codeslick-cli 1.3.0 → 1.4.0

package/dist/src/lib/analyzers/terraform/parser.js

@@ -0,0 +1,237 @@
+"use strict";
+/**
+ * Terraform HCL Parser
+ *
+ * WR3: IaC Scanning - Simple regex-based HCL parser
+ * Extracts resource blocks, attributes, and nested blocks from Terraform files
+ *
+ * MVP Approach: Regex-based parsing (fast, good enough for security checks)
+ * Future: Can swap for full HCL library if needed (no API changes required)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTerraform = parseTerraform;
+exports.getAttribute = getAttribute;
+exports.hasAttribute = hasAttribute;
+function parseTerraform(code) {
+    const lines = code.split('\n');
+    const resources = [];
+    const dataBlocks = [];
+    const variables = [];
+    const outputs = [];
+    const locals = [];
+    const modules = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i].trim();
+        // Match resource blocks: resource "aws_s3_bucket" "my_bucket" {
+        const resourceMatch = line.match(/^resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/);
+        if (resourceMatch) {
+            const block = parseBlock(lines, i, 'resource', [resourceMatch[1], resourceMatch[2]]);
+            const resource = {
+                ...block,
+                resourceType: resourceMatch[1],
+                resourceName: resourceMatch[2],
+                provider: detectProvider(resourceMatch[1]),
+            };
+            resources.push(resource);
+            i = block.endLine + 1;
+            continue;
+        }
+        // Match data blocks: data "aws_ami" "ubuntu" {
+        const dataMatch = line.match(/^data\s+"([^"]+)"\s+"([^"]+)"\s*\{/);
+        if (dataMatch) {
+            const block = parseBlock(lines, i, 'data', [dataMatch[1], dataMatch[2]]);
+            dataBlocks.push(block);
+            i = block.endLine + 1;
+            continue;
+        }
+        // Match variable blocks: variable "instance_type" {
+        const variableMatch = line.match(/^variable\s+"([^"]+)"\s*\{/);
+        if (variableMatch) {
+            const block = parseBlock(lines, i, 'variable', [variableMatch[1]]);
+            variables.push(block);
+            i = block.endLine + 1;
+            continue;
+        }
+        // Match output blocks: output "instance_ip" {
+        const outputMatch = line.match(/^output\s+"([^"]+)"\s*\{/);
+        if (outputMatch) {
+            const block = parseBlock(lines, i, 'output', [outputMatch[1]]);
+            outputs.push(block);
+            i = block.endLine + 1;
+            continue;
+        }
+        // Match locals blocks: locals {
+        const localsMatch = line.match(/^locals\s*\{/);
+        if (localsMatch) {
+            const block = parseBlock(lines, i, 'locals', []);
+            locals.push(block);
+            i = block.endLine + 1;
+            continue;
+        }
+        // Match module blocks: module "vpc" {
+        const moduleMatch = line.match(/^module\s+"([^"]+)"\s*\{/);
+        if (moduleMatch) {
+            const block = parseBlock(lines, i, 'module', [moduleMatch[1]]);
+            modules.push(block);
+            i = block.endLine + 1;
+            continue;
+        }
+        i++;
+    }
+    return { resources, dataBlocks, variables, outputs, locals, modules };
+}
+function parseBlock(lines, startLine, type, labels) {
+    const attributes = {};
+    const blocks = [];
+    let braceDepth = 0;
+    let currentLine = startLine;
+    // Start with opening brace
+    braceDepth = 1;
+    currentLine++;
+    while (currentLine < lines.length && braceDepth > 0) {
+        const line = lines[currentLine].trim();
+        // Count braces
+        const openBraces = (line.match(/\{/g) || []).length;
+        const closeBraces = (line.match(/\}/g) || []).length;
+        braceDepth += openBraces - closeBraces;
+        if (braceDepth === 0)
+            break;
+        // Skip comments and empty lines
+        if (line.startsWith('#') || line.startsWith('//') || line === '') {
+            currentLine++;
+            continue;
+        }
+        // Parse nested blocks (e.g., versioning { enabled = true })
+        const nestedBlockMatch = line.match(/^(\w+)\s*\{/);
+        if (nestedBlockMatch && !line.includes('=')) {
+            const nestedBlock = parseBlock(lines, currentLine, nestedBlockMatch[1], []);
+            blocks.push(nestedBlock);
+            // Attributes from nested blocks are also stored flat for easier access
+            attributes[nestedBlockMatch[1]] = nestedBlock.attributes;
