erosolar-cli 1.7.438 → 1.7.439

package/dist/core/securityAssessment.d.ts

@@ -1,91 +0,0 @@
-/**
- * Authorized Security Assessment Framework
- *
- * Ethical security testing that requires explicit authorization.
- * Focuses on defensive assessment and remediation guidance.
- *
- * Use cases:
- * - Scanning YOUR OWN code for vulnerabilities
- * - OWASP-style security checklists
- * - Dependency vulnerability analysis
- * - Secret detection in codebases you own
- * - CTF challenge assistance
- */
-/**
- * Authorization context for security testing
- */
-export interface SecurityAuthorizationContext {
-    /** User explicitly confirms they own/have permission to test this target */
-    ownershipConfirmed: boolean;
-    /** Target scope (paths, URLs) they're authorized to test */
-    authorizedScope: string[];
-    /** Authorization timestamp */
-    authorizedAt: Date;
-    /** Type of testing authorized */
-    testingType: 'code-review' | 'dependency-scan' | 'secret-detection' | 'ctf' | 'full-assessment';
-}
-/**
- * Vulnerability finding
- */
-export interface VulnerabilityFinding {
-    id: string;
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
-    category: string;
-    title: string;
-    description: string;
-    location: {
-        file?: string;
-        line?: number;
-        snippet?: string;
-    };
-    remediation: string;
-    references: string[];
-    cwe?: string;
-    owasp?: string;
-}
-/**
- * Security assessment result
- */
-export interface SecurityAssessmentResult {
-    success: boolean;
-    scanType: string;
-    scope: string[];
-    timestamp: Date;
-    findings: VulnerabilityFinding[];
-    summary: {
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        info: number;
-    };
-    recommendations: string[];
-}
-/**
- * Verify authorization before any security testing
- */
-export declare function verifyAuthorization(context: SecurityAuthorizationContext, targetPath: string): {
-    authorized: boolean;
-    reason?: string;
-};
-/**
- * Scan source code for vulnerabilities
- */
-export declare function scanSourceCode(directory: string, context: SecurityAuthorizationContext): SecurityAssessmentResult;
-/**
- * Scan for hardcoded secrets
- */
-export declare function scanSecrets(directory: string, context: SecurityAuthorizationContext): SecurityAssessmentResult;
-/**
- * Scan npm dependencies for vulnerabilities
- */
-export declare function scanDependencies(directory: string, context: SecurityAuthorizationContext): SecurityAssessmentResult;
-/**
- * Format assessment results for display
- */
-export declare function formatAssessmentReport(result: SecurityAssessmentResult): string;
-/**
- * Create authorization context (requires user confirmation)
- */
-export declare function createAuthorizationContext(scope: string[], testingType: SecurityAuthorizationContext['testingType']): SecurityAuthorizationContext;
-//# sourceMappingURL=securityAssessment.d.ts.map

package/dist/core/securityAssessment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"securityAssessment.d.ts","sourceRoot":"","sources":["../../src/core/securityAssessment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,4EAA4E;IAC5E,kBAAkB,EAAE,OAAO,CAAC;IAC5B,4DAA4D;IAC5D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,YAAY,EAAE,IAAI,CAAC;IACnB,iCAAiC;IACjC,WAAW,EAAE,aAAa,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,KAAK,GAAG,iBAAiB,CAAC;CACjG;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AA+JD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,4BAA4B,EACrC,UAAU,EAAE,MAAM,GACjB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiC1C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,4BAA4B,GACpC,wBAAwB,CA6F1B;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,4BAA4B,GACpC,wBAAwB,CAoG1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,4BAA4B,GACpC,wBAAwB,CAqG1B;AAuCD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAuD/E;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,4BAA4B,CAAC,aAAa,CAAC,GACvD,4BAA4B,CAO9B"}

package/dist/core/securityAssessment.js

@@ -1,580 +0,0 @@
-/**
- * Authorized Security Assessment Framework
- *
- * Ethical security testing that requires explicit authorization.
- * Focuses on defensive assessment and remediation guidance.
