guardlink 1.0.0

package/dist/mcp/suggest.js

@@ -0,0 +1,268 @@
+/**
+ * GuardLink Suggest — Annotation suggestion engine.
+ *
+ * Analyzes code for patterns that warrant security annotations:
+ *   - Function names suggesting security-relevant operations
+ *   - Dangerous imports/patterns (eval, exec, SQL, file I/O, crypto)
+ *   - HTTP handlers, auth checks, input parsing
+ *   - Missing annotations on files that handle sensitive data
+ *
+ * Designed for both file-based and diff-based analysis (§8.2).
+ *
+ * @exposes #suggest to #path-traversal [high] cwe:CWE-22 -- "Reads files from user-specified paths for analysis"
+ * @exposes #suggest to #prompt-injection [medium] cwe:CWE-77 -- "Suggestion output may be fed back to LLM agents"
+ * @accepts #prompt-injection on #suggest -- "Suggestions are intended for LLM consumption"
+ * @mitigates #suggest against #path-traversal using #path-validation -- "join() combines root with relative file paths"
+ * @flows #mcp -> #suggest via suggestAnnotations -- "MCP tool passes file path from agent request"
+ * @flows #suggest -> #mcp via suggestions -- "Suggestions returned to calling agent"
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+export async function suggestAnnotations(opts) {
+    const suggestions = [];
+    if (opts.diff) {
+        suggestFromDiff(opts.diff, opts.model, suggestions);
+    }
+    else if (opts.file) {
+        const fullPath = join(opts.root, opts.file);
+        if (existsSync(fullPath)) {
+            const content = readFileSync(fullPath, 'utf-8');
+            suggestFromFile(opts.file, content, opts.model, suggestions);
+        }
+    }
+    // Deduplicate and sort by confidence
+    const seen = new Set();
+    const confOrder = { high: 0, medium: 1, low: 2 };
+    return suggestions
+        .filter(s => {
+        const key = `${s.file}:${s.line}:${s.annotation}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    })
+        .sort((a, b) => confOrder[a.confidence] - confOrder[b.confidence]);
+}
+const PATTERNS = [
+    // SQL / database
+    {
+        regex: /(?:execute|query|raw_sql|cursor\.execute|\.query\(|knex\.|sequelize\.|prisma\.)\s*\(/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #sqli with Insufficient input validation`,
+        reason: 'Database query detected — potential SQL injection if inputs are not parameterized',
+        confidence: 'high',
+    },
+    // Command execution
+    {
+        regex: /(?:exec|spawn|execSync|child_process|subprocess|os\.system|os\.popen|Runtime\.exec)\s*\(/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #cmd-injection with Unsanitized command arguments`,
+        reason: 'Command execution detected — potential command injection',
+        confidence: 'high',
+    },
+    // File I/O with user input
+    {
+        regex: /(?:readFile|writeFile|open\(|fopen|fs\.read|Path\.resolve|path\.join).*(?:req\.|request\.|params|query|body)/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #path-traversal with User-controlled file path`,
+        reason: 'File operation with user-influenced path — potential path traversal',
+        confidence: 'high',
+    },
+    // eval / dynamic code
+    {
+        regex: /(?:eval\(|new\s+Function\(|exec\(|compile\(|setInterval\(|setTimeout\().*(?:req|input|user|param|body)/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #code-injection with Dynamic code execution`,
+        reason: 'Dynamic code execution with potential user input',
+        confidence: 'high',
+    },
+    // Auth/login handlers
+    {
+        regex: /(?:def\s+login|function\s+login|authenticate|verify_password|check_credentials|signIn)/i,
+        category: 'asset',
+        annotation: (_m, f) => `@asset ${assetFromFile(f)} -- "Authentication handler"`,
+        reason: 'Authentication-related function — should be declared as security-relevant asset',
+        confidence: 'medium',
+    },
+    // Input validation / sanitization
+    {
+        regex: /(?:sanitize|validate|escape|htmlEscape|xss|dompurify|bleach|strip_tags)/i,
+        category: 'mitigation',
