fullshield 0.4.0 → 1.0.0

package/dist/supply.js

@@ -1,324 +1,8 @@
-import { existsSync, statSync, readFileSync, readdirSync } from 'fs';
-import { join, relative } from 'path';
-import { createHash } from 'crypto';
-
-// src/supply/index.ts
-function makeFindingId(ruleId, file, snippet) {
-  const normalized = (snippet ?? "").replace(/\s+/g, " ").trim();
-  return createHash("sha256").update(`${ruleId}\0${file ?? ""}\0${normalized}`).digest("hex").slice(0, 16);
-}
-
-// src/supply/experimental.ts
-function experimentalVex() {
-  return process.env.FULLSHIELD_EXPERIMENTAL_VEX === "1";
-}
-
-// src/supply/index.ts
-var REGISTRY_HOST = "registry.npmjs.org";
-var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
-function assertRegistryUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error("supply: registry URL must be https://registry.npmjs.org/...");
-  }
-  if (parsed.protocol !== "https:" || parsed.hostname !== REGISTRY_HOST) {
-    throw new Error(`supply: only ${REGISTRY_HOST} is allowed (got ${parsed.hostname || url})`);
-  }
-}
-function packageNameFromSpec(spec) {
-  if (spec.startsWith("@")) {
-    const slash = spec.indexOf("/");
-    if (slash < 0) return spec;
-    const scope = spec.slice(0, slash);
-    const rest = spec.slice(slash + 1);
-    const name = rest.includes("@") ? rest.slice(0, rest.indexOf("@")) : rest;
-    return `${scope}/${name}`;
-  }
-  const at = spec.indexOf("@");
-  return at > 0 ? spec.slice(0, at) : spec;
-}
-function finding(ruleId, title, message, file, severity = "high") {
-  return {
-    id: makeFindingId(ruleId, file, message),
-    ruleId,
-    module: "deps",
-    title,
-    severity,
-    confidence: "high",
-    file,
-    message,
-    remediation: "Do not install this package until the behavior is reviewed. Use --ignore-scripts."
-  };
-}
-function walkJs(dir, out = []) {
-  if (!existsSync(dir)) return out;
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (entry.name === "node_modules") continue;
-      walkJs(full, out);
-    } else if (entry.isFile() && /\.(js|cjs|mjs|ts)$/.test(entry.name)) {
-      out.push(full);
-    }
-  }
-  return out;
-}
-function readJson(path) {
-  return JSON.parse(readFileSync(path, "utf8"));
-}
-function installScriptKeys(scripts) {
-  if (!scripts) return [];
-  return INSTALL_SCRIPT_KEYS.filter((k) => typeof scripts[k] === "string");
-}
-function analyzePackageDir(dir) {
-  const findings = [];
-  const manifestPath = join(dir, "package.json");
-  if (!existsSync(manifestPath) || !statSync(manifestPath).isFile()) return findings;
-  const pkg = readJson(manifestPath);
-  const scripts = pkg.scripts ?? {};
-  const keys = installScriptKeys(scripts);
-  if (keys.length > 0) {
-    findings.push(
-      finding(
-        "SUPPLY-INSTALLSCRIPT-001",
-        "Package declares an install script",
-        `install scripts: ${keys.join(", ")}`,
-        "package.json"
-      )
-    );
-  }
-  const sources = walkJs(dir).map((file) => ({
-    file: relative(dir, file) || file,
-    text: readFileSync(file, "utf8")
-  }));
-  const readsNpmrc = sources.some((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
-  const hasNet = sources.some((s) => /https\.request|http\.request|fetch\s*\(|axios\./.test(s.text));
-  if (readsNpmrc && hasNet) {
-    const hit = sources.find((s) => s.text.includes(".npmrc") || s.text.includes(".ssh"));
-    findings.push(
-      finding(
-        "SUPPLY-NPMRC-NET-001",
-        "Install-time code reads npm/ssh credentials and uses the network",
-        "static: credential file read combined with http(s)/fetch",
-        hit?.file,
-        "critical"
-      )
-    );
-  }
-  for (const src of sources) {
-    if (/eval\s*\(\s*(Buffer|atob|fromCharCode|decodeURIComponent)/.test(src.text)) {
-      findings.push(
-        finding(
-          "SUPPLY-OBFUSCATE-001",
-          "Package evals a decoded/obfuscated string",
-          "static: eval of decoded payload",
-          src.file
-        )
-      );
-    }
-  }
-  if (experimentalVex()) {
-    findings.push(...analyzeWormIndicators(dir));
-    findings.push(...analyzeWorkflowTampering(dir));
-  }
-  return findings;
-}
-function diffPackageVersions(oldDir, newDir) {
-  const oldManifest = existsSync(join(oldDir, "package.json")) ? readJson(join(oldDir, "package.json")) : {};
-  const nextManifest = existsSync(join(newDir, "package.json")) ? readJson(join(newDir, "package.json")) : {};
