project-athena 0.3.0 → 0.5.0

package/dist/chunk-LMOFZNTQ.js

@@ -1,379 +0,0 @@
-#!/usr/bin/env node
-import {
-  whichExecutable
-} from "./chunk-VSYBC3VY.js";
-import {
-  scanFilesForSecrets,
-  secretFingerprinter
-} from "./chunk-PANVPNYF.js";
-import {
-  walkProject
-} from "./chunk-ELKFRTZT.js";
-import {
-  loadConfig
-} from "./chunk-2DY4PUR4.js";
-
-// src/services/security.ts
-import { execFile } from "child_process";
-import { promises as fs } from "fs";
-import path from "path";
-var AuditToolError = class extends Error {
-};
-var asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
-var isObject = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
-var sev = (s) => {
-  const v = String(s ?? "").toLowerCase();
-  if (v === "critical") return "critical";
-  if (v === "high") return "high";
-  if (v === "moderate" || v === "medium") return "moderate";
-  if (v === "low" || v === "info") return "low";
-  return "unrated";
-};
-function parseJsonObject(stdout, tool) {
-  const text = stdout.trim();
-  if (!text) throw new AuditToolError(`${tool} produced no output`);
-  const json = JSON.parse(text);
-  if (!isObject(json)) throw new AuditToolError(`${tool} produced unexpected output`);
-  return json;
-}
-function throwIfToolError(json, tool) {
-  if (json.error === void 0) return;
-  const e = asRecord(json.error);
-  const parts = [e.code, e.summary ?? e.message].filter((x) => typeof x === "string" && x.trim());
-  const text = parts.length ? parts.join(": ") : typeof json.error === "string" ? json.error : "unknown error";
-  throw new AuditToolError(`${tool} reported an error: ${text.split("\n")[0].slice(0, 200)}`);
-}
-function parseAdvisories(advisories) {
-  const out = [];
-  for (const [key, raw] of Object.entries(advisories)) {
-    const a = asRecord(raw);
-    const versions = [...new Set((Array.isArray(a.findings) ? a.findings : []).map((f) => asRecord(f).version).filter((v) => typeof v === "string"))];
-    const patched = typeof a.patched_versions === "string" ? a.patched_versions.trim() : "";
-    out.push({
-      package: String(a.module_name ?? "unknown"),
-      severity: sev(a.severity),
-      title: String(a.title ?? `Vulnerable dependency: ${String(a.module_name ?? key)}`),
-      id: typeof a.github_advisory_id === "string" ? a.github_advisory_id : Array.isArray(a.cves) && typeof a.cves[0] === "string" ? a.cves[0] : String(a.id ?? key),
-      url: typeof a.url === "string" ? a.url : void 0,
-      vulnerableRange: typeof a.vulnerable_versions === "string" ? a.vulnerable_versions + (versions.length ? ` (installed ${versions.join(", ")})` : "") : void 0,
-      fixAvailable: Boolean(patched) && patched !== "<0.0.0"
-    });
-  }
-  return out;
-}
-function parseNpmAudit(stdout) {
-  const json = parseJsonObject(stdout, "npm audit");
-  throwIfToolError(json, "npm audit");
-  if (!isObject(json.vulnerabilities)) {
-    if (isObject(json.advisories)) return parseAdvisories(json.advisories);
-    throw new AuditToolError('npm audit output has no "vulnerabilities" report');
-  }
-  const out = [];
-  for (const [name, raw] of Object.entries(json.vulnerabilities)) {
-    const v = asRecord(raw);
-    const via = Array.isArray(v.via) ? v.via : [];
-    const advisory = via.find((x) => x && typeof x === "object");
-    const viaNames = via.filter((x) => typeof x === "string");
-    out.push({
-      package: name,
-      severity: sev(v.severity),
-      title: String(advisory?.title ?? (viaNames.length ? `Depends on vulnerable ${viaNames.join(", ")}` : `Vulnerable dependency: ${name}`)),
-      id: advisory?.source !== void 0 ? String(advisory.source) : void 0,
-      url: typeof advisory?.url === "string" ? advisory.url : void 0,
-      vulnerableRange: typeof v.range === "string" ? v.range : void 0,
-      fixAvailable: Boolean(v.fixAvailable)
-    });
-  }
-  return out;
-}
-function parsePnpmAudit(stdout) {
-  const json = parseJsonObject(stdout, "pnpm audit");
-  throwIfToolError(json, "pnpm audit");
