thuban 0.4.8 → 0.4.9

package/dist/README.md

@@ -1,437 +0,0 @@
-# Thuban -- Code Intelligence Scanner
-
-[![npm version](https://img.shields.io/npm/v/thuban.svg)](https://www.npmjs.com/package/thuban)
-[![license](https://img.shields.io/npm/l/thuban.svg)](LICENSE)
-[![tests](https://img.shields.io/badge/tests-746%20passing-brightgreen.svg)](#testing)
-[![coverage](https://img.shields.io/badge/coverage-91.2%25-brightgreen.svg)](#testing)
-
-AI Code Verification — Catch what AI gets wrong.
-
-Static analysis, security scanning, dead code detection, clone detection, AI-generated code scoring, dependency analysis, and mutation testing for 12 languages. One command. Zero runtime dependencies beyond `@babel/parser`.
-
----
-
-## Quick Start
-
-```bash
-npm install -g thuban
-thuban scan .
-```
-
-Or run without installing:
-
-```bash
-npx thuban scan .
-```
-
-JSON output for CI pipelines:
-
-```bash
-thuban scan . --json
-```
-
----
-
-## Feature Highlights
-
-### Security Analysis
-
-84 detection rules across multiple categories. Cross-file taint tracking follows user input from sources (`req.query`, `req.body`, `req.params`, `process.argv`, `process.env`) through assignment, concatenation, and template interpolation to dangerous SQL and XSS sinks -- across file boundaries via `require()`, `import`, destructured imports, and re-exports.
-
-```bash
-thuban scan src/ --json
-```
-
-### OWASP Top 10 & CWE Compliance
-
-All security rules (SEC001--SEC019, RUST001--RUST002) map to [OWASP Top 10 2021](https://owasp.org/Top10/) categories and [CWE](https://cwe.mitre.org/) identifiers. Every finding includes machine-readable `owasp` and `cwe` fields in JSON output, enabling direct integration with compliance dashboards and vulnerability management systems.
-
-| OWASP 2021 Category                    | Rules                                  | CWEs                              |
-|-----------------------------------------|----------------------------------------|-----------------------------------|
-| A01 Broken Access Control               | SEC005, SEC013, SEC014                 | CWE-22, CWE-942, CWE-601         |
-| A02 Cryptographic Failures              | SEC006, SEC007, SEC008, SEC016         | CWE-798, CWE-327, CWE-330, CWE-208 |
-| A03 Injection                           | SEC001, SEC002, SEC003, SEC004, SEC009, SEC011, SEC018, SEC019 | CWE-95, CWE-79, CWE-89, CWE-78, CWE-1321 |
-| A04 Insecure Design                     | SEC015                                 | CWE-209                          |
-| A05 Security Misconfiguration           | SEC017                                 | CWE-611                          |
-| A06 Vulnerable Components               | RUST001, RUST002                       | CWE-908, CWE-477                 |
-| A08 Software and Data Integrity         | SEC012                                 | CWE-502                          |
-| A10 SSRF                                | SEC010                                 | CWE-918                          |
-
-### Control Flow Graph Analysis
-
-Detects unreachable code, infinite loops, and dead branches through AST-based control flow graph construction.
-
-### Clone Detection
-
-Multi-language code clone detection with AST normalization. Finds duplicated logic across your codebase.
-
-```bash
-thuban clones src/
-```
-
-### AI-Generated Code Scoring
-
-Scores files for likelihood of AI generation based on structural patterns, naming conventions, and code smells common in LLM output.
-
-```bash
-thuban aiscore src/
-```
-
-### Dependency Analysis
-
-Maps dependency graphs, detects circular imports, and identifies unused or phantom dependencies.
-
-```bash
-thuban deps .
-```
-
-### Mutation Testing (Crucible)
-
-Built-in mutation testing engine. 515 seed files generate 1,030 mutations. Validates that your test suite catches real bugs.
-
-```bash
-thuban crucible --mode kenny    # standard mode
-thuban crucible --mode hell     # maximum mutation density
-```
-
-### Ghost Code Detection
-
-Finds dead exports, unused functions, and unreachable modules.
-
-```bash
-thuban ghosts src/
-```
-
-### Auto-Fix
-
-Automatically applies safe fixes for supported rule violations.
-
-```bash
-thuban fix src/
-```
-
-### HTML Dashboard
-
-Generates a visual HTML report with charts, trends, and drill-down by category.
-
-```bash
-thuban dashboard .
-```
-
-### Executive Reports
-
-PDF-ready executive summary with risk scores, trend data, and remediation priorities.
-
-```bash
-thuban executive .
-thuban pdf .
-```
-
-### Baseline Scanning
-
-Establish a baseline and track only new issues introduced after that point.
-
-```bash
-thuban baseline .          # save current state
-thuban scan . --baseline   # report only new issues
-thuban compare .           # compare current scan to baseline
-```
-
-### Pre-Commit Gate
-
-Block commits that introduce issues above a configurable threshold.
-
-```bash
-thuban gate .
-```
-
-### Inline Suppression
-
-Suppress specific rules on a per-line basis:
-
-```javascript
-const query = "SELECT * FROM " + input; // thuban-ignore SEC001
-```
-
-```python
-password = "admin123"  # thuban-ignore SEC005
-```
-
-Suppress all rules on a line:
-
-```javascript
-eval(code); // thuban-ignore
-```
-
----
-
-## Supported Languages
-
-| Language   | Extension(s)         | AST Engine     |
-|------------|----------------------|----------------|
-| JavaScript | `.js`, `.mjs`, `.cjs`| Babel          |
-| TypeScript | `.ts`                | Babel          |
-| JSX        | `.jsx`               | Babel          |
-| TSX        | `.tsx`               | Babel          |
-| Python     | `.py`                | Python `ast`   |
-| Go         | `.go`                | `go/parser`    |
-| Rust       | `.rs`                | Pattern-based  |
-| Ruby       | `.rb`                | Pattern-based  |
-| Java       | `.java`              | Pattern-based  |
-| C#         | `.cs`                | Pattern-based  |
-| Kotlin     | `.kt`                | Pattern-based  |
-| PHP        | `.php`               | Pattern-based  |
-
-Three AST engines provide deep analysis: Babel for JavaScript/TypeScript/JSX/TSX, Python `ast` for Python, and Go `go/parser` for Go. Remaining languages use pattern-based detection.
