@iris-code/core 0.1.0

package/dist/python/analyser.js

@@ -0,0 +1,630 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractPyThirdPartyImports = extractPyThirdPartyImports;
+exports.analysePython = analysePython;
+const lines_1 = require("../lines");
+const secrets_1 = require("../secrets");
+const securityContext_1 = require("../securityContext");
+const guards_1 = require("../guards");
+const scoring_1 = require("../scoring");
+// --- regex constants ---
+// Top-level and method defs: def func_name(
+const PY_FUNC_RE = /^([ \t]*)def\s+([A-Za-z_]\w*)\s*\(/gm;
+// --- Python stdlib module names (root segments) ---
+const PY_STDLIB = new Set([
+    '__future__', '_thread', 'abc', 'aifc', 'argparse', 'array', 'ast',
+    'asynchat', 'asyncio', 'asyncore', 'atexit', 'audioop', 'base64',
+    'bdb', 'binascii', 'binhex', 'bisect', 'builtins', 'bz2', 'calendar',
+    'cgi', 'cgitb', 'chunk', 'cmath', 'cmd', 'code', 'codecs', 'codeop',
+    'collections', 'colorsys', 'compileall', 'concurrent', 'configparser',
+    'contextlib', 'contextvars', 'copy', 'copyreg', 'cProfile', 'csv',
+    'ctypes', 'curses', 'dataclasses', 'datetime', 'dbm', 'decimal',
+    'difflib', 'dis', 'doctest', 'email', 'encodings', 'enum', 'errno',
+    'faulthandler', 'fcntl', 'filecmp', 'fileinput', 'fnmatch', 'fractions',
+    'ftplib', 'functools', 'gc', 'getopt', 'getpass', 'gettext', 'glob',
+    'grp', 'gzip', 'hashlib', 'heapq', 'hmac', 'html', 'http', 'idlelib',
+    'imaplib', 'imghdr', 'imp', 'importlib', 'inspect', 'io', 'ipaddress',
+    'itertools', 'json', 'keyword', 'lib2to3', 'linecache', 'locale',
+    'logging', 'lzma', 'mailbox', 'mailcap', 'marshal', 'math', 'mimetypes',
+    'mmap', 'modulefinder', 'multiprocessing', 'netrc', 'nis', 'nntplib',
+    'numbers', 'operator', 'optparse', 'os', 'ossaudiodev', 'pathlib',
+    'pdb', 'pickle', 'pickletools', 'pipes', 'pkgutil', 'platform',
+    'plistlib', 'poplib', 'posix', 'posixpath', 'pprint', 'profile',
+    'pstats', 'pty', 'pwd', 'py_compile', 'pyclbr', 'pydoc', 'queue',
+    'quopri', 'random', 're', 'readline', 'reprlib', 'resource', 'rlcompleter',
+    'runpy', 'sched', 'secrets', 'select', 'selectors', 'shelve', 'shlex',
+    'shutil', 'signal', 'site', 'smtpd', 'smtplib', 'sndhdr', 'socket',
+    'socketserver', 'spwd', 'sqlite3', 'sre_compile', 'sre_constants',
+    'sre_parse', 'ssl', 'stat', 'statistics', 'string', 'stringprep',
+    'struct', 'subprocess', 'sunau', 'symtable', 'sys', 'sysconfig',
+    'syslog', 'tabnanny', 'tarfile', 'telnetlib', 'tempfile', 'termios',
+    'test', 'textwrap', 'threading', 'time', 'timeit', 'tkinter', 'token',
+    'tokenize', 'tomllib', 'trace', 'traceback', 'tracemalloc', 'tty',
+    'turtle', 'turtledemo', 'types', 'typing', 'unicodedata', 'unittest',
+    'urllib', 'uu', 'uuid', 'venv', 'warnings', 'wave', 'weakref',
+    'webbrowser', 'winreg', 'winsound', 'wsgiref', 'xdrlib', 'xml',
+    'xmlrpc', 'zipapp', 'zipfile', 'zipimport', 'zlib', 'zoneinfo',
+]);
+// --- zeroed TS metrics (not applicable to Python) ---
+const ZEROED_TS_METRICS = {
+    anyUsages: [],
+    tsIgnoreCount: 0,
+    tsExpectErrorCount: 0,
+    nonNullAssertions: 0,
+    typeAssertions: 0,
+    missingReturnTypes: 0,
+};
+// --- helpers ---
+// Replace # comment text with spaces (preserving newlines and string contents)
+// so that `def` inside a comment is not matched by PY_FUNC_RE.
