hullproof 0.0.0-stage → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (363) hide show
  1. package/LICENSE +222 -0
  2. package/NOTICE +32 -0
  3. package/README.md +313 -2
  4. package/checks/db.firebase-rules-not-open.json +24 -0
  5. package/checks/db.rls-every-table.json +25 -0
  6. package/checks/log.no-credential-in-logs.json +30 -0
  7. package/checks/secrets.no-env-file-committed.json +31 -0
  8. package/checks/secrets.no-secret-in-public-env.json +37 -0
  9. package/checks/storage.firebase-rules-not-open.json +22 -0
  10. package/checks/supply.no-untrusted-event-in-run.json +23 -0
  11. package/checks/web.cors-no-reflected-origin.json +31 -0
  12. package/detectors/ai.json +25 -0
  13. package/detectors/auth.json +27 -0
  14. package/detectors/ci.json +19 -0
  15. package/detectors/containers.json +8 -0
  16. package/detectors/data_stores.json +38 -0
  17. package/detectors/frameworks.json +94 -0
  18. package/detectors/hosting.json +44 -0
  19. package/detectors/iac.json +43 -0
  20. package/detectors/languages.json +48 -0
  21. package/detectors/mobile.json +22 -0
  22. package/detectors/package_managers.json +39 -0
  23. package/detectors/payments.json +19 -0
  24. package/detectors/runtimes.json +17 -0
  25. package/dist/checks/code/admin-role.js +46 -0
  26. package/dist/checks/code/owner-filter.js +91 -0
  27. package/dist/checks/code/shared.js +84 -0
  28. package/dist/checks/code/webhook-verify.js +77 -0
  29. package/dist/checks/context.js +64 -0
  30. package/dist/checks/map/config-checks.js +74 -0
  31. package/dist/checks/map/entry-checks.js +97 -0
  32. package/dist/checks/map/shared.js +44 -0
  33. package/dist/checks/ops.js +307 -0
  34. package/dist/checks/pro-map.js +1 -0
  35. package/dist/checks/run.js +92 -0
  36. package/dist/checks/types.js +1 -0
  37. package/dist/ci/comment.js +44 -0
  38. package/dist/ci/sarif-check.js +157 -0
  39. package/dist/ci/sarif.js +61 -0
  40. package/dist/cli.js +358 -0
  41. package/dist/commands/ci.js +115 -0
  42. package/dist/commands/git.js +58 -0
  43. package/dist/commands/hooks.js +30 -0
  44. package/dist/commands/hunt-pro.js +1 -0
  45. package/dist/commands/hunt.js +86 -0
  46. package/dist/commands/map.js +33 -0
  47. package/dist/commands/mcp.js +17 -0
  48. package/dist/commands/pack.js +48 -0
  49. package/dist/commands/prove-pro.js +1 -0
  50. package/dist/commands/prove.js +173 -0
  51. package/dist/commands/report-gate.js +92 -0
  52. package/dist/commands/scan.js +158 -0
  53. package/dist/confirm/agreement.js +18 -0
  54. package/dist/confirm/chain.js +84 -0
  55. package/dist/confirm/confirm.js +112 -0
  56. package/dist/confirm/honesty.js +75 -0
  57. package/dist/confirm/lead.js +92 -0
  58. package/dist/confirm/merge.js +88 -0
  59. package/dist/confirm/query.js +145 -0
  60. package/dist/confirm/rule.js +86 -0
  61. package/dist/confirm/store.js +42 -0
  62. package/dist/confirm/summary.js +6 -0
  63. package/dist/confirm/synthesis.js +28 -0
  64. package/dist/discover/detectors.js +50 -0
  65. package/dist/discover/discover.js +270 -0
  66. package/dist/discover/extract.js +282 -0
  67. package/dist/discover/git.js +40 -0
  68. package/dist/discover/kit-files.js +47 -0
  69. package/dist/discover/walk.js +110 -0
  70. package/dist/env.js +57 -0
  71. package/dist/gate/gate.js +173 -0
  72. package/dist/hooks/install.js +153 -0
