@getmikk/core 2.0.13 → 2.0.15

package/tests/verification.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, afterEach, beforeEach } from 'bun:test';
+import { GraphBuilder } from '../src/graph/graph-builder.js';
+import { parseFiles } from '../src/parser/index.js';
+import { OxcResolver } from '../src/parser/oxc-resolver.js';
+import '../src/parser/oxc-parser.js';
+import '../src/parser/go/go-extractor.js';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+
+async function resolveImports(files: any[], projectRoot: string) {
+    const resolver = new OxcResolver(projectRoot);
+    return resolver.resolveBatch(files);
+}
+
+describe('🚀 Mikk Strategy Restoration Verification', () => {
+    let tmpDir: string;
+    
+    beforeEach(() => {
+        tmpDir = path.join(os.tmpdir(), 'mikk-verification-' + Math.random().toString(36).slice(2));
+    });
+    
+    afterEach(() => {
+        try {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        } catch {
+            // ignore cleanup errors
+        }
+    });
+
+    async function setupFiles(files: Record<string, string>) {
+        for (const [name, content] of Object.entries(files)) {
+            const filePath = path.join(tmpDir, name);
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.writeFileSync(filePath, content);
+        }
+        const filePaths = Object.keys(files).map(f => path.join(tmpDir, f));
+        const readFile = async (p: string) => fs.readFileSync(p, 'utf-8');
+        return { filePaths, readFile };
+    }
+
+    it('should resolve aliased imports correctly', async () => {
+        const { filePaths, readFile } = await setupFiles({
+            'utils.ts': `
+                export function validateInput(data) {
+                    return data !== null && data !== undefined;
+                }
+                export function sanitize(data) {
+                    return String(data).trim();
+                }
+            `,
+            'handler.ts': `
+                import { validateInput as check, sanitize as clean } from "./utils";
+                
+                export function process(data) {
+                    if (check(data)) {
+                        return clean(data);
+                    }
+                    return null;
+                }
+            `
+        });
+
+        const parsedFiles = await parseFiles(filePaths, tmpDir, readFile);
+        const resolvedFiles = await resolveImports(parsedFiles, tmpDir);
+
+        const builder = new GraphBuilder();
+        const graph = builder.build(resolvedFiles);
+
+        const processNode = Array.from(graph.nodes.values()).find(n => n.name === 'process');
+        const checkNode = Array.from(graph.nodes.values()).find(n => n.name === 'validateInput');
+        const cleanNode = Array.from(graph.nodes.values()).find(n => n.name === 'sanitize');
+
+        expect(processNode).toBeDefined();
+        expect(checkNode).toBeDefined();
+        expect(cleanNode).toBeDefined();
+
+        const checkEdge = graph.edges.find(e => e.from === processNode!.id && e.to === checkNode!.id);
+        const cleanEdge = graph.edges.find(e => e.from === processNode!.id && e.to === cleanNode!.id);
+
+        expect(checkEdge).toBeDefined();
+        expect(cleanEdge).toBeDefined();
+    });
+
+    it('should resolve default import with method call', async () => {
+        const { filePaths, readFile } = await setupFiles({
+            'jwt.ts': `
+                export function verifyToken(token) {
+                    return token.startsWith('eyJ');
+                }
+                export function decodeToken(token) {
+                    return JSON.parse(atob(token.split('.')[1]));
+                }
+            `,
+            'auth.ts': `
+                import jwt from "./jwt";
+                
+                export function validate(req) {
+                    return jwt.verifyToken(req.token);
+                }
+            `
+        });
+
+        const parsedFiles = await parseFiles(filePaths, tmpDir, readFile);