+function stripPythonComments(source) {
+    const lines = source.split('\n');
+    return lines.map(line => {
+        let inStr = null;
+        let result = '';
+        let i = 0;
+        while (i < line.length) {
+            const ch = line[i];
+            if (inStr) {
+                result += ch;
+                if (ch === '\\') {
+                    result += line[i + 1] ?? '';
+                    i += 2;
+                    continue;
+                }
+                if (ch === inStr)
+                    inStr = null;
+                i++;
+            }
+            else if (ch === '#') {
+                result += ' '.repeat(line.length - i);
+                break;
+            }
+            else if (ch === '"' || ch === "'") {
+                inStr = ch;
+                result += ch;
+                i++;
+            }
+            else {
+                result += ch;
+                i++;
+            }
+        }
+        return result;
+    }).join('\n');
+}
+function stripPythonStringsPreserveNewlines(source) {
+    let result = '';
+    let i = 0;
+    while (i < source.length) {
+        const triple = source.slice(i, i + 3);
+        if (triple === '"""' || triple === "'''") {
+            result += '   ';
+            i += 3;
+            while (i < source.length) {
+                const currentTriple = source.slice(i, i + 3);
+                if (currentTriple === triple) {
+                    result += '   ';
+                    i += 3;
+                    break;
+                }
+                if (source[i] === '\n')
+                    result += '\n';
+                else
+                    result += ' ';
+                i++;
+            }
+            continue;
+        }
+        const ch = source[i];
+        if (ch !== '"' && ch !== "'") {
+            result += ch;
+            i++;
+            continue;
+        }
+        result += ' ';
+        i++;
+        while (i < source.length) {
+            const current = source[i];
+            if (current === '\n') {
+                result += '\n';
+                i++;
+                continue;
+            }
+            if (current === '\\') {
+                result += ' ';
+                if (i + 1 < source.length) {
+                    result += source[i + 1] === '\n' ? '\n' : ' ';
+                }
+                i += 2;
+                continue;
+            }
+            result += ' ';
+            i++;
+            if (current === ch)
+                break;
+        }
+    }
+    return result;
+}
+// Keeps only regex SOURCE - the string literal passed to an `re.*` call - and
+// blanks everything else (newlines preserved so offsets stay exact). The ReDoS
+// heuristic runs over this so ordinary arithmetic `(a+b)*c` is never mistaken
+// for a nested-quantifier regex. Python has no regex literals, so only re.*
+// call arguments count; an optional string prefix (r/b/u/f) is allowed.
