progmune-runtime 2.1.6 → 3.2.0

package/dist/frameworks/express-detector.js

@@ -0,0 +1,445 @@
+"use strict";
+/**
+ * Express Framework Adapter — Protocol Detection for Express.js
+ *
+ * Detects Express-specific patterns that the generic \w* regex detector
+ * cannot see: middleware chains, route handlers, auth guards, and the
+ * relationship between them.
+ *
+ * This is the FIRST framework adapter. Before this, Progmune had 0/13
+ * framework adapters despite TS being its primary language.
+ *
+ * Key Express patterns detected:
+ *   - App initialization: express(), const app = express()
+ *   - Middleware registration: app.use(fn), router.use(fn)
+ *   - Route handlers: app.get(), app.post(), router.get(), etc.
+ *   - Auth middleware: passport.authenticate(), express-jwt, custom auth
+ *   - Missing auth: route without middleware when auth middleware exists
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectExpressApp = detectExpressApp;
+exports.extractRoutes = extractRoutes;
+exports.classifyMiddleware = classifyMiddleware;
+exports.extractGlobalMiddleware = extractGlobalMiddleware;
+exports.analyzeExpressApp = analyzeExpressApp;
+exports.analyzeExpressFile = analyzeExpressFile;
+exports.analyzeExpressProject = analyzeExpressProject;
+exports.formatExpressReport = formatExpressReport;
+const fs = __importStar(require("fs"));
+// ── Known auth/security middleware patterns ──
+const AUTH_MIDDLEWARE_PATTERNS = [
+    /\bpassport\.initialize\b/,
+    /\bpassport\.authenticate\b/,
+    /\bexpress-jwt\b/,
+    /\bjwt\s*\(\s*\{/,
+    /\bauthMiddleware\b/,
+    /\brequireAuth\b/,
+    /\bwithAuth\b/,
+    /\bauthenticateToken\b/,
+    /\bverifyToken\b/,
+    /\bvalidateToken\b/,
+    /\bisAuthenticated\b/,
+    /\bensureAuthenticated\b/,
+    /\bauthGuard\b/,
+    /\bAuthGuard\b/,
+    /\brequire\w*[Aa]uth\b/,
+    /\bcheckAuth\b/,
+    /\bprotect\b/,
+    /\bauthenticateRequest\b/,
+    // Variable references — common Express convention (e.g., const auth = passport.authenticate(...))
+    // These are standalone identifiers in middleware position
+    /^auth$/i,
+    /^authMw$/i,
+    /^jwtAuth$/i,
+    /^tokenAuth$/i,
+];
+const RATE_LIMIT_MIDDLEWARE_PATTERNS = [
+    /\bexpress-rate-limit\b/,
+    /\brateLimit\b/,
+    /\brate_limiter\b/,
+    /\bRateLimiter\b/,
+    /\bthrottle\b/,
+    // Common variable references
+    /^loginLimiter$/i,
+    /^apiLimiter$/i,
+    /^rateLimiter$/i,
+    /^limiter$/i,
+];
+const VALIDATION_MIDDLEWARE_PATTERNS = [
+    /\bexpress-validator\b/,
+    /\bcheck\s*\(/,
+    /\bbody\s*\(/,
+    /\bparam\s*\(/,
+    /\bquery\s*\(/,
+    /\bvalidate\b/,
+    /\bcelebrate\b/,
+    /\bJoi\./,
+    /\bzod\b/,
+    /\byup\b/,
+];
+const SECURITY_HEADER_PATTERNS = [
+    /\bhelmet\b/,
+    /\bcors\s*\(/,
+    /\bcors\b/,
+    /\bcsp\b/,
+    /\bcontentSecurityPolicy\b/,
+    /\bhsts\b/,
+];
+const SESSION_PATTERNS = [
+    /\bexpress-session\b/,
+    /\bcookie-session\b/,
+    /\bcookieParser\b/,
+    /\bsession\s*\(/,
+];
+// ── Detection Functions ──
+/**
+ * Detect Express app initialization from source code.
+ * Returns the app variable name if found.