-
----
-
-## Detection Rules
-
-84 rules organized by category:
-
-| Category    | Rule IDs              | Description                                      |
-|-------------|-----------------------|--------------------------------------------------|
-| Security    | SEC001--SEC019        | SQL injection, XSS, hardcoded secrets, eval, command injection, path traversal, insecure crypto, SSRF, prototype pollution, and more |
-| Security    | RUST001--RUST002      | Rust-specific unsafe patterns                    |
-| Quality     | QUAL001--QUAL004      | Code quality, naming, structure                  |
-| Performance | PERF001               | Performance anti-patterns                        |
-| AST         | AST001--AST005        | Phantom imports, deprecated APIs, unused variables, hallucinated APIs, empty catch blocks |
-| AST         | AST011--AST014        | Advanced AST patterns                            |
-| Taint       | TAINT001--TAINT002    | Cross-file taint tracking for SQLi and XSS       |
-| CFG         | CFG001--CFG005        | Unreachable code, infinite loops, dead branches  |
-| Nesting     | NEST001               | Excessive nesting depth                          |
-| Complexity  | CMPLX001--CMPLX002   | Cyclomatic and cognitive complexity              |
-
----
-
-## CLI Commands
-
-28 commands grouped by function:
-
-### Core Scanning
-
-| Command       | Description                                      |
-|---------------|--------------------------------------------------|
-| `scan [path]` | Scan a codebase for issues                       |
-| `diff [path]` | Scan only git-changed files                      |
-| `deps [path]` | Map dependencies and detect circular imports     |
-| `health [path]`| Run health check on codebase                    |
-| `report [path]`| Full scan + deps + drift combined report        |
-
-### Detection
-
-| Command              | Description                                |
-|----------------------|--------------------------------------------|
-| `hallucinate [path]` | Detect AI hallucinations and phantom imports|
-| `ghosts [path]`      | Detect dead code and unused exports        |
-| `aiscore [path]`     | Score files for AI-generated code patterns |
-| `clones [path]`      | Detect code clones across the codebase     |
-| `drift [path]`       | Detect drift from Mother Code annotations  |
-| `debt [path]`        | Analyze technical debt                     |
-| `cost [path]`        | Calculate technical debt cost              |
-
-### Remediation
-
-| Command       | Description                                      |
-|---------------|--------------------------------------------------|
-| `fix [path]`  | Auto-fix supported rule violations               |
-| `inject [path]`| Inject Mother Code DNA widget into files        |
-| `gate [path]` | Pre-commit quality gate                          |
-
-### Reporting
-
-| Command            | Description                                   |
-|--------------------|-----------------------------------------------|
-| `dashboard [path]` | Generate visual HTML dashboard                |
-| `executive [path]` | Generate executive summary report             |
-| `pdf [path]`       | Generate PDF-ready report                     |
-| `passport [path]`  | Generate codebase passport                    |
-
-### Monitoring
-
-| Command          | Description                                     |
-|------------------|-------------------------------------------------|
-| `watch [path]`   | Live sentinel -- continuous file monitoring     |
-| `monitor [path]` | Recurring scans with history and alerts         |
-| `history [path]` | View recurring scan history                     |
-| `trend [path]`   | Show issue trends across scans                  |
-
-### Baseline and Comparison
-
-| Command          | Description                                     |
-|------------------|-------------------------------------------------|
-| `baseline [path]`| Save current scan state as baseline             |
-| `compare [path]` | Compare current scan against baseline           |
-
-### Licensing
-
-| Command    | Description                                          |
-|------------|------------------------------------------------------|
-| `activate` | Activate a license key                               |
-| `status`   | Show current license status                          |
-| `upgrade`  | Upgrade license tier                                 |
-
-### Mutation Testing
-
-| Command    | Description                                          |
-|------------|------------------------------------------------------|
-| `crucible` | Run the Crucible mutation testing engine             |
-
----
-
-## Configuration
-
-### `.thubanrc.json`
-
-Place a `.thubanrc.json` in your project root to configure scan behavior:
-
-```json
-{
-  "$schema": "https://thuban.dev/schema/thubanrc.json",
-  "minScore": 0,
-  "ignore": [
-    "node_modules",
-    "dist",
-    ".git",
-    "coverage"
-  ],
-  "hallucination": {
-    "enabled": true,
-    "ignore": []
-  },
-  "motherCode": {
-    "enabled": true,
-    "autoInject": false
-  },
-  "report": {
-    "format": "html",
-    "outputDir": "."
-  },
-  "ci": {
-    "failOnGrade": "F",
-    "postComment": true
-  }
-}
-```
-
-### `.thubanignore`
-
-Exclude files and directories from scanning, one glob pattern per line:
-
-```
-packages/crucible/seeds/**
-tests/regression/fixtures/**
-vendor/**
-```
-
----
-
-## JSON Output
-
-All scan commands support `--json` for machine-readable output:
-
-```bash
-thuban scan src/ --json
-```
-
-```json
-{
-  "version": "0.4.5",
-  "timestamp": "2026-07-04T12:00:00.000Z",
-  "files": 42,
-  "issues": [
-    {
-      "file": "src/api/handler.js",
-      "line": 17,
-      "rule": "SEC001",
-      "severity": "critical",
-      "category": "security",
-      "message": "Potential SQL injection: unsanitized input in query string",
-      "fix": "Use parameterized queries instead of string concatenation"
-    }
-  ],
-  "summary": {
-    "critical": 1,
-    "warning": 3,
