Metadata-Version: 2.4
Name: klyrek-js
Version: 0.1.0
Summary: JavaScript analysis for the Klyrek ecosystem
Author: Klyrek Contributors
License: MIT
Keywords: appsec,javascript,pentesting,reconnaissance,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: klyrek-core
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# klyrek-js

JavaScript analysis. Pure text analysis — takes an already-fetched JS source string (from
`klyrek-http`/`klyrek-crawler`) rather than making its own requests, so this package has no
network dependency at all.

- **`endpoints`** — extracts API-shaped path and URL string literals referenced in the source
  (`"/api/v1/users"`, `"https://api.target.com/graphql"`) as `Endpoint` records.
- **`secrets`** — regex-based detection of hardcoded credentials (AWS keys, Stripe live keys,
  Slack tokens, GitHub PATs, private key blocks, generic `api_key`/`secret` assignments), as
  `Finding` records with the matched value masked (`sk_l...3f9a`) rather than stored in full.
- **`sourcemap`** — detects a `//# sourceMappingURL=` reference, which (if the `.map` file is
  publicly reachable) can reconstruct original unminified source.

Third-party SDK/library detection (Stripe.js, Sentry, Google Analytics, ...) deliberately isn't
duplicated here — `klyrek-tech`'s signature-based `fingerprint()` already works on any response
body, JS included.

```python
from klyrek_js.analyze import analyze_js

result = analyze_js(js_source, js_url="https://target.com/static/app.js")
print(result.endpoints, result.findings)
```