  73. package/dist/hooks/run.js +112 -0
  74. package/dist/map/analyze.js +201 -0
  75. package/dist/map/build.js +253 -0
  76. package/dist/map/candidates.js +49 -0
  77. package/dist/map/cblocks.js +77 -0
  78. package/dist/map/config.js +291 -0
  79. package/dist/map/dotnet.js +242 -0
  80. package/dist/map/entry.js +78 -0
  81. package/dist/map/expo.js +190 -0
  82. package/dist/map/go.js +292 -0
  83. package/dist/map/js-express.js +143 -0
  84. package/dist/map/js-misc.js +295 -0
  85. package/dist/map/js-next.js +292 -0
  86. package/dist/map/laravel.js +389 -0
  87. package/dist/map/lex-more.js +305 -0
  88. package/dist/map/lex.js +425 -0
  89. package/dist/map/light-index.js +191 -0
  90. package/dist/map/light-profiles.js +324 -0
  91. package/dist/map/light.js +574 -0
  92. package/dist/map/local-vocab.js +27 -0
  93. package/dist/map/mobile.js +326 -0
  94. package/dist/map/py-django.js +281 -0
  95. package/dist/map/py.js +391 -0
  96. package/dist/map/rails.js +391 -0
  97. package/dist/map/repo.js +178 -0
  98. package/dist/map/rust.js +312 -0
  99. package/dist/map/spring.js +207 -0
  100. package/dist/map/taint.js +96 -0
  101. package/dist/map/touches.js +355 -0
  102. package/dist/map/vocab.js +88 -0
  103. package/dist/mapping/controls.js +34 -0
  104. package/dist/mapping/dependency-policy.js +44 -0
  105. package/dist/mapping/map.js +44 -0
  106. package/dist/mapping/maps/gitleaks.json +12 -0
  107. package/dist/mapping/maps/osv-scanner.json +7 -0
  108. package/dist/mapping/maps/trivy.json +13 -0
  109. package/dist/mcp/confine.js +59 -0
  110. package/dist/mcp/protocol.js +140 -0
  111. package/dist/mcp/schema.js +43 -0
  112. package/dist/mcp/server.js +37 -0
  113. package/dist/mcp/tools.js +238 -0
  114. package/dist/packs/coverage.js +79 -0
  115. package/dist/packs/manifest.js +36 -0
  116. package/dist/packs/validate.js +271 -0
  117. package/dist/prove/container.js +276 -0
  118. package/dist/prove/exec-main.js +20 -0
  119. package/dist/prove/executor.js +149 -0
  120. package/dist/prove/local.js +131 -0
  121. package/dist/prove/probes.js +65 -0
  122. package/dist/prove/recipe.js +278 -0
  123. package/dist/prove/run.js +136 -0
  124. package/dist/prove/runner.js +1 -0
  125. package/dist/prove/safety.js +126 -0
  126. package/dist/prove/spec.js +357 -0
  127. package/dist/prove/store.js +65 -0
  128. package/dist/report/build.js +297 -0
  129. package/dist/report/entry-points.js +75 -0
  130. package/dist/report/hunt-section.js +71 -0
  131. package/dist/report/kit.js +41 -0
  132. package/dist/report/load.js +35 -0
  133. package/dist/report/messages.js +273 -0
  134. package/dist/report/prove-section.js +65 -0
  135. package/dist/report/report.js +156 -0
  136. package/dist/report/surface.js +21 -0
  137. package/dist/report/test-code.js +51 -0
  138. package/dist/report/tiers.js +44 -0
  139. package/dist/scanners/common.js +162 -0
  140. package/dist/scanners/gitleaks.js +90 -0
  141. package/dist/scanners/index.js +113 -0
  142. package/dist/scanners/osv-scanner.js +77 -0
  143. package/dist/scanners/run-targets.js +34 -0
  144. package/dist/scanners/secret-noise.js +89 -0
  145. package/dist/scanners/semgrep.js +142 -0
  146. package/dist/scanners/trivy.js +65 -0
  147. package/dist/scanners/types.js +1 -0
  148. package/dist/types/check.js +1 -0
  149. package/dist/types/codemap.js +1 -0
