openpitstop 1.0.0

package/dist/pen/report.js

@@ -0,0 +1,258 @@
+/**
+ * pen/report.ts — rendering for `pitstop pen`: terminal box, markdown, and a
+ * self-contained sealed HTML report (zero external assets, like the rest of
+ * OpenPitStop's reports).
+ */
+import boxen from "boxen";
+import chalk from "chalk";
+import path from "node:path";
+import { escapeHtml } from "../report/format.js";
+import { sortFindings, SEVERITY_ORDER } from "./types.js";
+function sevPaint(sev) {
+    switch (sev) {
+        case "critical":
+        case "high":
+            return chalk.red;
+        case "medium":
+            return chalk.yellow;
+        case "low":
+            return chalk.dim;
+        default:
+            return chalk.dim;
+    }
+}
+function confMark(conf) {
+    switch (conf) {
+        case "proven":
+            return chalk.bgRed(chalk.black("PROVEN"));
+        case "indicated":
+            return chalk.bgYellow(chalk.black("IND"));
+        default:
+            return chalk.bgGray(chalk.black("HEUR"));
+    }
+}
+function rel(repo, p) {
+    if (!p)
+        return "";
+    return path.relative(repo, p).replace(/\\/g, "/");
+}
+function loc(repo, f) {
+    const where = f.route ? `${f.route}${f.method ? " [" + f.method + "]" : ""}` : f.file ? rel(repo, f.file) : "";
+    if (!where)
+        return "";
+    return chalk.dim(`${f.line ? `:${f.line}` : ""}`) === "" ? where : `${where}${f.line ? chalk.dim(`:${f.line}`) : ""}`;
+}
+export function renderPenBox(result) {
+    const sum = result.summary;
+    const lines = [];
+    const sevParts = SEVERITY_ORDER.filter((s) => sum[s] > 0).map((s) => {
+        const paint = s === "critical" || s === "high" ? chalk.red : s === "medium" ? chalk.yellow : chalk.dim;
+        return paint(`${sum[s]} ${s}`);
+    });
+    lines.push(`${chalk.bold("Findings")}: ${sevParts.length ? sevParts.join(" · ") : chalk.green("clean")}`);
+    lines.push(`${chalk.bold("Confidence")}: ${sum.proven} proven · ${sum.indicated} indicated · ${sum.heuristic} heuristic`);
+    if (result.staticProof) {
+        const p = result.staticProof;
+        lines.push(chalk.dim(`Static findings verified live: ${p.proven} proven · ${p.indicated} indicated · ${p.unproven} unproven · ${p.notTested} not tested`));
+    }
+    lines.push("");
+    const dyn = result.dynamic;
+    if (result.dynamicEnabled && dyn.status === "ok") {
+        lines.push(`${chalk.bold("Dynamic phase")}: ${dyn.routesProbed} route(s) probed · ${dyn.attacks} attacks · boot ${dyn.bootMs}ms · ${dyn.outboundEvents} outbound events`);
+    }
+    else if (result.dynamicEnabled) {
+        lines.push(`${chalk.bold("Dynamic phase")}: ${chalk.yellow(dyn.status)} — ${dyn.note ?? ""}`);
+    }
+    else {
+        lines.push(`${chalk.bold("Dynamic phase")}: ${chalk.dim("skipped (--static)")}`);
+    }
+    lines.push("");
+    const findings = sortFindings(result.findings);
+    if (findings.length === 0) {
+        lines.push(chalk.green("No findings. The app holds up. (The absence of proof is not proof of absence —"));
+        lines.push(chalk.green("this test covers the routes and vectors OpenPitStop knows how to fire.)"));
+    }
+    else {
+        const shown = findings.slice(0, 8);
+        for (const f of shown) {
+            const paint = sevPaint(f.severity);
+            lines.push(`${confMark(f.confidence)} ${paint(f.severity.toUpperCase().padEnd(8))} ${chalk.bold(f.type)} [${chalk.dim(f.id)}]`);
+            lines.push(`    ${f.title} — ${loc(result.repo, f)}`);
+        }
+        if (findings.length > 8) {
+            lines.push(`${chalk.dim(`… and ${findings.length - 8} more (see PITSTOP_PEN_REPORT.md)`)}`);
+        }
+    }
