@dataparade/cli 0.0.1

package/dist/src/ingest/gitignore.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPosixPath = toPosixPath;
+exports.gitignorePatternToRegex = gitignorePatternToRegex;
+exports.readGitignore = readGitignore;
+exports.gitignoreRulesForDir = gitignoreRulesForDir;
+exports.isPathIgnored = isPathIgnored;
+const fs_1 = require("fs");
+const path = __importStar(require("path"));
+function toPosixPath(p) {
+    return p.split(path.sep).join("/");
+}
+function gitignorePatternToRegex(pattern, dirOnly) {
+    // Very small subset of .gitignore-style patterns:
+    // - * matches any chars except path separator
+    // - ** matches across directories
+    // - ? matches a single non-separator
+    // - pattern without leading slash matches anywhere under baseDir
+    let escaped = pattern.replace(/[-\\^$+?.()|[\]{}*?]/g, "\\$&");
+    // Restore globs
+    escaped = escaped.replace(/\\\*\\\*/g, ".*"); // **
+    escaped = escaped.replace(/\\\*/g, "[^/]*"); // *
+    escaped = escaped.replace(/\\\?/g, "[^/]"); // ?
+    const suffix = dirOnly ? "(?:/.*)?$" : "$";
+    // Match from start of the relative path
+    return new RegExp(`^${escaped}${suffix}`);
+}
+async function readGitignore(dir) {
+    const gitignorePath = path.join(dir, ".gitignore");
+    try {
+        const content = await fs_1.promises.readFile(gitignorePath, "utf8");
+        const lines = content.split(/\r?\n/);
+        const rules = [];
+        for (const rawLine of lines) {
+            let line = rawLine.trim();
+            if (!line || line.startsWith("#"))
+                continue;
+            let negate = false;
+            if (line.startsWith("!")) {
+                negate = true;
+                line = line.slice(1).trim();
+                if (!line)
+                    continue;
+            }
+            let dirOnly = false;
+            if (line.endsWith("/")) {
+                dirOnly = true;
+                line = line.slice(0, -1);
+                if (!line)
+                    continue;
+            }
+            const regex = gitignorePatternToRegex(toPosixPath(line), dirOnly);
+            rules.push({
+                baseDir: dir,
+                pattern: line,
+                negate,
+                dirOnly,
+                regex,
+            });
+        }
+        return rules;
+    }
+    catch (error) {
+        // If .gitignore does not exist, ignore silently
+        if (error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+}
+async function gitignoreRulesForDir(currentDir, accumulatedRules) {
+    const localRules = await readGitignore(currentDir);
+    return accumulatedRules.concat(localRules);
+}
+function isPathIgnored(absolutePath, isDirectory, rules) {
+    const normalizedPath = toPosixPath(absolutePath);
+    let ignored = false;
+    for (const rule of rules) {
+        const base = toPosixPath(rule.baseDir);
+        if (!normalizedPath.startsWith(base.endsWith("/") ? base : `${base}/`)) {
+            continue;
+        }
+        const rel = normalizedPath.slice(base.length + (base.endsWith("/") ? 0 : 1));
+        if (!rel)
+            continue;
+        if (rule.dirOnly && !isDirectory) {
+            continue;
+        }
+        if (rule.regex.test(rel)) {
+            ignored = !rule.negate;
+        }
+    }
+    return ignored;
+}

package/dist/src/ingest/sensitive-paths.d.ts

@@ -0,0 +1,2 @@
+/** True for `.env`, `.env.local`, `.env.production`, etc. */
+export declare function isSensitiveEnvPath(filePath: string): boolean;

package/dist/src/ingest/sensitive-paths.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveEnvPath = isSensitiveEnvPath;
+/** True for `.env`, `.env.local`, `.env.production`, etc. */
+function isSensitiveEnvPath(filePath) {
+    const base = filePath.split(/[/\\]/).pop() ?? filePath;
+    return base === ".env" || base.startsWith(".env.");
+}

