oc-pilot 0.5.1 → 0.88.1

package/dist/core/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/core/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAIxC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AASlD,MAAM,KAAK,GAA0B;IACnC;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,YAAY;QAClB,gBAAgB,EAAE,EAAE,IAAI,EAAE,sDAAsD,EAAE;QAClF,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACzC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,iBAAiB;QACvB,gBAAgB,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE;QAC1E,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACzC;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,gBAAgB;QACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;QACjE,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;KAC3C;CACF,CAAC;AAwCF,SAAS,QAAQ,CAAC,KAAuB;IACvC,MAAM,MAAM,GAAgB;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;KACjC,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,SAAS,GAAG;YACjB;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;oBACzD,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;iBACrE;aACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,UAAU,CAAC,OAA2B;IACpD,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,cAAc,EAAE,2CAA2C;wBAC3D,OAAO,EAAE,OAAO;wBAChB,KAAK,EAAE,KAAK;qBACb;iBACF;gBACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;aAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,QAAyB;IACpE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC5D,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,qCAAqC,OAAO,CAAC,OAAO,GAAG;QAC/E,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA4B,EAAE,GAAW;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC1B,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,8BAA8B,CAAC,QAA2B,EAAE,GAAW;IACrF,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/sarif.test.js

@@ -0,0 +1,60 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { CRITICAL_RULE_ID, SARIF_VERSION, SECRET_RULE_ID, WARNING_RULE_ID, analysisFindingsToSarifResults, buildSarif, secretFindingsToSarifResults, } from "./sarif.js";
+import { VERSION } from "../version.js";
+function secretFinding(overrides = {}) {
+    return {
+        file: "src/config.ts",
+        line: 3,
+        kind: "AWS Access Key ID",
+        severity: "critical",
+        preview: "[REDACTED:AWS Access Key ID]",
+        ...overrides,
+    };
+}
+test("secretFindingsToSarifResults maps severity to levels and rule id", () => {
+    const results = secretFindingsToSarifResults([
+        secretFinding(),
+        secretFinding({ severity: "warning", kind: "Generic secret", line: 9 }),
+    ]);
+    assert.equal(results[0]?.ruleId, SECRET_RULE_ID);
+    assert.equal(results[0]?.level, "error");
+    assert.equal(results[0]?.file, "src/config.ts");
+    assert.equal(results[0]?.line, 3);
+    assert.equal(results[1]?.level, "warning");
+});
+test("secret sarif message never contains a raw secret", () => {
+    const results = secretFindingsToSarifResults([secretFinding({ preview: "[REDACTED:AWS]" })]);
+    assert.ok(results[0].message.includes("[REDACTED:AWS]"));
+    assert.ok(!results[0].message.includes("AKIA"));
+});
+test("analysisFindingsToSarifResults maps severities and parses locations", () => {
+    const findings = [
+        { severity: "critical", location: "src/a.ts:12", text: "SQL injection" },
+        { severity: "warning", location: "src/a.ts:30:5", text: "Missing await" },
+        { severity: "style", text: "No location" },
+    ];
+    const results = analysisFindingsToSarifResults(findings, process.cwd());
+    assert.equal(results[0]?.ruleId, CRITICAL_RULE_ID);
+    assert.equal(results[0]?.level, "error");
+    assert.equal(results[0]?.file, "src/a.ts");
+    assert.equal(results[0]?.line, 12);
+    assert.equal(results[1]?.ruleId, WARNING_RULE_ID);
+    assert.equal(results[1]?.level, "warning");
+    assert.equal(results[1]?.line, 30);
+    assert.equal(results[2]?.level, "note");
+    assert.equal(results[2]?.file, undefined);
+});
+test("buildSarif produces a 2.1.0 log with driver and rules", () => {
+    const log = buildSarif(secretFindingsToSarifResults([secretFinding()]));
+    assert.equal(log.version, SARIF_VERSION);
+    assert.equal(log.version, "2.1.0");
+    assert.equal(log.runs[0]?.tool.driver.name, "oc-pilot");