-    "info": 5,
-    "score": 72,
-    "grade": "C"
-  }
-}
-```
-
----
-
-## Performance
-
-| Metric         | Value              |
-|----------------|--------------------|
-| Throughput     | ~23,000 lines/sec  |
-| Test suite     | 746 tests          |
-| Code coverage  | 91.2%              |
-| Dependencies   | 1 (`@babel/parser`) |
-
----
-
-## Tiers
-
-| Tier       | Limit     | Features                                          |
-|------------|-----------|---------------------------------------------------|
-| Free       | 100 files | Core scanning, all 84 rules, JSON output          |
-| Pro        | Unlimited | Recurring scans, history, trends, notifications   |
-| Team       | Unlimited | Dashboard, executive reports, baseline management |
-| Enterprise | Unlimited | Custom rules, priority support, SSO               |
-
-Activate a license:
-
-```bash
-thuban activate <license-key>
-thuban status
-```
-
----
-
-## CI Integration
-
-### GitHub Actions
-
-```yaml
-- name: Thuban Scan
-  run: npx thuban scan . --json --baseline
-  env:
-    THUBAN_LICENSE: ${{ secrets.THUBAN_LICENSE }}
-```
-
-### Pre-Commit Hook
-
-```bash
-thuban gate . --fail-on critical
-```
-
----
-
-## Requirements
-
-- Node.js >= 16.0.0
-
----
-
-## Contributing
-
-1. Fork the repository
-2. Create a feature branch (`git checkout -b feature/my-feature`)
-3. Run the test suite (`npm test`)
-4. Submit a pull request
-
-Issues and feature requests: [github.com/SilverwingsBenefitsGit/thuban/issues](https://github.com/SilverwingsBenefitsGit/thuban/issues)
-
----
-
-## License
-
-[MIT](LICENSE)
-
----
-
-[thuban.dev](https://thuban.dev)

package/dist/package.json

@@ -1,65 +0,0 @@
-{
-  "name": "thuban",
-  "version": "0.4.8",
-  "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Minimal dependencies.",
-  "bin": {
-    "thuban": "dist/cli.js"
-  },
-  "scripts": {
-    "scan": "node cli.js scan",
-    "test": "node build.js && node --test tests/build-integrity.test.js tests/crlf-safety.test.js tests/windows-paths.test.js tests/npm-publish-smoke.test.js",
-    "test:all": "node --test tests/*.test.js packages/scanner/*.test.js packages/crucible/*.test.js",
-    "test:build": "node build.js && node --test tests/build-integrity.test.js tests/npm-publish-smoke.test.js",
-    "build": "node build.js",
-    "prepublishOnly": "npm run build && node --test tests/build-integrity.test.js tests/npm-publish-smoke.test.js"
-  },
-  "keywords": [
-    "code-quality",
-    "static-analysis",
-    "ai-hallucination",
-    "hallucination-detection",
-    "ghost-code",
-    "tech-debt",
-    "ai-code-review",
-    "code-health",
-    "pre-commit",
-    "copilot",
-    "cursor",
-    "ai-safety",
-    "developer-tools",
-    "devtools",
-    "linter",
-    "code-scanner"
-  ],
-  "author": "Silverwings Benefits <hello@thuban.dev>",
-  "license": "SEE LICENSE IN LICENSE",
-  "homepage": "https://thuban.dev",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/SilverwingsBenefitsGit/thuban.git"
-  },
-  "bugs": {
-    "url": "https://github.com/SilverwingsBenefitsGit/thuban/issues"
-  },
-  "engines": {
-    "node": ">=16.0.0"
-  },
-  "files": [
-    "dist/cli.js",
-    "dist/packages/scanner/*.js",
-    "dist/packages/scanner/python_ast_helper.py",
-    "dist/packages/crucible/*.js",
-    "dist/packages/crucible/seeds/**",
-    "dist/packages/crucible/.golden/",
-    "dist/packages/crucible/rules/**",
-    "dist/README.md",
-    "dist/LICENSE",
-    "dist/package.json"
-  ],
-  "dependencies": {
-    "@babel/parser": "^7.29.7"
-  },
-  "devDependencies": {
-    "terser": "^5.48.0"
-  }
-}

package/dist/packages/scanner/go-ast-analyzer.js

@@ -1 +0,0 @@
-"use strict";const{execFileSync:execFileSync}=require("child_process"),path=require("path"),HELPER_SCRIPT=path.join(__dirname,"go_ast_helper.go"),PROBE_TIMEOUT_MS=3e3,EXEC_TIMEOUT_MS=8e3,MAX_BUFFER=2097152;let cachedGoBin;function resolveGoBin(){if(void 0!==cachedGoBin)return cachedGoBin;try{execFileSync("go",["version"],{stdio:"pipe",timeout:3e3}),cachedGoBin="go"}catch(e){cachedGoBin=null}return cachedGoBin}function _resetGoBinCache(){cachedGoBin=void 0}function snippet(e,n){return!n||n<1||n>e.length?"":e[n-1].trim().substring(0,100)}const RULES_BY_TYPE={unused_import:{id:"AST031",severity:"info",category:"quality",name:"Unused Import (Go AST)"},unused_variable:{id:"AST032",severity:"info",category:"quality",name:"Ineffectual Assignment (Go AST)"},high_complexity:{id:"AST033",severity:"warning",category:"quality",name:"High Cyclomatic Complexity (Go AST)"},dead_code:{id:"AST034",severity:"warning",category:"quality",name:"Unreachable Code (Go AST)"},unchecked_error:{id:"AST035",severity:"warning",category:"security",name:"Unchecked Error (Go AST)"},goroutine_leak:{id:"AST036",severity:"warning",category:"quality",name:"Goroutine Leak (Go AST)"},defer_in_loop:{id:"AST037",severity:"warning",category:"quality",name:"Defer Inside Loop (Go AST)"}};function toIssue(e,n,i){const t=RULES_BY_TYPE[i.type];return t?{file:e,line:i.line||0,category:t.category,type:i.type,severity:t.severity,id:t.id,name:t.name,message:i.message,code:snippet(n,i.line),source:"go-ast"}:null}function analyze(e,n){const i=resolveGoBin();if(!i)return[];let t,o;try{t=execFileSync(i,["run",HELPER_SCRIPT],{input:n,encoding:"utf8",timeout:8e3,maxBuffer:2097152,windowsHide:!0})}catch(e){return[]}try{o=JSON.parse(t)}catch(e){return[]}if(!o||!0!==o.ok||!Array.isArray(o.issues))return[];const r=n.split("\n"),a=[];for(const n of o.issues){const i=toIssue(e,r,n);i&&a.push(i)}return a}module.exports={analyze:analyze,_internal:{resolveGoBin:resolveGoBin,_resetGoBinCache:_resetGoBinCache,RULES_BY_TYPE:RULES_BY_TYPE}};

package/dist/packages/scanner/license-manager.js

@@ -1 +0,0 @@