package/dist/src/observability/scan-sentry.d.ts

@@ -0,0 +1,20 @@
+export type ScanCliAiMode = "byok" | "platform" | "none";
+export type ReportScanCliErrorInput = {
+    error: unknown;
+    scanRoot?: string;
+    jobId?: string;
+    aiMode?: ScanCliAiMode;
+    aiProvider?: string;
+    failurePhase?: string;
+    failureCode?: string;
+    extra?: Record<string, unknown>;
+};
+/**
+ * Report a CLI scan failure to Sentry (BYOK, platform, or structural-only).
+ * No-op when Sentry is disabled. Never throws.
+ */
+export declare function reportScanCliError(input: ReportScanCliErrorInput): Promise<void>;
+/** Flush pending Sentry events before process exit. */
+export declare function flushCliSentry(): Promise<void>;
+/** @internal tests */
+export declare function resetCliSentryForTests(): void;

package/dist/src/observability/scan-sentry.js

@@ -0,0 +1,133 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportScanCliError = reportScanCliError;
+exports.flushCliSentry = flushCliSentry;
+exports.resetCliSentryForTests = resetCliSentryForTests;
+const Sentry = __importStar(require("@sentry/node"));
+/** Same project as backend; override with SENTRY_DSN or disable with SCAN_SENTRY_ENABLED=false. */
+const DEFAULT_SENTRY_DSN = "https://f0f0617fca41c8c537c50553fb9a8eac@o4510835264192512.ingest.us.sentry.io/4510835291455488";
+let initialized = false;
+let enabled = false;
+function resolveDsn() {
+    const explicitOff = process.env.SCAN_SENTRY_ENABLED?.trim().toLowerCase() === "false";
+    if (explicitOff)
+        return undefined;
+    const fromEnv = process.env.SENTRY_DSN?.trim();
+    if (fromEnv === "" || fromEnv?.toLowerCase() === "false")
+        return undefined;
+    if (fromEnv)
+        return fromEnv;
+    if (process.env.NODE_ENV === "test")
+        return undefined;
+    return DEFAULT_SENTRY_DSN;
+}
+function ensureInitialized() {
+    if (initialized)
+        return;
+    initialized = true;
+    const dsn = resolveDsn();
+    if (!dsn)
+        return;
+    Sentry.init({
+        dsn,
+        environment: process.env.SENTRY_ENVIRONMENT?.trim() ||
+            process.env.NODE_ENV ||
+            "cli",
+        tracesSampleRate: 0,
+        sendDefaultPii: false,
+    });
+    enabled = true;
+}
+function toError(error, fallbackMessage) {
+    if (error instanceof Error)
+        return error;
+    if (typeof error === "string" && error.trim())
+        return new Error(error.trim());
+    return new Error(fallbackMessage);
+}
+/**
+ * Report a CLI scan failure to Sentry (BYOK, platform, or structural-only).
+ * No-op when Sentry is disabled. Never throws.
+ */
+async function reportScanCliError(input) {
+    try {
+        ensureInitialized();
+        if (!enabled)
+            return;
+        const err = toError(input.error, "CLI scan failed");
+        Sentry.withScope((scope) => {
+            scope.setTag("scan_process", "true");
+            scope.setTag("scan_error_source", "cli");
+            if (input.aiMode)
+                scope.setTag("ai_mode", input.aiMode);
+            if (input.aiProvider)
+                scope.setTag("ai_provider", input.aiProvider);
+            if (input.jobId)
+                scope.setTag("scan_job_id", input.jobId);
+            if (input.failurePhase)
+                scope.setTag("failure_phase", input.failurePhase);
+            if (input.failureCode)
+                scope.setTag("failure_code", input.failureCode);
+            if (input.scanRoot)
+                scope.setExtra("scanRoot", input.scanRoot);
+            if (input.extra)
+                scope.setExtras(input.extra);
+            Sentry.captureException(err);
+        });
+        await Sentry.flush(2000);
+    }
+    catch (reportErr) {
+        const detail = reportErr instanceof Error ? reportErr.message : String(reportErr);
+        // eslint-disable-next-line no-console
+        console.warn(`[scan] failed to report error to Sentry: ${detail}`);
+    }
+}
+/** Flush pending Sentry events before process exit. */
+async function flushCliSentry() {
+    if (!enabled)
+        return;
+    try {
+        await Sentry.flush(2000);
+    }
+    catch {
+        // ignore
+    }
+}
+/** @internal tests */
+function resetCliSentryForTests() {
+    initialized = false;
+    enabled = false;
+}

