@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/clients/project-scan-policy.js

@@ -1,52 +1,6 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import {
-  getProjectIgnoreMatcher,
-  isExcludedDirName
-} from "./file-utils.js";
-import {
-  isGeneratedArtifactDirectoryName,
-  isGeneratedOrArtifact
-} from "./generated-artifacts.js";
-import {
-  collectSourceFiles,
-  collectSourceFilesAsync,
   collectSourceFilesWithBudgetAsync
 } from "./source-filter.js";
-export function shouldSkipProjectPath(filePath, options) {
-  const isDirectory = options.isDirectory === true;
-  const matcher = options.ignoreMatcher ?? getProjectIgnoreMatcher(options.rootDir);
-  if (matcher.isIgnored(filePath, isDirectory))
-    return true;
-  const name = path.basename(filePath);
-  if (isDirectory) {
-    if (isExcludedDirName(name))
-      return true;
-    return options.includeGenerated !== true && isGeneratedArtifactDirectoryName(name);
-  }
-  return options.includeGenerated !== true && isGeneratedOrArtifact(filePath, {
-    readContentHeader: options.inspectGeneratedHeaders !== false,
-    includeDeclarations: options.includeDeclarationFiles !== true
-  });
-}
-export function shouldScanProjectSourceFile(filePath, options) {
-  try {
-    if (!fs.statSync(filePath).isFile())
-      return false;
-  } catch {
-    return false;
-  }
-  return !shouldSkipProjectPath(filePath, {
-    ...options,
-    isDirectory: false
-  });
-}
-export function collectProjectSourceFiles(rootDir, options) {
-  return collectSourceFiles(rootDir, options);
-}
-export function collectProjectSourceFilesAsync(rootDir, options) {
-  return collectSourceFilesAsync(rootDir, options);
-}
 export function collectProjectSourceFilesWithBudgetAsync(rootDir, options) {
   return collectSourceFilesWithBudgetAsync(rootDir, options);
 }

package/extensions/dm-lens/clients/python-environment.js

@@ -1,11 +1,87 @@
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
-export async function detectPythonEnvironment(projectRoot) {
+import {
+  extractTomlTableSection,
+  hasTomlTable,
+  parseTomlStringArray
+} from "./cargo-manifest.js";
+import {
+  isAtOrAboveHomeDir,
+  matchesWorkspaceMemberPattern,
+  toPosix,
+  UV_WORKSPACE_EXCLUDE_DIALECT,
+  UV_WORKSPACE_MEMBERS_DIALECT,
+  walkUpDirs
+} from "./path-utils.js";
+const UV_WORKSPACE_TABLE = "tool\\.uv\\.workspace";
+async function findUvWorkspace(startDir, homeDir) {
+  const resolvedStart = path.resolve(startDir);
+  let nearestProject;
+  for (const dir of walkUpDirs(startDir)) {
+    if (isAtOrAboveHomeDir(dir, homeDir))
+      break;
+    let content;
+    try {
+      content = await readFile(path.join(dir, "pyproject.toml"), "utf8");
+    } catch {
+      continue;
+    }
+    if (!nearestProject)
+      nearestProject = dir;
+    if (hasTomlTable(content, UV_WORKSPACE_TABLE)) {
+      const workspaceTable = extractTomlTableSection(content, UV_WORKSPACE_TABLE);
+      return {
+        root: dir,
+        explicit: true,
+        projectRoot: nearestProject,
+        isStartDir: nearestProject === resolvedStart,
+        members: parseTomlStringArray(workspaceTable, "members"),
+        exclude: parseTomlStringArray(workspaceTable, "exclude")
+      };
+    }
+  }
+  return nearestProject ? {
+    root: nearestProject,
+    explicit: false,
+    projectRoot: nearestProject,
+    isStartDir: nearestProject === resolvedStart,
+    members: [],
+    exclude: []
+  } : undefined;
+}
+function isUvWorkspaceMember(workspace, projectRoot) {
+  const relative = toPosix(path.relative(workspace.root, projectRoot));
