hackmyagent 0.7.2 → 0.8.1

package/dist/registry/contribution.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Anonymous registry contribution for scan results.
+ *
+ * When users opt in (--contribute flag), scan results are submitted
+ * anonymously to the OpenA2A registry for aggregate security intelligence.
+ *
+ * What IS sent:
+ * - SHA256 hash of scanned artifact (for deduplication, not identification)
+ * - Scan type and version
+ * - Finding IDs and severities (no file paths or content)
+ * - Domain scores (for governance scans)
+ * - Agent tier classification
+ * - Timestamp and scanner version
+ *
+ * What is NEVER sent:
+ * - File paths, file content, or source code
+ * - Usernames, hostnames, or IP addresses
+ * - Environment variables or credential values
+ * - Directory structure or project names
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashArtifact = hashArtifact;
+exports.generateContributionId = generateContributionId;
+exports.extractFindingIds = extractFindingIds;
+exports.countBySeverity = countBySeverity;
+exports.buildHardeningContribution = buildHardeningContribution;
+exports.buildGovernanceContribution = buildGovernanceContribution;
+exports.buildMcpContribution = buildMcpContribution;
+exports.buildAttackContribution = buildAttackContribution;
+exports.buildAgentScanContribution = buildAgentScanContribution;
+exports.submitContribution = submitContribution;
+const crypto = __importStar(require("crypto"));
+/**
+ * Generate SHA256 hash of content for artifact identification.
+ * The hash allows deduplication without revealing content.
+ */
+function hashArtifact(content) {
+    return crypto.createHash('sha256').update(content).digest('hex');
+}
+/**
+ * Generate a random contribution ID.
+ */
+function generateContributionId() {
+    return crypto.randomUUID();
+}
+/**
+ * Strip PII from a finding list -- return only check IDs.
+ */
+function extractFindingIds(findings) {
+    return [...new Set(findings.map(f => f.checkId))].sort();
+}
+/**
+ * Count findings by severity.
+ */
+function countBySeverity(findings) {
+    const failed = findings.filter(f => f.passed === false);
+    return {
+        critical: failed.filter(f => f.severity === 'critical').length,
+        high: failed.filter(f => f.severity === 'high').length,
+        medium: failed.filter(f => f.severity === 'medium').length,
+        low: failed.filter(f => f.severity === 'low').length,
+    };
+}
+/**
+ * Build a contribution payload from hardening scan results.
+ */
+function buildHardeningContribution(scannerVersion, artifactContent, findings, score, maxScore, durationMs) {
+    const counts = countBySeverity(findings);
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'hardening',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: counts.critical + counts.high + counts.medium + counts.low,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: extractFindingIds(findings.filter(f => !f.passed)),
+        score,
+        maxScore,
+    };
+}
+/**
+ * Build a contribution payload from governance scan results.
+ */
+function buildGovernanceContribution(scannerVersion, artifactContent, governanceScore, durationMs) {
+    const failed = governanceScore.results.filter(r => !r.passed);
+    const counts = countBySeverity(failed.map(r => ({ severity: r.severity, passed: false })));
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'governance',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: failed.length,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: failed.map(r => r.controlId),
+        score: governanceScore.overall,
+        maxScore: 100,
+        grade: governanceScore.grade,
+        governance: {
+            tier: governanceScore.tier,
+            domainScores: governanceScore.domains.map(d => ({
+                domain: d.domain,
+                score: d.score,
+                controlsPassed: d.controlsPassed,
+                controlsTotal: d.controlsTotal,
+            })),
+            criticalFailures: governanceScore.criticalFailures,
+        },
+    };
+}
+/**
+ * Build a contribution payload from MCP tool enumeration.
+ */
+function buildMcpContribution(scannerVersion, configContent, serverResults, durationMs) {
+    const allFindings = serverResults.flatMap(s => s.findings);
+    const counts = countBySeverity(allFindings.map(f => ({ severity: f.severity, passed: false })));
+    const categories = new Set();
+    for (const f of allFindings) {
+        if (f.checkId === 'MCPTOOL-001')
+            categories.add('execution');
+        if (f.checkId === 'MCPTOOL-002')
+            categories.add('filesystem');
+        if (f.checkId === 'MCPTOOL-003')
+            categories.add('network');
+        if (f.checkId === 'MCPTOOL-004')
+            categories.add('credential');
+    }
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(configContent),
+        scanType: 'mcp-enumeration',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: allFindings.length,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: [...new Set(allFindings.map(f => f.checkId))].sort(),
+        mcpEnumeration: {
+            serversScanned: serverResults.length,
+            totalTools: serverResults.reduce((sum, s) => sum + s.toolCount, 0),
+            dangerousToolCount: allFindings.length,
+            categories: [...categories],
+        },
+    };
+}
+/**
+ * Build a contribution payload from attack scan results.
+ */
+function buildAttackContribution(scannerVersion, targetIdentifier, attackReport, durationMs) {
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(targetIdentifier),
+        scanType: 'attack',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: attackReport.bypassed,
+        criticalCount: 0,
+        highCount: attackReport.bypassed,
+        mediumCount: 0,
+        lowCount: 0,
+        findingIds: attackReport.categories,
+        attack: {
+            categories: attackReport.categories,
+            payloadsRun: attackReport.totalPayloads,
+            payloadsBlocked: attackReport.blocked,
+            payloadsBypassed: attackReport.bypassed,
+            blockRate: attackReport.blockRate,
+        },
+    };
+}
+/**
+ * Build a contribution payload from agent card scan results.
+ */
+function buildAgentScanContribution(scannerVersion, artifactContent, scanResult, durationMs) {
+    const counts = countBySeverity(scanResult.findings.map(f => ({ severity: f.severity, passed: f.passed })));
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'agent-scan',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: counts.critical + counts.high + counts.medium + counts.low,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: extractFindingIds(scanResult.findings.filter(f => !f.passed)),
+        score: scanResult.score,
+        maxScore: 100,
+        grade: scanResult.grade,
+        agentScan: {
+            checksTotal: scanResult.findings.length,
+            checksPassed: scanResult.findings.filter(f => f.passed).length,
+            criticalFailures: scanResult.criticalFailures.length,
+            hasPublicKey: typeof scanResult.card.publicKey === 'string' && scanResult.card.publicKey.length > 0,
+            hasAttestation: scanResult.card.aimAttestation != null,
+            trustScore: scanResult.card.aimAttestation?.trustScore,
+        },
+    };
+}
+/**
+ * Submit contribution to registry. Never throws -- contribution failure is non-fatal.
+ */
+async function submitContribution(registryUrl, payload) {
+    try {
+        const response = await fetch(`${registryUrl}/api/v1/registry/community/contribute`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': 'HackMyAgent-CLI',
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const body = await response.json().catch(() => ({}));
+            return { status: 'failed', message: body.message || `HTTP ${response.status}` };
+        }
+        return await response.json();
+    }
+    catch {
+        return { status: 'failed', message: 'Network error' };
+    }
+}
+//# sourceMappingURL=contribution.js.map