+const PY_REGEX_CALL_RE = /re\.(?:compile|match|search|fullmatch|sub|subn|findall|finditer|split)\s*\(\s*[rbufRBUF]*$/;
+function pyRegexOnlySource(source) {
+    const out = [];
+    const n = source.length;
+    let i = 0;
+    const blank = (ch) => (ch === '\n' ? '\n' : ' ');
+    while (i < n) {
+        const ch = source[i];
+        if (ch === '#') {
+            while (i < n && source[i] !== '\n') {
+                out.push(' ');
+                i++;
+            }
+            continue;
+        }
+        const triple = source.slice(i, i + 3);
+        if (triple === '"""' || triple === "'''") {
+            const isRegexArg = PY_REGEX_CALL_RE.test(source.slice(Math.max(0, i - 48), i));
+            out.push('   ');
+            i += 3;
+            while (i < n) {
+                if (source.slice(i, i + 3) === triple) {
+                    out.push('   ');
+                    i += 3;
+                    break;
+                }
+                out.push(isRegexArg ? (source[i] === '\n' ? '\n' : source[i]) : blank(source[i]));
+                i++;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const q = ch;
+            const isRegexArg = PY_REGEX_CALL_RE.test(source.slice(Math.max(0, i - 48), i));
+            out.push(' ');
+            i++;
+            while (i < n) {
+                const c = source[i];
+                if (c === '\n') {
+                    out.push('\n');
+                    i++;
+                    continue;
+                }
+                if (c === '\\') {
+                    out.push(isRegexArg ? c : ' ');
+                    if (i + 1 < n)
+                        out.push(isRegexArg ? source[i + 1] : blank(source[i + 1]));
+                    i += 2;
+                    continue;
+                }
+                if (c === q) {
+                    out.push(' ');
+                    i++;
+                    break;
+                }
+                out.push(isRegexArg ? c : ' ');
+                i++;
+            }
+            continue;
+        }
+        out.push(blank(ch));
+        i++;
+    }
+    return out.join('');
+}
+function findPythonFunctionEnd(lines, startLine) {
+    // startLine is 1-indexed; determine indentation of the def line
+    const defLine = lines[startLine - 1] ?? '';
+    const baseIndent = defLine.length - defLine.trimStart().length;
+    for (let i = startLine; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trimStart();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue; // blank / comment
+        const indent = line.length - trimmed.length;
+        if (indent <= baseIndent)
+            return i + 1; // 1-indexed
+    }
+    return lines.length;
+}
+// --- import detection ---
+function isPyThirdParty(module) {
+    const root = module.split('.')[0];
+    return !PY_STDLIB.has(root) && root !== '' && !root.startsWith('_');
+}
+function extractPyThirdPartyImports(source) {
+    const imports = new Set();
+    // import foo, import foo as bar, import foo.bar, import foo, bar
+    // Single-line match only: allowing \s in the module class let consecutive
+    // `import x` lines collapse into one match, so files with the idiomatic
+    // one-import-per-line style counted as a single import (found by the 5.11
+    // benchmark corpus, fixed 2026-07-19).
+    const importRe = /^import[ \t]+([\w.]+(?:[ \t]*,[ \t]*[\w.]+)*(?:[ \t]+as[ \t]+\w+)?)/gm;
+    importRe.lastIndex = 0;
+    let m;
+    while ((m = importRe.exec(source)) !== null) {
+        for (const part of m[1].split(',')) {
+            const mod = part.trim().split(/\s+as\s+/)[0].trim();
+            const root = mod.split('.')[0];
+            if (root && isPyThirdParty(mod))
+                imports.add(root);
+        }
+    }
+    // from foo import bar, from foo.bar import baz
+    const fromRe = /^from\s+([\w.]+)\s+import\s+/gm;
+    fromRe.lastIndex = 0;
+    let fm;
+    while ((fm = fromRe.exec(source)) !== null) {
+        const mod = fm[1].replace(/^\.+/, ''); // strip relative dot prefix
+        const root = mod.split('.')[0];
+        if (root && isPyThirdParty(mod))
+            imports.add(root);
+    }
+    return [...imports].sort();
+}
+// --- function detection ---
+function detectPyFunctions(source) {
+    const stripped = stripPythonComments(source);
+    const results = [];
+    const seen = new Set();
+    PY_FUNC_RE.lastIndex = 0;
+    let match;
+    while ((match = PY_FUNC_RE.exec(stripped)) !== null) {
+        const name = match[2];
+        const line = (0, lines_1.lineOf)(source, match.index);
+        const key = `${name}:${line}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            results.push({ name, line });
+        }
+    }
+    return results.sort((a, b) => a.line - b.line);
+}
+// --- helpers ---
+function extractParamInner(lines, startLineIdx) {
+    let collected = '';
+    let depth = 0;
+    let started = false;
+    for (let i = startLineIdx; i < lines.length; i++) {
+        const line = lines[i];
+        for (const ch of line) {
+            if (ch === '(') {
+                if (!started) {
+                    started = true;
+                    depth = 1;
+                }
+                else
+                    depth++;
+            }
+            else if (ch === ')' && started) {
+                depth--;
+                if (depth === 0)
+                    return collected;
+                else
+                    collected += ch;
+            }
+            else if (started) {
+                collected += ch;
+            }
+        }
+        if (started)
+            collected += ' ';
+    }
+    return null;
+}
+// --- code smells ---
+function detectPyCodeSmells(source, functions, lineCount, config, isTest = false) {
+    const lines = source.split('\n');
+    // Python debug prints — print(...) and pprint(...)