-  const oldScripts = oldManifest.scripts ?? {};
-  const nextScripts = nextManifest.scripts ?? {};
-  const added = INSTALL_SCRIPT_KEYS.filter((k) => typeof nextScripts[k] === "string" && oldScripts[k] === void 0);
-  const oldSrc = walkJs(oldDir).map((f) => readFileSync(f, "utf8")).join("\n");
-  const newSrc = walkJs(newDir).map((f) => readFileSync(f, "utf8")).join("\n");
-  const newChild = /child_process/.test(newSrc) && !/child_process/.test(oldSrc);
-  const newNet = /https?\.request|fetch\s*\(/.test(newSrc) && !/https?\.request|fetch\s*\(/.test(oldSrc);
-  if (added.length === 0 && !newChild && !newNet) return [];
-  return [
-    finding(
-      "SUPPLY-BEHAVIOR-001",
-      "Package version adds install-script or process/network behavior",
-      `added scripts=${added.join(",") || "none"} child_process=${newChild} network=${newNet}`,
-      "package.json"
-    )
-  ];
-}
-function checkCooldown(packument, version, minHours = 72, nowMs = Date.now()) {
-  const stamp = packument.time?.[version];
-  if (!stamp) return [];
-  const published = Date.parse(stamp);
-  if (Number.isNaN(published)) return [];
-  const ageHours = (nowMs - published) / 36e5;
-  if (ageHours >= minHours) return [];
-  return [
-    finding(
-      "SUPPLY-COOLDOWN-001",
-      "Package version is younger than the release cooldown",
-      `${version} published ${ageHours.toFixed(1)}h ago (min ${minHours}h)`,
-      void 0,
-      "medium"
-    )
-  ];
-}
-function checkLockfileIntegrity(lock) {
-  const findings = [];
-  for (const [name, entry] of Object.entries(lock.packages ?? {})) {
-    if (name === "") continue;
-    const resolved = entry.resolved;
-    if (!resolved) continue;
-    if (entry.integrity === void 0 || entry.integrity.length === 0) {
-      findings.push(
-        finding(
-          "SUPPLY-LOCKINTEGRITY-001",
-          "Lockfile entry has no integrity hash",
-          `${name} resolved without an integrity hash`,
-          "package-lock.json"
-        )
-      );
-    }
-    try {
-      const url = new URL(resolved);
-      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
-        findings.push(
-          finding(
-            "SUPPLY-LOCKURL-001",
-            "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${url.hostname || resolved}`,
-            "package-lock.json"
-          )
-        );
-      }
-    } catch {
-      findings.push(
-        finding(
-          "SUPPLY-LOCKURL-001",
-          "Lockfile entry has a non-URL resolved field",
-          `${name} resolved ${resolved}`,
-          "package-lock.json"
-        )
-      );
-    }
-  }
-  return findings;
-}
-function checkDependencyConfusion(pkgName, npmrc, publicExists) {
-  const scoped = pkgName.startsWith("@");
-  const privateRegistry = /@[\w-]+\s*:\s*registry\s*=/.test(npmrc) || /registry\s*=\s*https?:\/\/(?!registry\.npmjs\.org)/.test(npmrc);
-  if (scoped && privateRegistry && publicExists) {
-    return [
-      finding(
-        "SUPPLY-CONFUSION-001",
-        "Private-scope name also exists on the public registry",
-        `${pkgName} is configured for a private registry but a public package exists`
-      )
-    ];
-  }
-  return [];
-}
-function checkProvenance(previouslyHad, currentlyHas) {
-  if (previouslyHad && !currentlyHas) {
-    return [
-      finding(
-        "SUPPLY-PROVENANCE-001",
-        "Package dropped npm provenance since the last scan",
-        "previous version had provenance; current version does not"
-      )
-    ];
-  }
-  return [];
-}
-async function installGuard(spec, opts = {}) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY !== "1") {
-    return { findings: [], skipped: true };
-  }
-  const name = packageNameFromSpec(spec);
-  const url = `https://${REGISTRY_HOST}/${encodeURIComponent(name)}`;
-  assertRegistryUrl(url);
-  if (opts.fetchPackument) await opts.fetchPackument(url);
-  const findings = opts.extractDir !== void 0 ? analyzePackageDir(opts.extractDir) : [];
-  if (findings.length === 0 && opts.runNpm) {
-    await opts.runNpm(["install", spec, "--ignore-scripts"]);
-  }
-  return { findings };
-}
-var TOKEN_RE = /(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/;
-var PUBLISH_RE = /\bnpm\s+publish\b|\bnpmPublish\b|\blibnpmpublish\b/;
-var REGISTRY_PUT_RE = /registry\.npmjs\.org[\s\S]{0,800}\bPUT\b|\bmethod\s*:\s*['"]PUT['"][\s\S]{0,400}registry\.npmjs\.org/;
-var GITHUB_CREATE_RE = /api\.github\.com\/(?:user\/repos|repos\/)|\/actions\/workflows/;