package/dist/registry/contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.js","sourceRoot":"","sources":["../../src/registry/contribution.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FH,oCAEC;AAKD,wDAEC;AAKD,8CAEC;AAKD,0CAUC;AAKD,gEAyBC;AAKD,kEA2CC;AAKD,oDAyCC;AAKD,0DAiCC;AAKD,gEAuCC;AAKD,gDAuBC;AAnWD,+CAAiC;AAsFjC;;;GAGG;AACH,SAAgB,YAAY,CAAC,OAAe;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB;IACpC,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAoC;IACpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,QAAuD;IAEvD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IACxD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9D,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC1D,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,cAAsB,EACtB,eAAuB,EACvB,QAAwE,EACxE,KAAa,EACb,QAAgB,EAChB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,WAAW;QACrB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG;QACzE,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CACzC,cAAsB,EACtB,eAAuB,EACvB,eAOC,EACD,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3F,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,eAAe,CAAC,KAAK;QAC5B,UAAU,EAAE;YACV,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9C,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B,CAAC,CAAC;YACH,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;SACnD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,cAAsB,EACtB,aAAqB,EACrB,aAIE,EACF,UAAmB;IAEnB,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAChE,cAAc,EAAE;YACd,cAAc,EAAE,aAAa,CAAC,MAAM;YACpC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAClE,kBAAkB,EAAE,WAAW,CAAC,MAAM;YACtC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CACrC,cAAsB,EACtB,gBAAwB,EACxB,YAMC,EACD,UAAmB;IAEnB,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAC5C,QAAQ,EAAE,QAAQ;QAClB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,YAAY,CAAC,QAAQ;QACpC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,YAAY,CAAC,QAAQ;QAChC,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,MAAM,EAAE;YACN,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,WAAW,EAAE,YAAY,CAAC,aAAa;YACvC,eAAe,EAAE,YAAY,CAAC,OAAO;YACrC,gBAAgB,EAAE,YAAY,CAAC,QAAQ;YACvC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,cAAsB,EACtB,eAAuB,EACvB,UAMC,EACD,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG;QACzE,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,SAAS,EAAE;YACT,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM;YACvC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC9D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,MAAM;YACpD,YAAY,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YACnG,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI;YACtD,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU;SACvD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,OAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,uCAAuC,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,iBAAiB;aAChC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/registry/index.d.ts