+        const resolvedFiles = await resolveImports(parsedFiles, tmpDir);
+
+        const builder = new GraphBuilder();
+        const graph = builder.build(resolvedFiles);
+
+        const validateNode = Array.from(graph.nodes.values()).find(n => n.name === 'validate');
+        const verifyNode = Array.from(graph.nodes.values()).find(n => n.name === 'verifyToken');
+
+        expect(validateNode).toBeDefined();
+        expect(verifyNode).toBeDefined();
+
+        const edge = graph.edges.find(e => e.from === validateNode!.id && e.to === verifyNode!.id);
+        expect(edge).toBeDefined();
+    });
+
+    it('should resolve cross-file calls using the GlobalSymbolTable', async () => {
+        const { filePaths, readFile } = await setupFiles({
+            'auth.ts': `
+                import { verify } from "./crypto";
+                export function login(u) { return verify(u); }
+            `,
+            'crypto.ts': `
+                export function verify(t) { return "ok"; }
+            `
+        });
+
+        const parsedFiles = await parseFiles(filePaths, tmpDir, readFile);
+        const resolvedFiles = await resolveImports(parsedFiles, tmpDir);
+
+        const builder = new GraphBuilder();
+        const graph = builder.build(resolvedFiles);
+
+        const loginNode = Array.from(graph.nodes.values()).find(n => n.name === 'login');
+        const verifyNode = Array.from(graph.nodes.values()).find(n => n.name === 'verify');
+
+        expect(loginNode).toBeDefined();
+        expect(verifyNode).toBeDefined();
+
+        const edges = graph.edges.filter(e => e.from === loginNode!.id && e.to === verifyNode!.id);
+        expect(edges.length).toBeGreaterThan(0);
+        expect(edges[0].type).toBe('calls');
+    });
+
+    it('should handle taint flow between files', async () => {
+        const { filePaths, readFile } = await setupFiles({
+            'app.ts': `
+                import { DB } from "./db";
+                const db = new DB();
+                function handle(req) { db.query(req.input); }
+            `,
+            'db.ts': `
+                export class DB { query(q) {} }
+            `
+        });
+
+        const parsedFiles = await parseFiles(filePaths, tmpDir, readFile);
+        const resolvedFiles = await resolveImports(parsedFiles, tmpDir);
+
+        const builder = new GraphBuilder();
+        const graph = builder.build(resolvedFiles);
+
+        const handleNode = Array.from(graph.nodes.values()).find(n => n.name === 'handle');
+        const queryNode = Array.from(graph.nodes.values()).find(n => n.name === 'DB.query');
+
+        expect(handleNode).toBeDefined();
+        expect(queryNode).toBeDefined();
+
+        const edge = graph.edges.find(e => e.from === handleNode!.id && e.to === queryNode!.id);
+        expect(edge).toBeDefined();
+    });
+});

package/src/parser/base-parser.ts

@@ -1,16 +0,0 @@
-import type { ParsedFile, ParsedImport } from './types.js'
-
-/**
- * Abstract base class all language parsers extend.
- * Forces consistency — every parser implements the same interface.
- */
-export abstract class BaseParser {
-    /** Given raw file content as a string, return ParsedFile */
-    abstract parse(filePath: string, content: string): Promise<ParsedFile>
-
-    /** Given a list of parsed files, resolve all import paths to absolute project paths */
-    abstract resolveImports(files: ParsedFile[], projectRoot: string): Promise<ParsedFile[]>
-
-    /** Returns which file extensions this parser handles */
-    abstract getSupportedExtensions(): string[]
-}

package/src/parser/go/go-parser.ts

@@ -1,43 +0,0 @@
-import { BaseParser } from '../base-parser.js'
-import { GoExtractor } from './go-extractor.js'
-import { GoResolver } from './go-resolver.js'
-import { hashContent } from '../../hash/file-hasher.js'
-import type { ParsedFile } from '../types.js'
-
-/**
- * GoParser -- implements BaseParser for .go files.
- * Uses GoExtractor (regex-based) to pull structured data from Go source
- * without requiring the Go toolchain.