+        annotation: (_m, f) => `@control Input_Validation (#input-validation) -- "Sanitizes user input"`,
+        reason: 'Input validation/sanitization detected — should be documented as a control',
+        confidence: 'medium',
+    },
+    // CORS configuration
+    {
+        regex: /(?:cors|Access-Control-Allow-Origin|allowed_origins)/i,
+        category: 'mitigation',
+        annotation: (_m, f) => `@control CORS_Policy (#cors-policy) -- "Restricts cross-origin requests"`,
+        reason: 'CORS configuration detected',
+        confidence: 'medium',
+    },
+    // Rate limiting
+    {
+        regex: /(?:rate.?limit|throttle|RateLimiter|express-rate-limit|slowapi)/i,
+        category: 'mitigation',
+        annotation: (_m, f) => `@control Rate_Limiting (#rate-limit) -- "Limits request frequency"`,
+        reason: 'Rate limiting detected',
+        confidence: 'medium',
+    },
+    // Crypto / hashing
+    {
+        regex: /(?:bcrypt|scrypt|argon2|pbkdf2|hashlib|crypto\.createHash|md5|sha256)/i,
+        category: 'mitigation',
+        annotation: (_m, f) => `@control Crypto_Hashing (#crypto-hash) -- "Cryptographic hashing for sensitive data"`,
+        reason: 'Cryptographic hashing detected',
+        confidence: 'medium',
+    },
+    // HTTP handlers
+    {
+        regex: /(?:@app\.(?:get|post|put|delete|patch)|router\.(?:get|post|put|delete)|@GetMapping|@PostMapping|@RequestMapping)/i,
+        category: 'flow',
+        annotation: (_m, f) => `@handles ${assetFromFile(f)} -- "HTTP request handler"`,
+        reason: 'HTTP endpoint handler — represents an entry point for user data',
+        confidence: 'medium',
+    },
+    // Secrets / credentials
+    {
+        regex: /(?:API_KEY|SECRET_KEY|PASSWORD|TOKEN|PRIVATE_KEY|AWS_ACCESS|DATABASE_URL)\s*[=:]/i,
+        category: 'data_handling',
+        annotation: (_m, f) => `@data ${assetFromFile(f)} stores secrets -- "Contains credentials or API keys"`,
+        reason: 'Hardcoded secret or credential reference detected',
+        confidence: 'high',
+    },
+    // Deserialization
+    {
+        regex: /(?:pickle\.load|yaml\.load\(|yaml\.unsafe_load|JSON\.parse|deserialize|unmarshal|ObjectInputStream)/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #unsafe-deser with Deserialization of untrusted data`,
+        reason: 'Deserialization detected — potential unsafe deserialization if input is untrusted',
+        confidence: 'medium',
+    },
+    // SSRF patterns
+    {
+        regex: /(?:fetch|requests\.get|urllib|http\.get|axios|HttpClient).*(?:req\.|request\.|params|query|body|url)/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #ssrf with User-controlled URL`,
+        reason: 'HTTP request with user-influenced URL — potential SSRF',
+        confidence: 'medium',
+    },
+    // Template rendering (XSS)
+    {
+        regex: /(?:render_template|innerHTML|dangerouslySetInnerHTML|v-html|ng-bind-html|\|safe\b|mark_safe)/i,
+        category: 'exposure',
+        annotation: (_m, f) => `@exposes ${assetFromFile(f)} to #xss with Unescaped output rendering`,
+        reason: 'Unsafe HTML rendering detected — potential XSS',
+        confidence: 'high',
+    },
+];
+// ─── File analysis ───────────────────────────────────────────────────
+function suggestFromFile(file, content, model, out) {
+    // Skip definition files and non-source
+    if (file.includes('.guardlink/') || file.includes('node_modules/'))
+        return;
+    const lines = content.split('\n');
+    // Check if file already has annotations
+    const hasAnnotations = lines.some(l => /@(?:asset|threat|control|exposes|mitigates|accepts|flows|boundary|handles|comment|data|shield)\b/.test(l));
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of PATTERNS) {
+            const match = line.match(pattern.regex);
+            if (match) {
+                out.push({
+                    file,
+                    line: i + 1,
+                    annotation: pattern.annotation(match, file),
+                    reason: pattern.reason,