@@ -0,0 +1,3 @@
+export { RegistryClient, buildScanReport, buildAttackReport, buildCommunityReport, buildCommunityAttackReport, } from './client';
+export type { RegistryConfig, RegistryPackage, ScanReportPayload, CommunityScanPayload, } from './client';
+//# sourceMappingURL=index.d.ts.map

package/dist/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,UAAU,CAAC"}

package/dist/registry/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCommunityAttackReport = exports.buildCommunityReport = exports.buildAttackReport = exports.buildScanReport = exports.RegistryClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "RegistryClient", { enumerable: true, get: function () { return client_1.RegistryClient; } });
+Object.defineProperty(exports, "buildScanReport", { enumerable: true, get: function () { return client_1.buildScanReport; } });
+Object.defineProperty(exports, "buildAttackReport", { enumerable: true, get: function () { return client_1.buildAttackReport; } });
+Object.defineProperty(exports, "buildCommunityReport", { enumerable: true, get: function () { return client_1.buildCommunityReport; } });
+Object.defineProperty(exports, "buildCommunityAttackReport", { enumerable: true, get: function () { return client_1.buildCommunityAttackReport; } });
+//# sourceMappingURL=index.js.map

package/dist/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":";;;AAAA,mCAMkB;AALhB,wGAAA,cAAc,OAAA;AACd,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,8GAAA,oBAAoB,OAAA;AACpB,oHAAA,0BAA0B,OAAA"}

package/dist/scanner/external-scanner.d.ts

@@ -0,0 +1,13 @@
+/**
+ * External Scanner
+ * Scans remote targets for exposed MCP endpoints, configs, and credentials
+ */
+import type { ExternalScanResult, ScannerOptions } from './types';
+export declare class ExternalScanner {
+    scan(target: string, options?: ScannerOptions): Promise<ExternalScanResult>;
+    private scanPorts;
+    private isPortOpen;
+    private checkPort;
+    private httpProbe;
+}
+//# sourceMappingURL=external-scanner.d.ts.map

package/dist/scanner/external-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-scanner.d.ts","sourceRoot":"","sources":["../../src/scanner/external-scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAmB,cAAc,EAAmB,MAAM,SAAS,CAAC;AAoDpG,qBAAa,eAAe;IACpB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA0CnE,SAAS;IAmBvB,OAAO,CAAC,UAAU;YAyBJ,SAAS;IAuHvB,OAAO,CAAC,SAAS;CA8ClB"}

