@iris-code/core 0.1.0

package/dist/ts/analyser.js

@@ -0,0 +1,769 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyseTs = analyseTs;
+const lines_1 = require("../lines");
+const secrets_1 = require("../secrets");
+const securityContext_1 = require("../securityContext");
+const guards_1 = require("../guards");
+const scoring_1 = require("../scoring");
+const sfc_1 = require("../sfc");
+// --- regex constants ---
+const FUNCTION_DECL_RE = /(?:^|\s)(?:async\s+)?function\s+(\w+)\s*\(/gm;
+// Two deliberate hardenings here, both from the 2026-08-04 security pass, which
+// measured a single 200k-line file taking 127 SECONDS to analyse - past the 2s
+// hard limit in TESTING.md, and a denial of service reachable by merely opening
+// a file from a cloned repo (CPU profile: 3.73s of 3.78s inside METHOD_RE).
+//
+// 1. LEADING INDENT IS `[ \t]*`, NOT `\s*`. This was the quadratic term. `\s`
+//    matches newlines, so under /m the engine anchored at a line start, let
+//    `\s*` swallow every blank line to EOF, failed `(\w+)`, then backtracked one
+//    character at a time - O(filesize) per line, O(n^2) overall. `^` already
+//    means line start under /m, so indentation is spaces and tabs by definition
+//    and this is both faster and more correct.
+// 2. THE PARAMETER SPAN IS BOUNDED. `[\s\S]*?` is unbounded lazy
+//    match-anything, so a `(` with no matching `)` scans the rest of the file on
+//    every attempt. The cap limits that to a fixed window.
+//
+// Neither change can create a false positive: both only ever narrow what
+// matches, and no real signature has a 2000-character parameter list.
+const PARAM_SPAN = '[\\s\\S]{0,2000}?';
+const ARROW_FN_RE = new RegExp(`(?:^|\\s)(?:export\\s+)?(?:const|let)\\s+(\\w+)\\s*=\\s*(?:async\\s*)?\\(${PARAM_SPAN}\\)[ \\t]*(?::[ \\t]*\\S+[ \\t]*)?[ \\t]*=>`, 'gm');
+const METHOD_RE = new RegExp(`^[ \\t]*(?:async[ \\t]+)?(\\w+)[ \\t]*\\(${PARAM_SPAN}\\)[ \\t]*(?::[ \\t]*\\S+[ \\t]*)?\\{`, 'gm');
+const IMPORT_RE = /^import\s+(?:.+\s+from\s+)?['"]([^'"]+)['"]/gm;
+const EXPORT_FROM_RE = /^export\s+(?:.+\s+from\s+)?['"]([^'"]+)['"]/gm;
+const REQUIRE_RE = /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
+const DYNAMIC_IMPORT_RE = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
+const BUILTIN_PREFIXES = ['.', '/', 'node:'];
+const NODE_BUILTINS = new Set([
+    'fs', 'path', 'os', 'crypto', 'http', 'https', 'net', 'stream',
+    'events', 'util', 'url', 'querystring', 'buffer', 'child_process',
+    'cluster', 'dns', 'domain', 'readline', 'repl', 'string_decoder',
+    'timers', 'tls', 'tty', 'v8', 'vm', 'zlib', 'assert', 'module',
+    'process', 'perf_hooks', 'worker_threads', 'async_hooks', 'inspector',
+]);
+// --- helpers ---
+// Replace comment text with spaces (preserving newlines so line numbers stay accurate).
+// Handles //-line comments and /* block comments */ while skipping string literals.