-var WORKFLOW_PATH_RE = /\.github\/workflows/;
-var CI_WRITE_RE = /\.github\/|\.git\/hooks\/|\.gitlab-ci\.yml|\.travis\.yml|azure-pipelines(?:\.yml)?|Jenkinsfile|\.circleci\//;
-function packageSources(dir) {
-  const manifestPath = join(dir, "package.json");
-  let scripts = "";
-  if (existsSync(manifestPath) && statSync(manifestPath).isFile()) {
-    try {
-      const pkg = readJson(manifestPath);
-      const block = pkg.scripts ?? {};
-      scripts = Object.values(block).join("\n");
-    } catch {
-      scripts = "";
-    }
-  }
-  const sources = walkJs(dir).map((file) => ({
-    file: relative(dir, file) || file,
-    text: readFileSync(file, "utf8")
-  }));
-  return { sources, scripts };
-}
-function analyzeWormIndicators(dir) {
-  const { sources, scripts } = packageSources(dir);
-  if (sources.length === 0 && scripts.length === 0) return [];
-  const text = `${sources.map((s) => s.text).join("\n")}
-${scripts}`;
-  if (!TOKEN_RE.test(text)) return [];
-  const replicates = PUBLISH_RE.test(text) || REGISTRY_PUT_RE.test(text) || GITHUB_CREATE_RE.test(text) || WORKFLOW_PATH_RE.test(text);
-  if (!replicates) return [];
-  const hit = sources.find(
-    (s) => TOKEN_RE.test(s.text) && (PUBLISH_RE.test(s.text) || REGISTRY_PUT_RE.test(s.text) || GITHUB_CREATE_RE.test(s.text) || WORKFLOW_PATH_RE.test(s.text))
-  ) ?? sources.find((s) => TOKEN_RE.test(s.text));
-  return [
-    finding(
-      "SUPPLY-WORM-001",
-      "Self-replicating worm indicators in dependency code",
-      "static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",
-      hit?.file,
-      "critical"
-    )
-  ];
-}
-function analyzeWorkflowTampering(dir) {
-  const { sources, scripts } = packageSources(dir);
-  const text = `${sources.map((s) => s.text).join("\n")}
-${scripts}`;
-  if (!CI_WRITE_RE.test(text)) return [];
-  const hit = sources.find((s) => CI_WRITE_RE.test(s.text));
-  return [
-    finding(
-      "SUPPLY-WORKFLOW-001",
-      "Dependency writes GitHub workflow, git hooks, or CI config",
-      "static: install script or package code writes .github/, .git/hooks/, or CI configuration",
-      hit?.file ?? (CI_WRITE_RE.test(scripts) ? "package.json" : void 0),
-      "critical"
-    )
-  ];
-}
-function provenanceCoverage(packages, known) {
-  let withProvenance = 0;
-  let unknown = 0;
-  for (const pkg of packages) {
-    const hit = known.get(`${pkg.name}@${pkg.version}`);
-    if (hit === true) withProvenance += 1;
-    else if (hit === void 0) unknown += 1;
-  }
-  const total = packages.length;
-  return {
-    total,
-    withProvenance,
-    unknown,
-    percent: total === 0 ? 0 : withProvenance / total * 100
-  };
-}
-
-export { analyzePackageDir, analyzeWorkflowTampering, analyzeWormIndicators, assertRegistryUrl, checkCooldown, checkDependencyConfusion, checkLockfileIntegrity, checkProvenance, diffPackageVersions, installGuard, packageNameFromSpec, provenanceCoverage };
+import {existsSync,statSync,readFileSync,readdirSync}from'fs';import {join,relative}from'path';import {createHash}from'crypto';function S(t,e,n){let i=(n??"").replace(/\s+/g," ").trim();return createHash("sha256").update(`${t}\0${e??""}\0${i}`).digest("hex").slice(0,16)}function v(){return process.env.FULLSHIELD_EXPERIMENTAL_VEX==="1"}var y="registry.npmjs.org",I=["preinstall","install","postinstall"];function j(t){let e;try{e=new URL(t);}catch{throw new Error("supply: registry URL must be https://registry.npmjs.org/...")}if(e.protocol!=="https:"||e.hostname!==y)throw new Error(`supply: only ${y} is allowed (got ${e.hostname||t})`)}function C(t){if(t.startsWith("@")){let n=t.indexOf("/");if(n<0)return t;let i=t.slice(0,n),r=t.slice(n+1),s=r.includes("@")?r.slice(0,r.indexOf("@")):r;return `${i}/${s}`}let e=t.indexOf("@");return e>0?t.slice(0,e):t}function a(t,e,n,i,r="high"){return {id:S(t,i,n),ruleId:t,module:"deps",title:e,severity:r,confidence:"high",file:i,message:n,remediation:"Do not install this package until the behavior is reviewed. Use --ignore-scripts."}}function f(t,e=[]){if(!existsSync(t))return e;for(let n of readdirSync(t,{withFileTypes:true})){let i=join(t,n.name);if(n.isDirectory()){if(n.name==="node_modules")continue;f(i,e);}else n.isFile()&&/\.(js|cjs|mjs|ts)$/.test(n.name)&&e.push(i);}return e}function x(t){return JSON.parse(readFileSync(t,"utf8"))}function T(t){return t?I.filter(e=>typeof t[e]=="string"):[]}function $(t){let e=[],n=join(t,"package.json");if(!existsSync(n)||!statSync(n).isFile())return e;let r=x(n).scripts??