-  if (!isObject(json.advisories)) throw new AuditToolError('pnpm audit output has no "advisories" report');
-  return parseAdvisories(json.advisories);
-}
-function parsePipAudit(stdout) {
-  const text = stdout.trim();
-  if (!text) throw new AuditToolError("pip-audit produced no output");
-  const json = JSON.parse(text);
-  const deps = isObject(json) && Array.isArray(json.dependencies) ? json.dependencies : Array.isArray(json) ? json : null;
-  if (!deps) throw new AuditToolError('pip-audit output has no "dependencies" list');
-  const out = [];
-  for (const raw of deps) {
-    const d = asRecord(raw);
-    for (const vRaw of Array.isArray(d.vulns) ? d.vulns : []) {
-      const v = asRecord(vRaw);
-      const aliases = Array.isArray(v.aliases) ? v.aliases.filter((a) => typeof a === "string") : [];
-      const id = typeof v.id === "string" ? v.id : void 0;
-      out.push({
-        package: String(d.name ?? "unknown"),
-        severity: "unrated",
-        // pip-audit does not report severity
-        title: String(v.description ?? id ?? "Known vulnerability").split("\n")[0].slice(0, 300),
-        id: id ?? aliases[0],
-        url: id ? `https://osv.dev/vulnerability/${id}` : void 0,
-        vulnerableRange: typeof d.version === "string" ? `installed ${d.version}` : void 0,
-        fixAvailable: Array.isArray(v.fix_versions) && v.fix_versions.length > 0
-      });
-    }
-  }
-  return out;
-}
-function splitJsonStream(text) {
-  const out = [];
-  let depth = 0;
-  let inString = false;
-  let escaped = false;
-  let start = -1;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    if (inString) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === '"') inString = false;
-      continue;
-    }
-    if (ch === '"') {
-      if (depth > 0) inString = true;
-    } else if (ch === "{") {
-      if (depth === 0) start = i;
-      depth++;
-    } else if (ch === "}" && depth > 0) {
-      depth--;
-      if (depth === 0) {
-        out.push(JSON.parse(text.slice(start, i + 1)));
-        start = -1;
-      }
-    }
-  }
-  if (depth !== 0) throw new AuditToolError("truncated JSON output");
-  return out;
-}
-var REACH_RANK = { required: 0, imported: 1, called: 2 };
-function parseGovulncheck(stdout) {
-  const messages = splitJsonStream(stdout).map(asRecord);
-  if (!messages.some((m) => isObject(m.config))) throw new AuditToolError("govulncheck produced no JSON report");
-  const osvs = /* @__PURE__ */ new Map();
-  for (const m of messages) {
-    const osv = asRecord(m.osv);
-    if (typeof osv.id === "string") osvs.set(osv.id, osv);
-  }
-  const found = /* @__PURE__ */ new Map();
-  for (const m of messages) {
-    const f = asRecord(m.finding);
-    if (typeof f.osv !== "string") continue;
-    const trace = (Array.isArray(f.trace) ? f.trace : []).map(asRecord);
-    const reach = trace.some((t) => typeof t.function === "string") ? "called" : trace.some((t) => typeof t.package === "string") ? "imported" : "required";
-    const first = trace[0] ?? {};
-    const prev = found.get(f.osv);
-    if (prev && REACH_RANK[prev.reach] >= REACH_RANK[reach]) continue;
-    found.set(f.osv, {
-      module: typeof first.module === "string" ? first.module : prev?.module,
-      version: typeof first.version === "string" ? first.version : prev?.version,
-      fixed: typeof f.fixed_version === "string" ? f.fixed_version : prev?.fixed,
-      reach
-    });
-  }
-  const label = { called: "called by your code", imported: "package imported, vulnerable symbol not called", required: "module required, package not imported" };
-  return [...found].map(([id, f]) => {
-    const osv = osvs.get(id) ?? {};
-    const affected = Array.isArray(osv.affected) ? asRecord(osv.affected[0]) : {};
-    return {
-      package: f.module ?? String(asRecord(affected.package).name ?? "unknown"),
-      severity: "unrated",
-      // the Go vulnerability database does not assign severities
-      title: `${String(osv.summary ?? id)} (${label[f.reach]})`,
-      id,
-      url: `https://pkg.go.dev/vuln/${id}`,