  150. package/dist/types/findings.js +5 -0
  151. package/dist/types/hunt.js +1 -0
  152. package/dist/types/index.js +1 -0
  153. package/dist/types/prove.js +1 -0
  154. package/dist/types/results.js +2 -0
  155. package/dist/types/scan.js +1 -0
  156. package/dist/types/stack.js +5 -0
  157. package/dist/util.js +71 -0
  158. package/dist/version.js +2 -0
  159. package/package.json +46 -4
  160. package/packs/android/fixture-result.json +43 -0
  161. package/packs/android/pack.json +56 -0
  162. package/packs/dotnet/fixture-result.json +62 -0
  163. package/packs/dotnet/pack.json +88 -0
  164. package/packs/expo/answer-key.json +51 -0
  165. package/packs/expo/fixture-result.json +62 -0
  166. package/packs/expo/pack.json +79 -0
  167. package/packs/firebase/answer-key.json +27 -0
  168. package/packs/firebase/fixture-result.json +43 -0
  169. package/packs/firebase/pack.json +58 -0
  170. package/packs/go/answer-key.json +101 -0
  171. package/packs/go/fixture-result.json +64 -0
  172. package/packs/go/pack.json +99 -0
  173. package/packs/ios/fixture-result.json +43 -0
  174. package/packs/ios/pack.json +55 -0
  175. package/packs/laravel/answer-key.json +84 -0
  176. package/packs/laravel/fixture-result.json +60 -0
  177. package/packs/laravel/pack.json +91 -0
  178. package/packs/node-ts/answer-key.json +220 -0
  179. package/packs/node-ts/fixture-result.json +114 -0
  180. package/packs/node-ts/pack.json +134 -0
  181. package/packs/python/answer-key.json +195 -0
  182. package/packs/python/fixture-result.json +119 -0
  183. package/packs/python/pack.json +121 -0
  184. package/packs/rails/answer-key.json +84 -0
  185. package/packs/rails/fixture-result.json +60 -0
  186. package/packs/rails/pack.json +78 -0
  187. package/packs/rust/fixture-result.json +43 -0
  188. package/packs/rust/pack.json +69 -0
  189. package/packs/spring/fixture-result.json +63 -0
  190. package/packs/spring/pack.json +103 -0
  191. package/packs/supabase/answer-key.json +52 -0
  192. package/packs/supabase/fixture-result.json +58 -0
  193. package/packs/supabase/pack.json +60 -0
  194. package/rules/gitleaks.toml +256 -0
  195. package/rules/semgrep/api-route-no-auth.yaml +31 -0
  196. package/rules/semgrep/cors-reflect-origin.yaml +48 -0
  197. package/rules/semgrep/eval-or-new-function.yaml +185 -0
  198. package/rules/semgrep/log-session-token.yaml +48 -0
  199. package/rules/semgrep/math-random-tokens.yaml +24 -0
  200. package/rules/semgrep/next-public-secret-name.yaml +32 -0
  201. package/rules/semgrep/postgrest-filter-injection.yaml +78 -0
  202. package/rules/semgrep/raw-sql-concat.yaml +42 -0
  203. package/rules/semgrep/read-by-id-no-owner.yaml +49 -0
  204. package/rules/semgrep/server-action-no-auth.yaml +26 -0
  205. package/rules/semgrep/sql-variants.yaml +99 -0
  206. package/rules/semgrep/ssrf-unguarded-url.yaml +137 -0
  207. package/rules/semgrep/subprocess-injection.yaml +163 -0
  208. package/rules/semgrep/taint-go.yaml +333 -0
  209. package/rules/semgrep/taint-java.yaml +317 -0
  210. package/rules/semgrep/taint-javascript.yaml +412 -0
  211. package/rules/semgrep/taint-php.yaml +361 -0
  212. package/rules/semgrep/taint-python.yaml +414 -0
  213. package/rules/semgrep/tool-endpoint-admin-client.yaml +86 -0
  214. package/rules/semgrep/user-metadata-authz.yaml +22 -0