+function stripCStyleComments(source) {
+    let result = '';
+    let i = 0;
+    const len = source.length;
+    while (i < len) {
+        const ch = source[i];
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const q = ch;
+            result += ch;
+            i++;
+            while (i < len) {
+                const c = source[i];
+                if (c === '\\') {
+                    result += c + (source[i + 1] ?? '');
+                    i += 2;
+                }
+                else {
+                    result += c;
+                    i++;
+                    if (c === q)
+                        break;
+                }
+            }
+        }
+        else if (ch === '/' && source[i + 1] === '/') {
+            while (i < len && source[i] !== '\n') {
+                result += ' ';
+                i++;
+            }
+        }
+        else if (ch === '/' && source[i + 1] === '*') {
+            result += ' ';
+            i++;
+            result += ' ';
+            i++;
+            while (i < len) {
+                if (source[i] === '*' && source[i + 1] === '/') {
+                    result += '  ';
+                    i += 2;
+                    break;
+                }
+                result += source[i] === '\n' ? '\n' : ' ';
+                i++;
+            }
+        }
+        else {
+            result += ch;
+            i++;
+        }
+    }
+    return result;
+}
+function stripQuotedTextPreserveNewlines(source, quotes) {
+    const quoteSet = new Set(quotes);
+    let result = '';
+    let i = 0;
+    while (i < source.length) {
+        const ch = source[i];
+        if (!quoteSet.has(ch)) {
+            result += ch;
+            i++;
+            continue;
+        }
+        result += ' ';
+        i++;
+        while (i < source.length) {
+            const current = source[i];
+            if (current === '\n') {
+                result += '\n';
+                i++;
+                continue;
+            }
+            if (current === '\\') {
+                result += ' ';
+                if (i + 1 < source.length) {
+                    result += source[i + 1] === '\n' ? '\n' : ' ';
+                }
+                i += 2;
+                continue;
+            }
+            result += ' ';
+            i++;
+            if (current === ch)
+                break;
+        }
+    }
+    return result;
+}
+function findFunctionEnd(lines, startLine) {
+    let depth = 0;
+    let parenDepth = 0;
+    let foundOpen = false;
+    for (let i = startLine - 1; i < lines.length; i++) {
+        const line = lines[i];
+        let j = 0;
+        while (j < line.length) {
+            const ch = line[j];
+            if (ch === '"' || ch === "'" || ch === '`') {
+                const q = ch;
+                j++;
+                while (j < line.length && line[j] !== q) {
+                    if (line[j] === '\\')
+                        j++;
+                    j++;
+                }
+            }
+            else if (ch === '/' && line[j + 1] === '/') {
+                break;
+            }
+            else if (ch === '(') {
+                parenDepth++;
+            }
+            else if (ch === ')') {
+                parenDepth = Math.max(0, parenDepth - 1);
+            }
+            else if (ch === '{' && parenDepth === 0) {
+                // Braces inside parentheses are destructured parameters, object
+                // arguments, or JSX expression containers nested in call arguments -
+                // never the function body. Counting them ended components like
+                // `function F({ props }: Props)` on their own first line, so
+                // function-too-long could never fire for React components (bug found
+                // via the 5.10 testbed, fixed 2026-07-19). Known remaining edge: an
+                // object-literal RETURN TYPE (`): { x: number } {`) still closes at
+                // depth 0 early - rare enough to accept.
+                depth++;
+                foundOpen = true;
+            }
+            else if (ch === '}' && parenDepth === 0 && foundOpen) {
+                depth--;
+                if (depth === 0)
+                    return i + 1;
+            }
+            j++;
+        }
+    }
+    return startLine;
+}
+// Returns a copy of `source` in which only regex SOURCE survives - the body of
+// a `/.../ ` regex literal and the string argument of a `RegExp(...)` /
+// `new RegExp(...)` call - with every other character blanked to a space
+// (newlines preserved so offsets and line numbers stay exact). The ReDoS
+// heuristic runs over this so arithmetic like `(a+b)*c` can never be mistaken
+// for a nested-quantifier regex (5.11 benchmark FP unsafe-regex/negative/
+// math_helpers.ts). A `/` is read as a regex start only when the previous
+// significant character cannot end an expression - the standard divide-vs-regex
+// disambiguation; when uncertain it favours NOT treating `/` as regex, so the
+// only failure mode is a missed regex (recall, guarded by the benchmark
+// positives), never a new false positive.
