cases.rule.ts
+var MAX_CASES = 4;
+var findOversizedSwitches = (filePath, content) => {
+  const results = [];
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    const cases = node.type === "SwitchStatement" && Array.isArray(node.cases) ? node.cases : [];
+    if (cases.length > MAX_CASES && node.loc) {
+      results.push({ line: node.loc.start.line, caseCount: cases.length });
+    }
+  });
+  return results;
+};
+var tooManySwitchCasesRule = {
+  id: "too-many-switch-cases",
+  description: 'Detecta "switch" com muitos "case" (considere um mapa/lookup)',
+  check(filePath, content) {
+    return findOversizedSwitches(filePath, content).map(({ line, caseCount }) => ({
+      ruleId: "too-many-switch-cases",
+      message: `Switch com ${caseCount} cases \u2014 complexidade alta, considere um mapa/lookup em vez de switch (limite recomendado: ${MAX_CASES})`,
+      file: filePath,
+      line,
+      severity: "low"
+    }));
+  }
+};
+
+// src/rules/too-many-try-catch.rule.ts
+var tooManyTryCatchRule = createFunctionStatementCountRule({
+  id: "too-many-try-catch",
+  description: 'Detecta fun\xE7\xF5es com muitos blocos "try/catch"',
+  statementTypes: /* @__PURE__ */ new Set(["TryStatement"]),
+  maxCount: 1,
+  unitLabel: "blocos try/catch"
+});
+
+// src/rules/too-many-while-loops.rule.ts
+var tooManyWhileLoopsRule = createFunctionStatementCountRule({
+  id: "too-many-while-loops",
+  description: 'Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"',
+  statementTypes: /* @__PURE__ */ new Set(["WhileStatement", "DoWhileStatement"]),
+  maxCount: 1,
+  unitLabel: "loops while/do-while"
+});
+
+// src/rules/unsafe-sql.rule.ts
+var SQL_KEYWORD_PREFIX = /^(select|insert|update|delete)\b/i;
+var leftmostStringLiteral = (node) => {
+  if (node?.type === "StringLiteral") {
+    return node;
+  }
+  if (node?.type === "BinaryExpression" && node.operator === "+") {
+    return leftmostStringLiteral(node.left);
+  }
+  return void 0;
+};
+var isUnsafeConcatenatedSql = (node) => {
+  if (node.type !== "BinaryExpression" || node.operator !== "+") {
+    return false;
+  }
+  const literal = leftmostStringLiteral(node);
+  return !!literal && SQL_KEYWORD_PREFIX.test(literal.value.trim());
+};
+var isUnsafeSqlTemplateLiteral = (node) => {
+  if (node.type !== "TemplateLiteral") {
+    return false;
+  }
+  const expressions = node.expressions;
+  if ((expressions?.length ?? 0) === 0) {
+    return false;
+  }
+  const quasis = node.quasis;
+  const firstQuasi = quasis?.[0];
+  const rawText = firstQuasi?.value?.raw ?? "";
+  return SQL_KEYWORD_PREFIX.test(rawText.trim());
+};
+var findUnsafeSqlLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if ((isUnsafeConcatenatedSql(node) || isUnsafeSqlTemplateLiteral(node)) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var unsafeSqlRule = {
+  id: "unsafe-sql",
+  description: "Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)",
+  check(filePath, content) {
+    return findUnsafeSqlLines(filePath, content).map((line) => ({
+      ruleId: "unsafe-sql",
+      message: "Consulta SQL montada por concatena\xE7\xE3o \u2014 use queries parametrizadas",
+      file: filePath,
+      line,
+      severity: "high"
+    }));
+  }
+};
+
+// src/rules/weak-hash-algorithm.rule.ts
+var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
+var isWeakCreateHashCall = (node) => {
+  const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  const algorithm = args?.[0];
+  return property?.type === "Identifier" && property.name === "createHash" && algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+};
+var findWeakHashLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isWeakCreateHashCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var weakHashAlgorithmRule = {
+  id: "weak-hash-algorithm",
+  description: "Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)",
+  check(filePath, content) {
+    return findWeakHashLines(filePath, content).map((line) => ({
+      ruleId: "weak-hash-algorithm",