-const fs=require("fs"),path=require("path"),os=require("os"),crypto=require("crypto"),TRIAL_HMAC_SECRET_DEFAULT="thuban-trial-silverwings-2026",THUBAN_DIR=path.join(os.homedir(),".thuban"),USAGE_FILE=path.join(THUBAN_DIR,"usage.json"),LICENSE_FILE=path.join(THUBAN_DIR,"license.json"),ED25519_PUBLIC_KEY_DER_B64="MCowBQYDK2VwAyEAyytegj0i6LHfXajJXodgEW6kAS9HxkWok+H3gGEy1lA=";function _trialBase64urlDecode(e){const t=e+"===".slice((e.length+3)%4);return Buffer.from(t.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8")}function _trialHmac8(e){const t=process.env.TRIAL_HMAC_SECRET||TRIAL_HMAC_SECRET_DEFAULT;return crypto.createHmac("sha256",t).update(e).digest("hex").substring(0,8)}function validateTrialKey(e){const t=e&&e.match(/^THUBAN-TRIAL-([A-Za-z0-9_-]+)-([A-Fa-f0-9]{8})$/);if(!t)return null;const s=t[1],r=t[2],a=_trialHmac8(`THUBAN-TRIAL-${s}`);if(r.toLowerCase()!==a.toLowerCase())return null;let i;try{i=JSON.parse(_trialBase64urlDecode(s))}catch(e){return null}if(!i||!i.x||!i.e)return null;const n=Math.floor(Date.now()/1e3),o=n>i.x,c=Math.max(0,Math.ceil((i.x-n)/86400));return{valid:!o,expired:o,email:i.e,name:i.n,invitedBy:i.i,expiresAt:new Date(1e3*i.x).toISOString(),daysRemaining:c,tier:"trial"}}const TIERS={free:{name:"Free",price:"$0/forever",maxFiles:100,maxProjects:3,scansPerMonth:200,showFullDetails:!0,showDashboard:!0,showAutoFix:!1,showCIAction:!1,showVSCode:!0,showMCP:!1,teaserIssues:1/0,maxHallucinationDetail:1/0},pro:{name:"Pro",price:"£29/month",maxFiles:1/0,maxProjects:1/0,scansPerMonth:1/0,showFullDetails:!0,showDashboard:!0,showAutoFix:!0,showCIAction:!1,showVSCode:!0,showMCP:!0,teaserIssues:1/0,maxHallucinationDetail:1/0},team:{name:"Team",price:"£99/month",maxFiles:1/0,maxProjects:1/0,scansPerMonth:1/0,showFullDetails:!0,showDashboard:!0,showAutoFix:!0,showCIAction:!0,showVSCode:!0,showMCP:!0,teaserIssues:1/0,maxHallucinationDetail:1/0},enterprise:{name:"Enterprise",price:"£299/month",maxFiles:1/0,maxProjects:1/0,scansPerMonth:1/0,showFullDetails:!0,showDashboard:!0,showAutoFix:!0,showCIAction:!0,showVSCode:!0,showMCP:!0,showSSO:!0,showAuditLogs:!0,showSLA:!0,teaserIssues:1/0,maxHallucinationDetail:1/0},trial:{name:"Trial",price:"Free (14 days)",maxFiles:1/0,maxProjects:1/0,scansPerMonth:1/0,showFullDetails:!0,showDashboard:!0,showAutoFix:!0,showCIAction:!0,showVSCode:!0,showMCP:!0,teaserIssues:1/0,maxHallucinationDetail:1/0}};class LicenseManager{constructor(){this._ensureDir(),this.machineId=this._getMachineId(),this.usage=this._loadUsage(),this.license=this._loadLicense()}getTier(){if("true"===process.env.THUBAN_DEV_MODE&&!__filename.includes("node_modules"))return"enterprise";if(!this.license||!this.license.key)return"free";if(this.license.key.startsWith("THUBAN-TRIAL-")){const e=validateTrialKey(this.license.key);return e?e.expired?(this._trialExpired=!0,"free"):(this._trialInfo=e,"trial"):"free"}return this._validateKey(this.license.key)&&this.license.tier||"free"}getTierConfig(){return"true"!==process.env.THUBAN_DEV_MODE||__filename.includes("node_modules")?TIERS[this.getTier()]||TIERS.free:TIERS.pro}canScan(){if("true"===process.env.THUBAN_DEV_MODE&&!__filename.includes("node_modules"))return{allowed:!0,remaining:1/0,devMode:!0};const e=this.getTierConfig();if(e.scansPerMonth===1/0)return{allowed:!0,remaining:1/0};const t=this._currentMonth(),s=this.usage.scans?.[t]||0,r=Math.max(0,e.scansPerMonth-s);return{allowed:r>0,remaining:r,limit:e.scansPerMonth,used:s,resetsOn:this._nextMonthDate()}}recordScan(){if("true"===process.env.THUBAN_DEV_MODE&&!__filename.includes("node_modules"))return;const e=this._currentMonth();this.usage.scans||(this.usage.scans={}),this.usage.scans[e]=(this.usage.scans[e]||0)+1,this.usage.lastScan=(new Date).toISOString(),this.usage.totalScans=(this.usage.totalScans||0)+1,this._saveUsage()}activate(e){if(e&&e.startsWith("THUBAN-TRIAL-")){const t=validateTrialKey(e);return t?t.expired?{success:!1,error:`Trial key expired on ${new Date(t.expiresAt).toLocaleDateString("en-GB")}. Upgrade at thuban.dev/pricing`}:(this.license={key:e,tier:"trial",activatedAt:(new Date).toISOString(),machineId:this.machineId,trialExpiresAt:t.expiresAt,trialEmail:t.email,trialName:t.name},this._saveLicense(),{success:!0,tier:"trial",tierName:"Trial (Pro features)",daysRemaining:t.daysRemaining,expiresAt:t.expiresAt}):{success:!1,error:"Invalid trial key format or signature"}}const t=this._validateKey(e);return t?(this.license={key:e,tier:t.tier,activatedAt:(new Date).toISOString(),machineId:this.machineId},this._saveLicense(),{success:!0,tier:t.tier,tierName:TIERS[t.tier]?.name||t.tier}):{success:!1,error:"Invalid license key format"}}deactivate(){return this.license={},this._saveLicense(),{success:!0}}getStatus(){const e=this.getTier(),t=this.getTierConfig(),s=this.canScan();let r=!1;return r="true"===process.env.THUBAN_DEV_MODE&&!__filename.includes("node_modules"),{tier:e,tierName:t.name,machineId:this.machineId.substring(0,8)+"...",licensed:"free"!==e,devMode:r,scansUsed:r?0:s.used||0,scansRemaining:s.remaining,scansLimit:r?1/0:s.limit||t.scansPerMonth,totalScans:this.usage.totalScans||0,..."trial"===e&&this._trialInfo?{trialDaysRemaining:this._trialInfo.daysRemaining,trialExpiresAt:this._trialInfo.expiresAt,trialName:this._trialInfo.name,trialEmail:this._trialInfo.email}:{},...this._trialExpired?{trialExpired:!0}:{},features:{fullDetails:t.showFullDetails,dashboard:t.showDashboard,autoFix:t.showAutoFix,ciAction:t.showCIAction,scheduledScans:"free"!==e&&"trial"!==e}}}canUseProFeature(e="This feature"){const t=this.getTier();return"free"===t?{allowed:!1,message:`${e} is available on Thuban Pro and above.`}:{allowed:!0,tier:t}}_ensureDir(){try{fs.existsSync(THUBAN_DIR)||fs.mkdirSync(THUBAN_DIR,{recursive:!0})}catch(e){}}_getMachineId(){const e=[os.hostname(),os.userInfo().username,os.platform(),os.arch()].join("|");try{const t=os.networkInterfaces(),s=Object.values(t).flat().filter(e=>!e.internal&&e.mac&&"00:00:00:00:00:00"!==e.mac).map(e=>e.mac).sort();if(s.length>0)return crypto.createHash("sha256").update(e+"|"+s[0]).digest("hex")}catch(e){}return crypto.createHash("sha256").update(e).digest("hex")}_loadUsage(){try{return JSON.parse(fs.readFileSync(USAGE_FILE,"utf-8"))}catch(e){return{scans:{},totalScans:0}}}_atomicWriteSync(e,t){const s=e+".tmp."+process.pid+"."