+    lines.push("");
+    lines.push(chalk.cyan("next:"));
+    lines.push(`  pitstop inspect <id>   deep-dive on one finding`);
+    lines.push(`  pitstop repro <id>     record it as a failing-then-passing regression test`);
+    lines.push(`  pitstop pen --fix      write repro tests + deterministic patches`);
+    lines.push(`  pitstop drive <id>     hand the finding to your own agent and verify its fix`);
+    return boxen(lines.join("\n"), {
+        title: " PITSTOP — Penetration Test ",
+        titleAlignment: "center",
+        borderStyle: "double",
+        padding: 1,
+        borderColor: sum.critical + sum.high > 0 ? "red" : "green",
+    });
+}
+/** Self-contained Markdown report (also the basis for the HTML one). */
+export function renderPenMarkdown(result) {
+    const sum = result.summary;
+    const findings = sortFindings(result.findings);
+    const L = [];
+    L.push(`# OpenPitStop Penetration Test — ${result.repo}`);
+    L.push("");
+    L.push(`_${result.timestamp}_ · static: ${result.staticEnabled ? "on" : "off"} · dynamic: ${result.dynamicEnabled ? "on" : "off"}`);
+    L.push("");
+    L.push(`## Summary`);
+    L.push("");
+    L.push(`| | | | | |`);
+    L.push(`|---|---|---|---|---|`);
+    L.push(`| critical | high | medium | low | info |`);
+    L.push(`| ${sum.critical} | ${sum.high} | ${sum.medium} | ${sum.low} | ${sum.info} |`);
+    L.push("");
+    L.push(`Confidence: **${sum.proven} proven** · ${sum.indicated} indicated · ${sum.heuristic} heuristic`);
+    L.push("");
+    if (result.staticProof) {
+        const p = result.staticProof;
+        L.push(`Static findings verified live: **${p.proven} proven** · ${p.indicated} indicated · ${p.unproven} unproven · ${p.notTested} not tested — every pattern finding was either confirmed by a live attack or honestly labeled unproven.`);
+        L.push("");
+    }
+    if (result.dynamicEnabled) {
+        L.push(`Dynamic: ${result.dynamic.status} — ${result.dynamic.routesProbed} routes, ${result.dynamic.attacks} attacks, boot ${result.dynamic.bootMs}ms, ${result.dynamic.outboundEvents} outbound events.`);
+        if (result.dynamic.note)
+            L.push(`> ${result.dynamic.note}`);
+    }
+    L.push("");
+    L.push(`## Findings`);
+    L.push("");
+    if (findings.length === 0) {
+        L.push("Nothing surfaced. See the boxed caveat: coverage is the routes + patterns OpenPitStop knows.");
+    }
+    for (const f of findings) {
+        L.push(`### ${f.severity.toUpperCase()} — ${f.title} \`${f.id}\``);
+        L.push("");
+        L.push(`- **Confidence**: ${f.confidence}`);
+        const where = f.file ? rel(result.repo, f.file) + (f.line ? `:${f.line}` : "") : f.route ? `${f.route} (${f.method})` : "—";
+        L.push(`- **Where**: \`${where}\``);
+        L.push("");
+        L.push(f.description);
+        L.push("");
+        if (f.runtimeProof) {
+            L.push(`- **Runtime verification**: ${f.runtimeProof === "proven"
+                ? "**PROVEN** by live attack"
+                : f.runtimeProof === "indicated"
+                    ? "indicated by live probing"
+                    : f.runtimeProof === "unproven"
+                        ? "unproven (probed, no signal)"
+                        : "not tested"} — ${f.runtimeNote ?? ""}`);
+        }
+        if (f.attack) {
+            L.push(`- **Attack**: \`${f.attack.method} ${f.attack.path}${f.attack.payload ? " payload=" + escapeHtml(JSON.stringify(f.attack.payload)).replace(/&lt;/g, "<").replace(/&gt;/g, ">") : ""}\``);
+        }
+        if (f.response) {
+            L.push(`- **Response**: HTTP ${f.response.status ?? "—"}${f.response.snippet ? ` — ${f.response.snippet}` : ""}`);