package/dist/scanner/external-scanner.js

@@ -0,0 +1,299 @@
+"use strict";
+/**
+ * External Scanner
+ * Scans remote targets for exposed MCP endpoints, configs, and credentials
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalScanner = void 0;
+const net = __importStar(require("net"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+// Default ports to scan
+const DEFAULT_PORTS = [80, 443, 3000, 3001, 4000, 5000, 8000, 8080, 8888, 18789, 18790];
+// Config file paths to check
+const CONFIG_PATHS = [
+    '/.claude/settings.json',
+    '/mcp.json',
+    '/.cursor/mcp.json',
+    '/.vscode/mcp.json',
+    '/config.json',
+    '/.env',
+];
+// MCP endpoint paths to check
+const MCP_SSE_PATHS = ['/sse', '/events', '/mcp/sse', '/mcp/events'];
+const MCP_TOOLS_PATHS = ['/tools', '/list', '/mcp/tools', '/mcp/list'];
+// CLAUDE.md paths
+const CLAUDE_MD_PATHS = ['/CLAUDE.md', '/.claude/CLAUDE.md'];
+// API key patterns
+const API_KEY_PATTERNS = [
+    { name: 'Anthropic', pattern: /sk-ant-api\d{2}-[a-zA-Z0-9_-]{6,}/ },
+    { name: 'OpenAI', pattern: /sk-proj-[a-zA-Z0-9]{6,}/ },
+    { name: 'OpenAI', pattern: /sk-[a-zA-Z0-9]{20,}/ },
+    { name: 'AWS', pattern: /AKIA[0-9A-Z]{16}/ },
+    { name: 'GitHub', pattern: /ghp_[a-zA-Z0-9]{36}/ },
+    { name: 'GitHub', pattern: /github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/ },
+];
+// Severity weights for scoring
+const SEVERITY_WEIGHTS = {
+    critical: 25,
+    high: 15,
+    medium: 10,
+    low: 5,
+};
+function generateId() {
+    return Math.random().toString(36).substring(2, 10);
+}
+function calculateGrade(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 80)
+        return 'B';
+    if (score >= 70)
+        return 'C';
+    if (score >= 60)
+        return 'D';
+    return 'F';
+}
+class ExternalScanner {
+    async scan(target, options) {
+        const startTime = Date.now();
+        const timeout = options?.timeout ?? 5000;
+        const ports = options?.ports ?? DEFAULT_PORTS;
+        const skipPortScan = options?.skipPortScan ?? false;
+        // Port scan
+        let openPorts = [];
+        if (!skipPortScan) {
+            openPorts = await this.scanPorts(target, ports, timeout);
+        }
+        // Run security checks on open ports
+        const findings = [];
+        for (const port of openPorts) {
+            const portFindings = await this.checkPort(target, port, timeout);
+            findings.push(...portFindings);
+        }
+        // Calculate score
+        let score = 100;
+        for (const finding of findings) {
+            score -= SEVERITY_WEIGHTS[finding.severity];
+        }
+        score = Math.max(0, score);
+        const grade = calculateGrade(score);
+        const duration = Date.now() - startTime;
+        return {
+            id: generateId(),
+            target,
+            score,
+            grade,
+            findings,
+            duration,
+            timestamp: new Date(),
+            openPorts,
+        };
+    }
+    async scanPorts(target, ports, timeout) {
+        const openPorts = [];
+        await Promise.all(ports.map(async (port) => {
+            const isOpen = await this.isPortOpen(target, port, timeout);
+            if (isOpen) {
+                openPorts.push(port);
+            }
+        }));
+        return openPorts.sort((a, b) => a - b);
+    }
+    isPortOpen(host, port, timeout) {
+        return new Promise((resolve) => {
+            const socket = new net.Socket();
+            socket.setTimeout(timeout);
+            socket.on('connect', () => {
+                socket.destroy();
+                resolve(true);
+            });
+            socket.on('timeout', () => {
+                socket.destroy();
+                resolve(false);
+            });
+            socket.on('error', () => {
+                socket.destroy();
+                resolve(false);
+            });
+            socket.connect(port, host);
+        });
+    }
+    async checkPort(target, port, timeout) {
+        const findings = [];
+        const useHttps = port === 443;
+        const baseUrl = `http${useHttps ? 's' : ''}://${target}:${port}`;
+        // Check MCP SSE endpoints
+        for (const path of MCP_SSE_PATHS) {
+            const result = await this.httpProbe(baseUrl + path, timeout);
+            if (result && result.contentType?.includes('text/event-stream')) {
+                findings.push({
+                    id: generateId(),
+                    checkId: 'MCP-SSE',
+                    severity: 'critical',
+                    title: 'MCP SSE Endpoint Exposed',
+                    description: 'Server-Sent Events endpoint for MCP is publicly accessible',
+                    port,
+                    path,
+                    evidence: `Content-Type: ${result.contentType}`,
+                    impact: 'Attackers can connect to the MCP server and potentially execute commands',
+                    fix: 'Restrict access with authentication or firewall rules',
+                });
+                break;
+            }
+        }
+        // Check MCP tools endpoints
+        for (const path of MCP_TOOLS_PATHS) {
+            const result = await this.httpProbe(baseUrl + path, timeout);
+            if (result && result.status === 200 && result.body?.includes('tools')) {