+function regexOnlySource(source) {
+    const out = [];
+    const n = source.length;
+    let i = 0;
+    let prevSig = '';
+    const EXPR_START = '([{,;:!&|=?+-*%^~<>';
+    const blank = (ch) => (ch === '\n' ? '\n' : ' ');
+    while (i < n) {
+        const ch = source[i];
+        if (ch === '/' && source[i + 1] === '/') {
+            while (i < n && source[i] !== '\n') {
+                out.push(' ');
+                i++;
+            }
+            continue;
+        }
+        if (ch === '/' && source[i + 1] === '*') {
+            out.push(' ', ' ');
+            i += 2;
+            while (i < n && !(source[i] === '*' && source[i + 1] === '/')) {
+                out.push(blank(source[i]));
+                i++;
+            }
+            if (i < n) {
+                out.push(' ', ' ');
+                i += 2;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const q = ch;
+            const before = source.slice(Math.max(0, i - 48), i);
+            const isRegexArg = /RegExp\s*\(\s*$/.test(before);
+            out.push(' ');
+            i++; // opening quote
+            while (i < n) {
+                const c = source[i];
+                if (c === '\\') {
+                    out.push(isRegexArg ? c : ' ');
+                    if (i + 1 < n)
+                        out.push(isRegexArg ? source[i + 1] : blank(source[i + 1]));
+                    i += 2;
+                    continue;
+                }
+                if (c === q) {
+                    out.push(' ');
+                    i++;
+                    break;
+                }
+                out.push(isRegexArg ? (c === '\n' ? '\n' : c) : blank(c));
+                i++;
+            }
+            prevSig = q;
+            continue;
+        }
+        if (ch === '/') {
+            const startsRegex = prevSig === '' || EXPR_START.includes(prevSig);
+            if (startsRegex) {
+                out.push('/');
+                i++;
+                let inClass = false;
+                while (i < n) {
+                    const c = source[i];
+                    if (c === '\n')
+                        break;
+                    if (c === '\\') {
+                        out.push(c);
+                        if (i + 1 < n)
+                            out.push(source[i + 1]);
+                        i += 2;
+                        continue;
+                    }
+                    if (c === '[')
+                        inClass = true;
+                    else if (c === ']')
+                        inClass = false;
+                    out.push(c);
+                    i++;
+                    if (c === '/' && !inClass)
+                        break;
+                }
+                while (i < n && /[a-z]/i.test(source[i])) {
+                    out.push(' ');
+                    i++;
+                }
+                prevSig = '/';
+                continue;
+            }
+            out.push(' ');
+            prevSig = '/';
+            i++;
+            continue;
+        }
+        out.push(blank(ch));
+        if (!/\s/.test(ch))
+            prevSig = ch;
+        i++;
+    }
+    return out.join('');
+}
+function isThirdParty(specifier) {
+    if (BUILTIN_PREFIXES.some(p => specifier.startsWith(p)))
+        return false;
+    const root = specifier.startsWith('@')
+        ? specifier.split('/').slice(0, 2).join('/')
+        : specifier.split('/')[0];
+    return !NODE_BUILTINS.has(root);
+}
+// --- unused import detection ---
+function extractImportBindings(importText, startLine) {
+    const bindings = [];
+    if (/^import\s*['"]/.test(importText.trim()))
+        return bindings;
+    const normalized = importText.replace(/\bimport\s+type\s+/, 'import ');
+    const fromMatch = /\bfrom\s+['"]/.exec(normalized);
+    if (!fromMatch)
+        return bindings;
+    const importKw = normalized.indexOf('import ');
+    const clause = normalized.slice(importKw + 'import '.length, fromMatch.index).trim();
+    const nsMatch = /\*\s+as\s+(\w+)/.exec(clause);
+    if (nsMatch)
+        bindings.push({ name: nsMatch[1], line: startLine });
+    const namedMatch = /\{([^}]*)\}/.exec(clause);
+    if (namedMatch) {
+        for (const part of namedMatch[1].split(',')) {
+            const t = part.trim().replace(/^type\s+/, '');
+            if (!t)
+                continue;
+            const asMatch = /^(\w+)\s+as\s+(\w+)$/.exec(t);
+            const localName = asMatch ? asMatch[2] : t.split(/\s+/)[0];
+            if (localName && /^\w+$/.test(localName))
+                bindings.push({ name: localName, line: startLine });
+        }
+    }
+    const defaultPart = clause
+        .replace(/\{[^}]*\}/, '')
+        .replace(/\*\s+as\s+\w+/, '')
+        .replace(/,/g, ' ')
+        .trim();
+    if (defaultPart && /^\w+$/.test(defaultPart))
+        bindings.push({ name: defaultPart, line: startLine });
+    return bindings;
+}
