projscan 4.4.0 → 4.6.0

package/dist/cli/pluginReporter.js

@@ -0,0 +1,46 @@
+import chalk from 'chalk';
+import { resolveReporterPlugin, renderReporterPlugin, } from '../core/plugins.js';
+export async function renderCliPluginReporterIfRequested(options) {
+    if (!isPluginReporterName(options.reporterName))
+        return false;
+    if (options.format !== 'console') {
+        console.error(chalk.red(pluginReporterFormatError(options.format)));
+        process.exit(1);
+    }
+    const resolved = await resolveReporterPlugin(options.rootPath, options.reporterName, options.command);
+    if (!resolved.ok) {
+        printPluginReporterDiagnostic(resolved.diagnostic);
+        process.exit(1);
+    }
+    const rendered = await renderReporterPlugin(resolved.plugin, {
+        command: options.command,
+        rootPath: options.rootPath,
+        manifest: resolved.plugin.manifest,
+        payload: options.payload,
+    });
+    if (!rendered.ok) {
+        printPluginReporterDiagnostic(rendered.diagnostic);
+        process.exit(1);
+    }
+    console.log(rendered.output);
+    return true;
+}
+export function isPluginReporterName(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+export function pluginReporterFormatError(format) {
+    return `--reporter cannot be combined with --format ${format}`;
+}
+export function pluginReporterDiagnosticLines(diagnostic) {
+    const lines = [`[${diagnostic.code}] ${diagnostic.message}`];
+    if (diagnostic.hint)
+        lines.push(`hint: ${diagnostic.hint}`);
+    return lines;
+}
+function printPluginReporterDiagnostic(diagnostic) {
+    const [first, ...rest] = pluginReporterDiagnosticLines(diagnostic);
+    console.error(chalk.red(first));
+    for (const line of rest)
+        console.error(chalk.dim(line));
+}
+//# sourceMappingURL=pluginReporter.js.map

package/dist/cli/pluginReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pluginReporter.js","sourceRoot":"","sources":["../../src/cli/pluginReporter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAW5B,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAAuC;IAEvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE;QAC3D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,OAAO,+CAA+C,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,UAA4B;IACxE,MAAM,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,6BAA6B,CAAC,UAA4B;IACjE,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cli/projectConfig.d.ts

@@ -0,0 +1,12 @@
+import type { ProjscanConfig, ReportFormat } from '../types/config.js';
+interface LoadCliProjectConfigOptions {
+    rootPath: string;
+    configOption: unknown;
+    quiet: boolean;
+    format: ReportFormat;
+}
+export declare function loadCliProjectConfig(options: LoadCliProjectConfigOptions): Promise<ProjscanConfig>;
+export declare function explicitConfigPath(configOption: unknown): string | undefined;
+export declare function projectConfigSourceNotice(rootPath: string, source?: string | null): string | null;
+export declare function configErrorMessage(err: unknown): string;
+export {};

package/dist/cli/projectConfig.js

@@ -0,0 +1,41 @@
+import chalk from 'chalk';
+import path from 'node:path';
+import { enableOfflineMode } from '../core/privacy.js';
+import { loadConfig } from '../utils/config.js';
+export async function loadCliProjectConfig(options) {
+    const explicit = explicitConfigPath(options.configOption);
+    try {
+        const { config, source } = await loadConfig(options.rootPath, explicit);
+        applyProjectConfigRuntime(config);
+        const sourceNotice = projectConfigSourceNotice(options.rootPath, source);
+        if (sourceNotice && !options.quiet && options.format === 'console') {
+            console.error(chalk.dim(sourceNotice));
+        }
+        return config;
+    }
+    catch (err) {
+        console.error(chalk.red(configErrorMessage(err)));
+        process.exit(1);
+    }
+}
+export function explicitConfigPath(configOption) {
+    return typeof configOption === 'string' ? configOption : undefined;
+}
+export function projectConfigSourceNotice(rootPath, source) {
+    if (!source)
+        return null;
+    return `  [config: ${path.relative(rootPath, source) || source}]`;
+}
+export function configErrorMessage(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return `  Config error: ${message}`;
+}
+function applyProjectConfigRuntime(config) {
+    if (config.scan?.offline)
+        enableOfflineMode();
+    if (config.scan?.includeIgnored)
+        process.env.PROJSCAN_INCLUDE_IGNORED = '1';
+    if (config.scan?.scanEnvValues)
+        process.env.PROJSCAN_SCAN_ENV_VALUES = '1';
+}
+//# sourceMappingURL=projectConfig.js.map

package/dist/cli/projectConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.js","sourceRoot":"","sources":["../../src/cli/projectConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUhD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxE,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAqB;IACtD,OAAO,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,MAAsB;IAChF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,cAAc,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,mBAAmB,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAsB;IACvD,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO;QAAE,iBAAiB,EAAE,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,cAAc;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC;AAC7E,CAAC"}