+    assert.equal(log.runs[0]?.tool.driver.version, VERSION);
+    const ruleIds = log.runs[0].tool.driver.rules.map((rule) => rule.id);
+    assert.deepEqual(ruleIds.sort(), [CRITICAL_RULE_ID, SECRET_RULE_ID, WARNING_RULE_ID].sort());
+    const result = log.runs[0].results[0];
+    assert.equal(result.locations?.[0]?.physicalLocation.artifactLocation.uri, "src/config.ts");
+    assert.equal(result.locations?.[0]?.physicalLocation.region.startLine, 3);
+});
+//# sourceMappingURL=sarif.test.js.map

package/dist/core/sarif.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.test.js","sourceRoot":"","sources":["../../src/core/sarif.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,UAAU,EACV,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,SAAS,aAAa,CAAC,YAAoC,EAAE;IAC3D,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,8BAA8B;QACvC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,OAAO,GAAG,4BAA4B,CAAC;QAC3C,aAAa,EAAE;QACf,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,OAAO,GAAG,4BAA4B,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,QAAQ,GAAsB;QAClC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE;QACxE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE;QACzE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;KAC3C,CAAC;IACF,MAAM,OAAO,GAAG,8BAA8B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,4BAA4B,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/dist/core/sast.js

@@ -0,0 +1,324 @@
+import { SARIF_SCHEMA, SARIF_VERSION } from "./sarif.js";
+import { VERSION } from "../version.js";
+/**
+ * Deterministic rules, not a model. Each sink is a call that becomes dangerous
+ * when a request-derived value reaches it; `taint` keeps the rules quiet on
+ * constant arguments.
+ */
+const RULES = [
+    {
+        id: "command-injection",
+        severity: "high",
+        message: "request data reaches a shell command; use execFile/spawn with an argument array",
+        sink: /\b(?:exec|execSync)\s*\(/,
+    },
+    {
+        id: "shell-true",
+        severity: "medium",
+        message: "spawn with shell:true turns arguments into shell syntax",
+        sink: /\bshell\s*:\s*true\b/,
+        taint: false,
+    },
+    {
+        id: "sql-injection",
+        severity: "high",
+        message: "request data is concatenated into a SQL query; use placeholders",
+        sink: /\.(?:query|execute|raw)\s*\(/,
+    },
+    {
+        id: "path-traversal",
+        severity: "high",
+        message: "request data reaches the filesystem; resolve and confine the path first",
+        sink: /\b(?:readFile|readFileSync|writeFile|writeFileSync|createReadStream|createWriteStream|unlink|unlinkSync|rm|rmSync)\s*\(/,
+    },
+    {
+        id: "ssrf",
+        severity: "high",
+        message: "request data becomes an outbound URL; allowlist hosts before the request",
+        sink: /\b(?:fetch|axios\.(?:get|post|put|delete)|got|request)\s*\(/,
+    },
+    {
+        id: "code-injection",
+        severity: "high",
+        message: "request data is evaluated as code",
+        sink: /\beval\s*\(|\bnew\s+Function\s*\(|\bvm\.runIn(?:NewContext|ThisContext|Context)\s*\(/,
+    },
+    {
+        id: "xss",
+        severity: "high",
+        message: "request data is written as HTML without escaping",
+        sink: /\.innerHTML\s*=|\bdangerouslySetInnerHTML\b/,
+    },
+    {
+        id: "open-redirect",
+        severity: "medium",
+        message: "request data controls a redirect target; allowlist paths",
+        sink: /\bres\.redirect\s*\(/,
+    },
+    {
+        id: "tls-verification",
+        severity: "high",
+        message: "TLS certificate verification is disabled",
+        sink: /rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*["']?0/,
+        taint: false,
+    },
+    {
+        id: "cors-wildcard",
+        severity: "low",
+        message: "wildcard CORS origin exposes the endpoint to any site",
+        sink: /origin\s*:\s*["']\*["']/,
+        taint: false,
+    },
+    {
+        id: "prototype-pollution",
+        severity: "medium",
+        message: "request data is merged into an object without key filtering",
+        sink: /Object\.assign\s*\(\s*[^,]+,\s*(?:req|request)\.|\.merge\s*\(\s*[^,]+,\s*(?:req|request)\./,