+function detectUnusedImports(source) {
+    const lines = source.split('\n');
+    const allBindings = [];
+    const importLineSet = new Set();
+    let i = 0;
+    while (i < lines.length) {
+        const trimmed = lines[i].trimStart();
+        if (/^import(\s+type)?\s/.test(trimmed)) {
+            const startLine = i + 1;
+            importLineSet.add(i);
+            let importText = lines[i];
+            while (!/\bfrom\s+['"]/.test(importText) && i + 1 < lines.length) {
+                i++;
+                importLineSet.add(i);
+                importText += ' ' + lines[i];
+            }
+            allBindings.push(...extractImportBindings(importText, startLine));
+        }
+        i++;
+    }
+    const body = lines.map((l, idx) => importLineSet.has(idx) ? '' : l).join('\n');
+    return allBindings.filter(b => {
+        const re = new RegExp(`\\b${b.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+        return !re.test(body);
+    });
+}
+// --- core detectors ---
+function detectFunctions(source) {
+    const stripped = stripCStyleComments(source);
+    const results = [];
+    const NOISE = new Set(['if', 'for', 'while', 'switch', 'catch', 'return']);
+    for (const re of [FUNCTION_DECL_RE, ARROW_FN_RE, METHOD_RE]) {
+        re.lastIndex = 0;
+        let match;
+        while ((match = re.exec(stripped)) !== null) {
+            const name = match[1];
+            if (NOISE.has(name))
+                continue;
+            results.push({ name, line: (0, lines_1.lineOf)(source, match.index) });
+        }
+    }
+    const seen = new Set();
+    return results.filter(f => {
+        const key = `${f.name}:${f.line}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    }).sort((a, b) => a.line - b.line);
+}
+function extractThirdPartyImports(source) {
+    const imports = new Set();
+    const patterns = [IMPORT_RE, EXPORT_FROM_RE, REQUIRE_RE, DYNAMIC_IMPORT_RE];
+    for (const pattern of patterns) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(source)) !== null) {
+            const specifier = match[1];
+            if (isThirdParty(specifier)) {
+                const pkg = specifier.startsWith('@')
+                    ? specifier.split('/').slice(0, 2).join('/')
+                    : specifier.split('/')[0];
+                imports.add(pkg);
+            }
+        }
+    }
+    return [...imports].sort();
+}
+function scoreComplexity(source, codeLines, functions, thirdPartyImports) {
+    let score = 1;
+    const fnDensity = codeLines > 0 ? functions.length / (codeLines / 50) : 0;
+    score += Math.min(3, Math.floor(fnDensity));
+    const maxIndent = source.split('\n').reduce((max, line) => {
+        const trimmed = line.trimStart();
+        if (!trimmed)
+            return max;
+        return Math.max(max, line.length - trimmed.length);
+    }, 0);
+    score += Math.min(2, Math.floor(Math.floor(maxIndent / 2) / 3));
+    const cfCount = (source.match(/\b(if|else|for|while|switch|catch|ternary|\?[^:])\b/g) ?? []).length;
+    score += Math.min(2, Math.floor(cfCount / 10));
+    score += Math.min(2, Math.floor(thirdPartyImports.length / 3));
+    return Math.max(1, Math.min(10, score));
+}
+function detectTypeScriptMetrics(source, config) {
+    const anyUsages = [];
+    // Scan comment- and string-stripped source so `: any` inside a comment or a
+    // string literal is not counted as a type annotation (5.11 benchmark FP:
+    // any-usage/negative/comment_mention.ts). The strippers preserve offsets and
+    // newlines, so lineOf against the original source stays accurate.
+    const anySource = stripQuotedTextPreserveNewlines(stripCStyleComments(source), [`'`, `"`, '`']);
+    const explicitRe = /:\s*any\b|\bas\s+any\b/g;
+    explicitRe.lastIndex = 0;
+    let em;
+    while ((em = explicitRe.exec(anySource)) !== null) {
+        anyUsages.push({ line: (0, lines_1.lineOf)(source, em.index) });
+    }
+    const tsIgnoreCount = (source.match(/\/\/\s*@ts-ignore/g) ?? []).length;
+    const tsExpectErrorCount = (source.match(/\/\/\s*@ts-expect-error/g) ?? []).length;
+    const nonNullAssertions = (source.match(/[\w)\]]!(?!=)/g) ?? []).length;
+    const typeAssertions = (source.match(/\bas\s+(?!any\b)\w/g) ?? []).length;
+    let missingReturnTypes = 0;
+    if (config.enableMissingReturnTypeWarnings) {
+        const exportedTotal = (source.match(/export\s+(?:async\s+)?function\s+\w+\s*\(/gm) ?? []).length;
+        const exportedWithReturn = (source.match(/export\s+(?:async\s+)?function\s+\w+[^{(]*\([^{]*\)\s*:\s*\w[^{]*\{/gm) ?? []).length;
+        missingReturnTypes = Math.max(0, exportedTotal - exportedWithReturn);
+    }
+    return { anyUsages, tsIgnoreCount, tsExpectErrorCount, nonNullAssertions, typeAssertions, missingReturnTypes };
+}
+// Collects the text between the first ( and its matching ) starting at startLineIdx,
+// spanning multiple lines if needed. Returns null if no opening ( is found.