+            currentLine = nestedBlock.endLine + 1;
+            continue;
+        }
+        // Parse attributes (key = value)
+        const attrMatch = line.match(/^(\w+)\s*=\s*(.+?)(?:\s*#.*)?$/);
+        if (attrMatch) {
+            const key = attrMatch[1];
+            let valueStr = attrMatch[2].trim();
+            // Check if this is a multiline value (jsonencode, lists, objects)
+            const isMultiline = (valueStr.includes('jsonencode(') && !valueStr.includes(')')) ||
+                (valueStr.startsWith('[') && !valueStr.endsWith(']')) ||
+                (valueStr.startsWith('{') && !valueStr.endsWith('}'));
+            if (isMultiline) {
+                // Accumulate lines until we find the closing delimiter
+                let parenDepth = (valueStr.match(/\(/g) || []).length - (valueStr.match(/\)/g) || []).length;
+                let braceDepth = (valueStr.match(/\{/g) || []).length - (valueStr.match(/\}/g) || []).length;
+                let bracketDepth = (valueStr.match(/\[/g) || []).length - (valueStr.match(/\]/g) || []).length;
+                currentLine++;
+                while (currentLine < lines.length && (parenDepth > 0 || braceDepth > 0 || bracketDepth > 0)) {
+                    const nextLine = lines[currentLine].trim();
+                    // Skip empty lines and comments
+                    if (nextLine === '' || nextLine.startsWith('#') || nextLine.startsWith('//')) {
+                        currentLine++;
+                        continue;
+                    }
+                    valueStr += ' ' + nextLine; // Add space separator between lines
+                    // Update depths
+                    parenDepth += (nextLine.match(/\(/g) || []).length - (nextLine.match(/\)/g) || []).length;
+                    braceDepth += (nextLine.match(/\{/g) || []).length - (nextLine.match(/\}/g) || []).length;
+                    bracketDepth += (nextLine.match(/\[/g) || []).length - (nextLine.match(/\]/g) || []).length;
+                    currentLine++;
+                }
+            }
+            const value = parseValue(valueStr);
+            attributes[key] = value;
+        }
+        currentLine++;
+    }
+    return {
+        type,
+        labels,
+        attributes,
+        blocks,
+        startLine: startLine + 1, // 1-indexed for display
+        endLine: currentLine + 1,
+    };
+}
+function parseValue(value) {
+    // Remove trailing comma
+    value = value.replace(/,$/, '').trim();
+    // Boolean
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    // Number
+    if (/^\d+(\.\d+)?$/.test(value))
+        return parseFloat(value);
+    // String (remove quotes)
+    if (value.startsWith('"') && value.endsWith('"')) {
+        return value.slice(1, -1);
+    }
+    // Handle jsonencode() function - extract JSON and parse it
+    const jsonencodeMatch = value.match(/jsonencode\s*\(([\s\S]+)\)$/);
+    if (jsonencodeMatch) {
+        try {
+            // Extract the content inside jsonencode()
+            let jsonContent = jsonencodeMatch[1].trim();
+            // Handle HCL-style JSON (without quotes on keys)
+            // Convert { Version = "2012-10-17" } to { "Version": "2012-10-17" }
+            // Step 1: Replace '=' with ':'
+            jsonContent = jsonContent.replace(/(\w+)\s*=/g, '"$1":');
+            // Step 2: Add commas after values (before next key or closing bracket/brace)
+            // Match: value followed by whitespace and then a key or closing delimiter
+            jsonContent = jsonContent
+                .replace(/("\w+":\s*"[^"]*")\s+(?=")/g, '$1,') // After quoted strings
+                .replace(/("\w+":\s*\d+)\s+(?=")/g, '$1,') // After numbers
+                .replace(/("\w+":\s*(?:true|false))\s+(?=")/g, '$1,') // After booleans
+                .replace(/(\])\s+(?=")/g, '$1,') // After arrays
+                .replace(/(\})\s+(?=")/g, '$1,'); // After objects
+            // Step 3: Quote unquoted string values
+            jsonContent = jsonContent.replace(/:\s*([a-zA-Z_]\w*(?:\s*\|\s*[a-zA-Z_]\w*)*)\s*([,\]\}])/g, ': "$1"$2');
+            return JSON.parse(jsonContent);
+        }
+        catch (e) {
+            // If JSON parsing fails, return as string
+            return value;
+        }
+    }
+    // List (basic support)
+    if (value.startsWith('[') && value.endsWith(']')) {
+        const items = value
+            .slice(1, -1)
+            .split(',')
