securevibe 0.1.0

package/dist/engine/readiness/checks.js

@@ -0,0 +1,99 @@
+// packages/cli/src/engine/readiness/checks.ts
+/**
+ * The two new launch-readiness checks. Both emit findings with category
+ * "readiness" so they are isolated from the score and the code-findings count.
+ * Pattern matching runs on comment-stripped text so a comment cannot trip it.
+ */
+import { createHash } from "node:crypto";
+const WEB_FRAMEWORKS = new Set([
+    "Next.js", "Express", "Fastify", "NestJS", "Hono", "Koa", "FastAPI", "Django", "Flask",
+]);
+const HEADER_NAMES = /Content-Security-Policy|Strict-Transport-Security|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy/i;
+const JS_EXT = new Set([".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mts", ".cts"]);
+export function isWebApp(inv) {
+    return inv.frameworks.some((f) => WEB_FRAMEWORKS.has(f));
+}
+/** True if a file references a real security response header (not a bare CORS header). */
+export function fileHasSecurityHeader(code) {
+    return HEADER_NAMES.test(code);
+}
+function rid(relPath, detector, line) {
+    return createHash("sha1").update(`${detector}:${relPath}:${line}`).digest("hex").slice(0, 12);
+}
+function stripComments(code) {
+    return code
+        .replace(/\/\*[\s\S]*?\*\//g, " ")
+        .replace(/\/\/[^\n]*/g, " ")
+        .replace(/#[^\n]*/g, " ");
+}
+const DEBUG_PY = /\bdebug\s*=\s*True\b/;
+const STACK_REF = /\b(?:err|error|e)\.stack\b/;
+const SEND_CALL = /\.(?:send|json|end|write)\s*\(/;
+export function checkDebugExposure(relPath, code) {
+    const dot = relPath.lastIndexOf(".");
+    const ext = dot >= 0 ? relPath.slice(dot) : "";
+    const isPy = ext === ".py";
+    const isJs = JS_EXT.has(ext);
+    if (!isPy && !isJs)
+        return [];
+    const out = [];
+    const lines = stripComments(code).split(/\r?\n/);
+    lines.forEach((ln, i) => {
+        let title = "";
+        let why = "";
+        let fix = "";
+        if (isPy && DEBUG_PY.test(ln)) {
+            title = "Debug mode enabled (stack traces exposed)";
+            why =
+                "Debug mode is enabled (debug=True). It exposes an interactive traceback and console to anyone who can trigger an error.";
+            fix = "Disable debug in production (debug=False / FLASK_DEBUG=0) and serve a generic error page.";
+        }
+        else if (isJs && STACK_REF.test(ln) && SEND_CALL.test(ln)) {
+            title = "Stack trace exposed in HTTP response";
+            why =
+                "A stack trace is written into an HTTP response. It leaks file paths, dependency versions, and internal logic to attackers.";
+            fix = "Never send a stack trace to the client. Log it server-side and return a generic error message.";
+        }
+        if (title) {
+            out.push({
+                id: rid(relPath, "debug-exposure", i + 1),
+                detector: "debug-exposure",
+                title,
+                category: "readiness",
+                severity: "high",
+                confidence: 0.8,
+                reachable: false,
+                cwe: "CWE-489",
+                owasp: "A05:2021 Security Misconfiguration",
+                file: relPath,
+                line: i + 1,
+                column: 1,
+                evidence: ln.trim().slice(0, 120),
+                why,
+                fix,
+            });
+        }
+    });
+    return out;
+}
+export function checkSecurityHeaders(anchorPath) {
+    return [
+        {
+            id: rid(anchorPath, "missing-security-headers", 1),
+            detector: "missing-security-headers",
+            title: "No security headers / Content-Security-Policy configured",
+            category: "readiness",
+            severity: "medium",
+            confidence: 0.7,
+            reachable: false,
+            cwe: "CWE-693",
+            owasp: "A05:2021 Security Misconfiguration",
+            file: anchorPath,
+            line: 1,
+            column: 1,
+            evidence: "no CSP / HSTS / X-Frame-Options / X-Content-Type-Options found",
+            why: "The app sets no security response headers, leaving it open to clickjacking, MIME sniffing, and protocol downgrade that a Content-Security-Policy and friends prevent.",
+            fix: "Add security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options): helmet for Express, a headers() block in next.config, or middleware for FastAPI/Django.",
+        },
+    ];
+}