  215. package/rules/semgrep/verify-result-unused.yaml +62 -0
  216. package/rules/semgrep/webhook-parse-before-verify.yaml +29 -0
  217. package/rules/test-artifact-ids.json +4 -0
  218. package/rules/tiers.json +427 -0
  219. package/schemas/check-results.schema.json +55 -0
  220. package/schemas/check.schema.json +41 -0
  221. package/schemas/codemap.schema.json +216 -0
  222. package/schemas/findings.schema.json +1048 -0
  223. package/schemas/hunt-output.schema.json +46 -0
  224. package/schemas/hunt-result.schema.json +58 -0
  225. package/schemas/results.schema.json +17 -0
  226. package/schemas/scan-hits.schema.json +32 -0
  227. package/schemas/scan-meta.schema.json +25 -0
  228. package/schemas/stack.schema.json +93 -0
  229. package/src/checks/README.md +32 -0
  230. package/src/checks/code/admin-role.ts +49 -0
  231. package/src/checks/code/owner-filter.ts +95 -0
  232. package/src/checks/code/shared.ts +66 -0
  233. package/src/checks/code/webhook-verify.ts +75 -0
  234. package/src/checks/context.ts +72 -0
  235. package/src/checks/map/config-checks.ts +79 -0
  236. package/src/checks/map/entry-checks.ts +116 -0
  237. package/src/checks/map/shared.ts +63 -0
  238. package/src/checks/ops.ts +280 -0
  239. package/src/checks/pro-map.ts +4 -0
  240. package/src/checks/run.ts +80 -0
  241. package/src/checks/types.ts +12 -0
  242. package/src/ci/comment.ts +52 -0
  243. package/src/ci/sarif-check.ts +100 -0
  244. package/src/ci/sarif.ts +72 -0
  245. package/src/cli.ts +273 -0
  246. package/src/commands/ci.ts +104 -0
  247. package/src/commands/git.ts +59 -0
  248. package/src/commands/hooks.ts +27 -0
  249. package/src/commands/hunt-pro.ts +4 -0
  250. package/src/commands/hunt.ts +68 -0
  251. package/src/commands/map.ts +27 -0
  252. package/src/commands/mcp.ts +18 -0
  253. package/src/commands/pack.ts +34 -0
  254. package/src/commands/prove-pro.ts +4 -0
  255. package/src/commands/prove.ts +126 -0
  256. package/src/commands/report-gate.ts +75 -0
  257. package/src/commands/scan.ts +156 -0
  258. package/src/confirm/agreement.ts +23 -0
  259. package/src/confirm/chain.ts +67 -0
  260. package/src/confirm/confirm.ts +107 -0
  261. package/src/confirm/honesty.ts +65 -0
  262. package/src/confirm/lead.ts +76 -0
  263. package/src/confirm/merge.ts +89 -0
  264. package/src/confirm/query.ts +126 -0
  265. package/src/confirm/rule.ts +76 -0
  266. package/src/confirm/store.ts +42 -0
  267. package/src/confirm/summary.ts +9 -0
  268. package/src/confirm/synthesis.ts +33 -0
  269. package/src/discover/detectors.ts +71 -0
  270. package/src/discover/discover.ts +253 -0
  271. package/src/discover/extract.ts +235 -0
  272. package/src/discover/git.ts +31 -0
  273. package/src/discover/kit-files.ts +37 -0
  274. package/src/discover/walk.ts +88 -0
  275. package/src/env.ts +51 -0
  276. package/src/gate/gate.ts +169 -0
  277. package/src/hooks/install.ts +142 -0
  278. package/src/hooks/run.ts +121 -0
  279. package/src/map/analyze.ts +219 -0
  280. package/src/map/build.ts +206 -0
  281. package/src/map/candidates.ts +47 -0
  282. package/src/map/cblocks.ts +55 -0
  283. package/src/map/config.ts +207 -0
  284. package/src/map/dotnet.ts +205 -0
  285. package/src/map/entry.ts +80 -0
  286. package/src/map/expo.ts +171 -0
  287. package/src/map/go.ts +271 -0
  288. package/src/map/js-express.ts +135 -0
  289. package/src/map/js-misc.ts +221 -0