+      message: "Algoritmo de hash fraco (MD5/SHA-1) \u2014 considere SHA-256 ou superior",
+      file: filePath,
+      line,
+      severity: "medium"
+    }));
+  }
+};
+
+// src/rules/weak-secret-fallback.rule.ts
+var SECRET_ENV_NAME_PATTERN = /password|senha|secret|token|apikey|api_key|private_key|access_key|encryption_key|signing_key|jwt/i;
+var isProcessEnvAccess = (node) => {
+  if (node?.type !== "MemberExpression") {
+    return false;
+  }
+  const object = node.object;
+  return object?.type === "MemberExpression" && object.object?.type === "Identifier" && object.object.name === "process" && object.property?.type === "Identifier" && object.property.name === "env";
+};
+var isNonEmptyStringLiteral2 = (node) => node?.type === "StringLiteral" && node.value.trim().length > 0;
+var isWeakSecretFallback = (node) => {
+  if (node.type !== "LogicalExpression" || node.operator !== "||" && node.operator !== "??") {
+    return false;
+  }
+  const left = node.left;
+  if (!isProcessEnvAccess(left)) {
+    return false;
+  }
+  const envVarName = left.property.name;
+  return SECRET_ENV_NAME_PATTERN.test(envVarName) && isNonEmptyStringLiteral2(node.right);
+};
+var findWeakSecretFallbackLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isWeakSecretFallback(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var weakSecretFallbackRule = {
+  id: "weak-secret-fallback",
+  description: "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)",
+  check(filePath, content) {
+    return findWeakSecretFallbackLines(filePath, content).map((line) => ({
+      ruleId: "weak-secret-fallback",
+      message: "Segredo/chave com fallback hardcoded \u2014 se a vari\xE1vel de ambiente n\xE3o for definida, um valor previs\xEDvel \xE9 usado",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/rules/xss.rule.ts
+import noUnsanitizedPlugin from "eslint-plugin-no-unsanitized";
+var RULES2 = {
+  "no-unsanitized/property": "error",
+  "no-unsanitized/method": "error"
+};
+var PLUGINS2 = { "no-unsanitized": noUnsanitizedPlugin };
+var isDangerouslySetInnerHtmlWithDynamicValue = (node) => {
+  if (node.type !== "JSXAttribute") {
+    return false;
+  }
+  const name = node.name;
+  if (name?.type !== "JSXIdentifier" || name.name !== "dangerouslySetInnerHTML") {
+    return false;
+  }
+  const value = node.value;
+  if (value?.type !== "JSXExpressionContainer") {
+    return false;
+  }
+  const expression = value.expression;
+  if (expression?.type !== "ObjectExpression") {
+    return false;
+  }
+  const properties = expression.properties;
+  const htmlProperty = properties?.find((property) => {
+    const key = property.key;
+    return key?.type === "Identifier" && key.name === "__html";
+  });
+  const htmlValue = htmlProperty?.value;
+  return htmlValue !== void 0 && htmlValue.type !== "StringLiteral";
+};
+var findDangerouslySetInnerHtmlFindings = (filePath, content) => {
+  const findings = [];
+  let sourceFile;
+  try {
+    sourceFile = parseSourceFile(filePath, content);
+  } catch {
+    return findings;
+  }
+  visitSourceNodes(sourceFile, (node) => {
+    if (isDangerouslySetInnerHtmlWithDynamicValue(node) && node.loc) {
+      findings.push({
+        ruleId: "dangerously-set-inner-html",
+        message: "Poss\xEDvel XSS: dangerouslySetInnerHTML com valor n\xE3o literal (dado n\xE3o confi\xE1vel)",
+        file: filePath,
+        line: node.loc.start.line,
+        severity: "high"
+      });
+    }
+  });
+  return findings;
+};
+var xssRule = {
+  id: "xss",
+  description: "Detecta sinks perigosos de XSS (innerHTML, document.write, dangerouslySetInnerHTML, etc.)",
+  check(filePath, content) {
+    const eslintFindings = runEslintRules(filePath, content, RULES2, PLUGINS2).map((finding) => ({
+      ruleId: finding.ruleId,
+      message: `Poss\xEDvel XSS: ${finding.message}`,
+      file: filePath,
+      line: finding.line,
+      severity: "high"
+    }));
+    return [...eslintFindings, ...findDangerouslySetInnerHtmlFindings(filePath, content)];
+  }
+};
+