+                    confidence: hasAnnotations ? pattern.confidence : lowerConfidence(pattern.confidence),
+                    category: pattern.category,
+                });
+            }
+        }
+    }
+    // Post-pass: suggest @comment on security-relevant functions with no nearby annotations or suggestions
+    const FUNC_RE = /(?:(?:export\s+)?(?:async\s+)?function\s+(\w+)|(?:export\s+)?class\s+(\w+)|def\s+(\w+)|fn\s+(\w+)|func\s+(\w+))/i;
+    const SEC_KEYWORDS = /auth|login|cred|token|secret|password|session|crypto|encrypt|decrypt|hash|key|cert|ssl|tls|api|admin|pay|billing|charge|invoice/i;
+    const suggestedLines = new Set(out.map(s => s.line));
+    for (let i = 0; i < lines.length; i++) {
+        const funcMatch = lines[i].match(FUNC_RE);
+        if (!funcMatch)
+            continue;
+        const funcName = funcMatch[1] || funcMatch[2] || funcMatch[3] || funcMatch[4] || funcMatch[5];
+        const lineNum = i + 1;
+        // Skip if already has a suggestion or annotation within 3 lines above
+        const hasNearby = Array.from({ length: 4 }, (_, k) => lineNum - k).some(ln => suggestedLines.has(ln) || (ln > 0 && ln <= lines.length && /@\w+/.test(lines[ln - 1])));
+        if (hasNearby)
+            continue;
+        // Only suggest for functions with security-relevant names or in security-relevant file paths
+        if (SEC_KEYWORDS.test(funcName) || SEC_KEYWORDS.test(file)) {
+            out.push({
+                file,
+                line: lineNum,
+                annotation: `@comment -- "TODO: Document security relevance of ${funcName}"`,
+                reason: `Security-relevant function '${funcName}' has no annotation — add at least @comment`,
+                confidence: 'low',
+                category: 'asset',
+            });
+        }
+    }
+}
+// ─── Diff analysis ───────────────────────────────────────────────────
+function suggestFromDiff(diff, model, out) {
+    // Parse unified diff format
+    let currentFile = '';
+    let lineNum = 0;
+    for (const line of diff.split('\n')) {
+        // File header: +++ b/path/to/file.ts
+        const fileMatch = line.match(/^\+\+\+\s+b\/(.+)/);
+        if (fileMatch) {
+            currentFile = fileMatch[1];
+            continue;
+        }
+        // Hunk header: @@ -old,count +new,count @@
+        const hunkMatch = line.match(/^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@/);
+        if (hunkMatch) {
+            lineNum = parseInt(hunkMatch[1], 10);
+            continue;
+        }
+        // Added lines (+ prefix)
+        if (line.startsWith('+') && !line.startsWith('+++')) {
+            const content = line.slice(1);
+            for (const pattern of PATTERNS) {
+                const match = content.match(pattern.regex);
+                if (match) {
+                    out.push({
+                        file: currentFile,
+                        line: lineNum,
+                        annotation: pattern.annotation(match, currentFile),
+                        reason: `[New code] ${pattern.reason}`,
+                        confidence: pattern.confidence,
+                        category: pattern.category,
+                    });
+                }
+            }
+            lineNum++;
+        }
+        else if (!line.startsWith('-')) {
+            // Context line (no prefix) — increment line counter
+            lineNum++;
+        }
+        // Removed lines (- prefix) — don't increment
+    }
+}
+// ─── Helpers ─────────────────────────────────────────────────────────
+function assetFromFile(file) {
+    // Convert file path to a reasonable asset name suggestion
+    const base = file
+        .replace(/\.[^.]+$/, '') // Remove extension
+        .replace(/^src\/|^lib\/|^app\//, '') // Strip common prefixes
+        .replace(/\//g, '.'); // Dots for path segments
+    return base.split('.').map(s => s.charAt(0).toUpperCase() + s.slice(1)).join('.');
+}
+function lowerConfidence(c) {
+    if (c === 'high')
+        return 'medium';
+    return 'low';
+}
+//# sourceMappingURL=suggest.js.map