+            .map(item => parseValue(item.trim()))
+            .filter(item => item !== '');
+        return items;
+    }
+    // Keep as string (references, complex expressions)
+    return value;
+}
+function detectProvider(resourceType) {
+    if (resourceType.startsWith('aws_'))
+        return 'aws';
+    if (resourceType.startsWith('azurerm_'))
+        return 'azure';
+    if (resourceType.startsWith('google_'))
+        return 'gcp';
+    return 'unknown';
+}
+// Helper to safely access nested attributes
+function getAttribute(resource, path) {
+    const parts = path.split('.');
+    let current = resource.attributes;
+    for (const part of parts) {
+        if (current === undefined || current === null)
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+// Helper to check if attribute exists
+function hasAttribute(resource, path) {
+    return getAttribute(resource, path) !== undefined;
+}
+//# sourceMappingURL=parser.js.map

package/dist/src/lib/analyzers/terraform/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/terraform/parser.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAIH,wCA6EC;AA0KD,oCAUC;AAGD,oCAEC;AAtQD,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7B,gEAAgE;QAChE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAsB;gBAClC,GAAG,KAAK;gBACR,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC9B,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC9B,QAAQ,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAC3C,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,+CAA+C;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,oDAAoD;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,gCAAgC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CACjB,KAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAgB;IAEhB,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAG,SAAS,CAAC;IAE5B,2BAA2B;IAC3B,UAAU,GAAG,CAAC,CAAC;IACf,WAAW,EAAE,CAAC;IAEd,OAAO,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAEvC,eAAe;QACf,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACrD,UAAU,IAAI,UAAU,GAAG,WAAW,CAAC;QAEvC,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM;QAE5B,gCAAgC;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACjE,WAAW,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,4DAA4D;QAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,uEAAuE;YACvE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC;YACzD,WAAW,GAAG,WAAW,CAAC,OAAO,GAAG,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEnC,kEAAkE;YAClE,MAAM,WAAW,GACf,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7D,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACrD,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAExD,IAAI,WAAW,EAAE,CAAC;gBAChB,uDAAuD;gBACvD,IAAI,UAAU,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7F,IAAI,UAAU,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC7F,IAAI,YAAY,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAE/F,WAAW,EAAE,CAAC;gBACd,OAAO,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;oBAE3C,gCAAgC;oBAChC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7E,WAAW,EAAE,CAAC;wBACd,SAAS;oBACX,CAAC;oBAED,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,oCAAoC;oBAEhE,gBAAgB;oBAChB,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;oBAC1F,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;oBAC1F,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;oBAE5F,WAAW,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACnC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QAED,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,UAAU;QACV,MAAM;QACN,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,wBAAwB;QAClD,OAAO,EAAE,WAAW,GAAG,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,wBAAwB;IACxB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,UAAU;IACV,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEpC,SAAS;IACT,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAE1D,yBAAyB;IACzB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,2DAA2D;IAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnE,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE5C,iDAAiD;YACjD,oEAAoE;YAEpE,+BAA+B;YAC/B,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAEzD,6EAA6E;YAC7E,0EAA0E;YAC1E,WAAW,GAAG,WAAW;iBACtB,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAE,uBAAuB;iBACtE,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAM,gBAAgB;iBAC/D,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAE,iBAAiB;iBACvE,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAgB,eAAe;iBAC9D,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAe,gBAAgB;YAElE,uCAAuC;YACvC,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,0DAA0D,EAAE,UAAU,CAAC,CAAC;YAE1G,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0CAA0C;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK;aAChB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;aACpC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mDAAmD;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC;IACxD,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4CAA4C;AAC5C,SAAgB,YAAY,CAAC,QAA2B,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAQ,QAAQ,CAAC,UAAU,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sCAAsC;AACtC,SAAgB,YAAY,CAAC,QAA2B,EAAE,IAAY;IACpE,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC;AACpD,CAAC"}

package/dist/src/lib/analyzers/terraform/types.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Terraform Analyzer - Type Definitions
+ *
+ * WR3: IaC Scanning - Terraform Support
+ * Defines TypeScript interfaces for Terraform HCL resources
+ */
+export interface TerraformBlock {
+    type: string;
+    labels: string[];
+    attributes: Record<string, any>;
+    blocks: TerraformBlock[];
+    startLine: number;
+    endLine: number;
+}
+export interface TerraformResource extends TerraformBlock {
+    resourceType: string;
+    resourceName: string;
+    provider: 'aws' | 'azure' | 'gcp' | 'unknown';
+}
+export interface ParsedTerraform {
+    resources: TerraformResource[];
+    dataBlocks: TerraformBlock[];
+    variables: TerraformBlock[];
+    outputs: TerraformBlock[];
+    locals: TerraformBlock[];
+    modules: TerraformBlock[];
+}
+export interface AWSS3Bucket {
+    bucket?: string;
+    acl?: string;
+    versioning?: {
+        enabled?: boolean;
+    };
+    logging?: {
+        target_bucket?: string;
+    };
+    server_side_encryption_configuration?: {
+        rule?: {
+            apply_server_side_encryption_by_default?: {
+                sse_algorithm?: string;
+            };
+        };
+    };
+    public_access_block?: {
+        block_public_acls?: boolean;
+        block_public_policy?: boolean;
+        ignore_public_acls?: boolean;
+        restrict_public_buckets?: boolean;
+    };
+}
+export interface AWSIAMPolicy {
+    name?: string;
+    policy?: string | object;
+    path?: string;
+}
+export interface AWSIAMRole {
+    name?: string;
+    assume_role_policy?: string | object;
+    managed_policy_arns?: string[];
+}
+export interface AWSIAMPolicyDocument {
+    Version?: string;
+    Statement?: Array<{
+        Effect?: 'Allow' | 'Deny';
+        Action?: string | string[];
+        Resource?: string | string[];
+        Principal?: any;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/lib/analyzers/terraform/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/terraform/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAGD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,oCAAoC,CAAC,EAAE;QACrC,IAAI,CAAC,EAAE;YACL,uCAAuC,CAAC,EAAE;gBACxC,aAAa,CAAC,EAAE,MAAM,CAAC;aACxB,CAAC;SACH,CAAC;KACH,CAAC;IACF,mBAAmB,CAAC,EAAE;QACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7B,SAAS,CAAC,EAAE,GAAG,CAAC;KACjB,CAAC,CAAC;CACJ"}

package/dist/src/lib/analyzers/terraform/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Terraform Analyzer - Type Definitions
+ *
+ * WR3: IaC Scanning - Terraform Support
+ * Defines TypeScript interfaces for Terraform HCL resources
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/lib/analyzers/terraform/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/terraform/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG"}

package/dist/src/lib/analyzers/terraform-analyzer.d.ts

@@ -0,0 +1,49 @@
+/**
+ * ⚠️ SHARED MODULE: Terraform Security Analyzer
+ *
+ * CRITICAL: This module is used by BOTH WebTool and GitHub App
+ *
+ * WebTool uses this for:
+ * - /api/analyze endpoint - Interactive single-file IaC analysis (<5s target)
+ * - Real-time misconfiguration detection for individual developers
+ *
+ * GitHub App uses this for:
+ * - /api/github/webhook - Batch PR analysis of Terraform files (10-30s OK)
+ * - Automated IaC security checks for professional teams
+ *
+ * WR3: IaC Scanning - Terraform Support
+ * Day 1-2: AWS S3 and IAM checks (10 checks total)
+ *
+ * ⚠️ BEFORE MODIFYING THIS FILE:
+ * 1. Run all analyzer tests: npm test terraform-analyzer
+ * 2. Test WebTool: Paste Terraform at /analyze → Verify results