+                findings.push({
+                    id: generateId(),
+                    checkId: 'MCP-TOOLS',
+                    severity: 'critical',
+                    title: 'MCP Tools Endpoint Exposed',
+                    description: 'MCP tools listing is publicly accessible',
+                    port,
+                    path,
+                    evidence: `Found tools listing at ${path}`,
+                    impact: 'Attackers can enumerate available MCP tools and capabilities',
+                    fix: 'Restrict access with authentication or remove from public access',
+                });
+                break;
+            }
+        }
+        // Check config files
+        for (const path of CONFIG_PATHS) {
+            const result = await this.httpProbe(baseUrl + path, timeout);
+            if (result && result.status === 200 && result.body) {
+                // Check if it looks like JSON config
+                if (result.contentType?.includes('application/json') ||
+                    result.body.trim().startsWith('{')) {
+                    findings.push({
+                        id: generateId(),
+                        checkId: 'CONFIG-EXPOSED',
+                        severity: 'critical',
+                        title: 'Configuration File Exposed',
+                        description: `Configuration file ${path} is publicly accessible`,
+                        port,
+                        path,
+                        evidence: `HTTP 200 at ${path}`,
+                        impact: 'Configuration files may contain sensitive settings, API keys, or server details',
+                        fix: 'Remove file from public access or configure web server to deny access',
+                    });
+                }
+            }
+        }
+        // Check CLAUDE.md
+        for (const path of CLAUDE_MD_PATHS) {
+            const result = await this.httpProbe(baseUrl + path, timeout);
+            if (result && result.status === 200 && result.body) {
+                findings.push({
+                    id: generateId(),
+                    checkId: 'CLAUDE-MD-EXPOSED',
+                    severity: 'high',
+                    title: 'CLAUDE.md System Instructions Exposed',
+                    description: 'Agent system instructions file is publicly accessible',
+                    port,
+                    path,
+                    evidence: `Found CLAUDE.md at ${path}`,
+                    impact: 'System instructions reveal agent behavior, capabilities, and potential weaknesses',
+                    fix: 'Remove file from public access or configure web server to deny access',
+                });
+                break;
+            }
+        }
+        // Check root path for API keys in responses
+        const rootResult = await this.httpProbe(baseUrl + '/', timeout);
+        if (rootResult && rootResult.body) {
+            for (const { name, pattern } of API_KEY_PATTERNS) {
+                if (pattern.test(rootResult.body)) {
+                    findings.push({
+                        id: generateId(),
+                        checkId: 'API-KEY-EXPOSED',
+                        severity: 'critical',
+                        title: `${name} API Key Exposed`,
+                        description: `${name} API key found in HTTP response`,
+                        port,
+                        path: '/',
+                        evidence: `Found ${name} API key pattern in response`,
+                        impact: 'API keys can be used to access services, incur costs, or steal data',
+                        fix: 'Remove API keys from responses and rotate compromised keys immediately',
+                    });
+                    break;
+                }
+            }
+        }
+        return findings;
+    }
+    httpProbe(url, timeout) {
+        return new Promise((resolve) => {
+            const isHttps = url.startsWith('https://');
+            const client = isHttps ? https : http;
+            const req = client.get(url, {
+                timeout,
+                headers: {
+                    'User-Agent': 'HackMyAgent-Scanner/1.0',
+                    'ngrok-skip-browser-warning': 'true',
+                },
+                rejectUnauthorized: false,
+            }, (res) => {
+                let body = '';
+                res.on('data', (chunk) => {
+                    body += chunk;
+                    // Limit body size
+                    if (body.length > 10000) {
+                        res.destroy();
+                    }
+                });
+                res.on('end', () => {
+                    resolve({
+                        status: res.statusCode ?? 0,
+                        contentType: res.headers['content-type'],
+                        body: body.substring(0, 10000),
+                    });
+                });
+                res.on('error', () => resolve(null));
+            });
+            req.on('timeout', () => {
+                req.destroy();
+                resolve(null);
+            });
+            req.on('error', () => resolve(null));
+        });
+    }
+}
+exports.ExternalScanner = ExternalScanner;
+//# sourceMappingURL=external-scanner.js.map