{},s=T(r);s.length>0&&e.push(a("SUPPLY-INSTALLSCRIPT-001","Package declares an install script",`install scripts: ${s.join(", ")}`,"package.json"));let o=f(t).map(c=>({file:relative(t,c)||c,text:readFileSync(c,"utf8")})),m=o.some(c=>c.text.includes(".npmrc")||c.text.includes(".ssh")),h=o.some(c=>/https\.request|http\.request|fetch\s*\(|axios\./.test(c.text));if(m&&h){let c=o.find(d=>d.text.includes(".npmrc")||d.text.includes(".ssh"));e.push(a("SUPPLY-NPMRC-NET-001","Install-time code reads npm/ssh credentials and uses the network","static: credential file read combined with http(s)/fetch",c?.file,"critical"));}for(let c of o)/eval\s*\(\s*(Buffer|atob|fromCharCode|decodeURIComponent)/.test(c.text)&&e.push(a("SUPPLY-OBFUSCATE-001","Package evals a decoded/obfuscated string","static: eval of decoded payload",c.file));return v()&&(e.push(..._(t)),e.push(...A(t))),e}function B(t,e){let n=existsSync(join(t,"package.json"))?x(join(t,"package.json")):{},i=existsSync(join(e,"package.json"))?x(join(e,"package.json")):{},r=n.scripts??{},s=i.scripts??{},o=I.filter(u=>typeof s[u]=="string"&&r[u]===void 0),m=f(t).map(u=>readFileSync(u,"utf8")).join(`
+`),h=f(e).map(u=>readFileSync(u,"utf8")).join(`
+`),c=/child_process/.test(h)&&!/child_process/.test(m),d=/https?\.request|fetch\s*\(/.test(h)&&!/https?\.request|fetch\s*\(/.test(m);return o.length===0&&!c&&!d?[]:[a("SUPPLY-BEHAVIOR-001","Package version adds install-script or process/network behavior",`added scripts=${o.join(",")||"none"} child_process=${c} network=${d}`,"package.json")]}function V(t,e,n=72,i=Date.now()){let r=t.time?.[e];if(!r)return [];let s=Date.parse(r);if(Number.isNaN(s))return [];let o=(i-s)/36e5;return o>=n?[]:[a("SUPPLY-COOLDOWN-001","Package version is younger than the release cooldown",`${e} published ${o.toFixed(1)}h ago (min ${n}h)`,void 0,"medium")]}function z(t){let e=[];for(let[n,i]of Object.entries(t.packages??{})){if(n==="")continue;let r=i.resolved;if(r){(i.integrity===void 0||i.integrity.length===0)&&e.push(a("SUPPLY-LOCKINTEGRITY-001","Lockfile entry has no integrity hash",`${n} resolved without an integrity hash`,"package-lock.json"));try{let s=new URL(r);(s.protocol!=="https:"||s.hostname!==y)&&e.push(a("SUPPLY-LOCKURL-001","Lockfile entry resolves from a non-npm registry host",`${n} resolved host ${s.hostname||r}`,"package-lock.json"));}catch{e.push(a("SUPPLY-LOCKURL-001","Lockfile entry has a non-URL resolved field",`${n} resolved ${r}`,"package-lock.json"));}}}return e}function q(t,e,n){let i=t.startsWith("@"),r=/@[\w-]+\s*:\s*registry\s*=/.test(e)||/registry\s*=\s*https?:\/\/(?!registry\.npmjs\.org)/.test(e);return i&&r&&n?[a("SUPPLY-CONFUSION-001","Private-scope name also exists on the public registry",`${t} is configured for a private registry but a public package exists`)]:[]}function J(t,e){return t&&!e?[a("SUPPLY-PROVENANCE-001","Package dropped npm provenance since the last scan","previous version had provenance; current version does not")]:[]}async function X(t,e={}){if(!e.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY!=="1")return {findings:[],skipped:true};let n=C(t),i=`https://${y}/${encodeURIComponent(n)}`;j(i),e.fetchPackument&&await e.fetchPackument(i);let r=e.extractDir!==void 0?$(e.extractDir):[];return r.length===0&&e.runNpm&&await e.runNpm(["install",t,"--ignore-scripts"]),{findings:r}}var b=/(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/,P=/\bnpm\s+publish\b|\bnpmPublish\b|\blibnpmpublish\b/,R=/registry\.npmjs\.org[\s\S]{0,800}\bPUT\b|\bmethod\s*:\s*['"]PUT['"][\s\S]{0,400}registry\.npmjs\.org/,w=/api\.github\.com\/(?:user\/repos|repos\/)|\/actions\/workflows/,E=/\.github\/workflows/,k=/\.github\/|\.git\/hooks\/|\.gitlab-ci\.yml|\.travis\.yml|azure-pipelines(?:\.yml)?|Jenkinsfile|\.circleci\//;function U(t){let e=join(t,"package.json"),n="";if(existsSync(e)&&statSync(e).isFile())try{let s=x(e).scripts??{};n=Object.values(s).join(`
+`);}catch{n="";}return {sources:f(t).map(r=>({file:relative(t,r)||r,text:readFileSync(r,"utf8")})),scripts:n}}function _(t){let{sources:e,scripts:n}=U(t);if(e.length===0&&n.length===0)return [];let i=`${e.map(o=>o.text).join(`
+`)}