+Date.now();try{fs.writeFileSync(s,t,"utf-8"),fs.renameSync(s,e)}catch(e){try{fs.unlinkSync(s)}catch{}}}_saveUsage(){try{this._atomicWriteSync(USAGE_FILE,JSON.stringify(this.usage,null,2))}catch(e){}}_loadLicense(){try{return JSON.parse(fs.readFileSync(LICENSE_FILE,"utf-8"))}catch(e){return{}}}_saveLicense(){try{this._atomicWriteSync(LICENSE_FILE,JSON.stringify(this.license,null,2))}catch(e){}}_validateKey(e){if(!e||"string"!=typeof e)return null;const t=e.match(/^THUBAN-(FREE|PRO|TEAM|ENT)-([A-Za-z0-9]{16})-([A-Fa-f0-9]{8,})$/);if(!t)return null;const s=t[1],r=t[2],a=t[3],i={FREE:"free",PRO:"pro",TEAM:"team",ENT:"enterprise"};try{const e=crypto.createPublicKey({key:Buffer.from(ED25519_PUBLIC_KEY_DER_B64,"base64"),format:"der",type:"spki"}),t=Buffer.from(`THUBAN-${s}-${r}`),n=Buffer.from(a,"hex");if(crypto.verify(null,t,e,n))return{tier:i[s]||"free",valid:!0,method:"ed25519"}}catch(e){}return null}_currentMonth(){const e=new Date;return`${e.getFullYear()}-${String(e.getMonth()+1).padStart(2,"0")}`}_nextMonthDate(){const e=new Date;return new Date(e.getFullYear(),e.getMonth()+1,1).toISOString().split("T")[0]}static generateKey(e="PRO"){const t=process.env.THUBAN_SIGNING_PRIVATE_KEY;if(!t)throw new Error("THUBAN_SIGNING_PRIVATE_KEY environment variable is required to generate license keys. This keeps the signing key out of source control and off end-user machines.");const s=crypto.createPrivateKey({key:Buffer.from(t,"base64"),format:"der",type:"pkcs8"}),r=crypto.randomBytes(8).toString("hex"),a=Buffer.from(`THUBAN-${e}-${r}`);return`THUBAN-${e}-${r}-${crypto.sign(null,a,s).toString("hex")}`}}module.exports=LicenseManager,module.exports.validateTrialKey=validateTrialKey;

package/dist/packages/scanner/taint-tracker.js

@@ -1 +0,0 @@
-"use strict";const parser=require("@babel/parser"),path=require("path"),fs=require("fs"),{joinLogicalStatements:joinLogicalStatements,extractBalanced:extractBalanced,splitTopLevelArgs:splitTopLevelArgs,isDynamicPyString:isDynamicPyString}=require("./ast-analyzer")._internal,BABEL_PLUGINS=["estree","typescript","jsx","classProperties","decorators-legacy"],MAX_TAINT_FILE_SIZE=2e4,MAX_FIXPOINT_ITERATIONS=10;function walk(e,t){if(e&&"object"==typeof e&&"string"==typeof e.type){t(e);for(const n in e){if("loc"===n||"range"===n||"start"===n||"end"===n)continue;const i=e[n];if(Array.isArray(i))for(const e of i)e&&"object"==typeof e&&"string"==typeof e.type&&walk(e,t);else i&&"object"==typeof i&&"string"==typeof i.type&&walk(i,t)}}}function lineOf(e){return e&&e.loc?e.loc.start.line:0}function snippet(e,t){return!t||t<1||t>e.length?"":e[t-1].trim().substring(0,100)}function mkTaintIssue(e,t,n,i){const r={file:e,line:t,category:"security",type:i.type,severity:i.severity||"critical",id:i.id,name:i.name,message:i.message,code:snippet(n,t),source:"taint",taintPath:i.taintPath};return i.crossFile&&(r.crossFile=!0,r.sourceFile=i.sourceFile),r}function fileTooLargeIssue(e,t){return{file:e,line:0,category:"quality",type:"file_too_large",severity:"info",id:"TAINT003",name:"Taint Analysis Skipped",message:`File too large (${t} chars) - taint analysis skipped (cap: 20000 chars)`,code:"",source:"taint"}}const SANITIZER_FUNCS=new Set(["parseInt","parseFloat","Number","Boolean","encodeURIComponent","encodeURI","escape","sanitize","sanitizeHtml","stripTags","escapeHtml","htmlEscape","htmlEncode","xssFilter","filterXSS","DOMPurify","purify","clean","validator"]),SANITIZER_MEMBER=new Set(["sanitize","escape","escapeHtml","stripTags","clean","escapeLiteral","escapeIdentifier","escapeId"]),SANITIZER_RECEIVER_NAMES=new Set(["dompurify","sanitizehtml","sanitize-html","html","xss","validator","bleach","markupsafe","purify","sqlstring","sanitizer","striptags","xssfilters","insane","mysql","mysql2","connection","conn","db","pool","pg","knex"]);function hasKnownSanitizerReceiver(e){let t=e,n=0;for(;t&&n++<20;){if("Identifier"===t.type)return SANITIZER_RECEIVER_NAMES.has(t.name.toLowerCase());if("MemberExpression"!==t.type)return!1;t=t.object}return!1}const JS_SOURCE_PATH_PATTERNS=[{re:/^req\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^request\.(params|query|body|headers)(\.|$)/,severity:"critical"},{re:/^process\.argv/,severity:"critical"},{re:/^process\.env/,severity:"warning"},{re:/^document\.location/,severity:"critical"},{re:/^window\.location/,severity:"critical"},{re:/^location\.(search|hash|href)/,severity:"critical"}];function memberChainToPath(e){const t=[];let n=e,i=0;for(;n&&i++<20;){if("Identifier"===n.type){t.unshift(n.name);break}if("ThisExpression"===n.type){t.unshift("this");break}if("MemberExpression"!==n.type)return null;n.computed||"Identifier"!==n.property.type?t.unshift("*"):t.unshift(n.property.name),n=n.object}return t.length?t.join("."):null}function jsSourceSeverity(e){if(!e)return null;if("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name)return"critical";if("NewExpression"===e.type&&"Identifier"===e.callee.type&&("URLSearchParams"===e.callee.name||"FormData"===e.callee.name))return"critical";const t=memberChainToPath(e);if(t)for(const e of JS_SOURCE_PATH_PATTERNS)if(e.re.test(t))return e.severity;return null}function isJSSourceExpr(e){return null!==jsSourceSeverity(e)}function describeJSSource(e){return memberChainToPath(e)||("CallExpression"===e.type&&"Identifier"===e.callee.type&&"prompt"===e.callee.name?"prompt()":"NewExpression"===e.type&&"Identifier"===e.callee.type?`new ${e.callee.name}()`:"tainted source")}function isSanitizerCall(e){return!(!e||"CallExpression"!==e.type)&&(!("Identifier"!==e.callee.type||!SANITIZER_FUNCS.has(e.callee.name))||!("MemberExpression"!==e.callee.type||"Identifier"!==e.callee.property.type||!SANITIZER_MEMBER.has(e.callee.property.name))&&hasKnownSanitizerReceiver(e.callee.object))}function isNumericCoercionCall(e){return!(!e||"CallExpression"!==e.type||"Identifier"!==e.callee.type||"parseInt"!==e.callee.name&&"parseFloat"!==e.callee.name&&"Number"!==e.callee.name)}function isTaintedExpr(e,t,n){if(n=n||0,!e||n>12)return!1;if("Identifier"===e.type)return t.has(e.name);if("CallExpression"===e.type){if(isSanitizerCall(e))return!1;if(isJSSourceExpr(e))return!0;if("MemberExpression"===e.callee.type&&isTaintedExpr(e.callee.object,t,n+1))return!0;for(const i of e.arguments)if(isTaintedExpr(i,t,n+1))return!0;return!1}return"MemberExpression"===e.type?!!isJSSourceExpr(e)||isTaintedExpr(e.object,t,n+1):"NewExpression"===e.type?isJSSourceExpr(e):"BinaryExpression"===e.type&&"+"===e.operator?