+  if (relative.length === 0 || relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) {
+    return false;
+  }
+  const matches = (dialect) => (pattern) => matchesWorkspaceMemberPattern(pattern, relative, dialect);
+  return !workspace.exclude.some(matches(UV_WORKSPACE_EXCLUDE_DIALECT)) && workspace.members.some(matches(UV_WORKSPACE_MEMBERS_DIALECT));
+}
+export async function detectPythonEnvironment(projectRoot, homeDir = os.homedir()) {
+  const root = path.resolve(projectRoot);
+  const uvWorkspace = await findUvWorkspace(root, homeDir);
+  const isProjectRoot = uvWorkspace?.isStartDir === true;
+  const memberWorkspaceRoot = isProjectRoot && uvWorkspace.explicit && isUvWorkspaceMember(uvWorkspace, root) ? uvWorkspace.root : undefined;
+  const uvEnvironmentRoot = isProjectRoot ? memberWorkspaceRoot ?? uvWorkspace.projectRoot : undefined;
+  const uvProjectEnvironment = process.env.UV_PROJECT_ENVIRONMENT;
   const candidates = [
+    ...uvEnvironmentRoot !== undefined && uvProjectEnvironment ? [
+      {
+        root: path.resolve(uvEnvironmentRoot, uvProjectEnvironment),
+        source: "uv-project-environment"
+      }
+    ] : [],
+    ...memberWorkspaceRoot !== undefined ? [
+      {
+        root: path.join(memberWorkspaceRoot, ".venv"),
+        source: "uv-workspace"
+      }
+    ] : [],
     { root: process.env.VIRTUAL_ENV, source: "virtual-env" },
     { root: process.env.CONDA_PREFIX, source: "conda" },
-    { root: path.join(projectRoot, ".venv"), source: "project-dot-venv" },
-    { root: path.join(projectRoot, "venv"), source: "project-venv" }
+    { root: path.join(root, ".venv"), source: "project-dot-venv" },
+    { root: path.join(root, "venv"), source: "project-venv" }
   ];
   for (const candidate of candidates) {
     if (!candidate.root)

package/extensions/dm-lens/clients/python-provenance.js

@@ -0,0 +1,551 @@
+const SUMMARY_BY_ROOT = new WeakMap;
+const TRAVERSAL_VISIT_CAP = 50000;
+const TRAVERSAL_DEPTH_CAP = 128;
+const EXPRESSION_DEPTH_CAP = 8;
+const BINDING_SCAN_DEPTH_CAP = 32;
+const ANCESTOR_DEPTH_CAP = 64;
+export const PYTHON_SQLALCHEMY_RECEIVER_NAMES = new Set([
+  "session",
+  "db_session",
+  "async_session",
+  "sync_session"
+]);
+export const PYTHON_SQLALCHEMY_STATEMENT_BUILDERS = new Set(["select", "insert", "update", "delete"]);
+const FROM_IMPORT_PROVENANCE = new Map([
+  ["sqlalchemy.orm:Session", "sqlalchemy-session"],
+  ["sqlalchemy.ext.asyncio:AsyncSession", "sqlalchemy-session"],
+  ["psycopg:sql", "psycopg-sql-module"],
+  ["psycopg2:sql", "psycopg-sql-module"],
+  ["psycopg.sql:SQL", "psycopg-sql-constructor"],
+  ["psycopg2.sql:SQL", "psycopg-sql-constructor"],
+  ["psycopg.sql:Identifier", "psycopg-identifier-constructor"],
+  ["psycopg2.sql:Identifier", "psycopg-identifier-constructor"]
+]);
+const PLAIN_PACKAGE_PROVENANCE = new Map([
+  ["sqlalchemy", "sqlalchemy-module"],
+  ["psycopg", "psycopg-package"],
+  ["psycopg2", "psycopg-package"]
+]);
+function nodeKey(node) {
+  return `${node.type}:${node.startIndex}:${node.endIndex}`;
+}
+function namedChildren(node) {
+  return (node.children ?? []).filter((child) => child.isNamed);
+}
+function calleeNode(call) {
+  if (call.type !== "call")
+    return;
+  return call.childForFieldName?.("function") ?? namedChildren(call)[0];
+}
+function directNamedChild(node, type) {
+  return namedChildren(node).find((child) => child.type === type);
+}
+const BINDING_TARGET_CONTAINER_TYPES = new Set([
+  "tuple",
+  "pattern_list",
+  "list",
+  "list_pattern",
+  "tuple_pattern",
+  "starred_expression",
+  "list_splat_pattern",
+  "dictionary_splat_pattern"
+]);