+ * 3. Test GitHub: Open PR with .tf file → Verify webhook comment
+ * 4. Verify performance: Analysis must complete in <5s per file
+ * 5. Check detection rate: All 10 Terraform checks must still detect
+ *
+ * CRITICAL OUTPUT FORMAT (DO NOT CHANGE):
+ * - result.security.vulnerabilities - Used by both systems
+ * - Each vulnerability has: line, message, severity, cvssScore, owasp, cwe
+ * - Changing this structure breaks BOTH WebTool and GitHub UI parsing
+ *
+ * See: docs/technical/WEBTOOL_GITHUB_SEPARATION.md
+ *
+ * Last modified: 2026-02-04 (WR3 Day 1-2)
+ * Last verified (both systems): TBD (after first commit)
+ */
+import { ICodeAnalyzer, AnalyzerInput, AnalyzerResult } from './types';
+import { SupportedLanguage } from '../types';
+export declare class TerraformAnalyzer implements ICodeAnalyzer {
+    readonly language: SupportedLanguage;
+    analyze(input: AnalyzerInput): Promise<AnalyzerResult>;
+    private analyzeSecurity;
+    private calculateMetrics;
+    private detectProductionContext;
+    validateSyntax(code: string): Promise<boolean>;
+    getLanguageInfo(): {
+        name: string;
+        extensions: string[];
+        description: string;
+    };
+}
+//# sourceMappingURL=terraform-analyzer.d.ts.map

package/dist/src/lib/analyzers/terraform-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-analyzer.d.ts","sourceRoot":"","sources":["../../../../../../src/lib/analyzers/terraform-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAyB,MAAM,SAAS,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAgB7C,qBAAa,iBAAkB,YAAW,aAAa;IACrD,SAAgB,QAAQ,EAAE,iBAAiB,CAAe;IAEpD,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IA6C5D,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,uBAAuB;IAMzB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,eAAe,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB;CAOF"}

package/dist/src/lib/analyzers/terraform-analyzer.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * ⚠️ SHARED MODULE: Terraform Security Analyzer
+ *
+ * CRITICAL: This module is used by BOTH WebTool and GitHub App
+ *
+ * WebTool uses this for:
+ * - /api/analyze endpoint - Interactive single-file IaC analysis (<5s target)
+ * - Real-time misconfiguration detection for individual developers
+ *
+ * GitHub App uses this for:
+ * - /api/github/webhook - Batch PR analysis of Terraform files (10-30s OK)
+ * - Automated IaC security checks for professional teams
+ *
+ * WR3: IaC Scanning - Terraform Support
+ * Day 1-2: AWS S3 and IAM checks (10 checks total)
+ *
+ * ⚠️ BEFORE MODIFYING THIS FILE:
+ * 1. Run all analyzer tests: npm test terraform-analyzer
+ * 2. Test WebTool: Paste Terraform at /analyze → Verify results
+ * 3. Test GitHub: Open PR with .tf file → Verify webhook comment
+ * 4. Verify performance: Analysis must complete in <5s per file
+ * 5. Check detection rate: All 10 Terraform checks must still detect
+ *
+ * CRITICAL OUTPUT FORMAT (DO NOT CHANGE):
+ * - result.security.vulnerabilities - Used by both systems
+ * - Each vulnerability has: line, message, severity, cvssScore, owasp, cwe
+ * - Changing this structure breaks BOTH WebTool and GitHub UI parsing
+ *
+ * See: docs/technical/WEBTOOL_GITHUB_SEPARATION.md
+ *
+ * Last modified: 2026-02-04 (WR3 Day 1-2)
+ * Last verified (both systems): TBD (after first commit)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TerraformAnalyzer = void 0;
+const parser_1 = require("./terraform/parser");
+const aws_checks_1 = require("./terraform/aws-checks");
+class TerraformAnalyzer {
+    constructor() {
+        this.language = 'terraform';
+    }
+    async analyze(input) {
+        const result = {
+            syntax: { valid: true, errors: [], lineErrors: [] },
+            quality: { score: 100, issues: [] },
+            performance: { score: 100, suggestions: [] },
+            security: { vulnerabilities: [] },
+            metrics: { complexity: 1, maintainability: 100, lines: 0, functions: 0 },
+        };
+        try {
+            // Parse Terraform HCL
+            const parsed = (0, parser_1.parseTerraform)(input.code);
+            // Analyze security for all resources
+            this.analyzeSecurity(parsed.resources, result);
+            // Calculate basic metrics
+            this.calculateMetrics(input.code, result);
+            // Feature 1 Phase 1: Smart Triage with EPSS scoring
+            // TODO (WR3 Week 2): Re-enable triage after fixing severity vs priority field issue
+            // For MVP Day 1-2, disabled to test base checks without triage interference