+function extractParamInner(lines, startLineIdx) {
+    let collected = '';
+    let depth = 0;
+    let started = false;
+    for (let i = startLineIdx; i < lines.length; i++) {
+        const line = lines[i];
+        for (const ch of line) {
+            if (ch === '(') {
+                if (!started) {
+                    started = true;
+                    depth = 1;
+                }
+                else
+                    depth++;
+            }
+            else if (ch === ')' && started) {
+                depth--;
+                if (depth === 0)
+                    return collected;
+                else
+                    collected += ch;
+            }
+            else if (started) {
+                collected += ch;
+            }
+        }
+        if (started)
+            collected += ' ';
+    }
+    return null;
+}
+function detectCodeSmells(source, functions, lineCount, config, isTest = false) {
+    const lines = source.split('\n');
+    const consoleLogs = [];
+    if (config.enableConsoleLogWarnings) {
+        // Scan comment-stripped source so "console.log(...)" inside a comment is
+        // not flagged; the stripper preserves offsets, so lineOf stays accurate.
+        const clogSource = stripCStyleComments(source);
+        const clogRe = /\bconsole\.(log|warn|error)\s*\(/g;
+        clogRe.lastIndex = 0;
+        let cm;
+        while ((cm = clogRe.exec(clogSource)) !== null) {
+            consoleLogs.push({ line: (0, lines_1.lineOf)(source, cm.index) });
+        }
+    }
+    const todos = [];
+    if (config.enableTodoDetection) {
+        const todoRe = /\/\/.*\b(TODO|FIXME|HACK)\b[:\s]*(.*)/;
+        lines.forEach((line, i) => {
+            const m = todoRe.exec(line);
+            if (m)
+                todos.push({ text: `${m[1]}: ${m[2].trim()}`.trim(), line: i + 1 });
+        });
+    }
+    let deepNesting = 0;
+    for (let i = 0; i < functions.length; i++) {
+        const startIdx = functions[i].line;
+        const endIdx = (functions[i + 1]?.line ?? lineCount + 1) - 1;
+        const body = lines.slice(startIdx, endIdx);
+        const maxIndent = body.reduce((max, l) => {
+            const t = l.trimStart();
+            return t ? Math.max(max, l.length - t.length) : max;
+        }, 0);
+        if (maxIndent >= 8)
+            deepNesting++;
+    }
+    const longParameterLists = [];
+    if (config.enableLongParamDetection) {
+        for (const fn of functions) {
+            const inner = extractParamInner(lines, fn.line - 1);
+            if (inner) {
+                const paramCount = inner.split(',').filter(p => p.trim()).length;
+                if (paramCount >= config.maxParameterCount)
+                    longParameterLists.push({ name: fn.name, paramCount, line: fn.line });
+            }
+        }
+    }
+    const magicNumbers = [];
+    if (config.enableMagicNumberDetection) {
+        // Matches named assignments that should not be flagged:
+        //   export? const/let/var name[: type] = number
+        //   class fields with at least one modifier: private/public/protected/static/readonly/override/abstract/declare
+        const namedAssignRe = /^\s*(?:export\s+)?(?:const|let|var)\s+\w+(?:\s*:\s*[\w<>[\]|&?]+)?\s*=\s*-?[\d.]+\s*[;,]?\s*$|^\s*(?:export\s+)?(?:(?:private|public|protected|static|readonly|override|abstract|declare)\s+)+\w+(?:\s*:\s*[\w<>[\]|&?]+)?\s*=\s*-?[\d.]+\s*[;,]?\s*$/;