package/dist/mcp/suggest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/mcp/suggest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAW,MAAM,WAAW,CAAC;AAmB1C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAoB;IAC3D,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjD,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,CAAC,EAAE;QACV,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAYD,MAAM,QAAQ,GAAkB;IAC9B,iBAAiB;IACjB;QACE,KAAK,EAAE,uFAAuF;QAC9F,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,8CAA8C;QACjG,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,MAAM;KACnB;IACD,oBAAoB;IACpB;QACE,KAAK,EAAE,2FAA2F;QAClG,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,uDAAuD;QAC1G,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,MAAM;KACnB;IACD,2BAA2B;IAC3B;QACE,KAAK,EAAE,+GAA+G;QACtH,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,oDAAoD;QACvG,MAAM,EAAE,qEAAqE;QAC7E,UAAU,EAAE,MAAM;KACnB;IACD,sBAAsB;IACtB;QACE,KAAK,EAAE,yGAAyG;QAChH,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,iDAAiD;QACpG,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,MAAM;KACnB;IACD,sBAAsB;IACtB;QACE,KAAK,EAAE,yFAAyF;QAChG,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,aAAa,CAAC,CAAC,CAAC,8BAA8B;QAC/E,MAAM,EAAE,iFAAiF;QACzF,UAAU,EAAE,QAAQ;KACrB;IACD,kCAAkC;IAClC;QACE,KAAK,EAAE,0EAA0E;QACjF,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,yEAAyE;QAChG,MAAM,EAAE,4EAA4E;QACpF,UAAU,EAAE,QAAQ;KACrB;IACD,qBAAqB;IACrB;QACE,KAAK,EAAE,uDAAuD;QAC9D,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,0EAA0E;QACjG,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,QAAQ;KACrB;IACD,gBAAgB;IAChB;QACE,KAAK,EAAE,kEAAkE;QACzE,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,oEAAoE;QAC3F,MAAM,EAAE,wBAAwB;QAChC,UAAU,EAAE,QAAQ;KACrB;IACD,mBAAmB;IACnB;QACE,KAAK,EAAE,wEAAwE;QAC/E,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,sFAAsF;QAC7G,MAAM,EAAE,gCAAgC;QACxC,UAAU,EAAE,QAAQ;KACrB;IACD,gBAAgB;IAChB;QACE,KAAK,EAAE,mHAAmH;QAC1H,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,4BAA4B;QAC/E,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,QAAQ;KACrB;IACD,wBAAwB;IACxB;QACE,KAAK,EAAE,mFAAmF;QAC1F,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,uDAAuD;QACvG,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,MAAM;KACnB;IACD,kBAAkB;IAClB;QACE,KAAK,EAAE,sGAAsG;QAC7G,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,0DAA0D;QAC7G,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,QAAQ;KACrB;IACD,gBAAgB;IAChB;QACE,KAAK,EAAE,uGAAuG;QAC9G,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,oCAAoC;QACvF,MAAM,EAAE,wDAAwD;QAChE,UAAU,EAAE,QAAQ;KACrB;IACD,2BAA2B;IAC3B;QACE,KAAK,EAAE,+FAA+F;QACtG,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,0CAA0C;QAC7F,MAAM,EAAE,gDAAgD;QACxD,UAAU,EAAE,MAAM;KACnB;CACF,CAAC;AAEF,wEAAwE;AAExE,SAAS,eAAe,CACtB,IAAY,EAAE,OAAe,EAAE,KAAkB,EAAE,GAAiB;IAEpE,uCAAuC;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO;IAE3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,wCAAwC;IACxC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kGAAkG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC;oBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;oBACrF,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uGAAuG;IACvG,MAAM,OAAO,GAAG,kHAAkH,CAAC;IACnI,MAAM,YAAY,GAAG,kIAAkI,CAAC;IACxJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,sEAAsE;QACtE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CACvF,CAAC;QACF,IAAI,SAAS;YAAE,SAAS;QAExB,6FAA6F;QAC7F,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,qDAAqD,QAAQ,GAAG;gBAC5E,MAAM,EAAE,+BAA+B,QAAQ,6CAA6C;gBAC5F,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,SAAS,eAAe,CACtB,IAAY,EAAE,KAAkB,EAAE,GAAiB;IAEnD,4BAA4B;IAC5B,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5E,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,OAAO;wBACb,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC;wBAClD,MAAM,EAAE,cAAc,OAAO,CAAC,MAAM,EAAE;wBACtC,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,oDAAoD;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,SAAS,aAAa,CAAC,IAAY;IACjC,0DAA0D;IAC1D,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAW,mBAAmB;SACrD,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,wBAAwB;SAC5D,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAc,yBAAyB;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,eAAe,CAAC,CAA4B;IACnD,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/parser/comment-strip.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Comment prefix stripping per §2.9.
+ * Strips the host language's comment prefix to expose the annotation text.
+ */
+/**
+ * Strip comment prefix from a single line, returning the inner text
+ * or null if the line is not a comment.
+ */
+export declare function stripCommentPrefix(line: string): string | null;
+/**
+ * Detect file's primary comment style from extension.
+ * Used for multi-line continuation detection.
+ */
+export declare function commentStyleForExt(ext: string): string;
+//# sourceMappingURL=comment-strip.d.ts.map