- */
-export class GoParser extends BaseParser {
-    async parse(filePath: string, content: string): Promise<ParsedFile> {
-        const extractor = new GoExtractor(filePath, content)
-
-        return {
-            path: filePath,
-            language: 'go',
-            functions: extractor.extractFunctions(),
-            classes: extractor.extractClasses(),
-            generics: [], // Go type aliases handled as classes/exports
-            imports: extractor.extractImports(),
-            exports: extractor.extractExports(),
-            routes: extractor.extractRoutes(),
-            variables: [],
-            calls: [],
-            hash: hashContent(content),
-            parsedAt: Date.now(),
-        }
-    }
-
-    async resolveImports(files: ParsedFile[], projectRoot: string): Promise<ParsedFile[]> {
-        const resolver = new GoResolver(projectRoot)
-        return files.map(file => ({
-            ...file,
-            imports: resolver.resolveAll(file.imports),
-        }))
-    }
-
-    getSupportedExtensions(): string[] {
-        return ['.go']
-    }
-}

package/src/parser/javascript/js-extractor.ts

@@ -1,278 +0,0 @@
-import ts from 'typescript'
-import { TypeScriptExtractor } from '../typescript/ts-extractor.js'
-import { hashContent } from '../../hash/file-hasher.js'
-import type { ParsedFunction, ParsedImport, ParsedExport } from '../types.js'
-
-/**
- * JavaScriptExtractor -- extends TypeScriptExtractor to add CommonJS support on top of
- * the TypeScript Compiler API's native JS/JSX parsing.
- *
- * Extra patterns handled:
- *   - require() imports: const x = require('./m') / const { a } = require('./m')
- *   - module.exports = { foo, bar }  / module.exports = function() {}
- *   - exports.foo = function() {}
- *
- * All ESM patterns (import/export, arrow functions, classes) are inherited from the
- * TypeScriptExtractor which already handles ScriptKind.JS and ScriptKind.JSX.
- */
-export class JavaScriptExtractor extends TypeScriptExtractor {
-
-    // --- Public overrides ------------------------------------------------------
-
-    /** ESM functions + module.exports-assigned functions */
-    override extractFunctions(): ParsedFunction[] {
-        const fns = super.extractFunctions()
-        // Use id (which includes start line) to avoid false deduplication
-        const seen = new Set(fns.map(f => f.id))
-        for (const fn of this.extractCommonJsFunctions()) {
-            if (!seen.has(fn.id)) { fns.push(fn); seen.add(fn.id) }
-        }
-        return fns
-    }
-
-    /** ESM imports + CommonJS require() calls */
-    override extractImports(): ParsedImport[] {
-        const esm = super.extractImports()
-        const seen = new Set(esm.map(i => i.source))
-        for (const imp of this.extractRequireImports()) {
-            if (!seen.has(imp.source)) { esm.push(imp); seen.add(imp.source) }
-        }
-        return esm
-    }
-
-    /** ESM exports + CommonJS module.exports / exports.x */
-    override extractExports(): ParsedExport[] {
-        const esm = super.extractExports()
-        // Index by name; for default exports use type as secondary key to avoid
-        // a local function named 'default' from being incorrectly matched.
-        const seen = new Map(esm.map(e => [`${e.name}:${e.type}`, true]))
-        for (const exp of this.extractCommonJsExports()) {
-            const key = `${exp.name}:${exp.type}`
-            if (!seen.has(key)) {
-                esm.push(exp)
-                seen.set(key, true)
-            }
-        }
-        return esm
-    }
-
-    // --- CommonJS: require() ---------------------------------------------------
-
-    private extractRequireImports(): ParsedImport[] {
-        const imports: ParsedImport[] = []
-        const walk = (node: ts.Node) => {
-            if (
-                ts.isCallExpression(node) &&
-                ts.isIdentifier(node.expression) &&
-                node.expression.text === 'require' &&
-                node.arguments.length === 1 &&
-                ts.isStringLiteral(node.arguments[0])
-            ) {
-                // Ignore require.resolve(), require.cache etc. — those are property accesses
-                // on the result, not on `require` itself:  require.resolve() has a
-                // PropertyAccessExpression as node.expression, not an Identifier.
-                const source = (node.arguments[0] as ts.StringLiteral).text
-                const names = this.getRequireBindingNames(node)
-                // isDefault = true when binding is a plain identifier (const x = require(...))
-                // or when there's no binding at all (require(...) used for side effects).
-                // Only destructured object bindings (const { a } = require(...)) are named imports.