+        const seen = new Set();
+        const sanitizedLines = stripQuotedTextPreserveNewlines(stripCStyleComments(source), [`'`, `"`, '`']).split('\n');
+        sanitizedLines.forEach((stripped, i) => {
+            if (namedAssignRe.test(stripped))
+                return;
+            const numRe = /\b(\d+(?:\.\d+)?)\b/g;
+            let nm;
+            while ((nm = numRe.exec(stripped)) !== null) {
+                const n = nm[1];
+                const key = `${i + 1}:${n}`;
+                if (n !== '0' && n !== '1' && !seen.has(key)) {
+                    magicNumbers.push({ value: n, line: i + 1 });
+                    seen.add(key);
+                }
+            }
+        });
+    }
+    // --- unused vars and functions ---
+    const { unusedVars, unusedFunctions } = config.enableUnusedDetection
+        ? detectUnusedDeclarations(source, functions)
+        : { unusedVars: [], unusedFunctions: [] };
+    // --- security smells ---
+    const evalUsage = [];
+    const sqlConcatenation = [];
+    const insecureRandom = [];
+    const unsafeRegex = [];
+    const hardcodedLocalhost = [];
+    const disabledTlsVerification = [];
+    const debugFlagsEnabled = [];
+    const weakHashing = [];
+    const openRedirect = [];
+    if (config.enableSecuritySmells) {
+        const stripped = stripCStyleComments(source);
+        // eval/new Function scan runs over comment- AND string-stripped source so
+        // the token `eval(` inside a string literal (e.g. a lint-message constant
+        // 'Calls like eval(userInput)...') is not flagged - the 5.11 benchmark FP
+        // eval-usage/negative/lint_messages.js. A real `eval(expr)` keeps its
+        // `eval(` outside the string, so detection is unaffected. Offsets preserved.
+        const evalSource = stripQuotedTextPreserveNewlines(stripped, [`'`, `"`, '`']);
+        const evalRe = /\beval\s*\(|new\s+Function\s*\(/g;
+        evalRe.lastIndex = 0;
+        let ev;
+        while ((ev = evalRe.exec(evalSource)) !== null) {
+            evalUsage.push({ line: (0, lines_1.lineOf)(source, ev.index) });
+        }
+        const sqlRe = /['"`][^'"`\n]*\b(?:SELECT|INSERT|UPDATE|DELETE|DROP)\b[^'"`\n]*['"`]\s*\+/g;
+        sqlRe.lastIndex = 0;
+        let sq;
+        while ((sq = sqlRe.exec(source)) !== null) {
+            sqlConcatenation.push({ line: (0, lines_1.lineOf)(source, sq.index) });
+        }
+        // Template literal SQL injection: `SELECT ... ${var}`
+        const sqlTplRe = /`[^`\n]*\b(?:SELECT|INSERT|UPDATE|DELETE|DROP)\b[^`\n]*\$\{[^}]+\}/g;
+        sqlTplRe.lastIndex = 0;
+        let sqt;
+        while ((sqt = sqlTplRe.exec(source)) !== null) {
+            sqlConcatenation.push({ line: (0, lines_1.lineOf)(source, sqt.index) });
+        }
+        const rngRe = /\bMath\.random\s*\(/g;
+        rngRe.lastIndex = 0;
+        let rn;
+        while ((rn = rngRe.exec(stripped)) !== null) {
+            if ((0, securityContext_1.hasSecurityContext)(stripped, rn.index)) {
+                insecureRandom.push({ line: (0, lines_1.lineOf)(source, rn.index) });
+            }
+        }
+        // Confine the nested-quantifier heuristic to actual regex source (literals
+        // and RegExp(...) args) so arithmetic like `(a+b)*c` is never flagged.