package/dist/src/output/json.d.ts

@@ -0,0 +1,51 @@
+import type { DiagramGraphJsonSchema } from "../core/schema";
+import { type DataflowWrapperSchema } from "../core/schema/dataflow-wrapper.schema";
+import type { ScanResult } from "../core/types";
+export interface BuildDataflowWrapperOptions {
+    /**
+     * Optional schema version to embed in the wrapper.
+     *
+     * Defaults to `"1.0"` which matches the current DataParade import contract.
+     * Callers should only override this when coordinating with a newer
+     * dataflow.json schema version.
+     */
+    schemaVersion?: string;
+}
+/**
+ * Assemble the top-level `dataflow.json` wrapper object from a scan result and graph.
+ *
+ * This function is intentionally free of I/O and validation side effects; it
+ * just constructs a value that can then be validated and written by callers.
+ */
+export declare function buildDataflowWrapper(scanResult: ScanResult, graph: DiagramGraphJsonSchema, options?: BuildDataflowWrapperOptions): DataflowWrapperSchema;
+export interface WriteDataflowJsonOptions {
+    /**
+     * Validated structural scan result produced by the orchestrator.
+     */
+    scanResult: ScanResult;
+    /**
+     * Diagram graph built from the scan result via `buildDiagramGraphFromScanResult`.
+     */
+    graph: DiagramGraphJsonSchema;
+    /**
+     * Absolute or relative file path where the wrapper JSON should be written.
+     */
+    outputPath: string;
+    /**
+     * Optional schema version to pass through to `buildDataflowWrapper`.
+     */
+    schemaVersion?: string;
+}
+/**
+ * Validate and write a `dataflow.json` wrapper to disk.
+ *
+ * Responsibilities:
+ * - Construct a wrapper object using `buildDataflowWrapper`.
+ * - Validate the wrapper against `DataflowWrapperSchema` and throw a
+ *   descriptive error if it is invalid.
+ * - Synchronously write the pretty-printed JSON file to `outputPath`.
+ *
+ * CLI callers rely on this function throwing for fatal output errors so they
+ * can emit a non-zero exit code.
+ */
+export declare function writeDataflowJson(options: WriteDataflowJsonOptions): void;

package/dist/src/output/json.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDataflowWrapper = buildDataflowWrapper;
+exports.writeDataflowJson = writeDataflowJson;
+const fs_1 = __importDefault(require("fs"));
+const dataflow_wrapper_schema_1 = require("../core/schema/dataflow-wrapper.schema");
+/**
+ * Assemble the top-level `dataflow.json` wrapper object from a scan result and graph.
+ *
+ * This function is intentionally free of I/O and validation side effects; it
+ * just constructs a value that can then be validated and written by callers.
+ */
+function buildDataflowWrapper(scanResult, graph, options = {}) {
+    const schemaVersion = options.schemaVersion ?? "1.0";
+    const metadata = {
+        componentsCount: scanResult.components.length,
+        dataFlowsCount: scanResult.dataFlows.length,
+        filesScanned: scanResult.filesScanned,
+        scanDurationMs: scanResult.scanDurationMs,
+    };
+    if (scanResult.aiInferenceSummary) {
+        metadata.aiInference =
+            scanResult.aiInferenceSummary;
+    }
+    if (scanResult.terraformScanSummary) {
+        metadata.terraform = scanResult.terraformScanSummary;
+    }
+    return {
+        schemaVersion,
+        graph,
+        metadata,
+    };
+}
+/**
+ * Validate and write a `dataflow.json` wrapper to disk.
+ *
+ * Responsibilities:
+ * - Construct a wrapper object using `buildDataflowWrapper`.
+ * - Validate the wrapper against `DataflowWrapperSchema` and throw a
+ *   descriptive error if it is invalid.
+ * - Synchronously write the pretty-printed JSON file to `outputPath`.
+ *
+ * CLI callers rely on this function throwing for fatal output errors so they
+ * can emit a non-zero exit code.
+ */
+function writeDataflowJson(options) {
+    const { scanResult, graph, outputPath, schemaVersion } = options;
+    const wrapper = buildDataflowWrapper(scanResult, graph, { schemaVersion });
+    const validation = (0, dataflow_wrapper_schema_1.validateDataflowJson)(wrapper);
+    if (!validation.ok) {
+        const messages = validation.errors.join("; ");
+        throw new Error(`Invalid dataflow.json wrapper: ${messages}`);
+    }
+    const json = JSON.stringify(validation.value, null, 2);
+    fs_1.default.writeFileSync(outputPath, json, "utf8");
+}