- *
- * Use cases:
- * - Scanning YOUR OWN code for vulnerabilities
- * - OWASP-style security checklists
- * - Dependency vulnerability analysis
- * - Secret detection in codebases you own
- * - CTF challenge assistance
- */
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, extname, relative } from 'node:path';
-import { execSync } from 'node:child_process';
-// Common vulnerability patterns for static analysis
-const VULNERABILITY_PATTERNS = {
-    // Injection vulnerabilities
-    sqlInjection: {
-        patterns: [
-            /`.*\$\{.*\}.*`.*(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)/gi,
-            /(?:execute|query|prepare)\s*\(\s*[`'"].*\+/gi,
-            /\.(?:raw|unsafeRaw)\s*\(/gi,
-        ],
-        severity: 'critical',
-        category: 'Injection',
-        title: 'Potential SQL Injection',
-        cwe: 'CWE-89',
-        owasp: 'A03:2021 Injection',
-        remediation: 'Use parameterized queries or prepared statements. Never concatenate user input into SQL strings.',
-    },
-    commandInjection: {
-        patterns: [
-            /exec(?:Sync)?\s*\(\s*[`'"].*\$\{/gi,
-            /spawn(?:Sync)?\s*\(\s*[`'"].*\$\{/gi,
-            /child_process.*exec.*\+/gi,
-        ],
-        severity: 'critical',
-        category: 'Injection',
-        title: 'Potential Command Injection',
-        cwe: 'CWE-78',
-        owasp: 'A03:2021 Injection',
-        remediation: 'Avoid shell commands with user input. Use parameterized APIs or strict input validation.',
-    },
-    xss: {
-        patterns: [
-            /innerHTML\s*=\s*[^;]*\$/gi,
-            /dangerouslySetInnerHTML/gi,
-            /document\.write\s*\(/gi,
-            /\.html\s*\(\s*[^)]*\$/gi,
-        ],
-        severity: 'high',
-        category: 'XSS',
-        title: 'Potential Cross-Site Scripting',
-        cwe: 'CWE-79',
-        owasp: 'A03:2021 Injection',
-        remediation: 'Use safe DOM manipulation methods. Sanitize all user input before rendering.',
-    },
-    pathTraversal: {
-        patterns: [
-            /(?:readFile|writeFile|unlink|rmdir).*\+.*(?:req\.|params\.|query\.)/gi,
-            /\.\.\/.*\$\{/gi,
-            /path\.join\s*\([^)]*(?:req\.|params\.|query\.)/gi,
-        ],
-        severity: 'high',
-        category: 'Path Traversal',
-        title: 'Potential Path Traversal',
-        cwe: 'CWE-22',
-        owasp: 'A01:2021 Broken Access Control',
-        remediation: 'Validate and sanitize file paths. Use path.resolve() and verify paths stay within expected directories.',
-    },
-    // Authentication/Authorization
-    hardcodedCredentials: {
-        patterns: [
-            /(?:password|passwd|pwd|secret|api_key|apikey|token)\s*[:=]\s*['"]\w{8,}['"]/gi,
-            /(?:BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY)/gi,
-            /(?:aws_access_key_id|aws_secret_access_key)\s*[:=]/gi,
-        ],
-        severity: 'critical',
-        category: 'Secrets',
-        title: 'Hardcoded Credentials',
-        cwe: 'CWE-798',
-        owasp: 'A07:2021 Identification and Authentication Failures',
-        remediation: 'Use environment variables or secure secret management. Never commit secrets to version control.',
-    },
-    weakCrypto: {
-        patterns: [
-            /createHash\s*\(\s*['"](?:md5|sha1)['"]\s*\)/gi,
-            /crypto\.(?:createCipher|createDecipher)\s*\(/gi,
-            /DES|RC4|Blowfish/gi,
-        ],
-        severity: 'medium',
-        category: 'Cryptography',
-        title: 'Weak Cryptographic Algorithm',
-        cwe: 'CWE-327',
-        owasp: 'A02:2021 Cryptographic Failures',
-        remediation: 'Use strong algorithms: SHA-256+, AES-256-GCM, bcrypt/argon2 for passwords.',
-    },
-    // Insecure configuration
-    debugEnabled: {
-        patterns: [
-            /DEBUG\s*[:=]\s*['"]?true['"]?/gi,
-            /NODE_ENV\s*[:=]\s*['"]development['"]/gi,
-            /console\.(?:log|debug|trace)\s*\([^)]*(?:password|token|secret|key)/gi,
-        ],
-        severity: 'medium',
-        category: 'Configuration',
-        title: 'Debug Mode / Sensitive Logging',
-        cwe: 'CWE-489',
-        owasp: 'A05:2021 Security Misconfiguration',
-        remediation: 'Disable debug mode in production. Never log sensitive data.',
-    },
-    corsWildcard: {
-        patterns: [
-            /Access-Control-Allow-Origin.*\*/gi,
-            /cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/gi,
-            /cors\s*\(\s*\)/gi,
-        ],
-        severity: 'medium',
-        category: 'Configuration',
-        title: 'Overly Permissive CORS',
