klyrek-js

JavaScript analysis. Pure text analysis — takes an already-fetched JS source string (from klyrek-http/klyrek-crawler) rather than making its own requests, so this package has no network dependency at all.

• endpoints — extracts API-shaped path and URL string literals referenced in the source ("/api/v1/users", "https://api.target.com/graphql") as Endpoint records.
• secrets — regex-based detection of hardcoded credentials (AWS keys, Stripe live keys, Slack tokens, GitHub PATs, private key blocks, generic api_key/secret assignments), as Finding records with the matched value masked (sk_l...3f9a) rather than stored in full.
• sourcemap — detects a //# sourceMappingURL= reference, which (if the .map file is publicly reachable) can reconstruct original unminified source.

Third-party SDK/library detection (Stripe.js, Sentry, Google Analytics, ...) deliberately isn't duplicated here — klyrek-tech's signature-based fingerprint() already works on any response body, JS included.

from klyrek_js.analyze import analyze_js

result = analyze_js(js_source, js_url="https://target.com/static/app.js")
print(result.endpoints, result.findings)