+    const consoleLogs = [];
+    if (config.enableConsoleLogWarnings) {
+        // Scan comment- AND string-stripped source so `print(...)` inside a `#`
+        // comment or a triple-quoted docstring is not flagged (the 5.11 benchmark FP
+        // console-log/negative/docstring_print.py). A real print call keeps its
+        // `print(` outside the string, so detection is unaffected. Both strippers
+        // preserve offsets and newlines, so lineOf stays accurate.
+        const printSource = stripPythonStringsPreserveNewlines(stripPythonComments(source));
+        const printRe = /\bprint\s*\(/g;
+        printRe.lastIndex = 0;
+        let pm;
+        while ((pm = printRe.exec(printSource)) !== null) {
+            consoleLogs.push({ line: (0, lines_1.lineOf)(source, pm.index) });
+        }
+    }
+    // TODOs — Python uses # comments
+    const todos = [];
+    if (config.enableTodoDetection) {
+        const todoRe = /#.*\b(TODO|FIXME|HACK)\b[:\s]*(.*)/;
+        lines.forEach((line, i) => {
+            const m = todoRe.exec(line);
+            if (m)
+                todos.push({ text: `${m[1]}: ${m[2].trim()}`.trim(), line: i + 1 });
+        });
+    }
+    // Deep nesting (indentation ≥ 16 spaces — Python uses 4-space indent by convention)
+    let deepNesting = 0;
+    for (let i = 0; i < functions.length; i++) {
+        const startIdx = functions[i].line;
+        const endIdx = (functions[i + 1]?.line ?? lineCount + 1) - 1;
+        const body = lines.slice(startIdx, endIdx);
+        const maxIndent = body.reduce((max, l) => {
+            const t = l.trimStart();
+            return t && !t.startsWith('#') ? Math.max(max, l.length - t.length) : max;
+        }, 0);
+        if (maxIndent >= 16)
+            deepNesting++;
+    }
+    // Long parameter lists
+    const longParameterLists = [];
+    if (config.enableLongParamDetection) {
+        for (const fn of functions) {
+            const inner = extractParamInner(lines, fn.line - 1);
+            if (inner) {
+                // Filter out 'self' and 'cls' which are not real parameters
+                const params = inner.split(',').filter(p => {
+                    const name = p.trim().split(/[=:]/)[0].trim();
+                    return name !== 'self' && name !== 'cls' && name !== '';
+                });
+                if (params.length >= config.maxParameterCount) {
+                    longParameterLists.push({ name: fn.name, paramCount: params.length, line: fn.line });
+                }
+            }
+        }
+    }
+    // Magic numbers
+    const magicNumbers = [];
+    if (config.enableMagicNumberDetection) {
+        // Matches named assignments that should not be flagged:
+        //   X = 14, X: int = 14           (module/class-level constant)
+        //   self.x = 14, cls.attr = 14    (instance/class attribute assignment)
+        const namedAssignRe = /^\s*(?:[A-Za-z_]\w*\.)*[A-Za-z_]\w*(?:\s*:\s*\w+)?\s*=\s*-?[\d.]+\s*$/;
+        const seen = new Set();
+        const sanitizedLines = stripPythonStringsPreserveNewlines(stripPythonComments(source)).split('\n');
+        sanitizedLines.forEach((stripped, i) => {
+            if (namedAssignRe.test(stripped))
+                return;
+            const numRe = /\b(\d+(?:\.\d+)?)\b/g;
+            let nm;
+            while ((nm = numRe.exec(stripped)) !== null) {
+                const n = nm[1];
+                const key = `${i + 1}:${n}`;
+                if (n !== '0' && n !== '1' && !seen.has(key)) {
+                    magicNumbers.push({ value: n, line: i + 1 });
+                    seen.add(key);
+                }
+            }
+        });
+    }
+    // --- unused vars and functions ---
+    const { unusedVars, unusedFunctions } = config.enableUnusedDetection
+        ? detectPyUnusedDeclarations(source, functions)
+        : { unusedVars: [], unusedFunctions: [] };
+    // --- security smells ---
+    const evalUsage = [];
+    const sqlConcatenation = [];
+    const insecureRandom = [];
+    const unsafeRegex = [];