-                const parent = node.parent
-                const isDestructured = parent &&
-                    ts.isVariableDeclaration(parent) &&
-                    ts.isObjectBindingPattern(parent.name)
-                imports.push({
-                    source,
-                    resolvedPath: '',
-                    names,
-                    isDefault: !isDestructured,
-                    isDynamic: false,
-                })
-            }
-            ts.forEachChild(node, walk)
-        }
-        ts.forEachChild(this.sourceFile, walk)
-        return imports
-    }
-
-    /** Names extracted from the variable declaration that receives the require() call. */
-    private getRequireBindingNames(call: ts.CallExpression): string[] {
-        const parent = call.parent
-        if (!parent || !ts.isVariableDeclaration(parent)) return []
-        // const { a: myA, b } = require('...') → ['a', 'b'] (use the SOURCE name, not the alias)
-        // The source name (propertyName) is what the module exports.
-        // The local alias (element.name) is only visible in this file.
-        if (ts.isObjectBindingPattern(parent.name)) {
-            return parent.name.elements
-                .filter(e => ts.isIdentifier(e.name))
-                .map(e => {
-                    // If there is a property name (the "a" in "a: myA"), use it.
-                    // Otherwise the binding uses the same name for both sides.
-                    if (e.propertyName && ts.isIdentifier(e.propertyName)) {
-                        return e.propertyName.text
-                    }
-                    return (e.name as ts.Identifier).text
-                })
-        }
-        // const x = require('...') → ['x']
-        if (ts.isIdentifier(parent.name)) return [parent.name.text]
-        return []
-    }
-
-    // --- CommonJS: module.exports / exports.x exports -------------------------
-
-    private extractCommonJsExports(): ParsedExport[] {
-        const result: ParsedExport[] = []
-        const fp = this.filePath
-
-        const walk = (node: ts.Node) => {
-            if (
-                ts.isExpressionStatement(node) &&
-                ts.isBinaryExpression(node.expression) &&
-                node.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken
-            ) {
-                const lhs = node.expression.left
-                const rhs = node.expression.right
-
-                // --- module.exports = ... ------------------------------------
-                if (isModuleExports(lhs)) {
-                    if (ts.isObjectLiteralExpression(rhs)) {
-                        // module.exports = { foo, bar }
-                        for (const prop of rhs.properties) {
-                            if (ts.isShorthandPropertyAssignment(prop)) {
-                                result.push({ name: prop.name.text, type: 'const', file: fp })
-                            } else if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
-                                const isFunc = ts.isFunctionExpression(prop.initializer) || ts.isArrowFunction(prop.initializer)
-                                result.push({ name: prop.name.text, type: isFunc ? 'function' : 'const', file: fp })
-                            }
-                        }
-                    } else if (ts.isFunctionExpression(rhs) || ts.isArrowFunction(rhs)) {
-                        // module.exports = function name() {} → use function name or 'default'
-                        const name = ts.isFunctionExpression(rhs) && rhs.name ? rhs.name.text : 'default'
-                        result.push({ name, type: 'default', file: fp })
-                    } else if (ts.isClassExpression(rhs) && rhs.name) {
-                        result.push({ name: rhs.name.text, type: 'class', file: fp })
-                    } else if (ts.isIdentifier(rhs)) {
-                        result.push({ name: rhs.text, type: 'default', file: fp })
-                    } else {
-                        result.push({ name: 'default', type: 'default', file: fp })
-                    }
-                }
-
-                // --- exports.foo = ... ---------------------------------------
-                if (isExportsDotProp(lhs)) {
-                    const prop = lhs as ts.PropertyAccessExpression
-                    const isFunc = ts.isFunctionExpression(rhs) || ts.isArrowFunction(rhs)
-                    result.push({ name: prop.name.text, type: isFunc ? 'function' : 'const', file: fp })
-                }
-
-                // --- module.exports.foo = ... --------------------------------
-                if (isModuleExportsDotProp(lhs)) {
-                    const prop = lhs as ts.PropertyAccessExpression
-                    const isFunc = ts.isFunctionExpression(rhs) || ts.isArrowFunction(rhs)