-        cwe: 'CWE-942',
-        owasp: 'A05:2021 Security Misconfiguration',
-        remediation: 'Restrict CORS to specific trusted origins. Avoid wildcard (*) in production.',
-    },
-    // Unsafe patterns
-    evalUsage: {
-        patterns: [
-            /\beval\s*\(/gi,
-            /new\s+Function\s*\(/gi,
-            /setTimeout\s*\(\s*['"]/gi,
-            /setInterval\s*\(\s*['"]/gi,
-        ],
-        severity: 'high',
-        category: 'Code Execution',
-        title: 'Dynamic Code Execution',
-        cwe: 'CWE-95',
-        owasp: 'A03:2021 Injection',
-        remediation: 'Avoid eval() and new Function(). Use safe alternatives like JSON.parse() for data.',
-    },
-    prototypePollutiion: {
-        patterns: [
-            /Object\.assign\s*\([^,]+,\s*(?:req\.|params\.|query\.|body\.)/gi,
-            /\[.*\]\s*=.*(?:req\.|params\.|query\.|body\.)/gi,
-            /__proto__|constructor\.prototype/gi,
-        ],
-        severity: 'high',
-        category: 'Object Manipulation',
-        title: 'Potential Prototype Pollution',
-        cwe: 'CWE-1321',
-        owasp: 'A03:2021 Injection',
-        remediation: 'Use Object.create(null) for dictionaries. Validate object keys before assignment.',
-    },
-};
-// Secret patterns for detection
-const SECRET_PATTERNS = [
-    { name: 'AWS Access Key', pattern: /AKIA[0-9A-Z]{16}/g },
-    { name: 'AWS Secret Key', pattern: /[A-Za-z0-9/+=]{40}/g },
-    { name: 'GitHub Token', pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g },
-    { name: 'Slack Token', pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}/g },
-    { name: 'Stripe Key', pattern: /sk_live_[0-9a-zA-Z]{24}/g },
-    { name: 'RSA Private Key', pattern: /-----BEGIN RSA PRIVATE KEY-----/g },
-    { name: 'Generic API Key', pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]/gi },
-    { name: 'Generic Secret', pattern: /(?:secret|password|passwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi },
-    { name: 'JWT Token', pattern: /eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g },
-    { name: 'NPM Token', pattern: /npm_[A-Za-z0-9]{36}/g },
-];
-/**
- * Verify authorization before any security testing
- */
-export function verifyAuthorization(context, targetPath) {
-    if (!context.ownershipConfirmed) {
-        return {
-            authorized: false,
-            reason: 'You must confirm ownership/permission before security testing.',
-        };
-    }
-    // Check if target is within authorized scope
-    const isInScope = context.authorizedScope.some((scope) => {
-        if (scope.startsWith('/')) {
-            return targetPath.startsWith(scope);
-        }
-        return targetPath.includes(scope);
-    });
-    if (!isInScope) {
-        return {
-            authorized: false,
-            reason: `Target "${targetPath}" is not within authorized scope: ${context.authorizedScope.join(', ')}`,
-        };
-    }
-    // Check authorization is recent (within 24 hours)
-    const hoursSinceAuth = (Date.now() - context.authorizedAt.getTime()) / (1000 * 60 * 60);
-    if (hoursSinceAuth > 24) {
-        return {
-            authorized: false,
-            reason: 'Authorization expired. Please re-authorize (valid for 24 hours).',
-        };
-    }
-    return { authorized: true };
-}
-/**
- * Scan source code for vulnerabilities
- */
-export function scanSourceCode(directory, context) {
-    const authCheck = verifyAuthorization(context, directory);
-    if (!authCheck.authorized) {
-        return {
-            success: false,
-            scanType: 'source-code',
-            scope: [directory],
-            timestamp: new Date(),
-            findings: [],
-            summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-            recommendations: [authCheck.reason ?? 'Authorization failed'],
-        };
-    }
-    const findings = [];
-    const extensions = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs'];
-    function scanFile(filePath) {
-        const ext = extname(filePath);
-        if (!extensions.includes(ext))
-            return;
-        let content;
-        try {
-            content = readFileSync(filePath, 'utf-8');
-        }
-        catch {
-            return;
-        }
-        const lines = content.split('\n');
-        for (const [vulnName, vulnConfig] of Object.entries(VULNERABILITY_PATTERNS)) {
-            for (const pattern of vulnConfig.patterns) {
-                const matches = content.matchAll(new RegExp(pattern.source, pattern.flags));
-                for (const match of matches) {