+// src/rules/xxe-unsafe-xml-parsing.rule.ts
+var XML_PARSE_METHOD_NAMES = /* @__PURE__ */ new Set(["parseXmlString", "parseXml"]);
+var RISKY_OPTION_NAMES = /* @__PURE__ */ new Set(["noent", "dtdload"]);
+var hasRiskyOptionEnabled = (options) => {
+  if (options?.type !== "ObjectExpression") {
+    return false;
+  }
+  const properties = options.properties;
+  return properties?.some((property) => {
+    const key = property.key;
+    const value = property.value;
+    return key?.type === "Identifier" && RISKY_OPTION_NAMES.has(key.name) && value?.type === "BooleanLiteral" && value.value === true;
+  }) ?? false;
+};
+var isUnsafeXmlParseCall = (node) => {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") {
+    return false;
+  }
+  const property = callee.property;
+  if (property?.type !== "Identifier" || !XML_PARSE_METHOD_NAMES.has(property.name)) {
+    return false;
+  }
+  const args = node.arguments;
+  return hasRiskyOptionEnabled(args?.[1]);
+};
+var findUnsafeXmlParsingLines = (filePath, content) => {
+  const lines = /* @__PURE__ */ new Set();
+  const sourceFile = parseSourceFile(filePath, content);
+  visitSourceNodes(sourceFile, (node) => {
+    if (isUnsafeXmlParseCall(node) && node.loc) {
+      lines.add(node.loc.start.line);
+    }
+  });
+  return [...lines].sort((a, b) => a - b);
+};
+var xxeUnsafeXmlParsingRule = {
+  id: "xxe-unsafe-xml-parsing",
+  description: "Detecta parsing de XML com substitui\xE7\xE3o de entidades e/ou carregamento de DTD externo habilitados (risco de XXE)",
+  check(filePath, content) {
+    return findUnsafeXmlParsingLines(filePath, content).map((line) => ({
+      ruleId: "xxe-unsafe-xml-parsing",
+      message: "Parser XML com noent/dtdload habilitado \u2014 risco de XML External Entity (XXE)",
+      file: filePath,
+      line,
+      severity: "critical"
+    }));
+  }
+};
+
+// src/rules/index.ts
+var allRules = [
+  noEvalRule,
+  noHardcodedSecretRule,
+  unsafeSqlRule,
+  longFunctionRule,
+  deepNestingRule,
+  highComplexityRule,
+  tooManyIfsRule,
+  tooManyForLoopsRule,
+  tooManyWhileLoopsRule,
+  tooManyTryCatchRule,
+  tooManySwitchCasesRule,
+  promiseNoCatchRule,
+  awaitNoTryCatchRule,
+  floatingPromiseRule,
+  noAnyRule,
+  emptyCatchRule,
+  commandInjectionRule,
+  jwtNoExpirationRule,
+  permissiveCorsRule,
+  insecureRandomTokenRule,
+  weakHashAlgorithmRule,
+  tlsValidationDisabledRule,
+  expressMissingBodyLimitRule,
+  xssRule,
+  securityLintRule,
+  weakSecretFallbackRule,
+  jwtDecodeWithoutVerifyRule,
+  xxeUnsafeXmlParsingRule,
+  sensitiveDataInLogsRule,
+  publicEnvVarSecretRule
+];
+
+// src/commands/rules/rules.command.ts
+var registerRulesCommand = (program) => {
+  program.command("rules").description("Lista as regras de an\xE1lise dispon\xEDveis").action(() => {
+    const table = new Table3({ head: ["ID", "Descri\xE7\xE3o"] });
+    for (const rule of allRules) {
+      table.push([rule.id, rule.description]);
+    }
+    console.log(table.toString());
+  });
+};
+
+// src/commands/scan/scan.command.ts
+import { resolve as resolve2 } from "path";
+var parseConcurrency = (value) => {
+  const concurrency = Number(value);
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new Error("A concorr\xEAncia deve ser um inteiro positivo.");
+  }
+  return concurrency;
+};
+var parseLocalSemgrepConfig = (value) => {
+  if (/^[a-z][a-z\d+.-]*:\/\//i.test(value)) {
+    throw new Error("A configura\xE7\xE3o do Semgrep deve ser um arquivo local.");
+  }
+  return resolve2(value);
+};
+var registerScanCommand = (program) => {
+  program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).action(
+    (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
+  );
+};
+
+// src/commands/security-lint/security-lint.command.ts
+var registerSecurityLintCommand = (program) => {
+  program.command("security-lint").description("Detecta padr\xF5es de seguran\xE7a gen\xE9ricos via eslint-plugin-security").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [securityLintRule], "Checking generic security patterns...", options)