  290. package/src/map/js-next.ts +282 -0
  291. package/src/map/laravel.ts +327 -0
  292. package/src/map/lex-more.ts +152 -0
  293. package/src/map/lex.ts +274 -0
  294. package/src/map/light-index.ts +134 -0
  295. package/src/map/light-profiles.ts +363 -0
  296. package/src/map/light.ts +484 -0
  297. package/src/map/local-vocab.ts +30 -0
  298. package/src/map/mobile.ts +263 -0
  299. package/src/map/py-django.ts +239 -0
  300. package/src/map/py.ts +329 -0
  301. package/src/map/rails.ts +291 -0
  302. package/src/map/repo.ts +150 -0
  303. package/src/map/rust.ts +256 -0
  304. package/src/map/spring.ts +185 -0
  305. package/src/map/taint.ts +86 -0
  306. package/src/map/touches.ts +296 -0
  307. package/src/map/vocab.ts +106 -0
  308. package/src/mapping/controls.ts +47 -0
  309. package/src/mapping/dependency-policy.ts +55 -0
  310. package/src/mapping/map.ts +59 -0
  311. package/src/mapping/maps/gitleaks.json +12 -0
  312. package/src/mapping/maps/osv-scanner.json +7 -0
  313. package/src/mapping/maps/trivy.json +13 -0
  314. package/src/mcp/confine.ts +44 -0
  315. package/src/mcp/protocol.ts +144 -0
  316. package/src/mcp/schema.ts +35 -0
  317. package/src/mcp/server.ts +32 -0
  318. package/src/mcp/tools.ts +235 -0
  319. package/src/packs/coverage.ts +98 -0
  320. package/src/packs/manifest.ts +97 -0
  321. package/src/packs/validate.ts +204 -0
  322. package/src/prove/container.ts +237 -0
  323. package/src/prove/exec-main.ts +16 -0
  324. package/src/prove/executor.ts +130 -0
  325. package/src/prove/local.ts +100 -0
  326. package/src/prove/probes.ts +68 -0
  327. package/src/prove/recipe.ts +215 -0
  328. package/src/prove/run.ts +124 -0
  329. package/src/prove/runner.ts +28 -0
  330. package/src/prove/safety.ts +98 -0
  331. package/src/prove/spec.ts +256 -0
  332. package/src/prove/store.ts +48 -0
  333. package/src/report/build.ts +304 -0
  334. package/src/report/entry-points.ts +78 -0
  335. package/src/report/hunt-section.ts +67 -0
  336. package/src/report/kit.ts +59 -0
  337. package/src/report/load.ts +49 -0
  338. package/src/report/messages.ts +270 -0
  339. package/src/report/prove-section.ts +61 -0
  340. package/src/report/report.ts +160 -0
  341. package/src/report/surface.ts +32 -0
  342. package/src/report/test-code.ts +56 -0
  343. package/src/report/tiers.ts +50 -0
  344. package/src/scanners/common.ts +149 -0
  345. package/src/scanners/gitleaks.ts +89 -0
  346. package/src/scanners/index.ts +103 -0
  347. package/src/scanners/osv-scanner.ts +90 -0
  348. package/src/scanners/run-targets.ts +35 -0
  349. package/src/scanners/secret-noise.ts +80 -0
  350. package/src/scanners/semgrep.ts +139 -0
  351. package/src/scanners/trivy.ts +66 -0
  352. package/src/scanners/types.ts +98 -0
  353. package/src/types/check.ts +52 -0
  354. package/src/types/codemap.ts +142 -0
  355. package/src/types/findings.ts +107 -0
  356. package/src/types/hunt.ts +97 -0
  357. package/src/types/index.ts +10 -0
  358. package/src/types/prove.ts +83 -0
  359. package/src/types/results.ts +15 -0
  360. package/src/types/scan.ts +63 -0
  361. package/src/types/stack.ts +61 -0
  362. package/src/util.ts +59 -0
  363. package/src/version.ts +2 -0
@@ -0,0 +1,305 @@
1
+ // Java, C#, Kotlin, Swift and Rust: line and block comments, "strings" with escapes, text blocks and raw strings, character literals.