+ */
+function detectExpressApp(code) {
+    // Pattern: const app = express()
+    const m = code.match(/(?:const|let|var)\s+(\w+)\s*=\s*express\s*\(\s*\)/);
+    if (m)
+        return m[1];
+    // Pattern: import express from 'express' ... const app = express()
+    if (/\brequire\s*\(\s*['"]express['"]\s*\)/.test(code) || /from\s+['"]express['"]/.test(code)) {
+        const varMatch = code.match(/(?:const|let|var)\s+(\w+)\s*=\s*express\s*\(\s*\)/);
+        if (varMatch)
+            return varMatch[1];
+        // Couldn't find app variable, but express is imported
+        return "app"; // default convention
+    }
+    return null;
+}
+/**
+ * Extract all routes registered on an Express app or router.
+ */
+function extractRoutes(code, appName) {
+    const routes = [];
+    const methods = ["get", "post", "put", "delete", "patch", "all", "use"];
+    for (const method of methods) {
+        // Pattern: app.get('/path', middleware1, middleware2, handler)
+        // or: router.post('/path', handler)
+        const routeRegex = new RegExp(`${appName}\\.${method}\\s*\\(\\s*['\"]([^'\"]+)['\"]\\s*,([^;]+)\\)`, "gi");
+        let match;
+        while ((match = routeRegex.exec(code)) !== null) {
+            const rawArgs = match[2].trim();
+            const args = rawArgs.split(",").map(a => a.trim()).filter(a => a.length > 0);
+            // Last arg is the handler, everything before is middleware
+            const handler = args[args.length - 1] || "anonymous";
+            const middlewares = args.slice(0, -1);
+            routes.push({
+                method,
+                path: match[1],
+                handler,
+                middlewares,
+                line: code.slice(0, match.index).split("\n").length,
+            });
+        }
+    }
+    return routes;
+}
+/**
+ * Identify the type of a middleware function from its name or pattern.
+ */
+function classifyMiddleware(code, name) {
+    const trimmed = name.trim();
+    for (const p of AUTH_MIDDLEWARE_PATTERNS) {
+        if (p.test(trimmed))
+            return "auth";
+    }
+    for (const p of RATE_LIMIT_MIDDLEWARE_PATTERNS) {
+        if (p.test(trimmed))
+            return "rate_limit";
+    }
+    for (const p of VALIDATION_MIDDLEWARE_PATTERNS) {
+        if (p.test(trimmed))
+            return "validation";
+    }
+    for (const p of SECURITY_HEADER_PATTERNS) {
+        if (p.test(trimmed))
+            return "security_header";
+    }
+    for (const p of SESSION_PATTERNS) {
+        if (p.test(trimmed))
+            return "session";
+    }
+    if (/\bcors\b/i.test(trimmed))
+        return "cors";
+    if (/\berrorHandler\b|\bhandleError\b|\berror_handler\b/i.test(trimmed))
+        return "error_handler";
+    if (/\blogger\b|\bmorgan\b|\blogging\b/i.test(trimmed))
+        return "logging";
+    return "unknown";
+}
+/**
+ * Extract global middleware registrations (app.use(fn)).
+ */
+function extractGlobalMiddleware(code, appName) {
+    const middleware = [];
+    const useRegex = new RegExp(`${appName}\\.use\\s*\\(([^)]+)\\)`, "gi");
+    let match;
+    while ((match = useRegex.exec(code)) !== null) {
+        const args = match[1].split(",").map(a => a.trim());
+        for (const arg of args) {
+            if (arg.startsWith("'") || arg.startsWith('"'))
+                continue; // skip path strings
+            if (/^(express|router|Router)\./.test(arg))
+                continue; // skip sub-routers (handled separately)
+            middleware.push({
+                name: arg,
+                type: classifyMiddleware(code, arg),
+                registeredAt: code.slice(0, match.index).split("\n").length,
+            });
+        }
+    }
+    return middleware;
+}
+/**
+ * Analyze an Express app for security issues.
+ * This is the main entry point — call this function on an Express source file.