package/dist/src/patterns/config.d.ts

@@ -0,0 +1,22 @@
+import type { ActorDetectionConfig } from "../config/actor-detection-config";
+import type { PropertyDetectionConfig } from "../config/property-detection-config";
+import type { ThirdPartyDetectionConfig } from "../config/third-party-detection-config";
+import type { TypeScriptPatternConfig } from "../analyzers/typescript/typescript-detection-config";
+import type { ClassifierConfig } from "../classifier/config";
+import type { PythonPatternConfig } from "../analyzers/python/python-detection-config";
+import type { TerraformPatternConfig } from "../analyzers/terraform/terraform-detection-config";
+export interface UnifiedPatternConfig {
+    actors: ActorDetectionConfig;
+    properties: PropertyDetectionConfig;
+    thirdParty: ThirdPartyDetectionConfig;
+    typescript: TypeScriptPatternConfig;
+    classifier: ClassifierConfig;
+    python: PythonPatternConfig;
+    terraform: TerraformPatternConfig;
+}
+/**
+ * Loads all pattern/classifier YAML configs into a single in-memory object
+ * so analyzers and the shared pattern engine can access them in a
+ * language-agnostic way.
+ */
+export declare function loadUnifiedPatternConfig(): UnifiedPatternConfig;

package/dist/src/patterns/config.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadUnifiedPatternConfig = loadUnifiedPatternConfig;
+const actor_detection_config_1 = require("../config/actor-detection-config");
+const property_detection_config_1 = require("../config/property-detection-config");
+const third_party_detection_config_1 = require("../config/third-party-detection-config");
+const typescript_detection_config_1 = require("../analyzers/typescript/typescript-detection-config");
+const config_1 = require("../classifier/config");
+const python_detection_config_1 = require("../analyzers/python/python-detection-config");
+const terraform_detection_config_1 = require("../analyzers/terraform/terraform-detection-config");
+let cachedUnifiedConfig;
+function validateUnifiedPatternConfig(unified) {
+    const classifierPatternIds = new Set(unified.classifier.patternDefaults.map((d) => d.patternId));
+    const emittedPatternIds = new Set();
+    // Actors.
+    for (const rule of unified.actors.rules) {
+        emittedPatternIds.add(String(rule.patternId));
+    }
+    // TypeScript.
+    for (const fw of unified.typescript.routes.frameworks) {
+        emittedPatternIds.add(String(fw.patternId));
+    }
+    for (const db of unified.typescript.dbClients) {
+        emittedPatternIds.add(String(db.patternId));
+    }
+    for (const lib of unified.typescript.auth.libraries) {
+        emittedPatternIds.add(String(lib.patternId));
+    }
+    emittedPatternIds.add(String(unified.typescript.heuristics.sqlKeyword.patternId));
+    for (const key of unified.typescript.configKeys.keys) {
+        emittedPatternIds.add(String(key.patternId));
+    }
+    // TS env/config patterns are driven by the engine, not by YAML fields.
+    // Still treat them as "emitted" patterns so classifier config remains consistent.
+    emittedPatternIds.add("env_variable");
+    emittedPatternIds.add("config_file");
+    // Python.
+    for (const db of unified.python.dbClients) {
+        emittedPatternIds.add(String(db.patternId));
+    }
+    if (unified.python.auth.jwt) {
+        emittedPatternIds.add(String(unified.python.auth.jwt.patternId));
+    }
+    for (const d of unified.python.auth.decorators) {
+        emittedPatternIds.add(String(d.patternId));
+    }
+    for (const fw of unified.python.routes.frameworks) {