package/dist/parser/comment-strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-strip.d.ts","sourceRoot":"","sources":["../../src/parser/comment-strip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA+C9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBtD"}

package/dist/parser/comment-strip.js

@@ -0,0 +1,76 @@
+/**
+ * Comment prefix stripping per §2.9.
+ * Strips the host language's comment prefix to expose the annotation text.
+ */
+/**
+ * Strip comment prefix from a single line, returning the inner text
+ * or null if the line is not a comment.
+ */
+export function stripCommentPrefix(line) {
+    const trimmed = line.trimStart();
+    // Single-line styles (order matters — longer prefixes first)
+    const singlePrefixes = [
+        '//', // C-family, Rust, Go, JS, TS
+        '#', // Python, Ruby, Bash, YAML, Terraform
+        '--', // Haskell, Lua, SQL, Ada
+        '%', // LaTeX, Erlang, MATLAB
+        ';', // Lisp, Clojure, Assembly
+        'REM ', // Batch (with trailing space)
+        'REM\t',
+        "'", // VBA, VB.NET
+    ];
+    for (const prefix of singlePrefixes) {
+        if (trimmed.startsWith(prefix)) {
+            return trimmed.slice(prefix.length).trimStart();
+        }
+    }
+    // Block comment line (already inside a block)
+    // Strip leading * (Javadoc-style) or bare text in block
+    if (trimmed.startsWith('*') && !trimmed.startsWith('*/')) {
+        return trimmed.slice(1).trimStart();
+    }
+    // HTML/XML comment: <!-- ... -->
+    const htmlMatch = trimmed.match(/^<!--\s*(.*?)\s*-->$/);
+    if (htmlMatch)
+        return htmlMatch[1];
+    // Opening block comment on same line: /* ... */  or  /* ...
+    const blockOpenClose = trimmed.match(/^\/\*\s*(.*?)\s*\*\/$/);
+    if (blockOpenClose)
+        return blockOpenClose[1];
+    const blockOpen = trimmed.match(/^\/\*\s*(.*)$/);
+    if (blockOpen)
+        return blockOpen[1].trimStart();
+    // Haskell block: {- ... -}
+    const haskellBlock = trimmed.match(/^\{-\s*(.*?)\s*-\}$/);
+    if (haskellBlock)
+        return haskellBlock[1];
+    // OCaml/Pascal: (* ... *)
+    const ocamlBlock = trimmed.match(/^\(\*\s*(.*?)\s*\*\)$/);
+    if (ocamlBlock)
+        return ocamlBlock[1];
+    return null;
+}
+/**
+ * Detect file's primary comment style from extension.
+ * Used for multi-line continuation detection.
+ */
+export function commentStyleForExt(ext) {
+    const map = {
+        '.ts': '//', '.tsx': '//', '.js': '//', '.jsx': '//',
+        '.java': '//', '.c': '//', '.cpp': '//', '.cc': '//',
+        '.cs': '//', '.go': '//', '.rs': '//', '.swift': '//',
+        '.kt': '//', '.scala': '//', '.dart': '//',
+        '.py': '#', '.rb': '#', '.sh': '#', '.bash': '#',
+        '.yml': '#', '.yaml': '#', '.tf': '#', '.r': '#',
+        '.ex': '#', '.exs': '#', '.nim': '#', '.pl': '#',
+        '.hs': '--', '.lua': '--', '.sql': '--', '.ada': '--',
+        '.html': '<!--', '.xml': '<!--', '.svg': '<!--',
+        '.css': '/*',
+        '.tex': '%', '.erl': '%', '.m': '%',
+        '.lisp': ';', '.cl': ';', '.clj': ';', '.asm': ';',
+        '.bat': 'REM', '.cmd': 'REM',
+        '.vb': "'", '.bas': "'",
+    };
+    return map[ext.toLowerCase()] || '//';
+}
+//# sourceMappingURL=comment-strip.js.map