package/dist/engine/readiness/scorecard.js

@@ -0,0 +1,59 @@
+const GATES = [
+    { id: "secrets", label: "Secrets managed", detectors: ["hardcoded-secret"], crit: "blocker" },
+    { id: "deps", label: "Dependencies current", detectors: ["vulnerable-dependency"], crit: "critical-only" },
+    { id: "injection", label: "Injection safe (SQLi/RCE)", detectors: ["sql-injection", "code-execution"], crit: "blocker" },
+    { id: "authz", label: "Access control", detectors: ["broken-access-control"], crit: "blocker" },
+    { id: "ai", label: "AI agent safety", detectors: ["ai-tool-hijack", "ai-missing-firewall", "ai-prompt-injection", "ai-overprivileged-tool"], crit: "high-blocks" },
+    { id: "transport", label: "Transport config (CORS/JWT)", detectors: ["cors-misconfig", "weak-jwt"], crit: "warning" },
+    { id: "headers", label: "Security headers / CSP", detectors: ["missing-security-headers"], crit: "blocker" },
+    { id: "debug", label: "Debug / stack traces", detectors: ["debug-exposure"], crit: "blocker" },
+];
+const NOT_ASSESSED = [
+    { id: "ratelimit", label: "Rate limiting" },
+    { id: "https", label: "HTTPS enforced" },
+];
+function worstOf(hits) {
+    if (hits.some((f) => f.severity === "critical"))
+        return "critical";
+    if (hits.some((f) => f.severity === "high"))
+        return "high";
+    return "medium";
+}
+function detailFor(id, hits) {
+    if (id === "headers")
+        return "no CSP / security headers configured";
+    const n = hits.length;
+    return `${n} ${n === 1 ? "issue" : "issues"} (${worstOf(hits)})`;
+}
+export function evaluateLaunchReadiness(findings, _inventory) {
+    const gates = [];
+    let blockers = 0;
+    let warnings = 0;
+    for (const spec of GATES) {
+        const hits = findings.filter((f) => spec.detectors.includes(f.detector));
+        if (hits.length === 0) {
+            gates.push({ id: spec.id, label: spec.label, status: "pass", detail: "", findingIds: [] });
+            continue;
+        }
+        const worst = worstOf(hits);
+        let status;
+        if (spec.crit === "blocker")
+            status = "blocker";
+        else if (spec.crit === "warning")
+            status = "warning";
+        else if (spec.crit === "critical-only")
+            status = worst === "critical" ? "blocker" : "warning";
+        else
+            status = worst === "critical" || worst === "high" ? "blocker" : "warning"; // high-blocks
+        if (status === "blocker")
+            blockers++;
+        else
+            warnings++;
+        gates.push({ id: spec.id, label: spec.label, status, detail: detailFor(spec.id, hits), findingIds: hits.map((f) => f.id) });
+    }
+    for (const na of NOT_ASSESSED) {
+        gates.push({ id: na.id, label: na.label, status: "not-assessed", detail: "not checked yet", findingIds: [] });
+    }
+    const verdict = blockers > 0 ? "not-ready" : warnings > 0 ? "warnings" : "ready";
+    return { verdict, blockers, warnings, gates };
+}