+ */
+function analyzeExpressApp(code) {
+    const appName = detectExpressApp(code);
+    if (!appName) {
+        return { hasExpress: false, appName: "", routes: [], globalMiddleware: [], issues: [] };
+    }
+    const routes = extractRoutes(code, appName);
+    const globalMiddleware = extractGlobalMiddleware(code, appName);
+    const issues = [];
+    // Check 1: Does the app have any auth middleware at all?
+    const hasGlobalAuth = globalMiddleware.some(m => m.type === "auth");
+    const hasAnyAuth = hasGlobalAuth || routes.some(r => r.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m))));
+    // Check 2: Does the app have rate limiting on auth routes?
+    const hasRateLimit = globalMiddleware.some(m => m.type === "rate_limit");
+    const authRoutes = routes.filter(r => /\b(login|signin|signup|register|auth|token|password)\b/i.test(r.path));
+    // Check 3: Does the app have security headers (helmet)?
+    const hasHelmet = globalMiddleware.some(m => m.type === "security_header") ||
+        /\bhelmet\s*\(/.test(code);
+    // Check 4: Does the app have input validation on POST/PUT routes?
+    const hasValidation = globalMiddleware.some(m => m.type === "validation");
+    // Check 5: Does the app have CORS configured?
+    const hasCors = globalMiddleware.some(m => m.type === "cors") || /\bcors\s*\(/.test(code);
+    // Check 6: Does the app have session management?
+    const hasSession = globalMiddleware.some(m => m.type === "session") || /\bsession\s*\(/.test(code);
+    // ── Generate Issues ──
+    if (!hasAnyAuth) {
+        issues.push({
+            severity: "critical",
+            rule: "EXPRESS_NO_AUTH_MIDDLEWARE",
+            message: "Express app has no authentication middleware registered. All routes are publicly accessible.",
+            line: 1,
+            fix: "Add an auth middleware (e.g., passport.authenticate('jwt'), express-jwt, or a custom auth middleware) to protect routes.",
+        });
+    }
+    // Check for routes without auth middleware (when auth middleware exists globally)
+    if (hasAnyAuth) {
+        for (const route of routes) {
+            if (["use", "all"].includes(route.method))
+                continue; // skip middleware registrations
+            const routeHasAuth = route.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m)));
+            if (!routeHasAuth && !hasGlobalAuth) {
+                // Route has no auth middleware AND no global auth → each route needs its own
+                // (already reported as EXPRESS_NO_AUTH_MIDDLEWARE above)
+                continue;
+            }
+            if (!routeHasAuth && hasGlobalAuth && !isPublicRoute(route.path)) {
+                issues.push({
+                    severity: "high",
+                    rule: "EXPRESS_ROUTE_MISSING_AUTH",
+                    message: `Route ${route.method.toUpperCase()} ${route.path} has no auth middleware. It may be inadvertently public.`,
+                    route: `${route.method.toUpperCase()} ${route.path}`,
+                    line: route.line,
+                    fix: `Add auth middleware to the route: app.${route.method}('${route.path}', authMiddleware, ${route.handler})`,
+                });
+            }
+        }
+    }
+    // Auth routes without rate limiting
+    if (authRoutes.length > 0 && !hasRateLimit) {
+        for (const route of authRoutes) {
+            issues.push({
+                severity: "high",
+                rule: "EXPRESS_AUTH_NO_RATE_LIMIT",
+                message: `Auth route ${route.method.toUpperCase()} ${route.path} has no rate limiting. Vulnerable to brute-force attacks.`,
+                route: `${route.method.toUpperCase()} ${route.path}`,
+                line: route.line,