package/dist/parser/comment-strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-strip.js","sourceRoot":"","sources":["../../src/parser/comment-strip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAEjC,6DAA6D;IAC7D,MAAM,cAAc,GAAG;QACrB,IAAI,EAAI,6BAA6B;QACrC,GAAG,EAAK,sCAAsC;QAC9C,IAAI,EAAI,yBAAyB;QACjC,GAAG,EAAK,wBAAwB;QAChC,GAAG,EAAK,0BAA0B;QAClC,MAAM,EAAE,8BAA8B;QACtC,OAAO;QACP,GAAG,EAAK,cAAc;KACvB,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,wDAAwD;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACtC,CAAC;IAED,iCAAiC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IAEnC,4DAA4D;IAC5D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAE/C,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAEzC,0BAA0B;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1D,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAErC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,GAAG,GAA2B;QAClC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QACpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;QACpD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;QACrD,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;QAC1C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG;QAChD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;QAChD,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;QAChD,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAC/C,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;QACnC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;QAClD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;QAC5B,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;KACxB,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC"}

package/dist/parser/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GuardLink Parser — Public API
+ */
+export { parseFile, parseString } from './parse-file.js';
+export { parseProject } from './parse-project.js';
+export type { ParseProjectOptions } from './parse-project.js';
+export { parseLine } from './parse-line.js';
+export { normalizeName, resolveSeverity, unescapeDescription } from './normalize.js';
+export { stripCommentPrefix, commentStyleForExt } from './comment-strip.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/parser/index.js

@@ -0,0 +1,9 @@
+/**
+ * GuardLink Parser — Public API
+ */
+export { parseFile, parseString } from './parse-file.js';
+export { parseProject } from './parse-project.js';
+export { parseLine } from './parse-line.js';
+export { normalizeName, resolveSeverity, unescapeDescription } from './normalize.js';
+export { stripCommentPrefix, commentStyleForExt } from './comment-strip.js';
+//# sourceMappingURL=index.js.map

package/dist/parser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/parser/normalize.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Name normalization per §2.10 of the GuardLink spec.
+ *
+ * Algorithm:
+ * 1. Apply Unicode NFKC normalization
+ * 2. Convert to lowercase
+ * 3. Replace whitespace → underscore
+ * 4. Replace hyphens → underscore
+ * 5. Collapse consecutive underscores
+ * 6. Strip leading/trailing underscores
+ */
+export declare function normalizeName(name: string): string;
+/**
+ * Severity alias resolution: P0→critical, P1→high, etc.
+ */
+export declare function resolveSeverity(raw: string): 'critical' | 'high' | 'medium' | 'low' | undefined;
+/**
+ * Unescape description string per §2.11.
+ * Handles \" → " and \\\\ → \\
+ */
+export declare function unescapeDescription(raw: string): string;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/parser/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/parser/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAQ/F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD"}