+        }
+        if (f.outbound?.length) {
+            L.push(`- **Sandbox evidence**:`);
+            for (const e of f.outbound)
+                L.push(`  - \`${e}\``);
+        }
+        if (f.repro)
+            L.push(`- **Reproduce**: ${f.repro}`);
+        if (f.fix) {
+            L.push(`- **Fix**: ${f.fix}`);
+            L.push(`  Run \`pitstop repro ${f.id}\` to capture it as a regression test, then \`pitstop pen\` again.`);
+        }
+        L.push("");
+    }
+    return L.join("\n");
+}
+/** Self-contained HTML report (no external assets), mirroring other guard deeds. */
+export function renderPenHtml(result) {
+    const findings = sortFindings(result.findings);
+    const sum = result.summary;
+    const rows = findings
+        .map((f) => {
+        const where = f.file
+            ? `<code>${escapeHtml(rel(result.repo, f.file))}${f.line ? `:${f.line}` : ""}</code>`
+            : f.route
+                ? `<code>${escapeHtml(f.route)}</code> [${escapeHtml(f.method ?? "")}]`
+                : "—";
+        const attack = f.attack
+            ? `<p class="atk"><code>${escapeHtml(f.attack.method)} ${escapeHtml(f.attack.path)}</code>${f.attack.payload ? `<br><code>→ ${escapeHtml(JSON.stringify(f.attack.payload)).slice(0, 160)}</code>` : ""}</p>`
+            : "";
+        const evidence = f.outbound?.length
+            ? `<ul class="evidence">${f.outbound.map((e) => `<li>${escapeHtml(e)}</li>`).join("")}</ul>`
+            : "";
+        return `<div class="card sev-${f.severity}">
+  <h3>${escapeHtml(f.severity.toUpperCase())} · ${escapeHtml(f.type)} <span class="id">${escapeHtml(f.id)}</span> <span class="conf ${f.confidence}">${f.confidence}</span></h3>
+  <p><strong>${escapeHtml(f.title)}</strong></p>
+  <p class="loc">${where}</p>
+  <p>${escapeHtml(f.description)}</p>
+  ${f.runtimeProof ? `<p class="rt rt-${f.runtimeProof}"><strong>Runtime: ${f.runtimeProof === "proven" ? "PROVEN by live attack" : f.runtimeProof === "indicated" ? "indicated by live probing" : f.runtimeProof === "unproven" ? "unproven (probed, no signal)" : "not tested"}</strong> ${escapeHtml(f.runtimeNote ?? "")}</p>` : ""}
+  ${attack}
+  ${f.response ? `<p class="resp">HTTP ${f.response.status ?? "—"}${f.response.snippet ? ` · ${escapeHtml(f.response.snippet)}` : ""}</p>` : ""}
+  ${evidence}
+  ${f.repro ? `<p><strong>Reproduce:</strong> ${escapeHtml(f.repro)}</p>` : ""}
+  ${f.fix ? `<p class="fix"><strong>Fix:</strong> ${escapeHtml(f.fix)}</p>` : ""}
+</div>`;
+    })
+        .join("\n");
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>OpenPitStop Pen Test — ${escapeHtml(result.repo)}</title>
+<style>
+  :root { color-scheme: light; }
+  body { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif; margin: 0; background: #f6f8fb; color: #111; }
+  .wrap { max-width: 860px; margin: 0 auto; padding: 32px 20px 80px; }
+  header { border-bottom: 3px solid #0ea5e9; padding-bottom: 16px; margin-bottom: 24px; }
+  h1 { margin: 0 0 4px; font-size: 28px; }
+  .muted { color: #5b6572; }
+  .sum { display: flex; gap: 10px; flex-wrap: wrap; margin: 20px 0; }
+  .badge { padding: 8px 14px; border-radius: 8px; font-weight: 600; background: #eef2f7; }
+  .badge.crit, .badge.high { background: #fee2e2; color: #b91c1c; }
+  .badge.med { background: #fef3c7; color: #92400e; }
+  .card { border: 1px solid #e2e8f0; background: #fff; border-radius: 10px; padding: 16px 18px; margin-bottom: 14px; border-left: 5px solid #94a3b8; }
+  .card.sev-critical, .card.sev-high { border-left-color: #dc2626; }
+  .card.sev-medium { border-left-color: #d97706; }
+  .card.sev-low, .card.sev-info { border-left-color: #64748b; }
+  h3 { margin: 0 0 6px; font-size: 15px; }