-      vulnerableRange: f.version ? `installed ${f.version}` : void 0,
-      fixAvailable: Boolean(f.fixed)
-    };
-  });
-}
-function parseCargoAudit(stdout) {
-  const json = parseJsonObject(stdout, "cargo audit");
-  if (!isObject(json.vulnerabilities)) throw new AuditToolError('cargo audit output has no "vulnerabilities" report');
-  const list = Array.isArray(json.vulnerabilities.list) ? json.vulnerabilities.list : [];
-  return list.map((raw) => {
-    const v = asRecord(raw);
-    const advisory = asRecord(v.advisory);
-    const pkg = asRecord(v.package);
-    return {
-      package: String(pkg.name ?? "unknown"),
-      severity: sev(asRecord(advisory.cvss).severity ?? advisory.severity),
-      title: String(advisory.title ?? "Known vulnerability"),
-      id: typeof advisory.id === "string" ? advisory.id : void 0,
-      url: typeof advisory.url === "string" ? advisory.url : void 0
-    };
-  });
-}
-function parseComposerAudit(stdout) {
-  const json = parseJsonObject(stdout, "composer audit");
-  if (json.advisories === void 0) throw new AuditToolError('composer audit output has no "advisories" report');
-  const advisories = asRecord(json.advisories);
-  const out = [];
-  for (const [pkg, raw] of Object.entries(advisories)) {
-    for (const aRaw of Array.isArray(raw) ? raw : Object.values(asRecord(raw))) {
-      const a = asRecord(aRaw);
-      out.push({
-        package: pkg,
-        severity: sev(a.severity),
-        title: String(a.title ?? "Known vulnerability"),
-        id: typeof a.cve === "string" ? a.cve : typeof a.advisoryId === "string" ? a.advisoryId : void 0,
-        url: typeof a.link === "string" ? a.link : void 0,
-        vulnerableRange: typeof a.affectedVersions === "string" ? a.affectedVersions : void 0
-      });
-    }
-  }
-  return out;
-}
-var MAX_PIP_TARGETS = 10;
-var REQUIREMENTS_FILE = /(^|\/)requirements[\w.-]*\.txt$/i;
-async function planPipAudit(ctx) {
-  const common = ["--format", "json", "--progress-spinner", "off"];
-  const reqs = ctx.files.filter((f) => REQUIREMENTS_FILE.test(f)).sort();
-  const reqDirs = new Set(reqs.map((f) => path.posix.dirname(f)));
-  const out = reqs.map((f) => ({ target: f, args: ["-r", f, ...common] }));
-  for (const f of ctx.files.filter((x) => x === "pyproject.toml" || x.endsWith("/pyproject.toml")).sort()) {
-    const dir = path.posix.dirname(f);
-    if (reqDirs.has(dir)) continue;
-    const text = await fs.readFile(path.join(ctx.root, f), "utf8").catch(() => "");
-    if (!/^\s*\[project\]\s*$/m.test(text)) continue;
-    out.push({ target: f, args: [...common, dir === "." ? "." : `./${dir}`] });
-  }
-  if (!out.length) return "no requirements file to audit (pip-audit needs requirements*.txt or a PEP 621 pyproject.toml; the active Python environment is never audited)";
-  return out.slice(0, MAX_PIP_TARGETS);
-}
-var single = (args) => async () => [{ args }];
-var RUNNERS = [
-  {
-    tool: "npm audit",
-    ecosystem: "npm",
-    command: "npm",
-    applies: (_m, has) => has("package-lock.json") || has("npm-shrinkwrap.json"),
-    plan: single(["audit", "--json", "--audit-level=low"]),
-    parse: parseNpmAudit
-  },
-  {
-    tool: "pnpm audit",
-    ecosystem: "npm",
-    command: "pnpm",
-    applies: (_m, has) => has("pnpm-lock.yaml"),
-    plan: single(["audit", "--json"]),
-    parse: parsePnpmAudit
-  },
-  {
-    tool: "pip-audit",
-    ecosystem: "python",
-    command: "pip-audit",
-    applies: (m, _has, ctx) => m.manifests.some((x) => x.ecosystem === "python") || ctx.files.some((f) => REQUIREMENTS_FILE.test(f)),
-    plan: planPipAudit,
-    parse: parsePipAudit
-  },
-  {
-    tool: "govulncheck",
-    ecosystem: "go",
-    command: "govulncheck",
-    applies: (_m, has) => has("go.mod"),
-    plan: single(["-format=json", "./..."]),
-    parse: parseGovulncheck
-  },
-  {
-    tool: "cargo audit",
-    ecosystem: "cargo",
-    command: "cargo",
-    applies: (_m, has) => has("Cargo.lock"),
-    plan: single(["audit", "--json"]),
-    parse: parseCargoAudit