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):"TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t,n+1)):"AssignmentExpression"===e.type?isTaintedExpr(e.right,t,n+1):"ConditionalExpression"===e.type?isTaintedExpr(e.consequent,t,n+1)||isTaintedExpr(e.alternate,t,n+1):"LogicalExpression"===e.type?isTaintedExpr(e.left,t,n+1)||isTaintedExpr(e.right,t,n+1):!("SequenceExpression"!==e.type||!e.expressions.length)&&isTaintedExpr(e.expressions[e.expressions.length-1],t,n+1)}function isDynamicTaintedBuild(e,t){return!!e&&("TemplateLiteral"===e.type?(e.expressions||[]).some(e=>isTaintedExpr(e,t)):"BinaryExpression"===e.type&&"+"===e.operator&&(isTaintedExpr(e.left,t)||isTaintedExpr(e.right,t)))}function collectFunctionReturnNodes(e){const t=[];return e.body&&"BlockStatement"===e.body.type?function n(i){if(i&&"object"==typeof i&&"string"==typeof i.type&&(i===e||"FunctionDeclaration"!==i.type&&"FunctionExpression"!==i.type&&"ArrowFunctionExpression"!==i.type)){"ReturnStatement"===i.type&&i.argument&&t.push(i.argument);for(const e in i){if("loc"===e||"range"===e||"start"===e||"end"===e)continue;const t=i[e];if(Array.isArray(t))for(const e of t)e&&"object"==typeof e&&"string"==typeof e.type&&n(e);else t&&"object"==typeof t&&"string"==typeof t.type&&n(t)}}}(e.body):e.body&&t.push(e.body),t}function findTaintOrigin(e,t){let n=null;return walk(e,e=>{if(!n)if("Identifier"===e.type&&t.has(e.name))n=t.get(e.name);else{const t=jsSourceSeverity(e);t&&(n={desc:describeJSSource(e),line:lineOf(e),severity:t})}}),n}function collectTaintedVars(e,t){const n=new Set,i=new Map,r=new Set,a=new Map;if(t)for(const[e,r]of t)n.add(e),i.set(e,r);let s=!0,o=0;function l(e){return!(!e||"CallExpression"!==e.type||"Identifier"!==e.callee.type||!r.has(e.callee.name))}for(;s&&o<10;)s=!1,o++,walk(e,e=>{if("FunctionDeclaration"!==e.type&&"FunctionExpression"!==e.type&&"ArrowFunctionExpression"!==e.type)return;const t=e.id&&e.id.name;if(t&&!r.has(t))for(const o of collectFunctionReturnNodes(e))if(isTaintedExpr(o,n)||l(o)){r.add(t),a.set(t,findTaintOrigin(o,i)||(l(o)?a.get(o.callee.name):null)||{desc:describeJSSource(o),line:lineOf(o),severity:jsSourceSeverity(o)||"critical"}),s=!0;break}}),walk(e,e=>{let t=null,r=null;if("VariableDeclarator"===e.type&&e.init&&"Identifier"===e.id.type?(t=e.id.name,r=e.init):"AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type&&(t=e.left.name,r=e.right),t&&r&&n.has(t)&&(isSanitizerCall(r)||isNumericCoercionCall(r)))return n.delete(t),i.delete(t),void(s=!0);if(!t||n.has(t))return;const o=l(r);if(isTaintedExpr(r,n)||o){n.add(t),s=!0;const l=findTaintOrigin(r,i)||(o?a.get(r.callee.name):null)||{desc:describeJSSource(r),line:lineOf(e),severity:jsSourceSeverity(r)||"critical"};i.set(t,l)}});return{taintedVars:n,origins:i}}const SQL_METHODS=new Set(["query","execute","raw","where"]);function parseJS(e){try{return parser.parse(e,{sourceType:"unambiguous",plugins:BABEL_PLUGINS,allowReturnOutsideFunction:!0,allowImportExportEverywhere:!0,allowAwaitOutsideFunction:!0,allowSuperOutsideMethod:!0,allowUndeclaredExports:!0,errorRecovery:!1}).program}catch(e){return null}}function analyzeJSTaint(e,t,n){const i=[],r=t.split("\n"),a=parseJS(t);if(!a)return i;const{taintedVars:s,origins:o}=collectTaintedVars(a,n),l=new Set;function c(t,n){const a=lineOf(t),s=`${a}:${n.id}`;if(l.has(s))return;l.add(s);const c=findTaintOrigin(t,o);c&&(n=Object.assign({},n,{severity:c.severity||"critical"}),c.crossFile&&(n=Object.assign({},n,{crossFile:!0,sourceFile:c.sourceFile}))),i.push(mkTaintIssue(e,a,r,n))}function p(e){const t=findTaintOrigin(e,o);if(t)return`${t.crossFile?`${t.sourceFile}: `:""}${t.desc} (line ${t.line}) -> sink (line ${lineOf(e)})`}return walk(a,e=>{if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&SQL_METHODS.has(e.callee.property.name)){const t=e.arguments[0];t&&(isDynamicTaintedBuild(t,s)||isTaintedExpr(t,s))&&c(e,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:`Tainted user input flows into .${e.callee.property.name}() without sanitization - SQL injection risk`,taintPath:p(e)})}if("AssignmentExpression"!==e.type||"MemberExpression"!==e.left.type||"Identifier"!==e.left.property.type||"innerHTML"!==e.left.property.name&&"outerHTML"!==e.left.property.name||(isTaintedExpr(e.right,s)||isDynamicTaintedBuild(e.right,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via "+e.left.property.name,message:`Tainted user input flows into ${e.left.property.name} without sanitization - XSS risk`,taintPath:p(e)}),"CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&"document"===e.callee.object.name&&"Identifier"===e.callee.property.type&&("write"===e.callee.property.name||"writeln"===e.callee.property.name)){const t=e.arguments[0];t&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Tainted XSS via document.${e.callee.property.name}()`,message:`Tainted user input flows into document.${e.callee.property.name}() without sanitization - XSS risk`,taintPath:p(e)})}if("JSXAttribute"===e.type&&e.name&&"dangerouslySetInnerHTML"===e.name.name&&e.value&&"JSXExpressionContainer"===e.value.type){const t=e.value.expression;if(t&&"ObjectExpression"===t.type){const n=t.properties.find(e=>e.key&&("__html"===e.key.name||"__html"===e.key.value));n&&(isTaintedExpr(n.value,s)||isDynamicTaintedBuild(n.value,s))&&c(e,{type:"xss",id:"TAINT002",name:"Tainted XSS via dangerouslySetInnerHTML",message:"Tainted user input flows into dangerouslySetInnerHTML without sanitization - XSS risk",taintPath:p(e)})}}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.object.type&&/^res(ponse)?$/.test(e.callee.object.name)&&"Identifier"===e.callee.property.type&&("send"===e.callee.property.name||"write"===e.callee.property.name)){const t=e.arguments[0];t&&"ObjectExpression"!==t.type&&"ArrayExpression"!==t.type&&(isTaintedExpr(t,s)||isDynamicTaintedBuild(t,s))&&c(e,{type:"xss",id:"TAINT002",name:`Reflected XSS via ${e.callee.object.name}.