+        emittedPatternIds.add(String(fw.patternId));
+    }
+    if (unified.python.envConfig.envVariable) {
+        emittedPatternIds.add(String(unified.python.envConfig.envVariable.patternId));
+    }
+    if (unified.python.envConfig.djangoSettings) {
+        emittedPatternIds.add(String(unified.python.envConfig.djangoSettings.patternId));
+    }
+    if (unified.python.envConfig.dotenvConfig) {
+        emittedPatternIds.add(String(unified.python.envConfig.dotenvConfig.patternId));
+    }
+    for (const c of unified.python.externalApis.httpClients) {
+        emittedPatternIds.add(String(c.patternId));
+    }
+    // Third-party external API pattern.
+    for (const svc of unified.thirdParty.services) {
+        emittedPatternIds.add(String(svc.patternId));
+    }
+    emittedPatternIds.add("external_api_call");
+    emittedPatternIds.add("auth_middleware");
+    emittedPatternIds.add("database_connection");
+    emittedPatternIds.add("express_route");
+    emittedPatternIds.add("terraform_resource");
+    emittedPatternIds.add("terraform_module");
+    emittedPatternIds.add("terraform_provider");
+    const missingInClassifier = Array.from(emittedPatternIds).filter((pid) => !classifierPatternIds.has(pid));
+    if (missingInClassifier.length > 0) {
+        throw new Error(`Unified pattern config validation failed: classifier.pattern_defaults is missing ${missingInClassifier.join(", ")}.`);
+    }
+    // Ensure third-party service catalog alignment (serviceName label).
+    const patternServiceNames = unified.thirdParty.services.map((s) => s.serviceName.toLowerCase());
+    const classifierServiceNames = unified.classifier.thirdParties.map((s) => s.serviceName.toLowerCase());
+    const missingThirdPartyServices = patternServiceNames.filter((svc) => !classifierServiceNames.includes(svc));
+    if (missingThirdPartyServices.length > 0) {
+        throw new Error(`Unified pattern config validation failed: third-party classifier is missing serviceName(s) referenced in third-party.patterns.yaml: ${Array.from(new Set(missingThirdPartyServices)).join(", ")}.`);
+    }
+}
+/**
+ * Loads all pattern/classifier YAML configs into a single in-memory object
+ * so analyzers and the shared pattern engine can access them in a
+ * language-agnostic way.
+ */
+function loadUnifiedPatternConfig() {
+    // Jest tests sometimes mock individual YAML loaders (e.g. TypeScript config).
+    // If we keep a process-wide cache, those mocks won't take effect.
+    if (process.env.NODE_ENV !== "test") {
+        if (cachedUnifiedConfig) {
+            return cachedUnifiedConfig;
+        }
+    }
+    const actors = (0, actor_detection_config_1.loadActorDetectionConfig)();
+    const properties = (0, property_detection_config_1.loadPropertyDetectionConfig)();
+    const thirdParty = (0, third_party_detection_config_1.loadThirdPartyDetectionConfig)();
+    const typescript = (0, typescript_detection_config_1.loadTypeScriptPatternConfig)();
+    const classifier = (0, config_1.loadClassifierConfig)();
+    const python = (0, python_detection_config_1.loadPythonPatternConfig)();
+    const terraform = (0, terraform_detection_config_1.loadTerraformPatternConfig)();
+    const unified = {
+        actors,
+        properties,
+        thirdParty,
+        typescript,
+        classifier,
+        python,
+        terraform,
+    };
+    validateUnifiedPatternConfig(unified);
+    if (process.env.NODE_ENV !== "test") {
+        cachedUnifiedConfig = unified;
+    }
+    return unified;
+}