package/dist/engine/scan.js

@@ -0,0 +1,269 @@
+/**
+ * Repository scan orchestrator (docs 01/02). Walks the tree, fingerprints the
+ * stack, parses supported files, runs classic + AI detectors with taint, then
+ * scores. Stateless and local-first — no upload required.
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { SEVERITY_ORDER } from "./types.js";
+import { parse, langForExtension } from "./parser.js";
+import { analyzeTaint } from "./taint.js";
+import { classicDetectors } from "./detectors/classic.js";
+import { aiDetectors } from "./detectors/aisecurity.js";
+import { detectSecrets } from "./detectors/secrets.js";
+import { computeScore } from "./score.js";
+import { detectDependencies, buildDependencyReport } from "./deps/detect.js";
+import { loadDepDb } from "./deps/db.js";
+import { checkDebugExposure, checkSecurityHeaders, fileHasSecurityHeader, isWebApp } from "./readiness/checks.js";
+import { evaluateLaunchReadiness } from "./readiness/scorecard.js";
+const IGNORE_DIRS = new Set([
+    "node_modules", ".git", "dist", "build", ".next", ".turbo", ".cache",
+    "coverage", "vendor", ".venv", "venv", "__pycache__", ".idea", ".vscode",
+    "out", ".pnpm", "tmp", ".securevibe-backup",
+]);
+const MAX_FILE_BYTES = 1_500_000;
+const TEXT_EXT_FOR_SECRETS = new Set([
+    ".env", ".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mts", ".cts", ".py",
+    ".json", ".yaml", ".yml", ".toml", ".txt", ".sh", ".pem", ".config",
+]);
+/** Is this file eligible for text-level secret detection? */
+function secretEligible(relPath) {
+    const ext = path.extname(relPath);
+    const key = ext === "" ? path.basename(relPath) : ext;
+    return TEXT_EXT_FOR_SECRETS.has(key) || /\.env/.test(relPath);
+}
+/**
+ * Run the full detector pipeline on a single file's content (in memory). This
+ * is the shared core of `scan` and is reused by the fix loop's verification
+ * step, so "re-scan after a fix" runs exactly the same detectors as the scan.
+ */
+export async function detectFile(relPath, code, options = {}) {
+    const findings = [];
+    if (!options.aiOnly && secretEligible(relPath)) {
+        findings.push(...detectSecrets(relPath, code));
+    }
+    if (!options.aiOnly && options.depDb) {
+        findings.push(...detectDependencies(relPath, code, options.depDb));
+    }
+    const lang = langForExtension(path.extname(relPath));
+    if (!lang)
+        return findings;
+    let rootNode;
+    try {
+        ({ root: rootNode } = await parse(code, lang));
+    }
+    catch {
+        return findings; // tree-sitter is error-tolerant; skip the rare hard failure
+    }
+    const file = { absPath: relPath, relPath, lang, code };
+    const taint = analyzeTaint(rootNode);
+    const ctx = { file, root: rootNode, taint };
+    const detectors = options.aiOnly ? aiDetectors : [...classicDetectors, ...aiDetectors];
+    for (const detect of detectors) {
+        try {
+            findings.push(...detect(ctx));
+        }
+        catch {
+            // a single detector failing must never abort the scan
+        }
+    }
+    return findings;
+}
+export async function scan(root, options = {}) {
+    const start = Date.now();
+    const progress = options.onProgress ?? (() => { });
+    const absRoot = path.resolve(root);
+    // Fail loudly on a bad path — silently scoring an empty/missing dir as "A"
+    // would mask typos in CI.
+    try {
+        const st = await fs.stat(absRoot);
+        if (!st.isDirectory())
+            throw new Error(`not a directory: ${absRoot}`);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            throw new Error(`path not found: ${absRoot}`);
+        throw err;
+    }
+    progress(options.files ? "Analyzing staged files…" : "Walking repository…");
+    const files = options.files ?? (await collectFiles(absRoot));
+    progress("Fingerprinting architecture…");
+    const inventory = await detectInventory(absRoot, files);
+    // Dependency (SCA) scanning runs on full scans only — not on --staged (so the
+    // commit guard never walls off pre-existing dependency debt) and not ai-audit.
+    const depDb = !options.aiOnly && !options.files ? await loadDepDb() : null;
+    const findings = [];
+    let parsedCount = 0;
+    const fullScan = !options.aiOnly && !options.files;
+    const readinessFindings = [];
+    let headersSeen = false;
+    let headerAnchor;
+    progress(`Analyzing ${files.length} files…`);
+    for (const abs of files) {
+        const rel = path.relative(absRoot, abs).split(path.sep).join("/");
+        let code;
+        try {
+            const stat = await fs.stat(abs);
+            if (stat.size > MAX_FILE_BYTES)
+                continue;
+            code = await fs.readFile(abs, "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (langForExtension(path.extname(abs)))
+            parsedCount++;
+        findings.push(...(await detectFile(rel, code, { aiOnly: options.aiOnly, depDb })));
+        if (fullScan) {
+            readinessFindings.push(...checkDebugExposure(rel, code));
+            if (!headersSeen && fileHasSecurityHeader(code))
+                headersSeen = true;