+  );
+};
+
+// src/commands/sensitive-data-in-logs/sensitive-data-in-logs.command.ts
+var registerSensitiveDataInLogsCommand = (program) => {
+  program.command("sensitive-data-in-logs").description("Detecta senhas/segredos/tokens sendo passados para chamadas de log").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
+    await scanAndReport(path, [sensitiveDataInLogsRule], "Checking sensitive data in logs...", options);
+  });
+};
+
+// src/commands/tls-validation-disabled/tls-validation-disabled.command.ts
+var registerTlsValidationDisabledCommand = (program) => {
+  program.command("tls-validation-disabled").description("Detecta a desativa\xE7\xE3o da valida\xE7\xE3o de certificados TLS").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tlsValidationDisabledRule], "Checking TLS validation...", options)
+  );
+};
+
+// src/commands/too-many-for-loops/too-many-for-loops.command.ts
+var registerTooManyForLoopsCommand = (program) => {
+  program.command("too-many-for-loops").description('Detecta fun\xE7\xF5es com muitos loops "for"/"for-in"/"for-of"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tooManyForLoopsRule], "Checking for-loop count...", options)
+  );
+};
+
+// src/commands/too-many-ifs/too-many-ifs.command.ts
+var registerTooManyIfsCommand = (program) => {
+  program.command("too-many-ifs").description('Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tooManyIfsRule], "Checking if count...", options)
+  );
+};
+
+// src/commands/too-many-switch-cases/too-many-switch-cases.command.ts
+var registerTooManySwitchCasesCommand = (program) => {
+  program.command("too-many-switch-cases").description('Detecta "switch" com muitos "case" (considere um mapa/lookup)').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tooManySwitchCasesRule], "Checking switch cases...", options)
+  );
+};
+
+// src/commands/too-many-try-catch/too-many-try-catch.command.ts
+var registerTooManyTryCatchCommand = (program) => {
+  program.command("too-many-try-catch").description('Detecta fun\xE7\xF5es com muitos blocos "try/catch"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tooManyTryCatchRule], "Checking try/catch count...", options)
+  );
+};
+
+// src/commands/too-many-while-loops/too-many-while-loops.command.ts
+var registerTooManyWhileLoopsCommand = (program) => {
+  program.command("too-many-while-loops").description('Detecta fun\xE7\xF5es com muitos loops "while"/"do-while"').argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [tooManyWhileLoopsRule], "Checking while-loop count...", options)
+  );
+};
+
+// src/commands/unhandled-promises/unhandled-promises.command.ts
+var registerUnhandledPromisesCommand = (program) => {
+  program.command("unhandled-promises").description("Detecta promises sem tratamento (sem .catch, await sem try/catch ou promises soltas)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(
+      path,
+      [promiseNoCatchRule, awaitNoTryCatchRule, floatingPromiseRule],
+      "Checking unhandled promises...",
+      options
+    )
+  );
+};
+
+// src/commands/unsafe-sql/unsafe-sql.command.ts
+var registerUnsafeSqlCommand = (program) => {
+  program.command("unsafe-sql").description("Detecta concatena\xE7\xE3o insegura de SQL (risco de SQL injection)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [unsafeSqlRule], "Checking unsafe SQL...", options)
+  );
+};
+
+// src/commands/weak-hash-algorithm/weak-hash-algorithm.command.ts
+var registerWeakHashAlgorithmCommand = (program) => {
+  program.command("weak-hash-algorithm").description("Detecta o uso de algoritmos de hash fracos (MD5, SHA-1)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [weakHashAlgorithmRule], "Checking weak hash algorithms...", options)
+  );
+};
+
+// src/commands/weak-secret-fallback/weak-secret-fallback.command.ts
+var registerWeakSecretFallbackCommand = (program) => {
+  program.command("weak-secret-fallback").description(
+    "Detecta uma vari\xE1vel de ambiente de segredo/chave com um valor hardcoded como fallback (|| ou ??)"