2
+ function maskC(text, lang) {
3
+ const n = text.length;
4
+ const out = [];
5
+ let i = 0;
6
+ const put = (from, to) => { out.push(blank(text.slice(from, to))); };
7
+ const keep = (from, to) => { out.push(text.slice(from, to)); };
8
+ const closed = (open, close, escapes, doubled = false) => {
9
+ // index of the closing delimiter at or after open, or -1
10
+ let j = open;
11
+ while (j < n) {
12
+ if (escapes && text[j] === '\\') {
13
+ j += 2;
14
+ continue;
15
+ }
16
+ if (text.startsWith(close, j)) {
17
+ if (doubled && text.startsWith(close + close, j)) {
18
+ j += close.length * 2;
19
+ continue;
20
+ }
21
+ return j;
22
+ }
23
+ j++;
24
+ }
25
+ return -1;
26
+ };
27
+ while (i < n) {
28
+ const c = text[i];
29
+ const c2 = text[i + 1];
30
+ if (c === '/' && c2 === '/') {
31
+ const e = text.indexOf('\n', i);
32
+ const end = e < 0 ? n : e;
33
+ put(i, end);
34
+ i = end;
35
+ continue;
36
+ }
37
+ if (c === '/' && c2 === '*') {
38
+ const e = text.indexOf('*/', i + 2);
39
+ const end = e < 0 ? n : e + 2;
40
+ put(i, end);
41
+ i = end;
42
+ continue;
43
+ }
44
+ // C#: $"...", @"...", $@"..." ; raw strings in every language: """..."""
45
+ let pre = 0;
46
+ if (lang === 'cs') {
47
+ while (text[i + pre] === '$' || text[i + pre] === '@')
48
+ pre++;
49
+ }
50
+ if (lang === 'rs' && (c === 'r' || (c === 'b' && c2 === 'r')) && /^b?r#*"/.test(text.slice(i, i + 12))) {
51
+ const m = /^b?r(#*)"/.exec(text.slice(i, i + 12));
52
+ const start = i + m[0].length;
53
+ const e = text.indexOf('"' + m[1], start);
54
+ const end = e < 0 ? n : e;
55
+ keep(i, start);
56
+ put(start, end);
57
+ if (e >= 0)
58
+ keep(e, e + 1 + m[1].length);
59
+ i = e < 0 ? n : e + 1 + m[1].length;
60
+ continue;
61
+ }
62
+ const q = i + pre;
63
+ if (text[q] === '"') {
64
+ if (text.startsWith('"""', q)) {
65
+ const e = text.indexOf('"""', q + 3);
66
+ const end = e < 0 ? n : e;
67
+ keep(i, q + 3);
68
+ put(q + 3, end);
69
+ if (e >= 0)
70
+ keep(e, e + 3);
71
+ i = e < 0 ? n : e + 3;
72
+ continue;
73
+ }
74
+ const verbatim = lang === 'cs' && text.slice(i, q).includes('@');
75
+ const e = closed(q + 1, '"', !verbatim, verbatim);
76
+ const end = e < 0 ? n : e;
77
+ keep(i, q + 1);
78
+ put(q + 1, end);
79
+ if (e >= 0)
80
+ keep(e, e + 1);
81
+ i = e < 0 ? n : e + 1;
82
+ continue;
83
+ }
84
+ if (c === '\'' && lang !== 'rs' || (c === '\'' && lang === 'rs' && /^'(?:\\.[^']*|[^\\'])'/.test(text.slice(i, i + 12)))) {
85
+ const e = closed(i + 1, '\'', true);
86
+ if (e >= 0 && e - i <= 12) {
87
+ keep(i, i + 1);
88
+ put(i + 1, e);
89
+ keep(e, e + 1);
90
+ i = e + 1;
91
+ continue;
92
+ }
93
+ }
94
+ keep(i, i + 1);
95
+ i++;
96
+ }
97
+ return out.join('');
98
+ }
99
+ const blank = (s) => s.replace(/[^\n]/g, ' ');
100
+ export function maskMore(text, lang) {
101
+ if (lang === 'java' || lang === 'cs' || lang === 'kt' || lang === 'swift' || lang === 'rs')
102
+ return maskC(text, lang);
103
+ const n = text.length;
104
+ const out = [];
105
+ const put = (from, to) => { out.push(blank(text.slice(from, to))); };
106
+ const keep = (from, to) => { out.push(text.slice(from, to)); };
107
+ let i = 0;
108
+ let prevSig = '';
109
+ let prevWord = '';
110
+ // Heredoc terminators waiting for the end of the current line (Ruby and PHP).