+    const hardcodedLocalhost = [];
+    const disabledTlsVerification = [];
+    const debugFlagsEnabled = [];
+    const weakHashing = [];
+    const openRedirect = [];
+    if (config.enableSecuritySmells) {
+        const stripped = stripPythonComments(source);
+        const evalRe = /\beval\s*\(|\bexec\s*\(/g;
+        evalRe.lastIndex = 0;
+        let ev;
+        while ((ev = evalRe.exec(stripped)) !== null) {
+            evalUsage.push({ line: (0, lines_1.lineOf)(source, ev.index) });
+        }
+        const sqlRe = /['"][^'"\n]*\b(?:SELECT|INSERT|UPDATE|DELETE|DROP)\b[^'"\n]*['"]\s*\+/g;
+        sqlRe.lastIndex = 0;
+        let sq;
+        while ((sq = sqlRe.exec(source)) !== null) {
+            sqlConcatenation.push({ line: (0, lines_1.lineOf)(source, sq.index) });
+        }
+        // f-string SQL injection: f"SELECT ... {var}"
+        const sqlFstrRe = /f['"][^'"\n]*\b(?:SELECT|INSERT|UPDATE|DELETE|DROP)\b[^'"\n]*\{[^}]+\}/g;
+        sqlFstrRe.lastIndex = 0;
+        let sqf;
+        while ((sqf = sqlFstrRe.exec(source)) !== null) {
+            sqlConcatenation.push({ line: (0, lines_1.lineOf)(source, sqf.index) });
+        }
+        const rngRe = /\brandom\.(?:random|randint|randrange|choice|shuffle|sample)\s*\(/g;
+        rngRe.lastIndex = 0;
+        let rn;
+        while ((rn = rngRe.exec(stripped)) !== null) {
+            if ((0, securityContext_1.hasSecurityContext)(stripped, rn.index)) {
+                insecureRandom.push({ line: (0, lines_1.lineOf)(source, rn.index) });
+            }
+        }
+        // Confine the nested-quantifier heuristic to regex source (re.* call args)
+        // so arithmetic like `(a+b)*c` is never flagged.
+        const regexSource = pyRegexOnlySource(source);
+        const reRe = /\([^)\n]*[+*][^)\n]*\)[+*]/g;
+        reRe.lastIndex = 0;
+        let rx;
+        while ((rx = reRe.exec(regexSource)) !== null) {
+            unsafeRegex.push({ line: (0, lines_1.lineOf)(source, rx.index) });
+        }
+        if (!isTest) {
+            const localRe = /\blocalhost\b|127\.0\.0\.1/g;
+            localRe.lastIndex = 0;
+            let lh;
+            while ((lh = localRe.exec(stripped)) !== null) {
+                hardcodedLocalhost.push({ line: (0, lines_1.lineOf)(source, lh.index) });
+            }
+        }
+        const tlsRe = /\bverify\s*=\s*False\b/g;
+        tlsRe.lastIndex = 0;
+        let tl;
+        while ((tl = tlsRe.exec(stripped)) !== null) {
+            disabledTlsVerification.push({ line: (0, lines_1.lineOf)(source, tl.index) });
+        }
+        if (!isTest) {
+            const dbgRe = /\bdebug\s*=\s*True\b/g;
+            dbgRe.lastIndex = 0;
+            let db;
+            while ((db = dbgRe.exec(stripped)) !== null) {
+                debugFlagsEnabled.push({ line: (0, lines_1.lineOf)(source, db.index) });
+            }
+        }
+        const hashRe = /\bhashlib\.(?:md5|sha1)\s*\(/g;
+        hashRe.lastIndex = 0;
+        let wh;
+        while ((wh = hashRe.exec(stripped)) !== null) {
+            weakHashing.push({ line: (0, lines_1.lineOf)(source, wh.index) });
+        }
+        const redirectRe = /\bredirect\s*\([^)]*(?:request\.(?:args|form|values|json)|request\[)/g;
+        redirectRe.lastIndex = 0;
+        let or;
+        while ((or = redirectRe.exec(stripped)) !== null) {
+            openRedirect.push({ line: (0, lines_1.lineOf)(source, or.index) });
+        }
+    }
+    return { consoleLogs, todos, deepNesting, longParameterLists, magicNumbers, unusedVars, unusedFunctions, hardcodedSecrets: [], bareSuppressions: [], duplicateBlocks: [], fileNamingViolations: [], evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect };
+}
+function detectPyUnusedDeclarations(source, functions) {
+    const lines = source.split('\n');
+    const unusedVars = [];
+    const unusedFunctions = [];
+    // --- unused variables (function-local only: indented lines) ---
+    // Matches: <indent> name = <non-equals>  (excludes ==, +=, self.x =, etc.)