package/dist/src/patterns/detectors/helpers.d.ts

@@ -0,0 +1,19 @@
+import type { FileInfo, SourceLocation } from "../../core/types/file";
+import type { UnifiedPatternConfig } from "../config";
+export declare function createLocationFromLine(file: FileInfo, line: number, code?: string): SourceLocation;
+export declare function findLineMatches(content: string, regex: RegExp): {
+    line: number;
+    match: RegExpMatchArray;
+}[];
+export declare function findFirstLineMatch(content: string, regex: RegExp | undefined): {
+    line: number;
+    code: string;
+} | undefined;
+export declare function buildThirdPartyUrlHostPatterns(config: UnifiedPatternConfig): {
+    pattern: string;
+    serviceName: string;
+}[];
+export declare function inferServiceNameFromUrl(url: string | undefined, urlHostPatterns: {
+    pattern: string;
+    serviceName: string;
+}[]): string | undefined;

package/dist/src/patterns/detectors/helpers.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLocationFromLine = createLocationFromLine;
+exports.findLineMatches = findLineMatches;
+exports.findFirstLineMatch = findFirstLineMatch;
+exports.buildThirdPartyUrlHostPatterns = buildThirdPartyUrlHostPatterns;
+exports.inferServiceNameFromUrl = inferServiceNameFromUrl;
+function createLocationFromLine(file, line, code) {
+    return {
+        filePath: file.path,
+        startLine: line,
+        endLine: line,
+        code,
+    };
+}
+function findLineMatches(content, regex) {
+    const results = [];
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const lineText = lines[i];
+        const trimmed = lineText.trim();
+        if (trimmed.startsWith("//") ||
+            trimmed.startsWith("/*") ||
+            trimmed.startsWith("*")) {
+            continue;
+        }
+        const match = lineText.match(regex);
+        if (match) {
+            results.push({
+                line: i + 1,
+                match,
+            });
+        }
+    }
+    return results;
+}
+function findFirstLineMatch(content, regex) {
+    if (!regex)
+        return undefined;
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const lineText = lines[i];
+        if (regex.test(lineText)) {
+            return { line: i + 1, code: lineText };
+        }
+    }
+    return undefined;
+}
+function buildThirdPartyUrlHostPatterns(config) {
+    const urlHostPatterns = [];
+    for (const svc of config.thirdParty.services) {
+        for (const pattern of svc.urlHostPatterns) {
+            urlHostPatterns.push({ pattern, serviceName: svc.serviceName });
+        }
+    }
+    return urlHostPatterns;
+}
+function inferServiceNameFromUrl(url, urlHostPatterns) {
+    if (!url || urlHostPatterns.length === 0)
+        return undefined;
+    const lower = url.toLowerCase();
+    for (const { pattern, serviceName } of urlHostPatterns) {
+        if (lower.includes(pattern.toLowerCase())) {
+            return serviceName;
+        }
+    }
+    return undefined;
+}

package/dist/src/patterns/detectors/python.d.ts

@@ -0,0 +1,8 @@
+import type { PatternContext } from "../engine";
+import type { UnifiedPatternConfig } from "../config";
+import type { RawFinding } from "../../core/types/detection";
+export declare function detectPythonDatabaseConnectionsFromImportsAndContent(ctx: PatternContext, config: UnifiedPatternConfig): RawFinding[];
+export declare function detectPythonAuthFromConfig(ctx: PatternContext, config: UnifiedPatternConfig): RawFinding[];
+export declare function detectPythonEnvAndConfigFromConfig(ctx: PatternContext, config: UnifiedPatternConfig): RawFinding[];
+export declare function detectPythonRoutesFromConfig(ctx: PatternContext, config: UnifiedPatternConfig): RawFinding[];
+export declare function detectPythonExternalApisFromConfig(ctx: PatternContext, config: UnifiedPatternConfig): RawFinding[];