+        const regexSource = regexOnlySource(source);
+        const reRe = /\([^)\n]*[+*][^)\n]*\)[+*]/g;
+        reRe.lastIndex = 0;
+        let rx;
+        while ((rx = reRe.exec(regexSource)) !== null) {
+            unsafeRegex.push({ line: (0, lines_1.lineOf)(source, rx.index) });
+        }
+        if (!isTest) {
+            const localRe = /\blocalhost\b|127\.0\.0\.1/g;
+            localRe.lastIndex = 0;
+            let lh;
+            while ((lh = localRe.exec(stripped)) !== null) {
+                hardcodedLocalhost.push({ line: (0, lines_1.lineOf)(source, lh.index) });
+            }
+        }
+        const tlsRe = /rejectUnauthorized\s*:\s*false/g;
+        tlsRe.lastIndex = 0;
+        let tl;
+        while ((tl = tlsRe.exec(stripped)) !== null) {
+            disabledTlsVerification.push({ line: (0, lines_1.lineOf)(source, tl.index) });
+        }
+        if (!isTest) {
+            const dbgRe = /\bdebug\s*:\s*true\b/gi;
+            dbgRe.lastIndex = 0;
+            let db;
+            while ((db = dbgRe.exec(stripped)) !== null) {
+                debugFlagsEnabled.push({ line: (0, lines_1.lineOf)(source, db.index) });
+            }
+        }
+        const hashRe = /\bcreateHash\s*\(\s*['"`](?:md5|sha1)['"`]\s*\)/gi;
+        hashRe.lastIndex = 0;
+        let wh;
+        while ((wh = hashRe.exec(stripped)) !== null) {
+            weakHashing.push({ line: (0, lines_1.lineOf)(source, wh.index) });
+        }
+        const redirectRe = /res(?:ponse)?\.redirect\s*\([^)]*(?:req(?:uest)?\.(?:query|params|body)|\bparams\b\[|\bquery\b\[)/gi;
+        redirectRe.lastIndex = 0;
+        let or;
+        while ((or = redirectRe.exec(stripped)) !== null) {
+            openRedirect.push({ line: (0, lines_1.lineOf)(source, or.index) });
+        }
+    }
+    return { consoleLogs, todos, deepNesting, longParameterLists, magicNumbers, unusedVars, unusedFunctions, hardcodedSecrets: [], bareSuppressions: [], duplicateBlocks: [], fileNamingViolations: [], evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect };
+}
+function detectUnusedDeclarations(source, functions) {
+    const lines = source.split('\n');
+    const unusedVars = [];
+    const unusedFunctions = [];
+    // --- unused variables ---
+    // Match const/let/var declarations. Destructuring ({, [) is naturally excluded because
+    // the name capture \w+ won't match { or [.
+    const varDeclRe = /^[ \t]*(?:export\s+)?(?:const|let|var)\s+(\w+)/gm;
+    varDeclRe.lastIndex = 0;
+    let vm;
+    while ((vm = varDeclRe.exec(source)) !== null) {
+        const name = vm[1];
+        const line = (0, lines_1.lineOf)(source, vm.index);
+        const declLine = lines[line - 1] ?? '';
+        // Skip exported declarations
+        if (/\bexport\b/.test(declLine))
+            continue;
+        // Skip function assignments (arrow fns / function expressions) — handled by unusedFunctions
+        if (/=\s*(?:async\s+)?(?:\(|function\b)/.test(declLine))
+            continue;
+        // Skip _ (conventional throwaway)
+        if (name === '_')
+            continue;
+        // Check usage in the rest of the file (don't strip strings — JSX / template literals count)
+        const bodyWithoutDecl = lines.map((l, i) => (i === line - 1 ? '' : l)).join('\n');
+        if (!new RegExp(`\\b${name}\\b`).test(bodyWithoutDecl)) {
+            unusedVars.push({ name, line });
+        }
+    }
+    // --- unused functions ---
+    for (const fn of functions) {
+        const declLine = lines[fn.line - 1] ?? '';
+        // Skip exported functions
+        if (/\bexport\b/.test(declLine))
+            continue;
+        const bodyWithoutDecl = lines.map((l, i) => (i === fn.line - 1 ? '' : l)).join('\n');
+        if (!new RegExp(`\\b${fn.name}\\b`).test(bodyWithoutDecl)) {
+            unusedFunctions.push({ name: fn.name, line: fn.line });
+        }
+    }
+    return { unusedVars, unusedFunctions };
+}
+function detectWarnings(lineCount, functions, thirdPartyImports, source, config, filePath = '') {
+    const warnings = [];
+    const sev = (type, fallback) => config.severityOverrides[type] ?? fallback;
+    const warnLine = Math.round(config.fileLengthThreshold * 2 / 3);
+    if (lineCount > config.fileLengthThreshold) {
+        warnings.push({ type: 'file-too-long', message: `File is ${lineCount} lines (>${config.fileLengthThreshold})`, severity: sev('file-too-long', 'error') });