${e.callee.property.name}()`,message:`Tainted user input is reflected via ${e.callee.object.name}.${e.callee.property.name}() without sanitization - reflected XSS risk`,taintPath:p(e)})}}),i}const PY_SOURCE_PATTERNS=[/\brequest\.args\b/,/\brequest\.form\b/,/\brequest\.json\b/,/\brequest\.data\b/,/\brequest\.GET\b/,/\brequest\.POST\b/,/\bsys\.argv\b/,/\bos\.environ\b/,/\binput\s*\(/],PY_SANITIZER_WRAP_RE=/^\s*(int|float|re\.escape|html\.escape|escape|markupsafe\.escape|bleach\.clean)\s*\(/;function describePySource(e){for(const t of PY_SOURCE_PATTERNS){const n=e.match(t);if(n)return n[0]}return"tainted source"}function isPySourceText(e){return PY_SOURCE_PATTERNS.some(t=>t.test(e))}function isDynamicPyText(e){return isDynamicPyString(e)}function collectPyTaintedVars(e){const t=new Set,n=new Map;let i=!0,r=0;const a=/^\s*([A-Za-z_]\w*)\s*=(?!=)\s*([\s\S]+?)\s*$/;for(;i&&r<10;){i=!1,r++;for(const r of e){const e=r.text.split("\n")[0].match(a)||r.text.match(a);if(!e)continue;const s=e[1],o=r.text.slice(r.text.indexOf("=")+1);if(PY_SANITIZER_WRAP_RE.test(o.trim())){t.has(s)&&(t.delete(s),n.delete(s),i=!0);continue}if(t.has(s))continue;let l=!1,c=null;if(isPySourceText(o))l=!0,c=describePySource(o);else for(const e of t)if(new RegExp("\\b"+e+"\\b").test(o)){l=!0,c=n.has(e)?n.get(e).desc:e;break}l&&(t.add(s),n.set(s,{desc:c,line:r.startLine}),i=!0)}}return{taintedVars:t,origins:n}}function textReferencesTaint(e,t){if(isPySourceText(e))return!0;for(const n of t)if(new RegExp("\\b"+n+"\\b").test(e))return!0;return!1}function analyzePythonTaint(e,t){const n=[],i=t.split("\n"),r=joinLogicalStatements(t),{taintedVars:a,origins:s}=collectPyTaintedVars(r),o=new Set;function l(t,r){const a=`${t}:${r.id}`;o.has(a)||(o.add(a),n.push(mkTaintIssue(e,t,i,r)))}function c(e,t){for(const n of a)if(new RegExp("\\b"+n+"\\b").test(e)&&s.has(n)){const e=s.get(n);return`${e.desc} (line ${e.line}) -> sink (line ${t})`}if(isPySourceText(e))return`${describePySource(e)} -> sink (line ${t})`}for(const e of r){const t=e.text,n=e.startLine,i=t.match(/\b(?:cursor|db|conn|connection)\.execute\s*\(/);if(i){const e=t.indexOf("(",i.index),r=extractBalanced(t,e),s=splitTopLevelArgs(r)[0]||"";isDynamicPyText(s)&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection",message:"Tainted user input flows into .execute() without sanitization - SQL injection risk",taintPath:c(s,n)})}const r=t.match(/\.(raw|extra)\s*\(|\bRawSQL\s*\(/);if(r){const e=t.indexOf("(",r.index),i=extractBalanced(t,e),s=splitTopLevelArgs(i)[0]||"";(isDynamicPyText(s)||isPySourceText(s))&&textReferencesTaint(s,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (Django)",message:"Tainted user input flows into raw SQL construct without sanitization - SQL injection risk",taintPath:c(s,n)})}const s=t.match(/\btext\s*\(/);if(s){const e=t.indexOf("(",s.index),i=extractBalanced(t,e);isDynamicPyText(i)&&textReferencesTaint(i,a)&&l(n,{type:"sql_injection",id:"TAINT001",name:"Tainted SQL Injection (SQLAlchemy text())",message:"Tainted user input flows into SQLAlchemy text() without sanitization - SQL injection risk",taintPath:c(i,n)})}const o=t.match(/\bmark_safe\s*\(/);if(o){const e=t.indexOf("(",o.index),i=extractBalanced(t,e);textReferencesTaint(i,a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via mark_safe()",message:"Tainted user input flows into mark_safe() without sanitization - XSS risk",taintPath:c(i,n)})}const p=t.match(/\{\{\s*([A-Za-z_][\w.]*)[^}]*\|\s*safe\b/);p&&textReferencesTaint(p[1],a)&&l(n,{type:"xss",id:"TAINT002",name:"Tainted XSS via Jinja2 |safe filter",message:"Tainted user input is rendered with the |safe filter without sanitization - XSS risk",taintPath:c(p[1],n)})}return n}const JS_RESOLVE_EXTS=["",".js",".jsx",".ts",".tsx",".mjs",".cjs",path.sep+"index.js",path.sep+"index.ts",path.sep+"index.jsx",path.sep+"index.tsx"];function resolveImportPath(e,t,n){if(!t||!t.startsWith(".")&&!path.isAbsolute(t))return null;const i=path.dirname(e),r=path.isAbsolute(t)?t:path.resolve(i,t);for(const e of JS_RESOLVE_EXTS){const t=r+e;if(n(t))return t}return null}function defaultFileExists(e){try{return fs.statSync(e).isFile()}catch(e){return!1}}function extractImportBindings(e){const t=[];return walk(e,e=>{if("ImportDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[])if("ImportDefaultSpecifier"===i.type)t.push({localName:i.local.name,importedName:"default",source:n});else if("ImportNamespaceSpecifier"===i.type)t.push({localName:i.local.name,importedName:"*",source:n});else if("ImportSpecifier"===i.type){const e=i.imported&&(i.imported.name||i.imported.value);t.push({localName:i.local.name,importedName:e||i.local.name,source:n})}}if("VariableDeclarator"===e.type&&e.init){const n=unwrapRequireCall(e.init);if(n)if("Identifier"===e.id.type)t.push({localName:e.id.name,importedName:"*",source:n});else if("ObjectPattern"===e.id.type)for(const i of e.id.properties)if("ObjectProperty"===i.type||"Property"===i.type){const e=i.key&&(i.key.name||i.key.value),r=i.value&&"Identifier"===i.value.type?i.value.name:e;e&&r&&t.push({localName:r,importedName:e,source:n})}}if("AssignmentExpression"===e.type&&"="===e.operator&&"Identifier"===e.left.type){const n=unwrapRequireCall(e.right);n&&t.push({localName:e.left.name,importedName:"*",source:n})}if("CallExpression"===e.type&&"MemberExpression"===e.callee.type&&"Identifier"===e.callee.property.type&&"then"===e.callee.property.name&&"ImportExpression"===e.callee.object.type&&e.callee.object.source&&"string"==typeof e.callee.object.source.value){const n=e.callee.object.source.value,i=e.arguments[0];i&&("ArrowFunctionExpression"===i.type||"FunctionExpression"===i.type)&&i.params[0]&&"Identifier"===i.params[0].type&&t.push({localName:i.params[0].name,importedName:"*",source:n})}}),t}function unwrapRequireCall(e){if(!e||"CallExpression"!==e.type)return null;if("Identifier"!==e.callee.type||"require"!