111
+ let pending = [];
112
+ const quoted = (q, escapes) => {
113
+ let j = i + 1;
114
+ while (j < n && text[j] !== q && (text[j] !== '\n' || lang !== 'go')) {
115
+ if (escapes && text[j] === '\\')
116
+ j++;
117
+ j++;
118
+ }
119
+ const close = j < n && text[j] === q ? j : -1;
120
+ keep(i, i + 1);
121
+ put(i + 1, close < 0 ? Math.min(j, n) : close);
122
+ if (close >= 0)
123
+ keep(close, close + 1);
124
+ i = close < 0 ? Math.min(j, n) : close + 1;
125
+ prevSig = q;
126
+ prevWord = '';
127
+ };
128
+ const flushHeredocs = () => {
129
+ // i is just after a newline. Blank lines until each pending terminator line.
130
+ for (const h of pending) {
131
+ for (;;) {
132
+ if (i >= n)
133
+ break;
134
+ const e = text.indexOf('\n', i);
135
+ const end = e < 0 ? n : e;
136
+ const row = text.slice(i, end);
137
+ const isEnd = (lang === 'rb' ? row.trim() : row.replace(/^\s+/, '').replace(/[;,)\s]+$/, '')) === h.id;
138
+ if (isEnd) {
139
+ keep(i, end);
140
+ i = end;
141
+ break;
142
+ }
143
+ put(i, end);
144
+ i = end;
145
+ if (i < n) {
146
+ out.push('\n');
147
+ i++;
148
+ }
149
+ }
150
+ }
151
+ pending = [];
152
+ };
153
+ while (i < n) {
154
+ const c = text[i];
155
+ const c2 = text[i + 1];
156
+ if (c === '\n') {
157
+ keep(i, i + 1);
158
+ i++;
159
+ if (pending.length)
160
+ flushHeredocs();
161
+ // Ruby block comments
162
+ if (lang === 'rb' && text.startsWith('=begin', i)) {
163
+ const e = text.indexOf('\n=end', i);
164
+ const end = e < 0 ? n : text.indexOf('\n', e + 1) < 0 ? n : text.indexOf('\n', e + 1);
165
+ put(i, end);
166
+ i = end;
167
+ }
168
+ continue;
169
+ }
170
+ if (lang === 'go') {
171
+ if (c === '/' && c2 === '/') {
172
+ const e = text.indexOf('\n', i);
173
+ const end = e < 0 ? n : e;
174
+ put(i, end);
175
+ i = end;
176
+ continue;
177
+ }
178
+ if (c === '/' && c2 === '*') {
179
+ const e = text.indexOf('*/', i + 2);
180
+ const end = e < 0 ? n : e + 2;
181
+ put(i, end);
182
+ i = end;
183
+ continue;
184
+ }
185
+ if (c === '"') {
186
+ quoted('"', true);
187
+ continue;
188
+ }
189
+ if (c === '\'') {
190
+ quoted('\'', true);
191
+ continue;
192
+ }
193
+ if (c === '`') {
194
+ const e = text.indexOf('`', i + 1);
195
+ const end = e < 0 ? n : e;
196
+ keep(i, i + 1);
197
+ put(i + 1, end);
198
+ if (e >= 0)
199
+ keep(e, e + 1);
200
+ i = e < 0 ? n : e + 1;
201
+ prevSig = '`';
202
+ continue;
203
+ }
204
+ }
205
+ else if (lang === 'rb') {
206
+ if (i === 0 && text.startsWith('=begin')) {
207
+ const e = text.indexOf('\n=end');
208
+ const end = e < 0 ? n : e + 5;
209
+ put(0, end);