+            if (!headerAnchor && /(?:^|\/)(next\.config\.(?:js|mjs|ts)|package\.json)$/.test(rel))
+                headerAnchor = rel;
+        }
+    }
+    progress("Scoring…");
+    if (fullScan && isWebApp(inventory) && !(headersSeen || inventory.dependencies.includes("helmet"))) {
+        readinessFindings.push(...checkSecurityHeaders(headerAnchor ?? "package.json"));
+    }
+    findings.push(...readinessFindings);
+    const deduped = dedupe(findings);
+    const sorted = prioritize(deduped);
+    const score = computeScore(sorted);
+    const dependencies = depDb ? buildDependencyReport(sorted, depDb.date) : undefined;
+    const launchReadiness = fullScan ? evaluateLaunchReadiness(sorted, inventory) : undefined;
+    return {
+        root: absRoot,
+        filesScanned: parsedCount,
+        inventory,
+        findings: sorted,
+        score,
+        durationMs: Date.now() - start,
+        dependencies,
+        launchReadiness,
+    };
+}
+async function collectFiles(root) {
+    const out = [];
+    async function recur(dir) {
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (IGNORE_DIRS.has(entry.name))
+                    continue;
+                await recur(path.join(dir, entry.name));
+            }
+            else if (entry.isFile()) {
+                out.push(path.join(dir, entry.name));
+            }
+        }
+    }
+    await recur(root);
+    return out;
+}
+async function readJsonSafe(file) {
+    try {
+        return JSON.parse(await fs.readFile(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const FRAMEWORK_DEPS = {
+    next: "Next.js", react: "React", express: "Express", hono: "Hono",
+    "@nestjs/core": "NestJS", fastify: "Fastify", svelte: "Svelte", vue: "Vue",
+};
+const AI_DEPS = {
+    openai: "OpenAI SDK", "@anthropic-ai/sdk": "Anthropic SDK", anthropic: "Anthropic SDK",
+    langchain: "LangChain", "@langchain/core": "LangChain", "@langchain/openai": "LangChain",
+    langgraph: "LangGraph", ai: "Vercel AI SDK", "cohere-ai": "Cohere",
+    "@modelcontextprotocol/sdk": "MCP", llamaindex: "LlamaIndex", crewai: "CrewAI",
+};
+async function detectInventory(root, files) {
+    const languages = new Set();
+    const frameworks = new Set();
+    const aiIntegrations = new Set();
+    const deployTargets = new Set();
+    const dependencies = new Set();
+    for (const abs of files) {
+        const ext = path.extname(abs);
+        const lang = langForExtension(ext);
+        if (lang)
+            languages.add(lang);
+        const base = path.basename(abs).toLowerCase();
+        if (base === "dockerfile")
+            deployTargets.add("Docker");
+        if (base === "vercel.json")
+            deployTargets.add("Vercel");
+        if (base === "wrangler.toml")
+            deployTargets.add("Cloudflare Workers");
+        if (/\.ya?ml$/.test(base) && /k8s|deployment|kustom/.test(abs.toLowerCase()))
+            deployTargets.add("Kubernetes");
+        if (/next\.config\.(js|mjs|ts)/.test(base))
+            frameworks.add("Next.js");
+    }
+    const pkg = await readJsonSafe(path.join(root, "package.json"));
+    if (pkg) {
+        const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+        for (const dep of Object.keys(deps)) {
+            dependencies.add(dep);
+            if (FRAMEWORK_DEPS[dep])
+                frameworks.add(FRAMEWORK_DEPS[dep]);
+            if (AI_DEPS[dep])
+                aiIntegrations.add(AI_DEPS[dep]);
+        }
+    }
+    // Python framework hints
+    for (const fname of ["requirements.txt", "pyproject.toml"]) {
+        try {
+            const txt = (await fs.readFile(path.join(root, fname), "utf8")).toLowerCase();
+            if (txt.includes("fastapi"))
+                frameworks.add("FastAPI");
+            if (txt.includes("django"))
+                frameworks.add("Django");
+            if (txt.includes("flask"))
+                frameworks.add("Flask");
+            if (txt.includes("openai"))
+                aiIntegrations.add("OpenAI SDK");
+            if (txt.includes("anthropic"))
+                aiIntegrations.add("Anthropic SDK");
+            if (txt.includes("langchain"))
+                aiIntegrations.add("LangChain");
+        }
+        catch {
+            /* not a python project */
+        }
+    }
+    return {
+        languages: [...languages],
+        frameworks: [...frameworks],
+        aiIntegrations: [...aiIntegrations],
+        deployTargets: [...deployTargets],
+        dependencies: [...dependencies],
+    };
+}
+function dedupe(findings) {
+    const byId = new Map();
+    for (const f of findings) {
+        const existing = byId.get(f.id);
+        if (!existing || f.confidence > existing.confidence)
+            byId.set(f.id, f);
+    }
+    return [...byId.values()];
+}
+function prioritize(findings) {
+    return findings.sort((a, b) => {
+        const sev = SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity];
+        if (sev !== 0)
+            return sev;
+        if (a.reachable !== b.reachable)
+            return a.reachable ? -1 : 1;
+        return b.confidence - a.confidence;
+    });
+}