+        taint: false,
+    },
+    {
+        id: "weak-hash",
+        severity: "low",
+        message: "MD5/SHA-1 are not collision resistant; use SHA-256 or better",
+        sink: /createHash\s*\(\s*["'](?:md5|sha1)["']/i,
+        taint: false,
+    },
+    {
+        id: "jwt-none",
+        severity: "high",
+        message: "the JWT 'none' algorithm accepts unsigned tokens",
+        sink: /algorithms\s*:\s*\[[^\]]*["']none["']/i,
+        taint: false,
+    },
+];
+const TAINT = /\b(?:req|request)\.(?:query|body|params|headers|cookies)\b|\buserInput\b|\buntrusted\w*\b|\b(?:query|body|params)\.\w+/;
+const SANITIZER = /\bpath\.(?:resolve|normalize|basename|join)\b/;
+const SUPPRESSION = /oc-pilot:sast-ignore(?:\s+([\w-]+))?\s*:\s*(\S.*)$/;
+const SEVERITY_RANK = { low: 1, medium: 2, high: 3 };
+export function severityAtLeast(value, threshold) {
+    return SEVERITY_RANK[value] >= SEVERITY_RANK[threshold];
+}
+export function parseSastSeverity(value) {
+    const normalized = value.trim().toLowerCase();
+    return normalized === "high" || normalized === "medium" || normalized === "low" ? normalized : undefined;
+}
+/** Removes comments but keeps string contents: SQL and HTML sinks live in strings. */
+export function stripComments(text) {
+    let out = "";
+    let state = "code";
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        const next = text[index + 1];
+        if (state === "code") {
+            if (char === "/" && next === "/") {
+                state = "line";
+                out += "  ";
+                index += 1;
+                continue;
+            }
+            if (char === "/" && next === "*") {
+                state = "block";
+                out += "  ";
+                index += 1;
+                continue;
+            }
+            if (char === "'")
+                state = "single";
+            else if (char === '"')
+                state = "double";
+            else if (char === "`")
+                state = "template";
+            out += char;
+            continue;
+        }
+        if (state === "line") {
+            if (char === "\n") {
+                state = "code";
+                out += char;
+            }
+            else {
+                out += " ";
+            }
+            continue;
+        }
+        if (state === "block") {
+            if (char === "*" && next === "/") {
+                state = "code";
+                out += "  ";
+                index += 1;
+            }
+            else {
+                out += char === "\n" ? "\n" : " ";
+            }
+            continue;
+        }
+        if (char === "\\") {
+            out += char + (next ?? "");
+            index += 1;
+            continue;
+        }
+        if ((state === "single" && char === "'") || (state === "double" && char === '"') || (state === "template" && char === "`")) {
+            state = "code";
+        }
+        out += char;
+    }
+    return out;
+}
+function lineStarts(text) {
+    const starts = [0];
+    for (let index = 0; index < text.length; index += 1) {
+        if (text[index] === "\n")
+            starts.push(index + 1);
+    }
+    return starts;
+}
+function locate(starts, offset) {
+    let low = 0;
+    let high = starts.length - 1;
+    while (low <= high) {
+        const middle = (low + high) >> 1;
+        if (starts[middle] <= offset)
+            low = middle + 1;
+        else
+            high = middle - 1;
+    }
+    const lineIndex = Math.max(0, high);
+    return { line: lineIndex + 1, column: offset - starts[lineIndex] + 1 };
+}
+function suppressionAt(lines, lineIndex, rule) {
+    for (const index of [lineIndex, lineIndex - 1]) {
+        const line = lines[index];
+        if (!line)
+            continue;
+        const match = line.match(SUPPRESSION);
+        if (!match)
+            continue;
+        const scopedRule = match[1];
+        const reason = match[2]?.trim() ?? "";
+        if (reason.length < 3)
+            continue;
+        if (scopedRule && scopedRule !== rule)
+            continue;
+        return true;
+    }
+    return false;
+}
+/**
+ * Scans one source file. The rules are intentionally conservative: a sink is
+ * reported only when request-derived data appears in the same expression.