+            // try {
+            //   if (result.security.vulnerabilities.length > 0) {
+            //     const triageResults = await triageSecurityIssues(result.security.vulnerabilities, {
+            //       environmentContext: {
+            //         isProduction: this.detectProductionContext(input.filename || ''),
+            //       },
+            //     });
+            //     // Update vulnerabilities with triaged versions (priority, triageReason, epssScore)
+            //     result.security.vulnerabilities = triageResults.map(tr => tr.issue);
+            //   }
+            // } catch (triageError) {
+            //   // Triage is optional enhancement - don't fail analysis if it errors
+            //   console.warn('[Terraform Analyzer] Triage service failed:', triageError instanceof Error ? triageError.message : 'Unknown error');
+            // }
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            result.syntax.valid = false;
+            result.syntax.errors.push(`Terraform analysis error: ${errorMessage}`);
+        }
+        return result;
+    }
+    analyzeSecurity(resources, result) {
+        const checks = [
+            // AWS S3 Checks (5 checks)
+            aws_checks_1.checkS3PublicACL,
+            aws_checks_1.checkS3Encryption,
+            aws_checks_1.checkS3Versioning,
+            aws_checks_1.checkS3Logging,
+            aws_checks_1.checkS3PublicAccessBlock,
+            // AWS IAM Checks (5 checks)
+            aws_checks_1.checkIAMWildcardActions,
+            aws_checks_1.checkIAMWildcardResources,
+            aws_checks_1.checkIAMAdminPolicy,
+            aws_checks_1.checkIAMPrivilegeEscalation,
+            aws_checks_1.checkIAMAssumeRolePolicy,
+        ];
+        for (const resource of resources) {
+            for (const check of checks) {
+                const vulnerability = check(resource);
+                if (vulnerability) {
+                    result.security.vulnerabilities.push(vulnerability);
+                }
+            }
+        }
+    }
+    calculateMetrics(code, result) {
+        const lines = code.split('\n');
+        result.metrics.lines = lines.length;
+        // Count resources as "functions" for metrics
+        const resourceCount = (code.match(/^resource\s+"/gm) || []).length;
+        result.metrics.functions = resourceCount;
+        // Basic complexity based on number of resources
+        result.metrics.complexity = Math.max(1, resourceCount);
+        result.metrics.maintainability = Math.max(50, 100 - resourceCount * 2);
+    }
+    detectProductionContext(filename) {
+        const prodIndicators = ['prod', 'production', 'live', 'main'];
+        const filenameLower = filename.toLowerCase();
+        return prodIndicators.some(indicator => filenameLower.includes(indicator));
+    }
+    async validateSyntax(code) {
+        try {
+            (0, parser_1.parseTerraform)(code);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    getLanguageInfo() {
+        return {
+            name: 'Terraform',
+            extensions: ['.tf', '.tfvars'],
+            description: 'Infrastructure as Code (IaC) security scanning for Terraform HCL files',
+        };
+    }
+}
+exports.TerraformAnalyzer = TerraformAnalyzer;
+//# sourceMappingURL=terraform-analyzer.js.map

package/dist/src/lib/analyzers/terraform-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-analyzer.js","sourceRoot":"","sources":["../../../../../../src/lib/analyzers/terraform-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;AAIH,+CAAoD;AACpD,uDAWgC;AAGhC,MAAa,iBAAiB;IAA9B;QACkB,aAAQ,GAAsB,WAAW,CAAC;IAgH5D,CAAC;IA9GC,KAAK,CAAC,OAAO,CAAC,KAAoB;QAChC,MAAM,MAAM,GAAmB;YAC7B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACnD,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;YACnC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5C,QAAQ,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;YACjC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;SACzE,CAAC;QAEF,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE1C,qCAAqC;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAE/C,0BAA0B;YAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAE1C,oDAAoD;YACpD,oFAAoF;YACpF,4EAA4E;YAC5E,QAAQ;YACR,sDAAsD;YACtD,0FAA0F;YAC1F,8BAA8B;YAC9B,4EAA4E;YAC5E,WAAW;YACX,UAAU;YACV,0FAA0F;YAC1F,2EAA2E;YAC3E,MAAM;YACN,0BAA0B;YAC1B,yEAAyE;YACzE,uIAAuI;YACvI,IAAI;QACN,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe,CAAC,SAAgB,EAAE,MAAsB;QAC9D,MAAM,MAAM,GAAG;YACb,2BAA2B;YAC3B,6BAAgB;YAChB,8BAAiB;YACjB,8BAAiB;YACjB,2BAAc;YACd,qCAAwB;YACxB,4BAA4B;YAC5B,oCAAuB;YACvB,sCAAyB;YACzB,gCAAmB;YACnB,wCAA2B;YAC3B,qCAAwB;SACzB,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,IAAY,EAAE,MAAsB;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAEpC,6CAA6C;QAC7C,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC;QAEzC,gDAAgD;QAChD,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAEO,uBAAuB,CAAC,QAAgB;QAC9C,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC;YACH,IAAA,uBAAc,EAAC,IAAI,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,eAAe;QAKb,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;YAC9B,WAAW,EAAE,wEAAwE;SACtF,CAAC;IACJ,CAAC;CACF;AAjHD,8CAiHC"}

package/dist/src/lib/analyzers/typescript/security-checks/type-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-security.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/type-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAgEzB"}
+{"version":3,"file":"type-security.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/type-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA0FzB"}

package/dist/src/lib/analyzers/typescript/security-checks/type-security.js

@@ -35,14 +35,29 @@ function checkTypeSecurity(lines) {
         // Skip comments and empty lines
         if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
             return;
-        // TypeScript-specific: 19. 'as any' in security-sensitive contexts - HIGH
-        if (trimmed.includes('as any') && (trimmed.includes('eval') || trimmed.includes('innerHTML'))) {
-            vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('type-assertion-security', 'Type assertion "as any" in sensitive context', 'Use specific types to maintain security', lineNumber, 'Using "as any" bypasses TypeScript\'s type checking, potentially allowing unsafe values to reach security-critical operations like eval() or innerHTML.', '(userInput as any).eval(); // Bypasses type safety, allows arbitrary code execution', [
-                'Type safety bypass',
-                'Runtime security vulnerabilities',
-                'Code injection risks',
-                'XSS vulnerabilities'
-            ], 'const unsafeCode = userInput as any;\neval(unsafeCode); // DANGEROUS: no type validation', 'const validatedCode: string = validateCode(userInput);\n// Don\'t use eval() at all, but if necessary, ensure proper validation', 'Avoid "as any" in security-sensitive contexts. Use proper type guards and validation instead of type assertions'));
+        // TypeScript-specific: 19a. Generic 'as any' - LOW (code quality, OWASP 2021/2025)
+        // Dec 16, 2025: Reclassified to LOW - code quality issue, not direct security vulnerability
+        // Uses 'any-type-usage' category which maps to LOW severity (CVSS 0.0) in centralized scoring
+        if (trimmed.includes('as any')) {
+            const isSecuritySensitive = trimmed.includes('eval') || trimmed.includes('innerHTML');
+            if (isSecuritySensitive) {
+                // 19b. 'as any' in security-sensitive contexts - HIGH
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('type-assertion-security', 'Type assertion "as any" in sensitive context', 'Use specific types to maintain security', lineNumber, 'Using "as any" bypasses TypeScript\'s type checking, potentially allowing unsafe values to reach security-critical operations like eval() or innerHTML.', '(userInput as any).eval(); // Bypasses type safety, allows arbitrary code execution', [
+                    'Type safety bypass',
+                    'Runtime security vulnerabilities',
+                    'Code injection risks',
+                    'XSS vulnerabilities'
+                ], 'const unsafeCode = userInput as any;\neval(unsafeCode); // DANGEROUS: no type validation', 'const validatedCode: string = validateCode(userInput);\n// Don\'t use eval() at all, but if necessary, ensure proper validation', 'Avoid "as any" in security-sensitive contexts. Use proper type guards and validation instead of type assertions'));
+            }
+            else {
+                // Generic 'as any' - code quality issue
+                vulnerabilities.push((0, createVulnerability_1.createTypeScriptSecurityVulnerability)('any-type-usage', 'Type assertion "as any" bypasses type safety', 'Use specific types or type guards instead of "as any"', lineNumber, 'Using "as any" disables TypeScript\'s type checking, which can mask bugs and make code harder to maintain. While not directly exploitable, it reduces code quality and may hide underlying issues.', 'const data = userInput as any; // Bypasses all type checks', [