package/dist/engine/score.js

@@ -0,0 +1,66 @@
+const SEVERITY_WEIGHT = {
+    critical: 40,
+    high: 18,
+    medium: 7,
+    low: 2,
+    info: 0,
+};
+function penalty(f) {
+    const base = SEVERITY_WEIGHT[f.severity];
+    const reach = f.reachable ? 1 : 0.4; // unreachable issues hurt less
+    return base * reach * f.confidence;
+}
+function subScore(findings) {
+    const total = findings.reduce((acc, f) => acc + penalty(f), 0);
+    return clamp(Math.round(100 - total), 0, 100);
+}
+function clamp(n, lo, hi) {
+    return Math.max(lo, Math.min(hi, n));
+}
+function gradeFor(n) {
+    if (n >= 90)
+        return "A";
+    if (n >= 80)
+        return "B";
+    if (n >= 70)
+        return "C";
+    if (n >= 55)
+        return "D";
+    if (n >= 40)
+        return "E";
+    return "F";
+}
+export function computeScore(findings) {
+    const ai = findings.filter((f) => f.category === "ai");
+    const secrets = findings.filter((f) => f.detector === "hardcoded-secret");
+    const deployment = findings.filter((f) => ["cors-misconfig", "weak-jwt"].includes(f.detector));
+    const app = findings.filter((f) => f.category === "classic" && !secrets.includes(f) && !deployment.includes(f));
+    const subScores = {
+        appSecurity: subScore(app),
+        aiSecurity: subScore(ai),
+        dependencies: subScore(secrets),
+        deployment: subScore(deployment),
+    };
+    // Weighted composite — app + AI carry the most signal for vibe-coded apps.
+    const composite = clamp(Math.round(subScores.appSecurity * 0.4 +
+        subScores.aiSecurity * 0.3 +
+        subScores.dependencies * 0.15 +
+        subScores.deployment * 0.15), 0, 100);
+    const readiness = computeReadiness(findings, composite);
+    return { composite, grade: gradeFor(composite), subScores, readiness };
+}
+function computeReadiness(allFindings, composite) {
+    // The launch-readiness checks (category "readiness") are a separate lens; they
+    // must never move the core ship/warn/block verdict.
+    const findings = allFindings.filter((f) => f.category !== "readiness");
+    const reachableCritical = findings.some((f) => f.severity === "critical" && f.reachable);
+    const liveSecret = findings.some((f) => f.detector === "hardcoded-secret" && (f.severity === "critical" || f.severity === "high"));
+    const aiToolNoFirewall = findings.some((f) => f.detector === "ai-tool-hijack" || f.detector === "ai-missing-firewall");
+    // A known-critical CVE in a dependency blocks even though it is not taint-reachable.
+    const criticalDependency = findings.some((f) => f.detector === "vulnerable-dependency" && f.severity === "critical");
+    if (reachableCritical || liveSecret || aiToolNoFirewall || criticalDependency)
+        return "block";
+    if (composite < 80 || findings.some((f) => f.severity === "high"))
+        return "warn";
+    return "ship";
+}