+const BINDING_TARGET_REFERENCE_TYPES = new Set(["attribute", "subscript"]);
+const BINDING_PATTERN_CONTAINER_TYPES = new Set([
+  "case_pattern",
+  "as_pattern",
+  "union_pattern",
+  "list_pattern",
+  "tuple_pattern",
+  "list_splat_pattern",
+  "dictionary_splat_pattern",
+  "class_pattern"
+]);
+const BINDING_PATTERN_REFERENCE_TYPES = new Set([
+  "attribute",
+  "qualified_pattern"
+]);
+function scanBindingNames(node, mode, scan, depth = 0) {
+  if (!node || depth > BINDING_SCAN_DEPTH_CAP) {
+    scan.unknown = true;
+    return;
+  }
+  const descend = (child, next) => scanBindingNames(child, next, scan, depth + 1);
+  if (node.type === "as_pattern_target") {
+    descend(namedChildren(node)[0], "target");
+    return;
+  }
+  if (mode === "as") {
+    for (const child of namedChildren(node))
+      descend(child, "as");
+    return;
+  }
+  if (node.type === "identifier") {
+    if (node.text !== "_")
+      scan.names.push(node.text);
+    return;
+  }
+  if (mode === "pattern") {
+    if (node.type === "dotted_name") {
+      if (!node.text.includes(".") && node.text !== "_") {
+        scan.names.push(node.text);
+      }
+      return;
+    }
+    if (BINDING_PATTERN_REFERENCE_TYPES.has(node.type))
+      return;
+    if (node.type === "keyword_pattern") {
+      const value = namedChildren(node).slice(1);
+      if (value.length !== 1)
+        scan.unknown = true;
+      else
+        descend(value[0], "pattern");
+      return;
+    }
+    if (BINDING_PATTERN_CONTAINER_TYPES.has(node.type)) {
+      for (const child of namedChildren(node))
+        descend(child, "pattern");
+      return;
+    }
+    scan.unknown = true;
+    return;
+  }
+  if (BINDING_TARGET_REFERENCE_TYPES.has(node.type))
+    return;
+  if (BINDING_TARGET_CONTAINER_TYPES.has(node.type)) {
+    for (const child of namedChildren(node))
+      descend(child, "target");
+    return;
+  }
+  scan.unknown = true;
+}
+function collectBindingNames(node, mode) {
+  const scan = { names: [], unknown: false };
+  scanBindingNames(node, mode, scan);
+  return scan;
+}
+function parseImportBinding(node, isFrom) {
+  if (node.type === "aliased_import") {
+    const children = namedChildren(node);
+    const source = children[0]?.text;
+    const local = children.at(-1);
+    return source && local?.type === "identifier" ? { source, local: local.text } : undefined;
+  }
+  if (node.type !== "dotted_name" && node.type !== "identifier") {
+    return;
+  }
+  if (isFrom)
+    return { source: node.text, local: node.text };
+  const local = node.text.split(".")[0];
+  return local ? { source: node.text, local } : undefined;
+}
+function directAnnotationName(parameter) {
+  if (parameter.type !== "typed_parameter" && parameter.type !== "typed_default_parameter") {
+    return;
+  }
+  const type = directNamedChild(parameter, "type");
+  const children = type ? namedChildren(type) : [];
+  return children.length === 1 && children[0]?.type === "identifier" ? children[0].text : undefined;
+}
+function parameterName(parameter) {
+  if (parameter.type === "identifier")
+    return parameter.text;
+  return directNamedChild(parameter, "identifier")?.text;
+}
+function markInvalid(state) {
+  state.invalid = true;
+}
+function addBinding(state, name, functionChain) {
+  state.bindingCounts.set(name, (state.bindingCounts.get(name) ?? 0) + 1);
+  for (const fn of functionChain) {
+    const key = nodeKey(fn);
+    const bindings = state.functionBindings.get(key) ?? new Map;
+    bindings.set(name, (bindings.get(name) ?? 0) + 1);
+    state.functionBindings.set(key, bindings);
+  }
+}