+                    'Reduces code maintainability',
+                    'Can mask underlying bugs',
+                    'Makes refactoring harder',
+                    'Decreases type safety benefits'
+                ], 'const data = userInput as any;\ndata.someMethod(); // No type checking, runtime errors possible', '// Use type guards or proper typing\nif (isValidData(userInput)) {\n  const data: DataType = userInput;\n  data.someMethod(); // Type-safe\n}', 'Avoid "as any". Use proper type guards (typeof, instanceof), type predicates, or refactor code to use correct types. TypeScript\'s type system is designed to catch errors at compile time.'));
+            }
         }
         // TypeScript-specific: 20. Non-null assertions in security contexts - MEDIUM
         if (trimmed.includes('!') && trimmed.match(/password|token|secret|auth/i)) {

package/dist/src/lib/analyzers/typescript/security-checks/type-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"type-security.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/type-security.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAeH,8CAkEC;AA9ED,sEAAqF;AAErF;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAC/B,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,0EAA0E;QAC1E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC9F,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,yBAAyB,EACzB,8CAA8C,EAC9C,yCAAyC,EACzC,UAAU,EACV,yJAAyJ,EACzJ,qFAAqF,EACrF;gBACE,oBAAoB;gBACpB,kCAAkC;gBAClC,sBAAsB;gBACtB,qBAAqB;aACtB,EACD,0FAA0F,EAC1F,iIAAiI,EACjI,iHAAiH,CAClH,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YAC1E,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,6BAA6B,EAC7B,yCAAyC,EACzC,qCAAqC,EACrC,UAAU,EACV,yIAAyI,EACzI,8GAA8G,EAC9G;gBACE,uBAAuB;gBACvB,wBAAwB;gBACxB,2CAA2C;gBAC3C,uBAAuB;aACxB,EACD,yEAAyE,EACzE,4GAA4G,EAC5G,mIAAmI,CACpI,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"type-security.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/type-security.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAeH,8CA4FC;AAxGD,sEAAqF;AAErF;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAC/B,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,mFAAmF;QACnF,4FAA4F;QAC5F,8FAA8F;QAC9F,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAEtF,IAAI,mBAAmB,EAAE,CAAC;gBACxB,sDAAsD;gBACtD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,yBAAyB,EACzB,8CAA8C,EAC9C,yCAAyC,EACzC,UAAU,EACV,yJAAyJ,EACzJ,qFAAqF,EACrF;oBACE,oBAAoB;oBACpB,kCAAkC;oBAClC,sBAAsB;oBACtB,qBAAqB;iBACtB,EACD,0FAA0F,EAC1F,iIAAiI,EACjI,iHAAiH,CAClH,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,gBAAgB,EAChB,8CAA8C,EAC9C,uDAAuD,EACvD,UAAU,EACV,oMAAoM,EACpM,4DAA4D,EAC5D;oBACE,8BAA8B;oBAC9B,0BAA0B;oBAC1B,0BAA0B;oBAC1B,gCAAgC;iBACjC,EACD,iGAAiG,EACjG,+IAA+I,EAC/I,6LAA6L,CAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YAC1E,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,6BAA6B,EAC7B,yCAAyC,EACzC,qCAAqC,EACrC,UAAU,EACV,yIAAyI,EACzI,8GAA8G,EAC9G;gBACE,uBAAuB;gBACvB,wBAAwB;gBACxB,2CAA2C;gBAC3C,uBAAuB;aACxB,EACD,yEAAyE,EACzE,4GAA4G,EAC5G,mIAAmI,CACpI,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/security/epss-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epss-service.d.ts","sourceRoot":"","sources":["../../../../../../src/lib/security/epss-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAeD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA2H1E;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3E;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAahF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IACrD,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB,CAsBA;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,GAAE,MAAW,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAatB"}
+{"version":3,"file":"epss-service.d.ts","sourceRoot":"","sources":["../../../../../../src/lib/security/epss-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AAeD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA0I1E;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3E;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAahF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IACrD,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB,CAsBA;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,GAAE,MAAW,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAatB"}