210
+ i = end;
211
+ continue;
212
+ }
213
+ if (c === '#') {
214
+ const e = text.indexOf('\n', i);
215
+ const end = e < 0 ? n : e;
216
+ put(i, end);
217
+ i = end;
218
+ continue;
219
+ }
220
+ const hd = c === '<' && c2 === '<' ? /^<<([~-]?)(['"`]?)([A-Za-z_]\w*)\2/.exec(text.slice(i, i + 60)) : null;
221
+ if (hd && !/[\w)\]]\s*$/.test(text.slice(Math.max(0, i - 2), i).replace(/ $/, '')) || (hd && /[=(,]\s*$/.test(text.slice(Math.max(0, i - 12), i)))) {
222
+ pending.push({ id: hd[3], squiggly: hd[1] === '~' });
223
+ keep(i, i + hd[0].length);
224
+ i += hd[0].length;
225
+ continue;
226
+ }
227
+ if (c === '"' || c === '\'' || c === '`') {
228
+ quoted(c, true);
229
+ continue;
230
+ }
231
+ if (c === '/' && /^[(,=~{|&!;]$/.test(prevSig) || (c === '/' && /^(?:when|if|unless|and|or|not|return|split|match|scan|gsub|sub)$/.test(prevWord))) {
232
+ let j = i + 1;
233
+ let cls = false;
234
+ while (j < n && text[j] !== '\n') {
235
+ if (text[j] === '\\') {
236
+ j += 2;
237
+ continue;
238
+ }
239
+ if (text[j] === '[')
240
+ cls = true;
241
+ else if (text[j] === ']')
242
+ cls = false;
243
+ else if (text[j] === '/' && !cls)
244
+ break;
245
+ j++;
246
+ }
247
+ if (j < n && text[j] === '/') {
248
+ keep(i, i + 1);
249
+ put(i + 1, j);
250
+ keep(j, j + 1);
251
+ i = j + 1;
252
+ prevSig = '/';
253
+ prevWord = '';
254
+ continue;
255
+ }
256
+ }
257
+ }
258
+ else {
259
+ if ((c === '/' && c2 === '/') || (c === '#' && c2 !== '[')) {
260
+ const e = text.indexOf('\n', i);
261
+ const end = e < 0 ? n : e;
262
+ put(i, end);
263
+ i = end;
264
+ continue;
265
+ }
266
+ if (c === '/' && c2 === '*') {
267
+ const e = text.indexOf('*/', i + 2);
268
+ const end = e < 0 ? n : e + 2;
269
+ put(i, end);
270
+ i = end;
271
+ continue;
272
+ }
273
+ const hd = c === '<' && c2 === '<' && text[i + 2] === '<' ? /^<<<\s*(['"]?)([A-Za-z_]\w*)\1/.exec(text.slice(i, i + 60)) : null;
274
+ if (hd) {
275
+ pending.push({ id: hd[2], squiggly: true });
276
+ keep(i, i + hd[0].length);
277
+ i += hd[0].length;
278
+ continue;
279
+ }
280
+ if (c === '"' || c === '\'') {
281
+ quoted(c, true);
282
+ continue;
283
+ }
284
+ }
285
+ keep(i, i + 1);
286
+ if (!/\s/.test(c)) {
287
+ prevSig = c;
288
+ if (/[A-Za-z_]/.test(c)) {
289
+ const m = /^[A-Za-z_]\w*/.exec(text.slice(i, i + 20));
290
+ if (m) {
291
+ prevWord = m[0];
292
+ out.pop();
293
+ keep(i, i + m[0].length);
294
+ i += m[0].length;
295
+ prevSig = 'w';
296
+ continue;
297
+ }
298
+ }
299
+ else
300
+ prevWord = '';
301
+ }
302
+ i++;
303
+ }
304
+ return out.join('');
305
+ }