+function addTarget(state, target, functionChain) {
+  const extracted = collectBindingNames(target, "target");
+  if (extracted.unknown)
+    markInvalid(state);
+  for (const name of extracted.names)
+    addBinding(state, name, functionChain);
+}
+function recordFunctionParameters(node, state) {
+  const annotations = new Map;
+  const parameters = directNamedChild(node, "parameters");
+  for (const parameter of namedChildren(parameters ?? node)) {
+    const name = parameterName(parameter);
+    if (!name) {
+      if (parameter.type !== "list_splat_pattern")
+        markInvalid(state);
+      continue;
+    }
+    addBinding(state, name, state.functionChain);
+    const annotation = directAnnotationName(parameter);
+    if (annotation)
+      annotations.set(name, annotation);
+  }
+  state.functionAnnotations.set(nodeKey(node), annotations);
+}
+function recordFunctionDefinition(node, state) {
+  recordFunctionParameters(node, state);
+  recordDefinitionBinding(node, state);
+}
+function recordLambdaParameters(node, state) {
+  const parameters = directNamedChild(node, "lambda_parameters");
+  for (const parameter of namedChildren(parameters ?? node)) {
+    const name = parameterName(parameter);
+    if (name)
+      addBinding(state, name, state.functionChain);
+    else
+      markInvalid(state);
+  }
+}
+function recordImportBindings(node, state) {
+  const isFrom = node.type === "import_from_statement";
+  const children = namedChildren(node);
+  const moduleName = isFrom ? children[0]?.text : undefined;
+  if (node.text.includes("*") || isFrom && !moduleName)
+    markInvalid(state);
+  for (const part of isFrom ? children.slice(1) : children) {
+    const binding = parseImportBinding(part, isFrom);
+    if (!binding) {
+      markInvalid(state);
+      continue;
+    }
+    addBinding(state, binding.local, state.functionChain);
+    if (!state.moduleDirect)
+      continue;
+    const provenance = isFrom ? FROM_IMPORT_PROVENANCE.get(`${moduleName}:${binding.source}`) : PLAIN_PACKAGE_PROVENANCE.get(binding.source);
+    if (provenance) {
+      state.imports.set(binding.local, {
+        name: binding.local,
+        provenance,
+        endIndex: node.endIndex
+      });
+    }
+  }
+}
+function recordTargetBinding(node, state) {
+  addTarget(state, node.childForFieldName?.("left") ?? namedChildren(node)[0], state.functionChain);
+}
+function recordAssignmentValue(node, state) {
+  recordTargetBinding(node, state);
+  const target = node.childForFieldName?.("left") ?? namedChildren(node)[0];
+  const value = node.childForFieldName?.("right") ?? namedChildren(node).at(-1);
+  if (target?.type !== "identifier" || !value || value === target)
+    return;
+  state.assignments.set(target.text, value);
+}
+function recordAsPatternBinding(node, state) {
+  const extracted = collectBindingNames(node, "as");
+  if (extracted.unknown)
+    markInvalid(state);
+  for (const name of extracted.names)
+    addBinding(state, name, state.functionChain);
+}
+function recordDeleteTargets(node, state) {
+  for (const child of namedChildren(node)) {
+    addTarget(state, child, state.functionChain);
+  }
+}
+function recordCaseBindings(node, state) {
+  const extracted = collectBindingNames(directNamedChild(node, "case_pattern"), "pattern");
+  if (extracted.unknown)
+    markInvalid(state);
+  for (const name of extracted.names)
+    addBinding(state, name, state.functionChain);
+}
+function recordDeclarationBindings(node, state) {
+  for (const child of namedChildren(node)) {
+    addBinding(state, child.text, state.functionChain);
+  }
+}