+${n}`;if(!b.test(i))return [];if(!(P.test(i)||R.test(i)||w.test(i)||E.test(i)))return [];let s=e.find(o=>b.test(o.text)&&(P.test(o.text)||R.test(o.text)||w.test(o.text)||E.test(o.text)))??e.find(o=>b.test(o.text));return [a("SUPPLY-WORM-001","Self-replicating worm indicators in dependency code","static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",s?.file,"critical")]}function A(t){let{sources:e,scripts:n}=U(t),i=`${e.map(s=>s.text).join(`
+`)}
+${n}`;if(!k.test(i))return [];let r=e.find(s=>k.test(s.text));return [a("SUPPLY-WORKFLOW-001","Dependency writes GitHub workflow, git hooks, or CI config","static: install script or package code writes .github/, .git/hooks/, or CI configuration",r?.file??(k.test(n)?"package.json":void 0),"critical")]}function Q(t,e){let n=0,i=0;for(let s of t){let o=e.get(`${s.name}@${s.version}`);o===true?n+=1:o===void 0&&(i+=1);}let r=t.length;return {total:r,withProvenance:n,unknown:i,percent:r===0?0:n/r*100}}export{$ as analyzePackageDir,A as analyzeWorkflowTampering,_ as analyzeWormIndicators,j as assertRegistryUrl,V as checkCooldown,q as checkDependencyConfusion,z as checkLockfileIntegrity,J as checkProvenance,B as diffPackageVersions,X as installGuard,C as packageNameFromSpec,Q as provenanceCoverage};

package/dist/threat.js

@@ -1,63 +1,3 @@
-import { existsSync, statSync, readFileSync, readdirSync } from 'fs';
-import { relative, join } from 'path';
-
-// src/threat/index.ts
-function walk(dir, out = []) {
-  if (!existsSync(dir)) return out;
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (["node_modules", "dist", ".git"].includes(entry.name)) continue;
-      walk(full, out);
-    } else if (entry.isFile() && /\.[cm]?[jt]sx?$/.test(entry.name)) {
-      out.push(full);
-    }
-  }
-  return out;
-}
-function buildThreatModel(dir, opts = {}) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") {
-    return { skipped: true, routes: [], stores: [], egress: [], stride: [], mermaid: "" };
-  }
-  const routes = [];
-  const stores = /* @__PURE__ */ new Set();
-  const egress = /* @__PURE__ */ new Set();
-  if (!existsSync(dir) || !statSync(dir).isDirectory()) {
-    return { routes, stores: [], egress: [], stride: [], mermaid: "flowchart LR\n" };
-  }
-  for (const file of walk(dir)) {
-    const rel = relative(dir, file) || file;
-    const text = readFileSync(file, "utf8");
-    const routeRe = /app\.(get|post|put|patch|delete|use)\(\s*['"]([^'"]+)['"]/g;
-    let m;
-    while ((m = routeRe.exec(text)) !== null) {
-      routes.push({
-        method: (m[1] ?? "get").toUpperCase(),
-        path: m[2] ?? "/",
-        file: rel,
-        auth: /auth|requireUser|requireAuth/.test(text)
-      });
-    }
-    if (/sqlite|mongodb|postgres|mysql|createPool|DatabaseSync/.test(text)) stores.add(rel);
-    const urlRe = /https?:\/\/[^\s'"[`]+/g;
-    while ((m = urlRe.exec(text)) !== null) egress.add(m[0] ?? "");
-  }
-  const stride = routes.slice(0, 20).map((r) => ({
-    element: `${r.method} ${r.path}`,
-    spoofing: r.auth ? "auth middleware present" : "no auth seen",
-    tampering: "input reaches handler",
-    repudiation: "check access logs",
-    infoDisclosure: "review response bodies",
-    denialOfService: "no rate-limit inferred",
-    elevation: r.auth ? "review authorization" : "unauthenticated route"
-  }));
-  const mermaid = [
-    "flowchart LR",
-    "  client[Client] --> app[App]",
-    ...routes.slice(0, 12).map((r, i) => `  app --> r${i}["${r.method} ${r.path}"]`),
-    ...[...stores].slice(0, 6).map((s, i) => `  app --> s${i}["store ${s}"]`)
-  ].join("\n");
-  return { routes, stores: [...stores], egress: [...egress], stride, mermaid };
-}
-
-export { buildThreatModel };
+import {existsSync,statSync,readFileSync,readdirSync}from'fs';import {relative,join}from'path';function c(r,s=[]){if(!existsSync(r))return s;for(let t of readdirSync(r,{withFileTypes:true})){let i=join(r,t.name);if(t.isDirectory()){if(["node_modules","dist",".git"].includes(t.name))continue;c(i,s);}else t.isFile()&&/\.[cm]?[jt]sx?$/.test(t.name)&&s.push(i);}return s}function T(r,s={}){if(!s.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM!=="1")return {skipped:true,routes:[],stores:[],egress:[],stride:[],mermaid:""};let t=[],i=new Set,l=new Set;if(!existsSync(r)||!statSync(r).isDirectory())return {routes:t,stores:[],egress:[],stride:[],mermaid:`flowchart LR