-                    const lineNumber = content.substring(0, match.index ?? 0).split('\n').length;
-                    const snippetLine = lines[lineNumber - 1] ?? '';
-                    findings.push({
-                        id: `${vulnName}-${filePath}-${lineNumber}`,
-                        severity: vulnConfig.severity,
-                        category: vulnConfig.category,
-                        title: vulnConfig.title,
-                        description: `Found pattern matching potential ${vulnConfig.title.toLowerCase()}.`,
-                        location: {
-                            file: relative(directory, filePath),
-                            line: lineNumber,
-                            snippet: snippetLine.trim().substring(0, 100),
-                        },
-                        remediation: vulnConfig.remediation,
-                        references: [
-                            `https://cwe.mitre.org/data/definitions/${vulnConfig.cwe?.replace('CWE-', '')}.html`,
-                        ],
-                        cwe: vulnConfig.cwe,
-                        owasp: vulnConfig.owasp,
-                    });
-                }
-            }
-        }
-    }
-    function scanDirectory(dir) {
-        const entries = readdirSync(dir);
-        for (const entry of entries) {
-            if (entry === 'node_modules' || entry === '.git' || entry === 'dist')
-                continue;
-            const fullPath = join(dir, entry);
-            const stat = statSync(fullPath);
-            if (stat.isDirectory()) {
-                scanDirectory(fullPath);
-            }
-            else {
-                scanFile(fullPath);
-            }
-        }
-    }
-    scanDirectory(directory);
-    const summary = {
-        critical: findings.filter((f) => f.severity === 'critical').length,
-        high: findings.filter((f) => f.severity === 'high').length,
-        medium: findings.filter((f) => f.severity === 'medium').length,
-        low: findings.filter((f) => f.severity === 'low').length,
-        info: findings.filter((f) => f.severity === 'info').length,
-    };
-    return {
-        success: true,
-        scanType: 'source-code',
-        scope: [directory],
-        timestamp: new Date(),
-        findings,
-        summary,
-        recommendations: generateRecommendations(findings),
-    };
-}
-/**
- * Scan for hardcoded secrets
- */
-export function scanSecrets(directory, context) {
-    const authCheck = verifyAuthorization(context, directory);
-    if (!authCheck.authorized) {
-        return {
-            success: false,
-            scanType: 'secret-detection',
-            scope: [directory],
-            timestamp: new Date(),
-            findings: [],
-            summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-            recommendations: [authCheck.reason ?? 'Authorization failed'],
-        };
-    }
-    const findings = [];
-    const extensions = ['.js', '.ts', '.jsx', '.tsx', '.json', '.env', '.yml', '.yaml', '.conf', '.config'];
-    function scanFile(filePath) {
-        const ext = extname(filePath);
-        const basename = filePath.split('/').pop() ?? '';
-        // Include .env files and config files
-        if (!extensions.includes(ext) && !basename.startsWith('.env') && !basename.includes('config')) {
-            return;
-        }
-        let content;
-        try {
-            content = readFileSync(filePath, 'utf-8');
-        }
-        catch {
-            return;
-        }
-        const lines = content.split('\n');
-        for (const secretPattern of SECRET_PATTERNS) {
-            const matches = content.matchAll(new RegExp(secretPattern.pattern.source, secretPattern.pattern.flags));
-            for (const match of matches) {
-                const lineNumber = content.substring(0, match.index ?? 0).split('\n').length;
-                const snippetLine = lines[lineNumber - 1] ?? '';
-                // Mask the secret in the output
-                const masked = match[0].substring(0, 8) + '...[REDACTED]';
-                findings.push({
-                    id: `secret-${filePath}-${lineNumber}`,
-                    severity: 'critical',
-                    category: 'Secrets',
-                    title: `Potential ${secretPattern.name}`,
-                    description: `Found what appears to be a ${secretPattern.name} in source code.`,
-                    location: {
-                        file: relative(directory, filePath),
-                        line: lineNumber,