+ */
+export function scanSource(file, text, options = {}) {
+    const clean = stripComments(text);
+    const starts = lineStarts(clean);
+    const lines = text.split(/\r?\n/);
+    const findings = [];
+    const seen = new Set();
+    let suppressed = 0;
+    for (const rule of RULES) {
+        const pattern = new RegExp(rule.sink.source, rule.sink.flags.includes("g") ? rule.sink.flags : `${rule.sink.flags}g`);
+        for (let match = pattern.exec(clean); match; match = pattern.exec(clean)) {
+            const offset = match.index ?? 0;
+            const window = clean.slice(offset, offset + 260);
+            if (rule.taint !== false && !TAINT.test(window))
+                continue;
+            if (rule.id === "path-traversal" && SANITIZER.test(window))
+                continue;
+            const { line, column } = locate(starts, offset);
+            const key = `${rule.id}:${String(line)}:${String(column)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            if (options.suppressions !== false && suppressionAt(lines, line - 1, rule.id)) {
+                suppressed += 1;
+                continue;
+            }
+            findings.push({
+                rule: rule.id,
+                severity: rule.severity,
+                file,
+                line,
+                column,
+                message: rule.message,
+                snippet: (lines[line - 1] ?? "").trim().slice(0, 200),
+            });
+        }
+    }
+    findings.sort((a, b) => a.line - b.line || a.column - b.column || a.rule.localeCompare(b.rule));
+    return { findings, suppressed };
+}
+export function buildSastReport(files, results) {
+    const findings = results.flatMap((result) => result.findings);
+    const summary = { high: 0, medium: 0, low: 0 };
+    for (const finding of findings)
+        summary[finding.severity] += 1;
+    return {
+        files,
+        findings,
+        suppressed: results.reduce((total, result) => total + result.suppressed, 0),
+        summary,
+    };
+}
+export function renderSast(report) {
+    const lines = [
+        `Файлов проверено: ${String(report.files)}.`,
+        `Найдено: ${String(report.findings.length)} (high ${String(report.summary.high)}, medium ${String(report.summary.medium)}, low ${String(report.summary.low)}), подавлено: ${String(report.suppressed)}.`,
+    ];
+    if (report.findings.length === 0) {
+        lines.push("Проблем не найдено.");
+    }
+    else {
+        for (const finding of report.findings) {
+            lines.push(`${finding.severity.toUpperCase().padEnd(6)} ${finding.rule.padEnd(20)} ${finding.file}:${String(finding.line)} — ${finding.message}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+/** SARIF 2.1.0 for code scanning uploads. */
+export function sastSarif(report) {
+    const levels = {
+        high: "error",
+        medium: "warning",
+        low: "note",
+    };
+    const rules = [...new Set(report.findings.map((finding) => finding.rule))].map((id) => {
+        const finding = report.findings.find((candidate) => candidate.rule === id);
+        return {
+            id: `oc-pilot/${id}`,
+            name: id,
+            shortDescription: { text: finding.message },
+            defaultConfiguration: { level: levels[finding.severity] },
+        };
+    });
+    const results = report.findings.map((finding) => ({
+        ruleId: `oc-pilot/${finding.rule}`,
+        level: levels[finding.severity],
+        message: { text: `${finding.message}: ${finding.snippet}` },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: finding.file.replace(/\\/g, "/") },
+                    region: { startLine: finding.line, startColumn: finding.column },
+                },
+            },
+        ],
+        properties: { severity: finding.severity },
+    }));
+    return `${JSON.stringify({
+        $schema: SARIF_SCHEMA,
+        version: SARIF_VERSION,
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "oc-pilot",