+`};for(let e of c(r)){let n=relative(r,e)||e,a=readFileSync(e,"utf8"),g=/app\.(get|post|put|patch|delete|use)\(\s*['"]([^'"]+)['"]/g,o;for(;(o=g.exec(a))!==null;)t.push({method:(o[1]??"get").toUpperCase(),path:o[2]??"/",file:n,auth:/auth|requireUser|requireAuth/.test(a)});/sqlite|mongodb|postgres|mysql|createPool|DatabaseSync/.test(a)&&i.add(n);let h=/https?:\/\/[^\s'"[`]+/g;for(;(o=h.exec(a))!==null;)l.add(o[0]??"");}let u=t.slice(0,20).map(e=>({element:`${e.method} ${e.path}`,spoofing:e.auth?"auth middleware present":"no auth seen",tampering:"input reaches handler",repudiation:"check access logs",infoDisclosure:"review response bodies",denialOfService:"no rate-limit inferred",elevation:e.auth?"review authorization":"unauthenticated route"})),d=["flowchart LR","  client[Client] --> app[App]",...t.slice(0,12).map((e,n)=>`  app --> r${n}["${e.method} ${e.path}"]`),...[...i].slice(0,6).map((e,n)=>`  app --> s${n}["store ${e}"]`)].join(`
+`);return {routes:t,stores:[...i],egress:[...l],stride:u,mermaid:d}}export{T as buildThreatModel};

package/dist/vex.js

@@ -1,180 +1,2 @@
-import { createHash } from 'crypto';
-
-// src/vex/index.ts
-
-// src/sbom/cyclonedx.ts
-function validateCycloneDx15(doc) {
-  const errors = [];
-  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
-    return ["CycloneDX document must be an object"];
-  }
-  const root = doc;
-  if (root.bomFormat !== "CycloneDX") errors.push('bomFormat must be "CycloneDX"');
-  if (root.specVersion !== "1.5") errors.push('specVersion must be "1.5"');
-  if (!Array.isArray(root.components)) errors.push("components must be an array");
-  return errors;
-}
-
-// src/vex/index.ts
-var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
-var OPENVEX_NOT_AFFECTED_JUSTIFICATION = "vulnerable_code_not_in_execute_path";
-var CDX_NOT_AFFECTED_JUSTIFICATION = "code_not_reachable";
-var OPENVEX_STATUSES = /* @__PURE__ */ new Set(["not_affected", "affected", "fixed", "under_investigation"]);
-function depFindings(findings) {
-  return findings.filter((f) => f.ruleId === "DEPS-VULN-001");
-}
-function vulnName(finding) {
-  return finding.references?.find((r) => r.startsWith("CVE-") || r.startsWith("GHSA-") || r.startsWith("MAL-")) ?? finding.id;
-}
-function npmPurl(snippet) {
-  const raw = snippet ?? "unknown@0.0.0";
-  let name;
-  let version;
-  if (raw.startsWith("@")) {
-    const second = raw.indexOf("@", 1);
-    name = second === -1 ? raw : raw.slice(0, second);
-    version = second === -1 ? "0.0.0" : raw.slice(second + 1);
-  } else {
-    const at = raw.indexOf("@");
-    name = at <= 0 ? raw : raw.slice(0, at);
-    version = at <= 0 ? "0.0.0" : raw.slice(at + 1);
-  }
-  return `pkg:npm/${encodeURIComponent(name)}@${version}`;
-}
-function notImported(finding) {
-  return finding.reachability === "not-imported";
-}
-function openVexStatement(finding) {
-  const base = {
-    vulnerability: { name: vulnName(finding) },
-    products: [{ "@id": npmPurl(finding.snippet) }]
-  };
-  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding.reachabilityEvidence?.reason !== void 0 ? { detail: finding.reachabilityEvidence.reason } : {};
-  if (notImported(finding)) {
-    return {
-      ...base,
-      status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
-      ...detail
-    };
-  }
-  return { ...base, status: "under_investigation", ...detail };
-}
-function buildOpenVex(findings) {
-  const statements = depFindings(findings).map(openVexStatement);
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const idSeed = JSON.stringify(statements);
-  const digest = createHash("sha256").update(idSeed).digest("hex").slice(0, 16);
-  return {
-    "@context": OPENVEX_CONTEXT,
-    "@id": `https://openvex.dev/docs/public/fullshield-${digest}`,
-    author: "FullShield",
-    timestamp,
-    version: 1,
-    statements
-  };
-}
-function validateOpenVex(doc) {
-  const errors = [];
-  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
-    return ["OpenVEX document must be an object"];
-  }
-  const root = doc;
-  if (typeof root["@context"] !== "string" || !String(root["@context"]).includes("openvex")) {
-    errors.push("@context must be an OpenVEX context URI");
-  }
-  if (typeof root["@id"] !== "string" || root["@id"].length === 0) errors.push("@id is required");
-  if (typeof root.author !== "string" || root.author.length === 0) errors.push("author is required");
-  if (typeof root.timestamp !== "string" || root.timestamp.length === 0) errors.push("timestamp is required");
-  if (typeof root.version !== "number") errors.push("version must be a number");
-  if (!Array.isArray(root.statements)) {
-    errors.push("statements must be an array");
-    return errors;
-  }