-  },
-  {
-    tool: "composer audit",
-    ecosystem: "composer",
-    command: "composer",
-    applies: (_m, has) => has("composer.lock"),
-    plan: single(["audit", "--format=json"]),
-    parse: parseComposerAudit
-  }
-];
-function run(command, args, cwd, timeoutMs) {
-  return new Promise((resolve) => {
-    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true, env: { ...process.env, NO_COLOR: "1", npm_config_color: "false" } }, (error, stdout, stderr) => {
-      const timedOut = Boolean(error && (error.code === "ETIMEDOUT" || error.killed));
-      resolve({ stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), timedOut, error: error ?? null });
-    });
-  });
-}
-async function runTool(runner, inv, root, timeoutMs) {
-  const t = Date.now();
-  const base = { tool: runner.tool, ecosystem: runner.ecosystem, ...inv.target ? { target: inv.target } : {} };
-  const r = await run(runner.command, inv.args, root, timeoutMs);
-  if (r.timedOut) return { ...base, status: "timeout", message: `Timed out after ${timeoutMs / 1e3}s`, durationMs: Date.now() - t, findings: [] };
-  try {
-    const findings = runner.parse(r.stdout, r.stderr);
-    return { ...base, status: "ok", durationMs: Date.now() - t, findings };
-  } catch (err) {
-    const reason = err instanceof AuditToolError ? err.message : `Could not parse output: ${r.stderr.trim().split("\n")[0] || r.error?.message || err.message || "unreadable output"}`;
-    return { ...base, status: "failed", message: reason.slice(0, 300), durationMs: Date.now() - t, findings: [] };
-  }
-}
-async function runSecurityScan(root, model, opts = {}) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? 12e4;
-  const { config } = await loadConfig(root);
-  const walk = await walkProject(root, { config, signal: opts.signal });
-  const ctx = { root, files: walk.files.map((f) => f.path) };
-  const files = new Set(model.manifests.map((m) => m.path));
-  for (const pm of model.packageManagers) for (const e of pm.provenance.evidence) files.add(e.file);
-  for (const f of ctx.files) files.add(f);
-  const has = (file) => files.has(file);
-  const tools = [];
-  if (!opts.skipAudit) {
-    for (const runner of RUNNERS) {
-      if (!runner.applies(model, has, ctx)) continue;
-      opts.signal?.throwIfAborted();
-      const t = Date.now();
-      opts.onTool?.(runner.tool);
-      const bin = await whichExecutable(runner.command);
-      if (!bin) {
-        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: `${runner.command} is not installed or not on PATH`, durationMs: Date.now() - t, findings: [] });
-        continue;
-      }
-      const plan = await runner.plan(ctx);
-      if (typeof plan === "string") {
-        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: plan, durationMs: Date.now() - t, findings: [] });
-        continue;
-      }
-      for (const inv of plan) {
-        opts.signal?.throwIfAborted();
-        tools.push(await runTool(runner, inv, root, timeoutMs));
-      }
-    }
-  }
-  const counts = { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0 };
-  for (const t of tools) for (const f of t.findings) counts[f.severity]++;
-  const secrets = await scanProjectSecrets(root, walk.files, opts.signal);
-  const scan = {
-    schemaVersion: 1,
-    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    durationMs: Date.now() - started,
-    tools,
-    counts,
-    secrets: {
-      count: secrets.findings.length,
-      files: [...new Set(secrets.findings.map((s) => s.file))].slice(0, 50),
-      skippedLongLines: secrets.skippedLongLines,
-      ...secrets.truncated ? { truncated: true } : {}
-    }
-  };
-  return scan;
-}
-async function scanProjectSecrets(root, files, signal) {
-  const fingerprint = await secretFingerprinter(root);
-  const read = async (rel) => fs.readFile(path.join(root, rel), "utf8").catch(() => null);
-  return scanFilesForSecrets(files, read, { fingerprint, signal });
-}
-
-export {
-  runSecurityScan
-};
-//# sourceMappingURL=chunk-LMOFZNTQ.js.map