+                        informationUri: "https://github.com/oc-pilot/oc-pilot",
+                        version: VERSION,
+                        rules,
+                    },
+                },
+                results,
+            },
+        ],
+    }, null, 2)}\n`;
+}
+//# sourceMappingURL=sast.js.map

package/dist/core/sast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sast.js","sourceRoot":"","sources":["../../src/core/sast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAyCxC;;;;GAIG;AACH,MAAM,KAAK,GAAe;IACxB;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iFAAiF;QAC1F,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,8BAA8B;KACrC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yEAAyE;QAClF,IAAI,EAAE,yHAAyH;KAChI;IACD;QACE,EAAE,EAAE,MAAM;QACV,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0EAA0E;QACnF,IAAI,EAAE,6DAA6D;KACpE;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,sFAAsF;KAC7F;IACD;QACE,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,6CAA6C;KACpD;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0DAA0D;QACnE,IAAI,EAAE,sBAAsB;KAC7B;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,0EAA0E;QAChF,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,uDAAuD;QAChE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,6DAA6D;QACtE,IAAI,EAAE,4FAA4F;QAClG,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,8DAA8D;QACvE,IAAI,EAAE,yCAAyC;QAC/C,KAAK,EAAE,KAAK;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,MAAM,KAAK,GACT,wHAAwH,CAAC;AAC3H,MAAM,SAAS,GAAG,+CAA+C,CAAC;AAClE,MAAM,WAAW,GAAG,oDAAoD,CAAC;AAEzE,MAAM,aAAa,GAAiC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEnF,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,SAAuB;IAC1E,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAiE,MAAM,CAAC;IACjF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,KAAK,GAAG,MAAM,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC;gBACZ,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,KAAK,GAAG,OAAO,CAAC;gBAChB,GAAG,IAAI,IAAI,CAAC;gBACZ,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,QAAQ,CAAC;iBAC9B,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,QAAQ,CAAC;iBACnC,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,UAAU,CAAC;YAC1C,GAAG,IAAI,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,GAAG,MAAM,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,GAAG,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,KAAK,GAAG,MAAM,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC;gBACZ,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YACpC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC3H,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;QACD,GAAG,IAAI,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB,EAAE,MAAc;IAC9C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,CAAE,IAAI,MAAM;YAAE,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC;;YAC3C,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAE,GAAG,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,SAAiB,EAAE,IAAY;IACrE,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,UAAU,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,UAA2B,EAAE;IAClF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACtH,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC1D,IAAI,IAAI,CAAC,EAAE,KAAK,gBAAgB,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9E,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI;gBACJ,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAyB;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAiC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,KAAK,GAAG;QACZ,qBAAqB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;QAC5C,YAAY,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG;KACzM,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CACtI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,SAAS,CAAC,MAAkB;IAC1C,MAAM,MAAM,GAAuD;QACjE,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,YAAY,EAAE,EAAE;YACpB,IAAI,EAAE,EAAE;YACR,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3C,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE;QAC3D,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;oBAC3D,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE;iBACjE;aACF;SACF;QACD,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC,CAAC;IACJ,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,cAAc,EAAE,sCAAsC;wBACtD,OAAO,EAAE,OAAO;wBAChB,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC"}