+function recordDefinitionBinding(node, state) {
+  const name = directNamedChild(node, "identifier")?.text;
+  if (name)
+    addBinding(state, name, state.parentFunctionChain);
+  else
+    markInvalid(state);
+}
+function recordTypeAliasBinding(node, state) {
+  const name = directNamedChild(node, "type")?.children?.find((child) => child.type === "identifier")?.text;
+  if (name)
+    addBinding(state, name, state.functionChain);
+  else
+    markInvalid(state);
+}
+const DYNAMIC_NAMESPACE_BUILTINS = new Set([
+  "exec",
+  "eval",
+  "globals",
+  "locals",
+  "vars"
+]);
+function recordDynamicNamespaceHazard(node, state) {
+  const callee = calleeNode(node);
+  if (callee?.type === "identifier" && DYNAMIC_NAMESPACE_BUILTINS.has(callee.text)) {
+    markInvalid(state);
+  }
+}
+const SUMMARY_NODE_RECORDERS = Object.freeze({
+  function_definition: recordFunctionDefinition,
+  class_definition: recordDefinitionBinding,
+  lambda: recordLambdaParameters,
+  import_from_statement: recordImportBindings,
+  import_statement: recordImportBindings,
+  assignment: recordAssignmentValue,
+  augmented_assignment: recordTargetBinding,
+  named_expression: recordTargetBinding,
+  for_statement: recordTargetBinding,
+  for_in_clause: recordTargetBinding,
+  with_item: recordAsPatternBinding,
+  except_clause: recordAsPatternBinding,
+  except_group_clause: recordAsPatternBinding,
+  delete_statement: recordDeleteTargets,
+  case_clause: recordCaseBindings,
+  type_alias_statement: recordTypeAliasBinding,
+  global_statement: recordDeclarationBindings,
+  nonlocal_statement: recordDeclarationBindings,
+  call: recordDynamicNamespaceHazard
+});
+
+class Summary {
+  invalid;
+  imports;
+  bindingCounts;
+  assignments;
+  functions;
+  constructor(root) {
+    const state = {
+      imports: new Map,
+      bindingCounts: new Map,
+      assignments: new Map,
+      functionBindings: new Map,
+      functionAnnotations: new Map,
+      invalid: false,
+      visits: 0,
+      functionChain: [],
+      parentFunctionChain: [],
+      moduleDirect: false
+    };
+    const visit = (node, depth, moduleDirect, activeFunctions) => {
+      if (++state.visits > TRAVERSAL_VISIT_CAP || depth > TRAVERSAL_DEPTH_CAP) {
+        markInvalid(state);
+        return;
+      }
+      if (node.hasError || node.type === "ERROR" || node.type === "MISSING") {
+        markInvalid(state);
+        return;
+      }
+      const functionChain = node.type === "function_definition" ? [...activeFunctions, node] : activeFunctions;
+      state.functionChain = functionChain;
+      state.parentFunctionChain = activeFunctions;
+      state.moduleDirect = moduleDirect;
+      const recorder = SUMMARY_NODE_RECORDERS[node.type];
+      if (recorder)
+        recorder(node, state);
+      for (const child of node.children ?? []) {
+        visit(child, depth + 1, node === root, functionChain);
+      }
+    };
+    visit(root, 0, false, []);
+    this.invalid = state.invalid;
+    this.imports = state.imports;
+    this.bindingCounts = state.bindingCounts;
+    this.assignments = state.assignments;
+    this.functions = new Map([...state.functionAnnotations.entries()].map(([key, annotations]) => [
+      key,
+      {
+        parameterAnnotations: annotations,
+        bindingCounts: state.functionBindings.get(key) ?? new Map
+      }
+    ]));
+  }
+  provenanceFor(name, reference) {
+    const candidate = this.boundOnce(name) ? this.imports.get(name) : undefined;
+    return candidate && candidate.endIndex <= reference.startIndex ? candidate.provenance : null;
+  }
+  boundOnce(name) {