+                fix: "Add express-rate-limit middleware to auth routes: max 5 attempts per minute per IP.",
+            });
+        }
+    }
+    // Missing security headers
+    if (!hasHelmet) {
+        issues.push({
+            severity: "medium",
+            rule: "EXPRESS_NO_HELMET",
+            message: "Express app does not use helmet middleware. Missing security headers (CSP, HSTS, X-Frame-Options, etc.).",
+            line: 1,
+            fix: "Add helmet middleware: app.use(helmet())",
+        });
+    }
+    // POST/PUT routes without validation
+    const mutationRoutes = routes.filter(r => ["post", "put", "patch"].includes(r.method));
+    if (mutationRoutes.length > 0 && !hasValidation) {
+        issues.push({
+            severity: "medium",
+            rule: "EXPRESS_NO_INPUT_VALIDATION",
+            message: `${mutationRoutes.length} POST/PUT/PATCH routes have no input validation middleware.`,
+            line: mutationRoutes[0]?.line ?? 1,
+            fix: "Add express-validator or zod validation to mutation routes.",
+        });
+    }
+    // Missing CORS configuration
+    if (!hasCors) {
+        issues.push({
+            severity: "low",
+            rule: "EXPRESS_NO_CORS_CONFIG",
+            message: "Express app has no explicit CORS configuration. Defaults to same-origin only — may break legitimate cross-origin requests or be overly permissive.",
+            line: 1,
+            fix: "Add explicit CORS configuration: app.use(cors({ origin: 'https://your-domain.com' }))",
+        });
+    }
+    // Session without secure settings (if present)
+    if (hasSession) {
+        const sessionSecure = /secure\s*:\s*true/.test(code) && /httpOnly\s*:\s*true/.test(code) && /sameSite\s*:\s*['"](?:strict|lax)['"]/.test(code);
+        if (!sessionSecure) {
+            issues.push({
+                severity: "medium",
+                rule: "EXPRESS_SESSION_INSECURE",
+                message: "Express session configured without secure, httpOnly, or sameSite cookie flags.",
+                line: 1,
+                fix: "Set cookie: { secure: true, httpOnly: true, sameSite: 'strict' } in session config.",
+            });
+        }
+    }
+    return { hasExpress: true, appName, routes, globalMiddleware, issues };
+}
+/**
+ * Check if a route is intentionally public (login, health, static, etc.).
+ */
+function isPublicRoute(path) {
+    const publicPatterns = [
+        /^\/login$/i,
+        /^\/signin$/i,
+        /^\/signup$/i,
+        /^\/register$/i,
+        /^\/auth\//i,
+        /^\/health$/i,
+        /^\/healthcheck$/i,
+        /^\/ping$/i,
+        /^\/status$/i,
+        /^\/public\//i,
+        /^\/static\//i,
+        /^\/assets\//i,
+        /^\/favicon/i,
+        /^\/robots\.txt/i,
+        /^\/$/,
+    ];
+    return publicPatterns.some(p => p.test(path));
+}
+/**
+ * Analyze a file on disk. Returns null if not an Express app.
+ */
+function analyzeExpressFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    // Quick check: does this file import express?
+    if (!/\bexpress\b/.test(code) && !/from\s+['"]express['"]/.test(code))
+        return null;
+    return analyzeExpressApp(code);
+}
+/**
+ * Batch analyze multiple files and return summary.
+ */
+function analyzeExpressProject(filePaths) {
+    let expressApps = 0;
+    let totalRoutes = 0;
+    const allIssues = [];
+    for (const fp of filePaths) {
+        const analysis = analyzeExpressFile(fp);
+        if (analysis && analysis.hasExpress) {
+            expressApps++;
+            totalRoutes += analysis.routes.length;
+            allIssues.push(...analysis.issues);
+        }
+    }
+    return {
+        files: filePaths.length,
+        expressApps,
+        totalRoutes,
+        issues: allIssues,
+    };
+}
+/**
+ * Format a summary report for CLI output.