-                        snippet: snippetLine.replace(match[0], masked).trim().substring(0, 100),
-                    },
-                    remediation: 'Remove secret from source code. Use environment variables or a secret management service.',
-                    references: [
-                        'https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/',
-                    ],
-                    cwe: 'CWE-798',
-                    owasp: 'A07:2021',
-                });
-            }
-        }
-    }
-    function scanDirectory(dir) {
-        const entries = readdirSync(dir);
-        for (const entry of entries) {
-            if (entry === 'node_modules' || entry === '.git')
-                continue;
-            const fullPath = join(dir, entry);
-            const stat = statSync(fullPath);
-            if (stat.isDirectory()) {
-                scanDirectory(fullPath);
-            }
-            else {
-                scanFile(fullPath);
-            }
-        }
-    }
-    scanDirectory(directory);
-    const summary = {
-        critical: findings.filter((f) => f.severity === 'critical').length,
-        high: findings.filter((f) => f.severity === 'high').length,
-        medium: findings.filter((f) => f.severity === 'medium').length,
-        low: findings.filter((f) => f.severity === 'low').length,
-        info: findings.filter((f) => f.severity === 'info').length,
-    };
-    return {
-        success: true,
-        scanType: 'secret-detection',
-        scope: [directory],
-        timestamp: new Date(),
-        findings,
-        summary,
-        recommendations: generateRecommendations(findings),
-    };
-}
-/**
- * Scan npm dependencies for vulnerabilities
- */
-export function scanDependencies(directory, context) {
-    const authCheck = verifyAuthorization(context, directory);
-    if (!authCheck.authorized) {
-        return {
-            success: false,
-            scanType: 'dependency-scan',
-            scope: [directory],
-            timestamp: new Date(),
-            findings: [],
-            summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-            recommendations: [authCheck.reason ?? 'Authorization failed'],
-        };
-    }
-    const findings = [];
-    try {
-        const auditOutput = execSync('npm audit --json', {
-            cwd: directory,
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const audit = JSON.parse(auditOutput);
-        if (audit.vulnerabilities) {
-            for (const [pkgName, vuln] of Object.entries(audit.vulnerabilities)) {
-                const v = vuln;
-                findings.push({
-                    id: `dep-${pkgName}`,
-                    severity: v.severity,
-                    category: 'Dependencies',
-                    title: `Vulnerable Dependency: ${pkgName}`,
-                    description: v.via
-                        .filter((x) => typeof x === 'object' && 'title' in x)
-                        .map((x) => x.title)
-                        .join(', '),
-                    location: { file: 'package.json' },
-                    remediation: v.fixAvailable
-                        ? typeof v.fixAvailable === 'object'
-                            ? `Update to ${v.fixAvailable.name}@${v.fixAvailable.version}`
-                            : 'Run npm audit fix'
-                        : 'No fix available - consider finding alternative package',
-                    references: v.via
-                        .filter((x) => typeof x === 'object' && 'url' in x)
-                        .map((x) => x.url),
-                    cwe: v.via
-                        .filter((x) => typeof x === 'object' && 'cwe' in x)
-                        .flatMap((x) => x.cwe)
-                        .join(', '),
-                });
-            }
-        }
-    }
-    catch (error) {
-        // npm audit returns non-zero if vulnerabilities found
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes('ENOENT') || message.includes('package.json')) {
-            return {
-                success: false,
-                scanType: 'dependency-scan',
-                scope: [directory],
-                timestamp: new Date(),
-                findings: [],
-                summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-                recommendations: ['No package.json found in directory'],
-            };
-        }
-        // Try to parse the output anyway
-        try {
-            const stdout = error.stdout;
-            if (stdout) {
-                const audit = JSON.parse(stdout);
-                // Process audit output...