package/dist/core/sast.test.js

@@ -0,0 +1,105 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { buildSastReport, parseSastSeverity, renderSast, sastSarif, scanSource, severityAtLeast, stripComments, } from "./sast.js";
+test("scanSource reports request data reaching dangerous sinks", () => {
+    const source = [
+        'const { exec } = require("node:child_process");',
+        "exec(`rm -rf ${req.query.dir}`);",
+        'db.query("SELECT * FROM users WHERE id = " + req.query.id);',
+        "readFile(req.query.file);",
+        "fetch(req.body.url);",
+        "eval(userInput);",
+        "el.innerHTML = req.query.html;",
+        "https.request({ rejectUnauthorized: false });",
+        "",
+    ].join("\n");
+    const { findings, suppressed } = scanSource("src/app.js", source);
+    const rules = findings.map((finding) => finding.rule).sort();
+    assert.deepEqual(rules, [
+        "code-injection",
+        "command-injection",
+        "path-traversal",
+        "sql-injection",
+        "ssrf",
+        "tls-verification",
+        "xss",
+    ]);
+    assert.equal(suppressed, 0);
+    assert.equal(findings.find((finding) => finding.rule === "sql-injection")?.line, 3);
+    assert.match(findings.find((finding) => finding.rule === "command-injection")?.snippet ?? "", /exec/);
+});
+test("constant arguments do not trigger the taint rules", () => {
+    const source = [
+        'exec("ls -la");',
+        'db.query("SELECT 1");',
+        'readFile("/etc/hosts");',
+        'fetch("https://example.com");',
+        'el.innerHTML = "<b>static</b>";',
+        "",
+    ].join("\n");
+    const { findings } = scanSource("src/safe.js", source);
+    assert.deepEqual(findings, []);
+});
+test("path.resolve silences the path-traversal rule", () => {
+    const source = 'readFile(path.resolve("/data", req.query.file));\n';
+    const { findings } = scanSource("src/files.js", source);
+    assert.deepEqual(findings, []);
+});
+test("stripComments removes comments but keeps string contents and offsets", () => {
+    const source = [
+        "// exec(req.query.x)",
+        "/* db.query(req.body.y) */",
+        'const value = "exec(req.query.z)";',
+        "",
+    ].join("\n");
+    const clean = stripComments(source);
+    assert.equal(clean.includes("exec(req.query.x)"), false);
+    assert.equal(clean.includes("db.query(req.body.y)"), false);
+    assert.equal(clean.includes("exec(req.query.z)"), true);
+    assert.equal(clean.split("\n").length, source.split("\n").length);
+    assert.equal(clean.length, source.length);
+});
+test("inline suppressions need a reason and may be scoped to a rule", () => {
+    const suppressed = scanSource("src/admin.js", "exec(req.query.cmd); // oc-pilot:sast-ignore command-injection: trusted admin command\n");
+    assert.deepEqual(suppressed.findings, []);
+    assert.equal(suppressed.suppressed, 1);
+    const noReason = scanSource("src/admin.js", "exec(req.query.cmd); // oc-pilot:sast-ignore\n");
+    assert.equal(noReason.findings.length, 1);
+    const wrongRule = scanSource("src/admin.js", "exec(req.query.cmd); // oc-pilot:sast-ignore sql-injection: wrong rule\n");
+    assert.equal(wrongRule.findings.length, 1);
+});
+test("severity helpers order the levels", () => {
+    assert.equal(parseSastSeverity(" HIGH "), "high");
+    assert.equal(parseSastSeverity("critical"), undefined);