+    // The ^[ \t]+ requirement naturally excludes module-level (non-indented) assignments.
+    const assignRe = /^([ \t]+)([A-Za-z_]\w*)\s*=[^=]/gm;
+    assignRe.lastIndex = 0;
+    let am;
+    while ((am = assignRe.exec(source)) !== null) {
+        const name = am[2];
+        const line = (0, lines_1.lineOf)(source, am.index);
+        const declLine = lines[line - 1] ?? '';
+        // Skip dunder names (__init__, __version__, etc.)
+        if (name.startsWith('__'))
+            continue;
+        // Skip ALL_CAPS constants (conventional module/class-level constants even if indented)
+        if (/^[A-Z][A-Z0-9_]*$/.test(name))
+            continue;
+        // Skip self/cls
+        if (name === 'self' || name === 'cls')
+            continue;
+        // Skip if the char before the identifier on this line is a dot (dotted attribute: self.x)
+        const beforeName = declLine.slice(0, declLine.indexOf(name));
+        if (beforeName.trimEnd().endsWith('.'))
+            continue;
+        const bodyWithoutDecl = lines.map((l, i) => (i === line - 1 ? '' : l)).join('\n');
+        if (!new RegExp(`\\b${name}\\b`).test(bodyWithoutDecl)) {
+            unusedVars.push({ name, line });
+        }
+    }
+    // --- unused functions ---
+    // Only flag private functions (single _ prefix). Public functions may be imported elsewhere.
+    for (const fn of functions) {
+        if (!fn.name.startsWith('_'))
+            continue;
+        // Skip dunder methods (__init__, __str__, etc.)
+        if (fn.name.startsWith('__'))
+            continue;
+        const bodyWithoutDecl = lines.map((l, i) => (i === fn.line - 1 ? '' : l)).join('\n');
+        if (!new RegExp(`\\b${fn.name}\\b`).test(bodyWithoutDecl)) {
+            unusedFunctions.push({ name: fn.name, line: fn.line });
+        }
+    }
+    return { unusedVars, unusedFunctions };
+}
+// --- warnings ---
+function detectPyWarnings(lineCount, functions, thirdPartyImports, source, config) {
+    const warnings = [];
+    const sev = (type, fallback) => config.severityOverrides[type] ?? fallback;
+    const warnLine = Math.round(config.fileLengthThreshold * 2 / 3);
+    if (lineCount > config.fileLengthThreshold) {
+        warnings.push({ type: 'file-too-long', message: `File is ${lineCount} lines (>${config.fileLengthThreshold})`, severity: sev('file-too-long', 'error') });
+    }
+    else if (lineCount > warnLine) {
+        warnings.push({ type: 'file-too-long', message: `File is ${lineCount} lines (>${warnLine})`, severity: sev('file-too-long', 'warning') });
+    }
+    const srcLines = source.split('\n');
+    const errorThreshold = config.functionLengthThreshold * 2;
+    for (const fn of functions) {
+        const endLine = findPythonFunctionEnd(srcLines, fn.line);
+        const span = endLine - fn.line + 1;
+        if (span > errorThreshold) {
+            warnings.push({ type: 'function-too-long', message: `${fn.name} is ~${span} lines (>${errorThreshold})`, severity: sev('function-too-long', 'error'), line: fn.line });
+        }
+        else if (span > config.functionLengthThreshold) {
+            warnings.push({ type: 'function-too-long', message: `${fn.name} is ~${span} lines (>${config.functionLengthThreshold})`, severity: sev('function-too-long', 'warning'), line: fn.line });
+        }
+    }
+    if (functions.length > config.maxFunctionsPerFile) {