-            }
-        }
-        catch {
-            // Ignore parse errors
-        }
-    }
-    const summary = {
-        critical: findings.filter((f) => f.severity === 'critical').length,
-        high: findings.filter((f) => f.severity === 'high').length,
-        medium: findings.filter((f) => f.severity === 'medium').length,
-        low: findings.filter((f) => f.severity === 'low').length,
-        info: findings.filter((f) => f.severity === 'info').length,
-    };
-    return {
-        success: true,
-        scanType: 'dependency-scan',
-        scope: [directory],
-        timestamp: new Date(),
-        findings,
-        summary,
-        recommendations: generateRecommendations(findings),
-    };
-}
-/**
- * Generate remediation recommendations
- */
-function generateRecommendations(findings) {
-    const recommendations = [];
-    if (findings.some((f) => f.category === 'Secrets')) {
-        recommendations.push('Immediately rotate all exposed secrets and remove from source code.');
-        recommendations.push('Use environment variables or a secret management service (e.g., AWS Secrets Manager, HashiCorp Vault).');
-        recommendations.push('Add .env files to .gitignore to prevent future commits.');
-    }
-    if (findings.some((f) => f.category === 'Injection')) {
-        recommendations.push('Review all database queries and use parameterized queries exclusively.');
-        recommendations.push('Implement input validation on all user-controlled data.');
-        recommendations.push('Use ORMs with built-in SQL injection protection.');
-    }
-    if (findings.some((f) => f.category === 'XSS')) {
-        recommendations.push('Implement Content Security Policy (CSP) headers.');
-        recommendations.push('Use templating engines with automatic escaping.');
-        recommendations.push('Sanitize all user input before rendering in the DOM.');
-    }
-    if (findings.some((f) => f.category === 'Dependencies')) {
-        recommendations.push('Run npm audit fix to automatically fix vulnerabilities.');
-        recommendations.push('Update outdated dependencies regularly.');
-        recommendations.push('Consider using npm ci in CI/CD pipelines for reproducible builds.');
-    }
-    if (recommendations.length === 0) {
-        recommendations.push('No immediate actions required. Continue regular security reviews.');
-    }
-    return recommendations;
-}
-/**
- * Format assessment results for display
- */
-export function formatAssessmentReport(result) {
-    const lines = [];
-    lines.push('');
-    lines.push('='.repeat(60));
-    lines.push('  SECURITY ASSESSMENT REPORT');
-    lines.push('='.repeat(60));
-    lines.push('');
-    lines.push(`Scan Type: ${result.scanType}`);
-    lines.push(`Scope: ${result.scope.join(', ')}`);
-    lines.push(`Timestamp: ${result.timestamp.toISOString()}`);
-    lines.push('');
-    lines.push('-'.repeat(60));
-    lines.push('  SUMMARY');
-    lines.push('-'.repeat(60));
-    lines.push(`  Critical: ${result.summary.critical}`);
-    lines.push(`  High:     ${result.summary.high}`);
-    lines.push(`  Medium:   ${result.summary.medium}`);
-    lines.push(`  Low:      ${result.summary.low}`);
-    lines.push(`  Info:     ${result.summary.info}`);
-    lines.push('');
-    if (result.findings.length > 0) {
-        lines.push('-'.repeat(60));
-        lines.push('  FINDINGS');
-        lines.push('-'.repeat(60));
-        for (const finding of result.findings) {
-            lines.push('');
-            lines.push(`  [${finding.severity.toUpperCase()}] ${finding.title}`);
-            lines.push(`  Category: ${finding.category}`);
-            if (finding.location.file) {
-                lines.push(`  Location: ${finding.location.file}:${finding.location.line}`);
-            }
-            if (finding.location.snippet) {
-                lines.push(`  Snippet: ${finding.location.snippet}`);
-            }
-            lines.push(`  ${finding.description}`);
-            lines.push(`  Remediation: ${finding.remediation}`);
-            if (finding.cwe)
-                lines.push(`  CWE: ${finding.cwe}`);
-            if (finding.owasp)
-                lines.push(`  OWASP: ${finding.owasp}`);
-        }
-    }
-    lines.push('');
-    lines.push('-'.repeat(60));
-    lines.push('  RECOMMENDATIONS');
-    lines.push('-'.repeat(60));
-    for (const rec of result.recommendations) {
-        lines.push(`  * ${rec}`);
-    }
-    lines.push('');
-    lines.push('='.repeat(60));
-    return lines.join('\n');
-}
-/**
- * Create authorization context (requires user confirmation)
- */
-export function createAuthorizationContext(scope, testingType) {
-    return {
-        ownershipConfirmed: true, // User must explicitly call this
-        authorizedScope: scope,
-        authorizedAt: new Date(),
-        testingType,
-    };
-}
-//# sourceMappingURL=securityAssessment.js.map