package/dist/web/assets/architecture-7GRP2DOG-DyxkwYiW.js

@@ -1 +0,0 @@
-import"./chunk-FOHPRMQF-DzxwRta7.js";import{M as e}from"./mermaid-parser.core-BvFFklev.js";export{e as createArchitectureServices};

package/dist/web/assets/channel-BvDD7AMO.js

@@ -1 +0,0 @@
-import{at as e,ot as t}from"./chunk-O7XYJQB3-BH2gESvO.js";var n=(n,r)=>t.lang.round(e.parse(n)[r]);export{n as t};

package/dist/web/assets/eventmodeling-NTZA5JFV-cLIzvgDp.js

@@ -1 +0,0 @@
-import"./chunk-FOHPRMQF-DzxwRta7.js";import{O as e}from"./mermaid-parser.core-BvFFklev.js";export{e as createEventModelingServices};

package/dist/web/assets/flowDiagram-KWPJA3E3-D7Zq63VQ.js

@@ -1 +0,0 @@
-import"./src-oBChb5qS.js";import"./chunk-O7XYJQB3-BH2gESvO.js";import"./chunk-ZIGJFQKS-BZYvP63G.js";import"./chunk-742MDFTN-BeZ7P5jB.js";import"./chunk-MBY4JIJT-DA_D1hjF.js";import"./chunk-7PRAP22T-DqQNS8oq.js";import"./chunk-7INBJB4K-IKy0pr5m.js";import"./chunk-5DYCD2WN-CZecgNhf.js";import"./chunk-Z7XXMR3K-BxcA-y5B.js";import"./chunk-GWA4HPMP-CE5GcwVN.js";import"./chunk-XXDRQBXY-BvKO0v-W.js";import"./chunk-WEXAMYUT-B4QwUZPM.js";import"./chunk-UA2S7LBM-BWr0xCux.js";import{n as e}from"./chunk-7M6MHVWA-Dg_QqJEX.js";import"./mermaid.core-Cd_Ssti9.js";export{e as diagram};

package/dist/web/assets/railroad-abnf-HS5TGJTU-DBFym6g8.js

@@ -1 +0,0 @@
-import"./chunk-FOHPRMQF-DzxwRta7.js";import{m as e}from"./mermaid-parser.core-BvFFklev.js";export{e as createRailroadAbnfServices};

package/dist/web/assets/railroad-ebnf-LZEXJU2U-CkG28ig8.js

@@ -1 +0,0 @@
-import"./chunk-FOHPRMQF-DzxwRta7.js";import{f as e}from"./mermaid-parser.core-BvFFklev.js";export{e as createRailroadEbnfServices};

package/dist/web/assets/railroad-peg-WCYAUIDC-Df_Ifaad.js

@@ -1 +0,0 @@
-import"./chunk-FOHPRMQF-DzxwRta7.js";import{u as e}from"./mermaid-parser.core-BvFFklev.js";export{e as createRailroadPegServices};

package/dist/web/assets/swimlanesDiagram-TC7HE7FX-CDSrqdgx.js

@@ -1,8 +0,0 @@
-import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./src-oBChb5qS.js";import"./chunk-O7XYJQB3-BH2gESvO.js";import"./chunk-ZIGJFQKS-BZYvP63G.js";import"./chunk-742MDFTN-BeZ7P5jB.js";import"./chunk-MBY4JIJT-DA_D1hjF.js";import"./chunk-7PRAP22T-DqQNS8oq.js";import"./chunk-7INBJB4K-IKy0pr5m.js";import"./chunk-5DYCD2WN-CZecgNhf.js";import"./chunk-Z7XXMR3K-BxcA-y5B.js";import"./chunk-GWA4HPMP-CE5GcwVN.js";import"./chunk-XXDRQBXY-BvKO0v-W.js";import"./chunk-WEXAMYUT-B4QwUZPM.js";import"./chunk-UA2S7LBM-BWr0xCux.js";import{r as t,t as n}from"./chunk-7M6MHVWA-Dg_QqJEX.js";import"./mermaid.core-Cd_Ssti9.js";var r=n({styles:e(e=>`${t(e)}
-  .swimlane.cluster:not([data-color-id]) rect {
-    stroke: ${e.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,`getStyles`)});export{r as diagram};