+    return !this.invalid && (this.bindingCounts.get(name) ?? 0) === 1;
+  }
+  singleAssignmentValue(name, reference) {
+    if (!this.boundOnce(name))
+      return null;
+    const value = this.assignments.get(name);
+    return value && value.endIndex <= reference.startIndex ? value : null;
+  }
+  isFunctionLocalName(reference) {
+    if (this.invalid || reference.type !== "identifier")
+      return true;
+    let current = reference.parent;
+    for (let depth = 0;current && depth < ANCESTOR_DEPTH_CAP; depth++) {
+      if (current.type === "function_definition") {
+        const summary = this.functions.get(nodeKey(current));
+        if (!summary)
+          return true;
+        if ((summary.bindingCounts.get(reference.text) ?? 0) > 0)
+          return true;
+      }
+      current = current.parent;
+    }
+    return false;
+  }
+  isSqlAlchemySessionReceiver(receiver) {
+    if (this.invalid || receiver.type !== "identifier")
+      return false;
+    let current = receiver.parent;
+    for (let depth = 0;current && depth < ANCESTOR_DEPTH_CAP; depth++) {
+      if (current.type === "function_definition") {
+        const summary = this.functions.get(nodeKey(current));
+        if (!summary)
+          return false;
+        const annotation = summary.parameterAnnotations.get(receiver.text);
+        return annotation !== undefined && (summary.bindingCounts.get(receiver.text) ?? 0) === 1 && this.provenanceFor(annotation, receiver) === "sqlalchemy-session";
+      }
+      current = current.parent;
+    }
+    return false;
+  }
+}
+function getPythonProvenanceSummary(root) {
+  const cached = SUMMARY_BY_ROOT.get(root);
+  if (cached)
+    return cached;
+  const summary = new Summary(root);
+  SUMMARY_BY_ROOT.set(root, summary);
+  return summary;
+}
+function expressionProvenance(node, summary, depth = 0) {
+  if (!node || depth > EXPRESSION_DEPTH_CAP)
+    return null;
+  if (node.type === "identifier")
+    return summary.provenanceFor(node.text, node);
+  if (node.type !== "attribute")
+    return null;
+  const object = node.childForFieldName?.("object") ?? namedChildren(node)[0];
+  const attribute = node.childForFieldName?.("attribute") ?? namedChildren(node).at(-1);
+  const provenance = expressionProvenance(object, summary, depth + 1);
+  if (provenance === "psycopg-package" && attribute?.text === "sql") {
+    return "psycopg-sql-module";
+  }
+  if (provenance === "psycopg-sql-module") {
+    if (attribute?.text === "SQL")
+      return "psycopg-sql-constructor";
+    if (attribute?.text === "Identifier")
+      return "psycopg-identifier-constructor";
+  }
+  return null;
+}
+export function isSafePsycopgIdentifierComposition(node, root) {
+  if (node?.type !== "call" || !root)
+    return false;
+  const summary = getPythonProvenanceSummary(root);
+  if (summary.invalid)
+    return false;
+  const formatCallee = node.childForFieldName?.("function") ?? namedChildren(node)[0];
+  if (formatCallee?.type !== "attribute")
+    return false;
+  const formatChildren = namedChildren(formatCallee);
+  const hasFormatMethod = formatChildren.some((child) => child.text === "format");
+  const sqlConstructor = formatChildren.find((child) => child.type === "call");
+  if (!hasFormatMethod || !sqlConstructor)
+    return false;
+  const constructorCallee = sqlConstructor.childForFieldName?.("function") ?? namedChildren(sqlConstructor)[0];
+  if (expressionProvenance(constructorCallee, summary) !== "psycopg-sql-constructor")
+    return false;
+  const templateArgs = namedChildren(directNamedChild(sqlConstructor, "argument_list") ?? sqlConstructor).filter((child) => child.type !== "comment");