package/dist/parser/normalize.js

@@ -0,0 +1,42 @@
+/**
+ * Name normalization per §2.10 of the GuardLink spec.
+ *
+ * Algorithm:
+ * 1. Apply Unicode NFKC normalization
+ * 2. Convert to lowercase
+ * 3. Replace whitespace → underscore
+ * 4. Replace hyphens → underscore
+ * 5. Collapse consecutive underscores
+ * 6. Strip leading/trailing underscores
+ */
+export function normalizeName(name) {
+    return name
+        .normalize('NFKC')
+        .toLowerCase()
+        .replace(/[\s\t\u00A0]+/g, '_') // whitespace → underscore
+        .replace(/-+/g, '_') // hyphens → underscore
+        .replace(/_+/g, '_') // collapse consecutive
+        .replace(/^_|_$/g, ''); // strip leading/trailing
+}
+/**
+ * Severity alias resolution: P0→critical, P1→high, etc.
+ */
+export function resolveSeverity(raw) {
+    const map = {
+        p0: 'critical', critical: 'critical',
+        p1: 'high', high: 'high',
+        p2: 'medium', medium: 'medium',
+        p3: 'low', low: 'low',
+    };
+    return map[raw.toLowerCase()];
+}
+/**
+ * Unescape description string per §2.11.
+ * Handles \" → " and \\\\ → \\
+ */
+export function unescapeDescription(raw) {
+    return raw
+        .replace(/\\"/g, '"')
+        .replace(/\\\\/g, '\\');
+}
+//# sourceMappingURL=normalize.js.map

package/dist/parser/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/parser/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAE,0BAA0B;SAC1D,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAc,uBAAuB;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAc,uBAAuB;SACxD,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAW,yBAAyB;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAA2D;QAClE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU;QACpC,EAAE,EAAE,MAAM,EAAM,IAAI,EAAE,MAAM;QAC5B,EAAE,EAAE,QAAQ,EAAI,MAAM,EAAE,QAAQ;QAChC,EAAE,EAAE,KAAK,EAAO,GAAG,EAAE,KAAK;KAC3B,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG;SACP,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/parser/parse-file.d.ts

@@ -0,0 +1,18 @@
+/**
+ * GuardLink — File-level parser.
+ * Reads source files and extracts all GuardLink annotations.
+ *
+ * @exposes #parser to #path-traversal [high] cwe:CWE-22 -- "Reads files from disk using provided file path"
+ * @comment -- "File paths are controlled by parse-project glob results, not direct user input"
+ */
+import type { ParseResult } from '../types/index.js';
+/**
+ * Parse a single file and return all annotations found.
+ */
+export declare function parseFile(filePath: string): Promise<ParseResult>;
+/**
+ * Parse a string of source code and return all annotations found.
+ * Useful for testing without file I/O.
+ */
+export declare function parseString(content: string, filePath?: string): ParseResult;
+//# sourceMappingURL=parse-file.d.ts.map

package/dist/parser/parse-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-file.d.ts","sourceRoot":"","sources":["../../src/parser/parse-file.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAA+B,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKlF;;GAEG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGtE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAkB,GAAG,WAAW,CAgDtF"}