+    }
+    else if (lineCount > warnLine) {
+        warnings.push({ type: 'file-too-long', message: `File is ${lineCount} lines (>${warnLine})`, severity: sev('file-too-long', 'warning') });
+    }
+    const srcLines = source.split('\n');
+    const errorThreshold = config.functionLengthThreshold * 2;
+    for (const fn of functions) {
+        const endLine = findFunctionEnd(srcLines, fn.line);
+        const span = endLine - fn.line + 1;
+        if (span > errorThreshold) {
+            warnings.push({ type: 'function-too-long', message: `${fn.name} is ~${span} lines (>${errorThreshold})`, severity: sev('function-too-long', 'error'), line: fn.line });
+        }
+        else if (span > config.functionLengthThreshold) {
+            warnings.push({ type: 'function-too-long', message: `${fn.name} is ~${span} lines (>${config.functionLengthThreshold})`, severity: sev('function-too-long', 'warning'), line: fn.line });
+        }
+    }
+    if (functions.length > config.maxFunctionsPerFile) {
+        warnings.push({ type: 'too-many-functions', message: `${functions.length} functions in one file (>${config.maxFunctionsPerFile})`, severity: sev('too-many-functions', 'warning') });
+    }
+    if (thirdPartyImports.length > config.maxImportsPerFile) {
+        warnings.push({ type: 'too-many-imports', message: `${thirdPartyImports.length} third-party imports (>${config.maxImportsPerFile})`, severity: sev('too-many-imports', 'warning') });
+    }
+    // A CommonJS module (`module.exports = ...` / `exports.foo = ...`) has no
+    // `export` keyword but is not export-less - \bexport\b never matches "exports"
+    // (the trailing "s" defeats the boundary). Recognise both so .js/.cjs modules
+    // are not falsely flagged (5.11 benchmark FP no-exports/negative/exported_utils.js).
+    //
+    // A Vue or Svelte single-file component is NEVER export-less: the component
+    // itself is the module's export, produced by the compiler. `<script setup>`
+    // exists precisely so the author writes no `export` statement, a Svelte
+    // component body never has one, and a template-only SFC has no script at all.
+    // Flagging those made no-exports fire on essentially every component in a Vue
+    // or Svelte codebase.
+    const hasEsExport = /\bexport\b/.test(source);
+    const hasCommonJsExport = /\bmodule\.exports\b|\bexports\s*(?:\.|\[)/.test(source);
+    if (!hasEsExport && !hasCommonJsExport && !(0, sfc_1.isSingleFileComponent)(filePath)) {
+        warnings.push({ type: 'no-exports', message: 'No exports detected', severity: sev('no-exports', 'info') });
+    }
+    return warnings;
+}
+function analyseTs(source, config, filePath = '') {
+    const rawLines = source.split('\n');
+    const lineCount = rawLines.length;
+    const blankLines = rawLines.filter(l => l.trim() === '').length;
+    const codeLines = lineCount - blankLines;
+    const allFunctions = detectFunctions(source);
+    const functions = config.ignoreFunctions.length > 0
+        ? allFunctions.filter(f => !config.ignoreFunctions.includes(f.name))
+        : allFunctions;
+    const thirdPartyImports = extractThirdPartyImports(source);
+    const unusedImports = detectUnusedImports(source);
+    const complexityScore = scoreComplexity(source, codeLines, functions, thirdPartyImports);
+    const warnings = detectWarnings(lineCount, functions, thirdPartyImports, source, config, filePath);
+    const typeScriptMetrics = detectTypeScriptMetrics(source, config);
+    const baseSmells = detectCodeSmells(source, functions, lineCount, config, (0, guards_1.isTestFile)(filePath));
+    const hardcodedSecrets = (0, secrets_1.detectHardcodedSecrets)(source, config, 'typescript', filePath);
+    const secretLines = new Set(hardcodedSecrets.map(s => s.line));
+    const codeSmells = {
+        ...baseSmells,
+        unusedVars: baseSmells.unusedVars.filter(v => !secretLines.has(v.line)),
+        hardcodedSecrets,
+    };
+    const healthScore = (0, scoring_1.computeHealthScore)(warnings, typeScriptMetrics, codeSmells, config);
+    return {
+        lineCount,
+        blankLines,
+        codeLines,
+        functions,
+        thirdPartyImports,
+        unusedImports,
+        complexityScore,
+        warnings,
+        typeScriptMetrics,
+        codeSmells,
+        healthScore,
+    };
+}
+//# sourceMappingURL=analyser.js.map