-  for (const [i, raw] of root.statements.entries()) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      errors.push(`statements[${i}] must be an object`);
-      continue;
-    }
-    const stmt = raw;
-    if (typeof stmt.vulnerability !== "object" || stmt.vulnerability === null) {
-      errors.push(`statements[${i}].vulnerability is required`);
-    }
-    if (!Array.isArray(stmt.products) || stmt.products.length === 0) {
-      errors.push(`statements[${i}].products must be a non-empty array`);
-    }
-    if (typeof stmt.status !== "string" || !OPENVEX_STATUSES.has(stmt.status)) {
-      errors.push(`statements[${i}].status is invalid`);
-      continue;
-    }
-    if (stmt.status === "not_affected") {
-      if (stmt.justification !== OPENVEX_NOT_AFFECTED_JUSTIFICATION) {
-        errors.push(
-          `statements[${i}]: not_affected requires justification ${OPENVEX_NOT_AFFECTED_JUSTIFICATION}`
-        );
-      }
-    }
-  }
-  return errors;
-}
-function cdxAnalysis(finding) {
-  if (notImported(finding)) {
-    return { state: "not_affected", justification: CDX_NOT_AFFECTED_JUSTIFICATION };
-  }
-  return { state: "in_triage" };
-}
-function buildCycloneDxVex(meta, findings) {
-  return {
-    $schema: "http://cyclonedx.org/schema/bom-1.5.schema.json",
-    bomFormat: "CycloneDX",
-    specVersion: "1.5",
-    version: 1,
-    metadata: {
-      component: { type: "application", name: meta.name, version: meta.version }
-    },
-    components: [],
-    vulnerabilities: depFindings(findings).map((f) => ({
-      id: vulnName(f),
-      description: f.message,
-      affects: [{ ref: npmPurl(f.snippet) }],
-      analysis: cdxAnalysis(f)
-    }))
-  };
-}
-function validateCycloneDxVex(doc) {
-  const errors = validateCycloneDx15(doc);
-  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return errors;
-  const root = doc;
-  if (!Array.isArray(root.vulnerabilities)) {
-    errors.push("vulnerabilities must be an array");
-    return errors;
-  }
-  for (const [i, raw] of root.vulnerabilities.entries()) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      errors.push(`vulnerabilities[${i}] must be an object`);
-      continue;
-    }
-    const vuln = raw;
-    if (typeof vuln.analysis !== "object" || vuln.analysis === null || Array.isArray(vuln.analysis)) {
-      errors.push(`vulnerabilities[${i}].analysis is required`);
-      continue;
-    }
-    const analysis = vuln.analysis;
-    if (typeof analysis.state !== "string" || analysis.state.length === 0) {
-      errors.push(`vulnerabilities[${i}].analysis.state is required`);
-      continue;
-    }
-    if (analysis.state === "not_affected" && analysis.justification !== CDX_NOT_AFFECTED_JUSTIFICATION) {
-      errors.push(
-        `vulnerabilities[${i}]: not_affected requires justification ${CDX_NOT_AFFECTED_JUSTIFICATION}`
-      );
-    }
-  }
-  return errors;
-}
-function buildVex(findings, format, meta = { name: "app", version: "0.0.0" }) {
-  if (format === "cyclonedx") return buildCycloneDxVex(meta, findings);
-  return buildOpenVex(findings);
-}
-
-export { buildCycloneDxVex, buildOpenVex, buildVex, validateCycloneDxVex, validateOpenVex };
+import {createHash}from'crypto';function c(n){let e=[];if(typeof n!="object"||n===null||Array.isArray(n))return ["CycloneDX document must be an object"];let t=n;return t.bomFormat!=="CycloneDX"&&e.push('bomFormat must be "CycloneDX"'),t.specVersion!=="1.5"&&e.push('specVersion must be "1.5"'),Array.isArray(t.components)||e.push("components must be an array"),e}var y="https://openvex.dev/ns/v0.2.0",a="vulnerable_code_not_in_execute_path",u="code_not_reachable",g=new Set(["not_affected","affected","fixed","under_investigation"]);function l(n){return n.filter(e=>e.ruleId==="DEPS-VULN-001")}function p(n){return n.references?.find(e=>e.startsWith("CVE-")||e.startsWith("GHSA-")||e.startsWith("MAL-"))??n.id}function d(n){let e=n??"unknown@0.0.0",t,s;if(e.startsWith("@")){let i=e.indexOf("@",1);t=i===-1?e:e.slice(0,i),s=i===-1?"0.0.0":e.slice(i+1);}else {let i=e.indexOf("@");t=i<=0?e:e.slice(0,i),s=i<=0?"0.0.0":e.slice(i+1);}return `pkg:npm/${encodeURIComponent(t)}@${s}`}function m(n){return n.reachability==="not-imported"}function h(n){let e={vulnerability:{name:p(n)},products:[{"@id":d(n.snippet)}]},t=process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH==="1"&&n.reachabilityEvidence?.reason!==void 0?{detail:n.reachabilityEvidence.reason}:{};return m(n)?