package/dist/parser/parse-file.js

@@ -0,0 +1,68 @@
+/**
+ * GuardLink — File-level parser.
+ * Reads source files and extracts all GuardLink annotations.
+ *
+ * @exposes #parser to #path-traversal [high] cwe:CWE-22 -- "Reads files from disk using provided file path"
+ * @comment -- "File paths are controlled by parse-project glob results, not direct user input"
+ */
+import { readFile } from 'node:fs/promises';
+import { stripCommentPrefix } from './comment-strip.js';
+import { parseLine } from './parse-line.js';
+import { unescapeDescription } from './normalize.js';
+/**
+ * Parse a single file and return all annotations found.
+ */
+export async function parseFile(filePath) {
+    const content = await readFile(filePath, 'utf-8');
+    return parseString(content, filePath);
+}
+/**
+ * Parse a string of source code and return all annotations found.
+ * Useful for testing without file I/O.
+ */
+export function parseString(content, filePath = '<input>') {
+    const lines = content.split('\n');
+    const annotations = [];
+    const diagnostics = [];
+    let lastAnnotation = null;
+    for (let i = 0; i < lines.length; i++) {
+        const lineNum = i + 1; // 1-indexed
+        const rawLine = lines[i];
+        // Strip comment prefix
+        const inner = stripCommentPrefix(rawLine);
+        if (inner === null) {
+            lastAnnotation = null;
+            continue;
+        }
+        // Check for continuation line: -- "..."
+        const contMatch = inner.match(/^--\s*"((?:[^"\\]|\\.)*)"/);
+        if (contMatch && lastAnnotation) {
+            // Append to last annotation's description
+            const contDesc = unescapeDescription(contMatch[1]);
+            if (lastAnnotation.description) {
+                lastAnnotation.description += ' ' + contDesc;
+            }
+            else {
+                lastAnnotation.description = contDesc;
+            }
+            continue;
+        }
+        // Try to parse as annotation
+        const location = { file: filePath, line: lineNum };
+        const result = parseLine(inner, location);
+        if (result.annotation) {
+            annotations.push(result.annotation);
+            lastAnnotation = result.annotation;
+        }
+        else {
+            if (result.diagnostic) {
+                diagnostics.push(result.diagnostic);
+            }
+            if (!result.isContinuation) {
+                lastAnnotation = null;
+            }
+        }
+    }
+    return { annotations, diagnostics, files_parsed: 1 };
+}
+//# sourceMappingURL=parse-file.js.map

package/dist/parser/parse-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-file.js","sourceRoot":"","sources":["../../src/parser/parse-file.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,WAAmB,SAAS;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,IAAI,cAAc,GAAsB,IAAI,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,YAAY;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzB,uBAAuB;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QAED,wCAAwC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3D,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;YAChC,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC/B,cAAc,CAAC,WAAW,IAAI,GAAG,GAAG,QAAQ,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,WAAW,GAAG,QAAQ,CAAC;YACxC,CAAC;YACD,SAAS;QACX,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE1C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACpC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/parser/parse-line.d.ts

@@ -0,0 +1,21 @@
+/**
+ * GuardLink — Line-level annotation parser.
+ * Parses a single comment line into a typed Annotation.
+ *
+ * @exposes #parser to #redos [medium] cwe:CWE-1333 -- "Complex regex patterns run against untrusted annotation content"
+ * @mitigates #parser against #redos using #regex-anchoring -- "All patterns use ^ anchor and defined character classes"
+ * @comment -- "PATTERNS object contains all annotation regex; patterns are pre-compiled for performance"
+ */
+import type { Annotation, ParseDiagnostic, SourceLocation } from '../types/index.js';
+export interface ParseLineResult {
+    annotation: Annotation | null;
+    diagnostic: ParseDiagnostic | null;
+    isContinuation: boolean;
+}
+/**
+ * Parse a single annotation line (after comment prefix has been stripped).
+ * Returns the typed annotation, a diagnostic if parsing failed, or null if
+ * the line is not an annotation.
+ */
+export declare function parseLine(text: string, location: SourceLocation): ParseLineResult;
+//# sourceMappingURL=parse-line.d.ts.map

package/dist/parser/parse-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-line.d.ts","sourceRoot":"","sources":["../../src/parser/parse-line.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EAAE,cAAc,EAChC,MAAM,mBAAmB,CAAC;AAsE3B,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,GACvB,eAAe,CA8KjB"}