-                    result.push({ name: prop.name.text, type: isFunc ? 'function' : 'const', file: fp })
-                }
-            }
-            ts.forEachChild(node, walk)
-        }
-
-        ts.forEachChild(this.sourceFile, walk)
-        return result
-    }
-
-    // --- CommonJS: module.exports / exports.x function bodies -----------------
-
-    /**
-     * Detect functions directly assigned via module.exports or exports.x:
-     *   module.exports = function handleLogin(req, res) { ... }
-     *   module.exports = function() { ... }            ← name = 'default'
-     *   exports.createUser = function(data) { ... }
-     *   exports.createUser = (data) => { ... }
-     */
-    private extractCommonJsFunctions(): ParsedFunction[] {
-        const result: ParsedFunction[] = []
-
-        const walk = (node: ts.Node) => {
-            if (
-                ts.isExpressionStatement(node) &&
-                ts.isBinaryExpression(node.expression) &&
-                node.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken
-            ) {
-                const lhs = node.expression.left
-                const rhs = node.expression.right
-
-                if (!ts.isFunctionExpression(rhs) && !ts.isArrowFunction(rhs)) {
-                    ts.forEachChild(node, walk)
-                    return
-                }
-
-                let fnName: string | null = null
-                if (isModuleExports(lhs)) {
-                    // module.exports = function name() {} / function() {}
-                    fnName = ts.isFunctionExpression(rhs) && rhs.name ? rhs.name.text : 'default'
-                } else if (isExportsDotProp(lhs)) {
-                    // exports.foo = function() {}
-                    fnName = (lhs as ts.PropertyAccessExpression).name.text
-                } else if (isModuleExportsDotProp(lhs)) {
-                    // module.exports.foo = function() {}
-                    fnName = (lhs as ts.PropertyAccessExpression).name.text
-                }
-
-                if (fnName !== null) {
-                    const startLine = this.getLineNumber(node.getStart())
-                    const endLine = this.getLineNumber(node.getEnd())
-                    const isAsync = !!(rhs.modifiers?.some((m: ts.Modifier) => m.kind === ts.SyntaxKind.AsyncKeyword))
-                    result.push({
-                        id: `fn:${this.filePath}:${fnName}`,
-                        name: fnName,
-                        file: this.filePath,
-                        startLine,
-                        endLine,
-                        params: this.extractParams(rhs.parameters),
-                        returnType: rhs.type ? rhs.type.getText(this.sourceFile) : 'void',
-                        isExported: true,
-                        isAsync,
-                        calls: this.extractCallsFromNode(rhs),
-                        hash: hashContent(rhs.getText(this.sourceFile)),
-                        purpose: this.extractPurpose(node),
-                        edgeCasesHandled: this.extractEdgeCases(rhs),
-                        errorHandling: this.extractErrorHandling(rhs),
-                        detailedLines: this.extractDetailedLines(rhs),
-                    })
-                }
-            }
-            ts.forEachChild(node, walk)
-        }
-
-        ts.forEachChild(this.sourceFile, walk)
-        return result
-    }
-}
-
-// --- Helpers -----------------------------------------------------------------
-
-/** node is `module.exports` */
-function isModuleExports(node: ts.Node): boolean {
-    return (
-        ts.isPropertyAccessExpression(node) &&
-        ts.isIdentifier(node.expression) &&
-        node.expression.text === 'module' &&
-        node.name.text === 'exports'
-    )
-}
-
-/** node is `exports.something` */
-function isExportsDotProp(node: ts.Node): boolean {
-    return (
-        ts.isPropertyAccessExpression(node) &&
-        ts.isIdentifier(node.expression) &&
-        node.expression.text === 'exports'
-    )
-}
-
-/** node is `module.exports.something` */
-function isModuleExportsDotProp(node: ts.Node): boolean {
-    return (
-        ts.isPropertyAccessExpression(node) &&
-        isModuleExports(node.expression)
-    )
-}

package/src/parser/javascript/js-parser.ts

@@ -1,101 +0,0 @@
-import * as path from 'node:path'
-import * as fs from 'node:fs'
-import { BaseParser } from '../base-parser.js'
-import { JavaScriptExtractor } from './js-extractor.js'
-import { JavaScriptResolver } from './js-resolver.js'
-import { hashContent } from '../../hash/file-hasher.js'
-import type { ParsedFile } from '../types.js'
-import { MIN_FILES_FOR_COMPLETE_SCAN, parseJsonWithComments } from '../parser-constants.js'
-
-/**
- * JavaScriptParser -- implements BaseParser for .js / .mjs / .cjs / .jsx files.