+    assert.equal(severityAtLeast("high", "medium"), true);
+    assert.equal(severityAtLeast("medium", "high"), false);
+    assert.equal(severityAtLeast("low", "low"), true);
+});
+test("buildSastReport and renderSast summarize the scan", () => {
+    const high = scanSource("src/a.js", "exec(req.query.cmd);\n");
+    const medium = scanSource("src/b.js", "res.redirect(req.query.next);\n");
+    const report = buildSastReport(2, [high, medium]);
+    assert.equal(report.files, 2);
+    assert.equal(report.findings.length, 2);
+    assert.deepEqual(report.summary, { high: 1, medium: 1, low: 0 });
+    const text = renderSast(report);
+    assert.match(text, /Файлов проверено: 2\./);
+    assert.match(text, /Найдено: 2 \(high 1, medium 1, low 0\), подавлено: 0\./);
+    assert.match(text, /HIGH\s+command-injection\s+src\/a\.js:1/);
+    assert.equal(text.endsWith("\n"), true);
+    const empty = renderSast(buildSastReport(1, [scanSource("src/safe.js", "const a = 1;\n")]));
+    assert.match(empty, /Проблем не найдено\./);
+});
+test("sastSarif emits SARIF 2.1.0 with rule metadata", () => {
+    const report = buildSastReport(1, [scanSource("src/a.js", 'db.query("SELECT " + req.query.id);\n')]);
+    const sarif = JSON.parse(sastSarif(report));
+    assert.equal(sarif.version, "2.1.0");
+    assert.equal(sarif.runs[0]?.tool.driver.name, "oc-pilot");
+    assert.deepEqual(sarif.runs[0]?.tool.driver.rules.map((rule) => rule.id), ["oc-pilot/sql-injection"]);
+    assert.equal(sarif.runs[0]?.results[0]?.ruleId, "oc-pilot/sql-injection");
+    assert.equal(sarif.runs[0]?.results[0]?.level, "error");
+    assert.equal(sarif.runs[0]?.results[0]?.locations[0]?.physicalLocation.artifactLocation.uri, "src/a.js");
+    assert.equal(sarif.runs[0]?.results[0]?.locations[0]?.physicalLocation.region.startLine, 1);
+    assert.equal(sarif.runs[0]?.results[0]?.properties.severity, "high");
+});
+//# sourceMappingURL=sast.test.js.map

package/dist/core/sast.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sast.test.js","sourceRoot":"","sources":["../../src/core/sast.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,UAAU,EACV,eAAe,EACf,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,MAAM,GAAG;QACb,iDAAiD;QACjD,kCAAkC;QAClC,6DAA6D;QAC7D,2BAA2B;QAC3B,sBAAsB;QACtB,kBAAkB;QAClB,gCAAgC;QAChC,+CAA+C;QAC/C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;QACtB,gBAAgB;QAChB,mBAAmB;QACnB,gBAAgB;QAChB,eAAe;QACf,MAAM;QACN,kBAAkB;QAClB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,MAAM,GAAG;QACb,iBAAiB;QACjB,uBAAuB;QACvB,yBAAyB;QACzB,+BAA+B;QAC/B,iCAAiC;QACjC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;IACzD,MAAM,MAAM,GAAG,oDAAoD,CAAC;IACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,MAAM,GAAG;QACb,sBAAsB;QACtB,4BAA4B;QAC5B,oCAAoC;QACpC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,UAAU,GAAG,UAAU,CAC3B,cAAc,EACd,yFAAyF,CAC1F,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1C,MAAM,SAAS,GAAG,UAAU,CAC1B,cAAc,EACd,0EAA0E,CAC3E,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAElD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAEjE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAWzC,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC"}

package/dist/core/sbom.js

@@ -0,0 +1,121 @@
+/**
+ * License audit and CycloneDX SBOM for the resolved lockfile. Both work
+ * offline: the SBOM needs only the lockfile, and licenses are read from the
+ * installed packages when `node_modules` is present.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { VERSION } from "../version.js";
+const PERMISSIVE = ["mit", "isc", "bsd", "apache", "0bsd", "unlicense", "cc0", "wtfpl", "zlib", "python-2.0"];
+const WEAK_COPYLEFT = ["lgpl", "mpl", "epl", "cddl"];
+export function licenseRisk(license) {
+    const value = license.trim().toLowerCase();
+    if (!value || value === "unknown" || value === "noassertion")
+        return "unknown";
+    if (value.includes("unlicensed") || value.includes("proprietary") || value.includes("see license"))