+ */
+function formatExpressReport(analysis) {
+    if (!analysis.hasExpress) {
+        return "Not an Express app (no express import found).";
+    }
+    const lines = [
+        `Express App: ${analysis.appName}`,
+        `Routes: ${analysis.routes.length}`,
+        `Global Middleware: ${analysis.globalMiddleware.length}`,
+        `Security Issues: ${analysis.issues.length}`,
+        "",
+    ];
+    if (analysis.issues.length === 0) {
+        lines.push("✅ No Express security issues detected.");
+        return lines.join("\n");
+    }
+    const bySeverity = {
+        critical: analysis.issues.filter(i => i.severity === "critical"),
+        high: analysis.issues.filter(i => i.severity === "high"),
+        medium: analysis.issues.filter(i => i.severity === "medium"),
+        low: analysis.issues.filter(i => i.severity === "low"),
+    };
+    for (const [sev, issues] of Object.entries(bySeverity)) {
+        if (issues.length === 0)
+            continue;
+        const emoji = sev === "critical" ? "🔴" : sev === "high" ? "🟠" : sev === "medium" ? "🟡" : "🔵";
+        lines.push(`${emoji} ${sev.toUpperCase()} (${issues.length})`);
+        for (const issue of issues) {
+            lines.push(`  [${issue.rule}] ${issue.message}`);
+            if (issue.route)
+                lines.push(`    Route: ${issue.route} (line ${issue.line})`);
+            lines.push(`    Fix: ${issue.fix}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}

package/dist/frameworks/express-detector.test.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Unit tests for Express Framework Adapter
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const express_detector_1 = require("./express-detector");
+// ── Test fixtures ──
+const BASIC_EXPRESS_APP = `
+const express = require('express');
+const app = express();
+
+app.get('/', (req, res) => { res.send('Hello'); });
+app.listen(3000);
+`;
+const AUTH_APP = `
+const express = require('express');
+const passport = require('passport');
+const app = express();
+
+app.use(express.json());
+app.use(passport.initialize());
+
+app.post('/login', passport.authenticate('local'), (req, res) => {
+  res.json({ token: 'xxx' });
+});
+
+app.get('/profile', passport.authenticate('jwt'), (req, res) => {
+  res.json(req.user);
+});
+
+app.listen(3000);
+`;
+const INSECURE_APP = `
+const express = require('express');
+const app = express();
+
+app.get('/api/users', getUsers);
+app.post('/api/users', createUser);
+app.delete('/api/users/:id', deleteUser);
+app.listen(3000);
+`;
+const SECURE_APP = `
+const express = require('express');
+const helmet = require('helmet');
+const cors = require('cors');
+const rateLimit = require('express-rate-limit');
+const session = require('express-session');
+const passport = require('passport');
+const app = express();
+
+app.use(helmet());
+app.use(cors({ origin: 'https://example.com' }));
+app.use(express.json());
+app.use(session({
+  secret: 'mysecret',
+  resave: false,
+  saveUninitialized: false,
+  cookie: { secure: true, httpOnly: true, sameSite: 'strict' }
+}));
+app.use(passport.initialize());
+
+const auth = passport.authenticate('jwt', { session: false });
+const loginLimiter = rateLimit({ windowMs: 60_000, max: 5 });
+
+app.post('/login', loginLimiter, passport.authenticate('local'), (req, res) => {
+  res.json({ token: 'xxx' });
+});
+
+app.get('/profile', auth, (req, res) => {
+  res.json(req.user);
+});
+
+app.get('/public', (req, res) => {
+  res.json({ message: 'public' });
+});
+
+app.listen(3000);
+`;
+// ── Tests ──
+(0, vitest_1.describe)("detectExpressApp", () => {
+    (0, vitest_1.it)("should detect express() call", () => {
+        (0, vitest_1.expect)((0, express_detector_1.detectExpressApp)(BASIC_EXPRESS_APP)).toBe("app");
+    });
+    (0, vitest_1.it)("should detect express with require", () => {
+        // require('express')() creates an app directly — detectExpressApp
+        // returns 'app' as default when express is imported but we can't find the variable
+        (0, vitest_1.expect)((0, express_detector_1.detectExpressApp)("const server = require('express')();")).toBe("app");
+    });
+    (0, vitest_1.it)("should return null for non-express code", () => {
+        (0, vitest_1.expect)((0, express_detector_1.detectExpressApp)("const http = require('http');")).toBeNull();
+    });
+});
+(0, vitest_1.describe)("extractRoutes", () => {
+    (0, vitest_1.it)("should extract GET/POST routes", () => {
+        const routes = (0, express_detector_1.extractRoutes)(SECURE_APP, "app");
+        // SECURE_APP has post('/login'), get('/profile'), get('/public')