- *
- * Uses the TypeScript Compiler API (ScriptKind.JS / ScriptKind.JSX) which correctly
- * parses JavaScript without type annotations.  JavaScriptExtractor extends
- * TypeScriptExtractor and adds CommonJS require() / module.exports support.
- */
-export class JavaScriptParser extends BaseParser {
-    async parse(filePath: string, content: string): Promise<ParsedFile> {
-        const extractor = new JavaScriptExtractor(filePath, content)
-
-        const functions = extractor.extractFunctions()
-        const classes = extractor.extractClasses()
-        const generics = extractor.extractGenerics()
-        const imports = extractor.extractImports()
-        const exports = extractor.extractExports()
-        const routes = extractor.extractRoutes()
-
-        // Cross-reference: CJS exports may mark a name exported even when the
-        // declaration itself had no `export` keyword.
-        //
-        // We only mark a symbol as exported when the export list contains an
-        // entry with BOTH a matching name AND a non-default type. This prevents
-        // `module.exports = function() {}` (which produces name='default', type='default')
-        // from accidentally marking an unrelated local function called 'default' as exported.
-        const exportedNonDefault = new Set(
-            exports.filter(e => e.type !== 'default').map(e => e.name)
-        )
-        for (const fn of functions) { if (!fn.isExported && exportedNonDefault.has(fn.name)) fn.isExported = true }
-        for (const cls of classes) { if (!cls.isExported && exportedNonDefault.has(cls.name)) cls.isExported = true }
-        for (const gen of generics) { if (!gen.isExported && exportedNonDefault.has(gen.name)) gen.isExported = true }
-
-        return {
-            path: filePath,
-            language: 'javascript',
-            functions,
-            classes,
-            generics,
-            imports,
-            exports,
-            routes,
-            variables: [],
-            calls: [],
-            hash: hashContent(content),
-            parsedAt: Date.now(),
-        }
-    }
-
-    async resolveImports(files: ParsedFile[], projectRoot: string): Promise<ParsedFile[]> {
-        const aliases = loadAliases(projectRoot)
-        // Only pass the file list when it represents a reasonably complete scan.
-        // A sparse list (< MIN_FILES_FOR_COMPLETE_SCAN files) causes valid alias-resolved
-        // imports to return '' because the target file is not in the partial list.
-        const allFilePaths = files.length >= MIN_FILES_FOR_COMPLETE_SCAN ? files.map(f => f.path) : []
-        const resolver = new JavaScriptResolver(projectRoot, aliases)
-        return files.map(file => ({
-            ...file,
-            imports: resolver.resolveAll(file.imports, file.path, allFilePaths),
-        }))
-    }
-
-    getSupportedExtensions(): string[] {
-        return ['.js', '.mjs', '.cjs', '.jsx']
-    }
-}
-
-/**
- * Load path aliases from jsconfig.json → tsconfig.json → tsconfig.base.json.
- * Strips JSON5 comments via the shared helper and falls back to raw content if parsing fails.
- * Returns {} when no config is found.
- */
-function loadAliases(projectRoot: string): Record<string, string[]> {
-    for (const name of ['jsconfig.json', 'tsconfig.json', 'tsconfig.base.json']) {
-        const configPath = path.join(projectRoot, name)
-        try {
-            const raw = fs.readFileSync(configPath, 'utf-8')
-            const config: any = parseJsonWithComments(raw)
-
-            const options = config.compilerOptions ?? {}
-            const rawPaths: Record<string, string[]> = options.paths ?? {}
-            if (Object.keys(rawPaths).length === 0) continue
-
-            const baseUrl = options.baseUrl ?? '.'
-            const resolved: Record<string, string[]> = {}
-            for (const [alias, targets] of Object.entries(rawPaths)) {
-                resolved[alias] = (targets as string[]).map((t: string) => path.posix.join(baseUrl, t))
-            }
-            return resolved
-        } catch { /* config absent or unreadable — try next */ }
-    }
-    return {}
-}