+        return "proprietary";
+    if (value.includes("agpl") || (value.includes("gpl") && !value.includes("lgpl")))
+        return "strong-copyleft";
+    if (WEAK_COPYLEFT.some((marker) => value.includes(marker)))
+        return "weak-copyleft";
+    if (PERMISSIVE.some((marker) => value.includes(marker)))
+        return "permissive";
+    return "unknown";
+}
+function licenseOf(value) {
+    if (typeof value === "string" && value.trim().length > 0)
+        return value.trim();
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        const type = value.type;
+        if (typeof type === "string" && type.trim().length > 0)
+            return type.trim();
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = licenseOf(item);
+            if (found)
+                return found;
+        }
+    }
+    return undefined;
+}
+/** Reads licenses from installed packages; absent `node_modules` is reported, not guessed. */
+export function auditLicenses(cwd, packages) {
+    const unique = new Map();
+    for (const pkg of packages) {
+        if (pkg.name && pkg.version)
+            unique.set(`${pkg.name}@${pkg.version}`, pkg);
+    }
+    let checked = 0;
+    let missing = 0;
+    const findings = [];
+    for (const pkg of unique.values()) {
+        const manifestPath = join(cwd, "node_modules", pkg.name, "package.json");
+        if (!existsSync(manifestPath)) {
+            missing += 1;
+            continue;
+        }
+        let manifest;
+        try {
+            manifest = JSON.parse(readFileSync(manifestPath, "utf8").replace(/^\uFEFF/, ""));
+        }
+        catch {
+            missing += 1;
+            continue;
+        }
+        checked += 1;
+        const license = licenseOf(manifest.license) ?? licenseOf(manifest.licenses) ?? "unknown";
+        const risk = licenseRisk(license);
+        if (risk !== "permissive")
+            findings.push({ name: pkg.name, version: pkg.version, license, risk });
+    }
+    return { checked, missing, findings };
+}
+function purl(name, version) {
+    const encoded = name.startsWith("@") ? `%40${name.slice(1)}` : name;
+    return `pkg:npm/${encoded}@${version}`;
+}
+export function buildSbom(packages, packageName, timestamp = new Date().toISOString()) {
+    const unique = new Map();
+    for (const pkg of packages) {
+        if (pkg.name && pkg.version)
+            unique.set(`${pkg.name}@${pkg.version}`, pkg);
+    }
+    const components = [...unique.values()]
+        .map((pkg) => ({ type: "library", name: pkg.name, version: pkg.version, purl: purl(pkg.name, pkg.version) }))
+        .sort((a, b) => a.purl.localeCompare(b.purl));
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        version: 1,
+        metadata: {
+            timestamp,
+            tools: [{ vendor: "oc-pilot", name: "oc-pilot", version: VERSION }],
+            component: { type: "application", name: packageName },
+        },
+        components,
+    };
+}
+export function writeSbom(cwd, file, sbom) {
+    const absolute = isAbsolute(file) ? file : resolve(cwd, file);
+    mkdirSync(dirname(absolute), { recursive: true });
+    writeFileSync(absolute, `${JSON.stringify(sbom, null, 2)}\n`, "utf8");
+    return absolute;
+}
+export function renderLicenses(audit) {
+    const lines = [
+        `Лицензии: проверено ${String(audit.checked)} пакетов` +
+            (audit.missing > 0 ? `, без package.json ${String(audit.missing)} (node_modules не установлен?)` : "") +
+            ".",
+    ];
+    if (audit.findings.length === 0) {
+        lines.push("Лицензионных рисков не найдено.");
+        return `${lines.join("\n")}\n`;
+    }
+    lines.push("Лицензионные риски:");
+    for (const finding of audit.findings) {
+        lines.push(`${finding.risk.padEnd(15)} ${finding.name}@${finding.version} — ${finding.license}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=sbom.js.map