package/dist/scanner/external-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-scanner.js","sourceRoot":"","sources":["../../src/scanner/external-scanner.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAA2B;AAC3B,2CAA6B;AAC7B,6CAA+B;AAG/B,wBAAwB;AACxB,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAExF,6BAA6B;AAC7B,MAAM,YAAY,GAAG;IACnB,wBAAwB;IACxB,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,cAAc;IACd,OAAO;CACR,CAAC;AAEF,8BAA8B;AAC9B,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACrE,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAEvE,kBAAkB;AAClB,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAE7D,mBAAmB;AACnB,MAAM,gBAAgB,GAAG;IACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,EAAE;IACtD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAClD,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE;IAC5C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAClD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4CAA4C,EAAE;CAC1E,CAAC;AAEF,+BAA+B;AAC/B,MAAM,gBAAgB,GAAoC;IACxD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,GAAG,EAAE,CAAC;CACP,CAAC;AAEF,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAa,eAAe;IAC1B,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,OAAwB;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC;QAC9C,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC;QAEpD,YAAY;QACZ,IAAI,SAAS,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACjC,CAAC;QAED,kBAAkB;QAClB,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,OAAO;YACL,EAAE,EAAE,UAAU,EAAE;YAChB,MAAM;YACN,KAAK;YACL,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,KAAe,EACf,OAAe;QAEf,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;QAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAEhC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAE3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACxB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACxB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,IAAY,EACZ,OAAe;QAEf,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAEjE,0BAA0B;QAC1B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,UAAU,EAAE;oBAChB,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,UAAU;oBACpB,KAAK,EAAE,0BAA0B;oBACjC,WAAW,EAAE,4DAA4D;oBACzE,IAAI;oBACJ,IAAI;oBACJ,QAAQ,EAAE,iBAAiB,MAAM,CAAC,WAAW,EAAE;oBAC/C,MAAM,EAAE,0EAA0E;oBAClF,GAAG,EAAE,uDAAuD;iBAC7D,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,UAAU,EAAE;oBAChB,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,UAAU;oBACpB,KAAK,EAAE,4BAA4B;oBACnC,WAAW,EAAE,0CAA0C;oBACvD,IAAI;oBACJ,IAAI;oBACJ,QAAQ,EAAE,0BAA0B,IAAI,EAAE;oBAC1C,MAAM,EAAE,8DAA8D;oBACtE,GAAG,EAAE,kEAAkE;iBACxE,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACnD,qCAAqC;gBACrC,IACE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAClC,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,UAAU,EAAE;wBAChB,OAAO,EAAE,gBAAgB;wBACzB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,4BAA4B;wBACnC,WAAW,EAAE,sBAAsB,IAAI,yBAAyB;wBAChE,IAAI;wBACJ,IAAI;wBACJ,QAAQ,EAAE,eAAe,IAAI,EAAE;wBAC/B,MAAM,EAAE,iFAAiF;wBACzF,GAAG,EAAE,uEAAuE;qBAC7E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,UAAU,EAAE;oBAChB,OAAO,EAAE,mBAAmB;oBAC5B,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,uCAAuC;oBAC9C,WAAW,EAAE,uDAAuD;oBACpE,IAAI;oBACJ,IAAI;oBACJ,QAAQ,EAAE,sBAAsB,IAAI,EAAE;oBACtC,MAAM,EAAE,mFAAmF;oBAC3F,GAAG,EAAE,uEAAuE;iBAC7E,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;gBACjD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,UAAU,EAAE;wBAChB,OAAO,EAAE,iBAAiB;wBAC1B,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,GAAG,IAAI,kBAAkB;wBAChC,WAAW,EAAE,GAAG,IAAI,iCAAiC;wBACrD,IAAI;wBACJ,IAAI,EAAE,GAAG;wBACT,QAAQ,EAAE,SAAS,IAAI,8BAA8B;wBACrD,MAAM,EAAE,qEAAqE;wBAC7E,GAAG,EAAE,wEAAwE;qBAC9E,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CACf,GAAW,EACX,OAAe;QAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CACpB,GAAG,EACH;gBACE,OAAO;gBACP,OAAO,EAAE;oBACP,YAAY,EAAE,yBAAyB;oBACvC,4BAA4B,EAAE,MAAM;iBACrC;gBACD,kBAAkB,EAAE,KAAK;aAC1B,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACvB,IAAI,IAAI,KAAK,CAAC;oBACd,kBAAkB;oBAClB,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;wBACxB,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,OAAO,CAAC;wBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBAC3B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;wBACxC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC;qBAC/B,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC,CACF,CAAC;YAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACrB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5PD,0CA4PC"}

package/dist/scanner/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * External scanner module
+ */
+export { ExternalScanner } from './external-scanner';
+export type { ExternalScanResult, ExternalFinding, ScannerOptions, FindingSeverity, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/scanner/index.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * External scanner module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalScanner = void 0;
+var external_scanner_1 = require("./external-scanner");
+Object.defineProperty(exports, "ExternalScanner", { enumerable: true, get: function () { return external_scanner_1.ExternalScanner; } });
+//# sourceMappingURL=index.js.map