+  if (templateArgs.length !== 1 || templateArgs[0]?.type !== "string" || namedChildren(templateArgs[0]).some((child) => child.type === "interpolation"))
+    return false;
+  const formatArgs = namedChildren(directNamedChild(node, "argument_list") ?? node).filter((child) => child.type !== "comment");
+  if (formatArgs.length === 0)
+    return false;
+  return formatArgs.every((argument) => {
+    if (argument.type !== "call")
+      return false;
+    const callee = argument.childForFieldName?.("function") ?? namedChildren(argument)[0];
+    return expressionProvenance(callee, summary) === "psycopg-identifier-constructor";
+  });
+}
+export function isProvenSqlAlchemySessionReceiver(receiver, root) {
+  return !!receiver && !!root && getPythonProvenanceSummary(root).isSqlAlchemySessionReceiver(receiver);
+}
+function isStaticStringLiteral(node) {
+  return node?.type === "string" && !namedChildren(node).some((child) => child.type === "interpolation");
+}
+function callArguments(call) {
+  return namedChildren(directNamedChild(call, "argument_list") ?? call).filter((child) => child.type !== "comment");
+}
+const COMPOSED_SQL_NODE_TYPES = new Set([
+  "string",
+  "concatenated_string",
+  "binary_operator"
+]);
+function carriesComposedSql(node, depth = 0) {
+  if (!node)
+    return false;
+  if (depth > EXPRESSION_DEPTH_CAP)
+    return true;
+  if (COMPOSED_SQL_NODE_TYPES.has(node.type))
+    return true;
+  if (node.type !== "call")
+    return false;
+  const callee = calleeNode(node);
+  if (callee?.type === "attribute") {
+    const object = callee.childForFieldName?.("object") ?? namedChildren(callee)[0];
+    if (carriesComposedSql(object, depth + 1))
+      return true;
+  }
+  return callArguments(node).some((argument) => carriesComposedSql(argument, depth + 1));
+}
+function builderCalleeName(call, summary) {
+  const callee = calleeNode(call);
+  if (callee?.type === "identifier")
+    return callee.text;
+  if (callee?.type !== "attribute")
+    return;
+  const object = callee.childForFieldName?.("object") ?? namedChildren(callee)[0];
+  if (expressionProvenance(object, summary) !== "sqlalchemy-module") {
+    return;
+  }
+  const attribute = callee.childForFieldName?.("attribute") ?? namedChildren(callee).at(-1);
+  return attribute?.type === "identifier" ? attribute.text : undefined;
+}
+function isStatementBuilderCall(node, summary) {
+  if (node?.type !== "call")
+    return false;
+  const name = builderCalleeName(node, summary);
+  if (!name)
+    return false;
+  const args = callArguments(node);
+  if (name === "text") {
+    return args.length === 1 && isStaticStringLiteral(args[0]);
+  }
+  if (!PYTHON_SQLALCHEMY_STATEMENT_BUILDERS.has(name))
+    return false;
+  return !args.some((argument) => carriesComposedSql(argument));
+}
+export function isSqlAlchemyStatementArgument(node, root) {
+  if (!node || !root)
+    return false;
+  const summary = getPythonProvenanceSummary(root);
+  if (isStatementBuilderCall(node, summary))
+    return true;
+  if (node.type !== "identifier")
+    return false;
+  const bound = summary.singleAssignmentValue(node.text, node);
+  return isStatementBuilderCall(bound ?? undefined, summary);
+}
+export function isSqlAlchemyEntityQueryArgument(node, root) {
+  if (!node || !root)
+    return false;
+  const summary = getPythonProvenanceSummary(root);
+  if (isStatementBuilderCall(node, summary))
+    return true;
+  if (carriesComposedSql(node))
+    return false;
+  if (node.type !== "identifier")
+    return true;
+  return !summary.isFunctionLocalName(node);
+}