==e.callee.name)return null;const t=e.arguments[0];return t&&"string"==typeof t.value?t.value:null}function extractReExports(e){const t=[];return walk(e,e=>{if("ExportNamedDeclaration"===e.type&&e.source&&"string"==typeof e.source.value){const n=e.source.value;for(const i of e.specifiers||[]){const e=i.local&&(i.local.name||i.local.value),r=i.exported&&(i.exported.name||i.exported.value);e&&r&&t.push({importedName:e,exportedName:r,source:n})}}if("ExportAllDeclaration"===e.type&&e.source&&"string"==typeof e.source.value&&t.push({importedName:"*",exportedName:"*",source:e.source.value}),"AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)){const n=unwrapRequireCall(e.right);n&&t.push({importedName:"*",exportedName:"*",source:n})}}),t}function extractLocalExports(e){const t=[];return walk(e,e=>{if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&!e.left.computed&&"Identifier"===e.left.property.type){const n=memberChainToPath(e.left.object);"module.exports"!==n&&"exports"!==n||t.push({exportedName:e.left.property.name,localName:null,inlineNode:e.right})}if("AssignmentExpression"===e.type&&"="===e.operator&&"MemberExpression"===e.left.type&&"module.exports"===memberChainToPath(e.left)&&"ObjectExpression"===e.right.type)for(const n of e.right.properties){if("ObjectProperty"!==n.type&&"Property"!==n.type)continue;const e=n.key&&(n.key.name||n.key.value);e&&(n.value&&"Identifier"===n.value.type?t.push({exportedName:e,localName:n.value.name,inlineNode:null}):t.push({exportedName:e,localName:null,inlineNode:n.value}))}if("ExportNamedDeclaration"===e.type&&e.declaration){const n=e.declaration;if("VariableDeclaration"===n.type)for(const e of n.declarations)"Identifier"===e.id.type&&t.push({exportedName:e.id.name,localName:e.id.name,inlineNode:e.init||null});else"FunctionDeclaration"!==n.type&&"ClassDeclaration"!==n.type||!n.id||t.push({exportedName:n.id.name,localName:n.id.name,inlineNode:null})}if("ExportNamedDeclaration"===e.type&&!e.source)for(const n of e.specifiers||[]){const e=n.local&&(n.local.name||n.local.value),i=n.exported&&(n.exported.name||n.exported.value);e&&i&&t.push({exportedName:i,localName:e,inlineNode:null})}if("ExportDefaultDeclaration"===e.type){const n=e.declaration;n&&("FunctionDeclaration"===n.type||"ClassDeclaration"===n.type)&&n.id?t.push({exportedName:"default",localName:n.id.name,inlineNode:null}):n&&"Identifier"===n.type?t.push({exportedName:"default",localName:n.name,inlineNode:null}):t.push({exportedName:"default",localName:null,inlineNode:n})}}),t}function buildExportTaintMap(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8").replace(/\r\n/g,"\n")),i=t.fileExists||defaultFileExists,r=t.parsedCache||null,a=new Map;for(const t of e){const e=path.extname(t).toLowerCase();if(!JS_EXTS.has(e))continue;let i;try{i=n(t)}catch(e){continue}if(r&&r.set(t,{content:i,ast:null}),i.length>2e4)continue;const s=parseJS(i);r&&(r.get(t).ast=s),s&&a.set(t,{ast:s,content:i})}const s=new Map;for(const e of a.keys())s.set(e,new Map);const o=Math.max(10,a.size+1);let l=!0,c=0;for(;l&&c<o;){l=!1,c++;for(const[e,{ast:t}]of a){const n=s.get(e),r=extractImportBindings(t),a=new Map;for(const t of r){const n=resolveImportPath(e,t.source,i);if(!n||!s.has(n))continue;const r=s.get(n);if("*"===t.importedName)for(const[,e]of r)a.has(t.localName)||a.set(t.localName,e);else r.has(t.importedName)&&a.set(t.localName,r.get(t.importedName))}const{taintedVars:o,origins:c}=collectTaintedVars(t,a),p=extractLocalExports(t);for(const t of p){if(n.has(t.exportedName))continue;let i=null;if(t.localName&&o.has(t.localName)?i=c.get(t.localName)||{desc:t.localName,line:0}:t.inlineNode&&(isTaintedExpr(t.inlineNode,o)||isDynamicTaintedBuild(t.inlineNode,o))&&(i=findTaintOrigin(t.inlineNode,c)||{desc:describeJSSource(t.inlineNode),line:lineOf(t.inlineNode)}),i){const r=i.crossFile?i.sourceFile:e;n.set(t.exportedName,{desc:i.desc,line:i.line,sourceFile:r,crossFile:!0}),l=!0}}const u=extractReExports(t);for(const t of u){const r=resolveImportPath(e,t.source,i);if(!r||!s.has(r))continue;const a=s.get(r);if("*"===t.importedName)for(const[e,t]of a)n.has(e)||(n.set(e,t),l=!0);else a.has(t.importedName)&&!n.has(t.exportedName)&&(n.set(t.exportedName,a.get(t.importedName)),l=!0)}}}return s}function buildImportSeeds(e,t,n,i){const r=new Map,a=extractImportBindings(t);for(const t of a){const a=resolveImportPath(e,t.source,i);if(!a||!n.has(a))continue;const s=n.get(a);if("*"===t.importedName)for(const[,e]of s)r.has(t.localName)||r.set(t.localName,e);else s.has(t.importedName)&&r.set(t.localName,s.get(t.importedName))}return r}function analyzeProject(e,t){const n=(t=t||{}).readFile||(e=>fs.readFileSync(e,"utf8").replace(/\r\n/g,"\n")),i=t.fileExists||defaultFileExists,r=new Map,a=buildExportTaintMap(e,{readFile:n,fileExists:i,parsedCache:r}),s=[];for(const t of e){const e=path.extname(t).toLowerCase(),o=r.get(t);let l;if(o)l=o.content;else try{l=n(t)}catch(e){continue}if(l.length>2e4)(JS_EXTS.has(e)||PY_EXTS.has(e))&&s.push(fileTooLargeIssue(t,l.length));else try{if(JS_EXTS.has(e)){const e=o?o.ast:parseJS(l);if(!e)continue;const n=buildImportSeeds(t,e,a,i);s.push(...analyzeJSTaint(t,l,n.size?n:void 0))}else PY_EXTS.has(e)&&s.push(...analyzePythonTaint(t,l))}catch(e){}}return s}const JS_EXTS=new Set([".js",".jsx",".ts",".tsx",".mjs",".cjs"]),PY_EXTS=new Set([".py",".pyw"]);function analyze(e,t){if(t.length>2e4)return[fileTooLargeIssue(e,t.length)];const n=path.extname(e).toLowerCase();try{if(JS_EXTS.has(n))return analyzeJSTaint(e,t);if(PY_EXTS.has(n))return analyzePythonTaint(e,t)}catch(e){return[]}return[]}module.exports={analyze:analyze,analyzeProject:analyzeProject,analyzeJSTaint:analyzeJSTaint,analyzePythonTaint:analyzePythonTaint,buildExportTaintMap:buildExportTaintMap,buildImportSeeds:buildImportSeeds,resolveImportPath:resolveImportPath,_internal:{walk:walk,isTaintedExpr:isTaintedExpr,isJSSourceExpr:isJSSourceExpr,isSanitizerCall:isSanitizerCall,collectTaintedVars:collectTaintedVars,memberChainToPath:memberChainToPath,isPySourceText:isPySourceText,isDynamicPyText:isDynamicPyText,collectPyTaintedVars:collectPyTaintedVars,resolveImportPath:resolveImportPath,extractImportBindings:extractImportBindings,extractReExports:extractReExports,extractLocalExports:extractLocalExports,parseJS:parseJS}};