+  .id { font-family: ui-monospace, Consolas, monospace; font-size: 12px; color: #64748b; font-weight: 400; }
+  .conf { font-size: 11px; padding: 2px 8px; border-radius: 999px; text-transform: uppercase; }
+  .conf.proven { background: #dc2626; color: #fff; }
+  .conf.indicated { background: #f59e0b; color: #fff; }
+  .conf.heuristic { background: #94a3b8; color: #fff; }
+  .loc { color: #475569; font-size: 13px; }
+  code { font-family: ui-monospace, Consolas, monospace; font-size: 12.5px; background: #f1f5f9; padding: 1px 5px; border-radius: 4px; }
+  .atk { background: #f8fafc; border: 1px solid #e2e8f0; border-radius: 6px; padding: 6px 10px; }
+  .resp { color: #475569; }
+  .evidence { color: #b91c1c; }
+  .fix { background: #f0fdf4; border: 1px solid #bbf7d0; border-radius: 6px; padding: 8px 10px; }
+  .rt { font-size: 12.5px; padding: 6px 10px; border-radius: 6px; }
+  .rt-proven { background: #fee2e2; border: 1px solid #fecaca; color: #991b1b; }
+  .rt-indicated { background: #fef3c7; border: 1px solid #fde68a; color: #92400e; }
+  .rt-unproven { background: #f1f5f9; border: 1px solid #e2e8f0; color: #475569; }
+  .rt-not-tested { background: #f1f5f9; border: 1px solid #e2e8f0; color: #475569; }
+</style>
+</head><body><div class="wrap">
+<header>
+  <h1>OpenPitStop Penetration Test</h1>
+  <p class="muted">${escapeHtml(result.timestamp)} · ${escapeHtml(result.repo)} · static ${result.staticEnabled ? "on" : "off"} · dynamic ${result.dynamicEnabled ? "on" : "off"}</p>
+  ${result.dynamicEnabled ? `<p class="muted">Dynamic: ${result.dynamic.status} — ${result.dynamic.routesProbed} routes · ${result.dynamic.attacks} attacks · boot ${result.dynamic.bootMs}ms${result.dynamic.note ? ` · ${escapeHtml(result.dynamic.note)}` : ""}</p>` : ""}
+  <div class="sum">
+    <span class="badge crit">critical ${sum.critical}</span>
+    <span class="badge high">high ${sum.high}</span>
+    <span class="badge med">medium ${sum.medium}</span>
+    <span class="badge">low ${sum.low}</span>
+    <span class="badge">info ${sum.info}</span>
+    <span class="badge">proven ${sum.proven}</span>
+  </div>
+</header>
+${rows}
+<p class="muted">Coverage: the routes and patterns OpenPitStop knows how to fire. No proof of absence — rerun after every change.</p>
+</div></body></html>`;
+}
+//# sourceMappingURL=report.js.map

package/dist/pen/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/pen/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAqB,cAAc,EAAmC,MAAM,YAAY,CAAC;AAE9G,SAAS,QAAQ,CAAC,GAA2B;IAC3C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB;YACE,OAAO,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA8B;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C;YACE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,CAAU;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,CAAa;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QACvG,OAAO,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAC9F,CAAC;IACF,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,SAAS,YAAY,CAC9G,CAAC;IACF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CACP,kCAAkC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,SAAS,gBAAgB,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,SAAS,aAAa,CACpI,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,YAAY,sBAAsB,GAAG,CAAC,OAAO,mBAAmB,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,cAAc,kBAAkB,CAC9J,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC,CAAC;QAC1G,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CACR,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CACpH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC3F,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7B,KAAK,EAAE,8BAA