+        warnings.push({ type: 'too-many-functions', message: `${functions.length} functions in one file (>${config.maxFunctionsPerFile})`, severity: sev('too-many-functions', 'warning') });
+    }
+    if (thirdPartyImports.length > config.maxImportsPerFile) {
+        warnings.push({ type: 'too-many-imports', message: `${thirdPartyImports.length} third-party imports (>${config.maxImportsPerFile})`, severity: sev('too-many-imports', 'warning') });
+    }
+    // Public functions: those not starting with _
+    const hasPublic = functions.some(f => !f.name.startsWith('_'));
+    if (!hasPublic && functions.length > 0) {
+        warnings.push({ type: 'no-exports', message: 'No public functions detected', severity: sev('no-exports', 'info') });
+    }
+    return warnings;
+}
+// --- complexity ---
+function scorePyComplexity(source, codeLines, functions, thirdPartyImports) {
+    let score = 1;
+    const fnDensity = codeLines > 0 ? functions.length / (codeLines / 50) : 0;
+    score += Math.min(3, Math.floor(fnDensity));
+    const maxIndent = source.split('\n').reduce((max, line) => {
+        const trimmed = line.trimStart();
+        if (!trimmed || trimmed.startsWith('#'))
+            return max;
+        return Math.max(max, line.length - trimmed.length);
+    }, 0);
+    score += Math.min(2, Math.floor(Math.floor(maxIndent / 4) / 3));
+    const cfCount = (source.match(/\b(if|elif|else|for|while|try|except|finally|with|match|case|lambda)\b/g) ?? []).length;
+    score += Math.min(2, Math.floor(cfCount / 10));
+    score += Math.min(2, Math.floor(thirdPartyImports.length / 3));
+    return Math.max(1, Math.min(10, score));
+}
+// --- health score ---
+// Shared scorer in ../scoring.ts — Python passes zeroed TypeScript metrics.
+// --- main export ---
+function analysePython(source, config, filePath = '') {
+    const rawLines = source.split('\n');
+    const lineCount = rawLines.length;
+    const blankLines = rawLines.filter(l => l.trim() === '' || l.trim().startsWith('#')).length;
+    const codeLines = lineCount - blankLines;
+    const allFunctions = detectPyFunctions(source);
+    const functions = config.ignoreFunctions.length > 0
+        ? allFunctions.filter(f => !config.ignoreFunctions.includes(f.name))
+        : allFunctions;
+    const thirdPartyImports = extractPyThirdPartyImports(source);
+    const complexityScore = scorePyComplexity(source, codeLines, functions, thirdPartyImports);
+    const warnings = detectPyWarnings(lineCount, functions, thirdPartyImports, source, config);
+    const baseSmells = detectPyCodeSmells(source, functions, lineCount, config, (0, guards_1.isTestFile)(filePath));
+    const hardcodedSecrets = (0, secrets_1.detectHardcodedSecrets)(source, config, 'python', filePath);
+    const secretLines = new Set(hardcodedSecrets.map(s => s.line));
+    const codeSmells = {
+        ...baseSmells,
+        unusedVars: baseSmells.unusedVars.filter(v => !secretLines.has(v.line)),
+        hardcodedSecrets,
+    };
+    const healthScore = (0, scoring_1.computeHealthScore)(warnings, ZEROED_TS_METRICS, codeSmells, config);
+    return {
+        lineCount,
+        blankLines,
+        codeLines,
+        functions,
+        thirdPartyImports,
+        unusedImports: [], // Python doesn't enforce unused imports at runtime
+        complexityScore,
+        warnings,
+        typeScriptMetrics: ZEROED_TS_METRICS,
+        codeSmells,
+        healthScore,
+    };
+}
+//# sourceMappingURL=analyser.js.map