+        // (the const auth variable is passed by reference, not inline, so not extracted)
+        (0, vitest_1.expect)(routes.length).toBeGreaterThanOrEqual(3);
+        (0, vitest_1.expect)(routes.some(r => r.path === "/login")).toBe(true);
+        (0, vitest_1.expect)(routes.some(r => r.path === "/profile")).toBe(true);
+    });
+    (0, vitest_1.it)("should identify middleware on routes", () => {
+        const routes = (0, express_detector_1.extractRoutes)(SECURE_APP, "app");
+        const profileRoute = routes.find(r => r.path === "/profile");
+        (0, vitest_1.expect)(profileRoute).toBeDefined();
+        (0, vitest_1.expect)(profileRoute.middlewares.length).toBeGreaterThan(0);
+    });
+    (0, vitest_1.it)("should find routes with no middleware", () => {
+        const routes = (0, express_detector_1.extractRoutes)(INSECURE_APP, "app");
+        (0, vitest_1.expect)(routes.length).toBeGreaterThan(0);
+        // Some routes may have inline handlers that look like middleware
+        // The key assertion: at least some routes have no middleware
+        const withoutMiddleware = routes.filter(r => r.middlewares.length === 0);
+        (0, vitest_1.expect)(withoutMiddleware.length).toBeGreaterThan(0);
+    });
+});
+(0, vitest_1.describe)("classifyMiddleware", () => {
+    (0, vitest_1.it)("should classify passport.authenticate as auth", () => {
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "passport.authenticate('jwt')")).toBe("auth");
+    });
+    (0, vitest_1.it)("should classify rateLimit as rate_limit", () => {
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "rateLimit({ windowMs: 60000 })")).toBe("rate_limit");
+    });
+    (0, vitest_1.it)("should classify helmet as security_header", () => {
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "helmet()")).toBe("security_header");
+    });
+});
+(0, vitest_1.describe)("extractGlobalMiddleware", () => {
+    (0, vitest_1.it)("should extract app.use middleware", () => {
+        const mw = (0, express_detector_1.extractGlobalMiddleware)(SECURE_APP, "app");
+        (0, vitest_1.expect)(mw.length).toBeGreaterThanOrEqual(4);
+    });
+    (0, vitest_1.it)("should classify passport as auth", () => {
+        const mw = (0, express_detector_1.extractGlobalMiddleware)(AUTH_APP, "app");
+        // passport.initialize() and passport.authenticate() are now both classified as auth
+        (0, vitest_1.expect)(mw.some(m => m.type === "auth")).toBe(true);
+    });
+});
+(0, vitest_1.describe)("analyzeExpressApp", () => {
+    (0, vitest_1.it)("should return hasExpress=false for non-express code", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)("const x = 1;");
+        (0, vitest_1.expect)(result.hasExpress).toBe(false);
+    });
+    (0, vitest_1.it)("should detect missing auth as critical issue", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
+        const critical = result.issues.filter(i => i.severity === "critical");
+        (0, vitest_1.expect)(critical.length).toBeGreaterThan(0);
+        (0, vitest_1.expect)(critical[0].rule).toBe("EXPRESS_NO_AUTH_MIDDLEWARE");
+    });
+    (0, vitest_1.it)("should detect auth routes without rate limiting", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(AUTH_APP);
+        const rateIssues = result.issues.filter(i => i.rule === "EXPRESS_AUTH_NO_RATE_LIMIT");
+        (0, vitest_1.expect)(rateIssues.length).toBeGreaterThan(0);
+    });
+    (0, vitest_1.it)("should detect missing helmet", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_HELMET")).toBe(true);
+    });
+    (0, vitest_1.it)("should detect missing CORS", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_CORS_CONFIG")).toBe(true);
+    });
+    (0, vitest_1.it)("should flag no input validation on POST routes", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_INPUT_VALIDATION")).toBe(true);
+    });
+    (0, vitest_1.it)("should flag insecure session", () => {
+        const insecureSession = `
+      const app = require('express')();
+      app.use(require('express-session')({ secret: 'x', cookie: {} }));
+      app.listen(3000);
+    `;
+        const result = (0, express_detector_1.analyzeExpressApp)(insecureSession);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_SESSION_INSECURE")).toBe(true);
+    });
+    (0, vitest_1.it)("should PASS a fully secured Express app", () => {
+        const result = (0, express_detector_1.analyzeExpressApp)(SECURE_APP);
+        const critical = result.issues.filter(i => i.severity === "critical");
+        // /public route without explicit auth will trigger EXPRESS_ROUTE_MISSING_AUTH (high)
+        // — that's correct behavior; public routes should be explicitly marked.