8B;QACrC,cAAc,EAAE,QAAQ;QACxB,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,SAAS,YAAY,CAAC,CAAC;IACzG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC,CAAC,IAAI,CACJ,oCAAoC,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,SAAS,gBAAgB,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,SAAS,yGAAyG,CACpO,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CACJ,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,YAAY,MAAM,CAAC,OAAO,CAAC,OAAO,kBAAkB,MAAM,CAAC,OAAO,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,mBAAmB,CACnM,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACzG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5H,CAAC,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACnB,CAAC,CAAC,IAAI,CACJ,+BACE,CAAC,CAAC,YAAY,KAAK,QAAQ;gBACzB,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW;oBAC9B,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,UAAU;wBAC7B,CAAC,CAAC,8BAA8B;wBAChC,CAAC,CAAC,YACV,MAAM,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnM,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,CAAC,KAAK;YAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,oEAAoE,CAAC,CAAC;QAC5G,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI;YAClB,CAAC,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS;YACrF,CAAC,CAAC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG;gBACvE,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;YACrB,CAAC,CAAC,wBAAwB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM;YAC5M,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM;YACjC,CAAC,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;YAC5F,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,wBAAwB,CAAC,CAAC,QAAQ;QACvC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;eACpJ,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;mBACf,KAAK;OACjB,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5B,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,YAAY,sBAAsB,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,YAAY,aAAa,UAAU,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACnU,MAAM;IACN,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE;IAC3I,QAAQ;IACR,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kCAAkC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IAC1E,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,wCAAwC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;OACzE,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;gCAEuB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAqClC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;IAC5K,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,MAAM,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,aAAa,MAAM,CAAC,OAAO,CAAC,OAAO,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE;;wCAEpO,GAAG,CAAC,QAAQ;oCAChB,GAAG,CAAC,IAAI;qCACP,GAAG,CAAC,MAAM;8BACjB,GAAG,CAAC,GAAG;+BACN,GAAG,CAAC,IAAI;iCACN,GAAG,CAAC,MAAM;;;EAGzC,IAAI;;qBAEe,CAAC;AACtB,CAAC"}

package/dist/pen/static.d.ts

@@ -0,0 +1,17 @@
+/**
+ * pen/static.ts — the static phase of `pitstop pen`.
+ *
+ * Cheap, dependency-free, honest heuristics. Every finding is labelled with
+ * its confidence: `heuristic` (pattern matched, no proof yet), `indicated`
+ * (the data flow is concrete: user input reaching a sink). Nothing is ever
+ * labelled `proven` here — proof is the dynamic phase's job.
+ */
+import type { PenFinding, PenRoute } from "./types.js";
+export declare function findRoutes(repo: string): PenRoute[];
+export interface PenStaticOutcome {
+    findings: PenFinding[];
+    routes: PenRoute[];
+    framework: "express" | "other" | "none";
+    packages: string[];
+}
+export declare function analyzeStatic(repo: string): PenStaticOutcome;