package/dist/engine/taint.js

@@ -0,0 +1,123 @@
+import { walk } from "./ast.js";
+/** Untrusted-input sources. Matching text is considered tainted at its origin. */
+const SOURCE_RE = /\b(req|request)\.(query|body|params|headers|cookies)\b|\bsearchParams\.get\b|\bnextUrl\.searchParams\b|\bparams\.[a-zA-Z_$]|\breq(uest)?\.json\(\)|\bawait\s+\w+\.json\(\)|\bprocess\.argv\b|\bflask\.request\.|\brequest\.args\b|\brequest\.form\b|\brequest\.json\b/;
+function collectAssignments(root) {
+    const out = [];
+    walk(root, (n) => {
+        // JS: const x = expr  /  let x = expr
+        if (n.type === "variable_declarator") {
+            const name = n.childForFieldName("name");
+            const value = n.childForFieldName("value");
+            if (name && value)
+                out.push({ name: name.text, valueText: value.text });
+        }
+        // JS: x = expr
+        if (n.type === "assignment_expression") {
+            const left = n.childForFieldName("left");
+            const right = n.childForFieldName("right");
+            if (left && right)
+                out.push({ name: left.text, valueText: right.text });
+        }
+        // Python: x = expr
+        if (n.type === "assignment") {
+            const left = n.childForFieldName("left");
+            const right = n.childForFieldName("right");
+            if (left && right)
+                out.push({ name: left.text, valueText: right.text });
+        }
+    });
+    return out;
+}
+function referencesTainted(text, tainted) {
+    if (SOURCE_RE.test(text))
+        return true;
+    for (const v of tainted) {
+        // word-boundary match so `id` doesn't match `idx`
+        const re = new RegExp(`\\b${escapeRe(v)}\\b`);
+        if (re.test(text))
+            return true;
+    }
+    return false;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const ROUTE_DECORATOR_RE = /@[\w.]*\.(get|post|put|patch|delete|route|websocket|head|options)\b/;
+/**
+ * Seed taint from route-handler parameters. In FastAPI/Flask, path and query
+ * parameters arrive as plain function arguments (e.g. `def order(id: str)`),
+ * so they're untrusted input even though no `req.`/`params.` appears.
+ */
+function seedRouteParamTaint(root, tainted) {
+    walk(root, (n) => {
+        if (n.type !== "decorated_definition")
+            return;
+        let isRoute = false;
+        let fn = null;
+        for (let i = 0; i < n.namedChildCount; i++) {
+            const c = n.namedChild(i);
+            if (!c)
+                continue;
+            if (c.type === "decorator" && ROUTE_DECORATOR_RE.test(c.text))
+                isRoute = true;
+            if (c.type === "function_definition")
+                fn = c;
+        }
+        if (!isRoute || !fn)
+            return;
+        const params = fn.childForFieldName("parameters");
+        if (!params)
+            return;
+        for (let i = 0; i < params.namedChildCount; i++) {
+            const p = params.namedChild(i);
+            if (!p)
+                continue;
+            const name = paramName(p);
+            if (name && name !== "self")
+                tainted.add(name);
+        }
+    });
+}
+function paramName(p) {
+    if (p.type === "identifier")
+        return p.text;
+    const named = p.childForFieldName("name");
+    if (named)
+        return named.text;
+    for (let i = 0; i < p.namedChildCount; i++) {
+        const c = p.namedChild(i);
+        if (c && c.type === "identifier")
+            return c.text;
+    }
+    return null;
+}
+/** Build the taint state for a parsed file. */
+export function analyzeTaint(root) {
+    const assignments = collectAssignments(root);
+    const tainted = new Set();
+    seedRouteParamTaint(root, tainted);
+    // Fixpoint: keep propagating until no new variable becomes tainted.
+    let changed = true;
+    let guard = 0;
+    while (changed && guard++ < 50) {
+        changed = false;
+        for (const { name, valueText } of assignments) {
+            if (tainted.has(name))
+                continue;
+            if (referencesTainted(valueText, tainted)) {
+                tainted.add(name);
+                changed = true;
+            }
+        }
+    }
+    return { tainted };
+}
+/** Does the given expression text carry untrusted data under this taint state? */
+export function isTainted(text, state) {
+    return referencesTainted(text, state.tainted);
+}
+/** Heuristic: does the expression build a string from untrusted data (concat / template / f-string)? */
+export function isUntrustedStringBuild(text, state) {
+    const hasInterpolation = /\$\{[^}]*\}/.test(text) || /["'][^"']*["']\s*\+/.test(text) || /\bf["'][^"']*\{/.test(text);
+    return hasInterpolation && isTainted(text, state);
+}

package/dist/engine/types.js

@@ -0,0 +1,8 @@
+/** Core types shared across the SecureVibe analysis engine. */
+export const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0,
+};