+        // The KEY assertion: no CRITICAL issues (critical = BLOCKED decision)
+        (0, vitest_1.expect)(critical.length).toBe(0);
+    });
+    (0, vitest_1.it)("should not flag public routes for auth", () => {
+        const publicApp = `
+      const app = require('express')();
+      app.use(require('passport').initialize());
+      app.get('/health', (req, res) => { res.send('ok'); });
+      app.get('/login', (req, res) => { res.send('login'); });
+      app.listen(3000);
+    `;
+        const result = (0, express_detector_1.analyzeExpressApp)(publicApp);
+        const missingAuth = result.issues.filter(i => i.rule === "EXPRESS_ROUTE_MISSING_AUTH");
+        // /health and /login are public, should not be flagged
+        (0, vitest_1.expect)(missingAuth.length).toBe(0);
+    });
+});
+(0, vitest_1.describe)("formatExpressReport", () => {
+    (0, vitest_1.it)("should return a human-readable report", () => {
+        const analysis = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
+        const report = (0, express_detector_1.formatExpressReport)(analysis);
+        (0, vitest_1.expect)(report).toContain("Express App:");
+        (0, vitest_1.expect)(report).toContain("Security Issues:");
+    });
+});

package/dist/frameworks/index.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Progmune Framework Adapters
+ *
+ * Framework-specific protocol detection that complements the generic
+ * \w* regex patterns in protocol-detector.ts.
+ *
+ * Each adapter knows the API surface of a specific framework:
+ * middleware chains, route handlers, dependency injection, guards, etc.
+ *
+ * Current: Express.js (first adapter — broke the 0/13 gap)
+ * Planned: Next.js, NestJS, Fastify, FastAPI, Django
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+var express_detector_1 = require("./express-detector");
+Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
+Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
+Object.defineProperty(exports, "analyzeExpressProject", { enumerable: true, get: function () { return express_detector_1.analyzeExpressProject; } });
+Object.defineProperty(exports, "detectExpressApp", { enumerable: true, get: function () { return express_detector_1.detectExpressApp; } });
+Object.defineProperty(exports, "extractRoutes", { enumerable: true, get: function () { return express_detector_1.extractRoutes; } });
+Object.defineProperty(exports, "extractGlobalMiddleware", { enumerable: true, get: function () { return express_detector_1.extractGlobalMiddleware; } });
+Object.defineProperty(exports, "classifyMiddleware", { enumerable: true, get: function () { return express_detector_1.classifyMiddleware; } });
+Object.defineProperty(exports, "formatExpressReport", { enumerable: true, get: function () { return express_detector_1.formatExpressReport; } });
+// ── Framework Version-Aware Governance ──
+var version_awareness_1 = require("./version-awareness");
+Object.defineProperty(exports, "detectFrameworks", { enumerable: true, get: function () { return version_awareness_1.detectFrameworks; } });
+Object.defineProperty(exports, "checkFrameworkConventions", { enumerable: true, get: function () { return version_awareness_1.checkFrameworkConventions; } });
+Object.defineProperty(exports, "checkFileRename", { enumerable: true, get: function () { return version_awareness_1.checkFileRename; } });
+Object.defineProperty(exports, "generateVersionAwarenessReport", { enumerable: true, get: function () { return version_awareness_1.generateVersionAwarenessReport; } });