package/dist/cli/treeSlice.d.ts

@@ -0,0 +1,3 @@
+import type { DirectoryNode } from '../types.js';
+/** Walk a DirectoryNode to find the node whose `path` matches targetPath. */
+export declare function sliceCliTree(node: DirectoryNode, targetPath: string): DirectoryNode | null;

package/dist/cli/treeSlice.js

@@ -0,0 +1,12 @@
+/** Walk a DirectoryNode to find the node whose `path` matches targetPath. */
+export function sliceCliTree(node, targetPath) {
+    if (node.path === targetPath)
+        return node;
+    for (const child of node.children) {
+        const hit = sliceCliTree(child, targetPath);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+//# sourceMappingURL=treeSlice.js.map

package/dist/cli/treeSlice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"treeSlice.js","sourceRoot":"","sources":["../../src/cli/treeSlice.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,UAAkB;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/ast.d.ts

@@ -1,76 +1,5 @@
-export type SymbolKind = 'function' | 'class' | 'variable' | 'type' | 'interface' | 'enum' | 'default' | 'unknown';
-export interface AstImport {
-    source: string;
-    kind: 'static' | 'dynamic' | 'require' | 'reexport';
-    specifiers: string[];
-    typeOnly: boolean;
-    line: number;
-}
-export interface AstExport {
-    name: string;
-    kind: SymbolKind;
-    typeOnly: boolean;
-    line: number;
-}
-/**
- * Per-function cyclomatic complexity entry. `name` is qualified with the
- * containing class for methods (`Class.method`), bare for top-level functions,
- * and `<anonymous>` for unnamed function expressions / arrows assigned to
- * non-trivially-named bindings.
- */
-export interface FunctionInfo {
-    name: string;
-    /** 1-based start line (function keyword / arrow). */
-    line: number;
-    /** 1-based end line. Equal to `line` for adapters that don't track end. */
-    endLine: number;
-    cyclomaticComplexity: number;
-    /**
-     * Approximate per-function fan-in (0.15.0+): count of OTHER files whose
-     * `callSites` includes this function's bare name. Populated post-parse in
-     * `buildCodeGraph`; absent right after `parse()` since it requires the
-     * full graph. Name-based: shared function names across files cannot be
-     * disambiguated and will be attributed to all definitions.
-     */
-    fanIn?: number;
-    /**
-     * Per-function call sites (1.2.0+): bare names of functions called from
-     * within this function's body. Nested functions / lambdas are NOT
-     * included (their calls fold into their own entries). Populated by each
-     * language adapter's per-function walker.
-     */
-    callSites?: string[];
-    /**
-     * Qualified member call sites for JavaScript/TypeScript functions, such as
-     * `request.json` or `db.query`. Bare `callSites` remains the stable
-     * cross-language field; this keeps receiver-sensitive checks precise.
-     */
-    memberCallSites?: string[];
-    /** Function parameter names when the adapter can recover them. */
-    parameters?: string[];
-    /** Bare identifier call sites, excluding member calls like cache.query(). */
-    directCallSites?: string[];
-    /** Local aliases for member functions, e.g. query=pool.query from const { query } = pool. */
-    memberAliases?: string[];
-    /** Qualified call expression this function was passed to, e.g. app.post for Express callbacks. */
-    contextualCallSite?: string;
-    /**
-     * Per-function fan-out (1.2.0+): count of distinct callee names from
-     * `callSites`, restricted to names that are defined as functions
-     * SOMEWHERE in the graph. External / library / unresolved calls do not
-     * count. Populated post-parse in `buildCodeGraph`.
-     */
-    fanOut?: number;
-    /**
-     * Per-function member-expression reads (1.6.0+): rightmost identifier
-     * of every `obj.prop` chain in the function body that is NOT in callee
-     * position. Used by taint analysis to detect property-shaped sources
-     * like `process.env.X` (captures `env` and `X`). Currently only the
-     * JavaScript/TypeScript adapter populates this; other adapters omit
-     * it and taint will only match call-shaped sources for those files.
-     */
-    references?: string[];
-}
+import type { AstExport, AstImport, FunctionInfo } from './astTypes.js';
+export type { AstExport, AstImport, FunctionInfo, SymbolKind } from './astTypes.js';
 export interface AstResult {
     ok: boolean;
     reason?: string;
@@ -87,12 +16,11 @@ export interface AstResult {
      */
     functions: FunctionInfo[];
 }
-/** Is this a file we should try to AST-parse at all? */
-export declare function isParseable(filePath: string): boolean;
+export { isParseable } from './astParser.js';
 /**
  * Parse a source file and extract imports, exports, and call sites.
  *
- * Uses @babel/parser with generous options so we accept real-world code:
+ * Uses the Babel parser helper with generous options so we accept real-world code:
  * TypeScript, JSX, decorators, top-level await, class properties, etc.
  *
  * Failures return ok:false with a reason - callers decide whether to fall