+  ).argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
+    await scanAndReport(path, [weakSecretFallbackRule], "Checking weak secret fallbacks...", options);
+  });
+};
+
+// src/commands/xss/xss.command.ts
+var registerXssCommand = (program) => {
+  program.command("xss").description("Detecta sinks perigosos de XSS (innerHTML, document.write, etc.)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(
+    (path, options) => scanAndReport(path, [xssRule], "Checking XSS sinks...", options)
+  );
+};
+
+// src/commands/xxe-unsafe-xml-parsing/xxe-unsafe-xml-parsing.command.ts
+var registerXxeUnsafeXmlParsingCommand = (program) => {
+  program.command("xxe-unsafe-xml-parsing").description("Detecta parsing de XML com noent/dtdload habilitados (risco de XXE)").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--json", "exibe o resultado em JSON").action(async (path, options) => {
+    await scanAndReport(path, [xxeUnsafeXmlParsingRule], "Checking unsafe XML parsing...", options);
+  });
+};
+
+// src/cli.ts
+var printBanner = () => {
+  if (!process.stdout.isTTY) {
+    return;
+  }
+  const banner = figlet.textSync("CodeSentry", { font: "Standard" });
+  console.log(gradient(["cyan", "magenta"])(banner));
+};
+var registerAnalysisCommands = (program) => {
+  registerScanCommand(program);
+  registerLongFunctionsCommand(program);
+  registerDeepNestingCommand(program);
+  registerHighComplexityCommand(program);
+  registerTooManyIfsCommand(program);
+  registerTooManyForLoopsCommand(program);
+  registerTooManyWhileLoopsCommand(program);
+  registerTooManyTryCatchCommand(program);
+  registerTooManySwitchCasesCommand(program);
+};
+var registerQualityCommands = (program) => {
+  registerUnhandledPromisesCommand(program);
+  registerNoAnyCommand(program);
+  registerEmptyCatchCommand(program);
+  registerRulesCommand(program);
+  registerHelpCommand(program);
+};
+var registerSecurityCommands = (program) => {
+  registerNoEvalCommand(program);
+  registerCommandInjectionCommand(program);
+  registerUnsafeSqlCommand(program);
+  registerJwtNoExpirationCommand(program);
+  registerNoHardcodedSecretCommand(program);
+  registerPermissiveCorsCommand(program);
+  registerInsecureRandomTokenCommand(program);
+  registerWeakHashAlgorithmCommand(program);
+  registerTlsValidationDisabledCommand(program);
+  registerExpressMissingBodyLimitCommand(program);
+  registerXssCommand(program);
+  registerSecurityLintCommand(program);
+  registerDependencyAuditCommand(program);
+  registerWeakSecretFallbackCommand(program);
+  registerJwtDecodeWithoutVerifyCommand(program);
+  registerXxeUnsafeXmlParsingCommand(program);
+  registerSensitiveDataInLogsCommand(program);
+  registerPublicEnvVarSecretCommand(program);
+};
+var createCli = () => {
+  printBanner();
+  const program = new Command().name("codesentry").description("CLI de verifica\xE7\xE3o de vulnerabilidades e qualidade de c\xF3digo").version("0.1.0").helpCommand(false);
+  registerInitCommand(program);
+  registerAnalysisCommands(program);
+  registerQualityCommands(program);
+  registerSecurityCommands(program);
+  return program;
+};
+
+// src/index.ts
+createCli().parseAsync(process.argv);