{...e,status:"not_affected",justification:a,...t}:{...e,status:"under_investigation",...t}}function b(n){let e=l(n).map(h),t=new Date().toISOString(),s=JSON.stringify(e),i=createHash("sha256").update(s).digest("hex").slice(0,16);return {"@context":y,"@id":`https://openvex.dev/docs/public/fullshield-${i}`,author:"FullShield",timestamp:t,version:1,statements:e}}function E(n){let e=[];if(typeof n!="object"||n===null||Array.isArray(n))return ["OpenVEX document must be an object"];let t=n;if((typeof t["@context"]!="string"||!String(t["@context"]).includes("openvex"))&&e.push("@context must be an OpenVEX context URI"),(typeof t["@id"]!="string"||t["@id"].length===0)&&e.push("@id is required"),(typeof t.author!="string"||t.author.length===0)&&e.push("author is required"),(typeof t.timestamp!="string"||t.timestamp.length===0)&&e.push("timestamp is required"),typeof t.version!="number"&&e.push("version must be a number"),!Array.isArray(t.statements))return e.push("statements must be an array"),e;for(let[s,i]of t.statements.entries()){if(typeof i!="object"||i===null||Array.isArray(i)){e.push(`statements[${s}] must be an object`);continue}let r=i;if((typeof r.vulnerability!="object"||r.vulnerability===null)&&e.push(`statements[${s}].vulnerability is required`),(!Array.isArray(r.products)||r.products.length===0)&&e.push(`statements[${s}].products must be a non-empty array`),typeof r.status!="string"||!g.has(r.status)){e.push(`statements[${s}].status is invalid`);continue}r.status==="not_affected"&&r.justification!==a&&e.push(`statements[${s}]: not_affected requires justification ${a}`);}return e}function v(n){return m(n)?{state:"not_affected",justification:u}:{state:"in_triage"}}function x(n,e){return {$schema:"http://cyclonedx.org/schema/bom-1.5.schema.json",bomFormat:"CycloneDX",specVersion:"1.5",version:1,metadata:{component:{type:"application",name:n.name,version:n.version}},components:[],vulnerabilities:l(e).map(t=>({id:p(t),description:t.message,affects:[{ref:d(t.snippet)}],analysis:v(t)}))}}function j(n){let e=c(n);if(typeof n!="object"||n===null||Array.isArray(n))return e;let t=n;if(!Array.isArray(t.vulnerabilities))return e.push("vulnerabilities must be an array"),e;for(let[s,i]of t.vulnerabilities.entries()){if(typeof i!="object"||i===null||Array.isArray(i)){e.push(`vulnerabilities[${s}] must be an object`);continue}let r=i;if(typeof r.analysis!="object"||r.analysis===null||Array.isArray(r.analysis)){e.push(`vulnerabilities[${s}].analysis is required`);continue}let o=r.analysis;if(typeof o.state!="string"||o.state.length===0){e.push(`vulnerabilities[${s}].analysis.state is required`);continue}o.state==="not_affected"&&o.justification!==u&&e.push(`vulnerabilities[${s}]: not_affected requires justification ${u}`);}return e}function C(n,e,t={name:"app",version:"0.0.0"}){return e==="cyclonedx"?x(t,n):b(n)}
+export{x as buildCycloneDxVex,b as buildOpenVex,C as buildVex,j as validateCycloneDxVex,E as validateOpenVex};

package/dist/workspaces.js

@@ -1,23 +1,2 @@
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-
-// src/workspaces/index.ts
-function listWorkspaces(dir, opts = {}) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") return [];
-  const manifestPath = join(dir, "package.json");
-  if (!existsSync(manifestPath)) return [];
-  try {
-    const pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
-    if (Array.isArray(pkg.workspaces)) return pkg.workspaces;
-    if (Array.isArray(pkg.workspaces?.packages)) return pkg.workspaces.packages;
-  } catch {
-    return [];
-  }
-  const pnpm = join(dir, "pnpm-workspace.yaml");
-  if (existsSync(pnpm)) {
-    return readFileSync(pnpm, "utf8").split("\n").map((l) => l.replace(/^-+\s*/, "").trim()).filter((l) => l.length > 0 && !l.startsWith("packages:"));
-  }
-  return [];
-}
-
-export { listWorkspaces };
+import {existsSync,readFileSync}from'fs';import {join}from'path';function k(s,i={}){if(!i.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM!=="1")return [];let e=join(s,"package.json");if(!existsSync(e))return [];try{let r=JSON.parse(readFileSync(e,"utf8"));if(Array.isArray(r.workspaces))return r.workspaces;if(Array.isArray(r.workspaces?.packages))return r.workspaces.packages}catch{return []}let t=join(s,"pnpm-workspace.yaml");return existsSync(t)?readFileSync(t,"utf8").split(`
+`).map(r=>r.replace(/^-+\s*/,"").trim()).filter(r=>r.length>0&&!r.startsWith("packages:")):[]}export{k as listWorkspaces};