@keithadler/frostjs 0.1.0

package/dist/eslint.js

@@ -0,0 +1,111 @@
+/**
+ * ESLint plugin. One rule, `frostjs/capability`, runs the same engine the
+ * CLI does on each file ESLint hands it: frostjs's own parse, extraction,
+ * policy discovery (nearest frostjs.policy above the file) and decision.
+ * Reports are ESLint problems at the use's position, so they show in
+ * editors and `eslint-disable` comments work alongside `frostjs: ignore`.
+ *
+ *   import frostjs from "@keithadler/frostjs/eslint";
+ *   export default [{ plugins: { frostjs }, rules: { "frostjs/capability": "error" } }];
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { parseSource } from "./extract/ast.js";
+import { extract } from "./extract/index.js";
+import { compilePolicyFile, decide, findPolicyFile, isoToday, matchesGlob, DENY_ALL, PolicyError, } from "./policy/index.js";
+import { denialText, describeUse } from "./report/text.js";
+import { VERSION } from "./version.js";
+const cache = new Map();
+/** The policy for a file, cached by mtime so edits are picked up without restarting ESLint. */
+function loadPolicy(file, today, explicit) {
+    const policyFile = explicit ? path.resolve(explicit) : findPolicyFile(path.dirname(file));
+    if (policyFile === null)
+        return { policy: DENY_ALL, dir: path.dirname(file) };
+    const dir = path.dirname(policyFile);
+    let mtimeMs;
+    try {
+        mtimeMs = fs.statSync(policyFile).mtimeMs;
+    }
+    catch {
+        return { policy: DENY_ALL, dir, error: `cannot read policy ${policyFile}` };
+    }
+    const hit = cache.get(policyFile);
+    if (hit && hit.mtimeMs === mtimeMs && hit.policy.today === today)
+        return { policy: hit.policy, dir };
+    try {
+        const policy = compilePolicyFile(policyFile, today);
+        cache.set(policyFile, { policy, mtimeMs });
+        return { policy, dir };
+    }
+    catch (e) {
+        if (e instanceof PolicyError || e instanceof Error)
+            return { policy: DENY_ALL, dir, error: e.message };
+        throw e;
+    }
+}
+/** The `frostjs/capability` rule. See RuleOptions. */
+export const capabilityRule = {
+    meta: {
+        type: "problem",
+        docs: { description: "Deny capability uses the frostjs policy has not granted", recommended: true },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    policy: { type: "string" },
+                    minConfidence: { enum: ["certain", "probable", "possible"] },
+                    reportUnknown: { type: "boolean" },
+                    today: { type: "string" },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    create(context) {
+        return {
+            Program() {
+                const filename = context.filename ?? context.getFilename?.() ?? "<input>";
+                const text = context.sourceCode?.text ?? context.getSourceCode?.().text ?? "";
+                const opts = (context.options[0] ?? {});
+                const today = opts.today ?? isoToday();
+                const file = path.resolve(filename);
+                const { policy, dir, error } = loadPolicy(file, today, opts.policy);
+                if (error) {
+                    context.report({ message: `frostjs: ${error.split("\n")[0]}`, loc: { line: 1, column: 0 } });
+                    return;
+                }
+                if (policy.ignore.some((g) => matchesGlob(g, path.relative(dir, file))))
+                    return;
+                const parsed = parseSource(file, text);
+                if (parsed.errors.length > 0)
+                    return; // ESLint's own parser will have complained already
+                const decisions = decide(extract(parsed), policy, {
+                    scopePath: (u) => path.relative(dir, u.file),
+                    ...(opts.minConfidence ? { minConfidence: opts.minConfidence } : {}),
+                });
+                for (const d of decisions) {
+                    const { use } = d;
+                    const loc = { line: use.line, column: use.column - 1 };
+                    const subject = describeUse(use.capability, use.target);
+                    if (d.verdict === "denied") {
+                        context.report({ message: `${subject} ${denialText(d)}`, loc });
+                    }
+                    else if (d.verdict === "unknown" && opts.reportUnknown) {
+                        context.report({ message: `${subject} ${use.confidence} (not failing the build)`, loc });
+                    }
+                }
+            },
+        };
+    },
+};
+const plugin = {
+    meta: { name: "frostjs", version: VERSION },
+    rules: { capability: capabilityRule },
+    configs: {},
+};
+plugin.configs["recommended"] = {
+    plugins: { frostjs: plugin },
+    rules: { "frostjs/capability": "error" },
+};
+export default plugin;
+//# sourceMappingURL=eslint.js.map

package/dist/eslint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslint.js","sourceRoot":"","sources":["../src/eslint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,GAGZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA6BvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa,EAAE,QAAiB;IAChE,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,UAAU,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,WAAW,IAAI,CAAC,YAAY,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvG,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,WAAW,EAAE,IAAI,EAAE;QACnG,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;oBAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,MAAM,CAAC,OAAgB;QACrB,OAAO;YACL,OAAO;gBACL,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,SAAS,CAAC;gBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAgB,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAEpC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpE,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC7F,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO;gBAChF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,mDAAmD;gBACzF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE;oBAChD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBAClB,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxD,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3B,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAClE,CAAC;yBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACzD,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,GAAG,CAAC,UAAU,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3F,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;IAC3C,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;IACrC,OAAO,EAAE,EAA6B;CACvC,CAAC;AAEF,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG;IAC9B,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;IAC5B,KAAK,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE;CACzC,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/extract/annotations.d.ts

@@ -0,0 +1,5 @@
+/** Annotation keys the scope analysis writes onto identifier nodes for the recognizers to read. */
+export declare const FOLDED = "$frostjsFolded";
+export declare const FREE = "$frostjsFree";
+export declare const AMBIGUOUS = "$frostjsAmbiguous";
+//# sourceMappingURL=annotations.d.ts.map

package/dist/extract/annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/extract/annotations.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,eAAO,MAAM,MAAM,mBAAmB,CAAC;AACvC,eAAO,MAAM,IAAI,iBAAiB,CAAC;AACnC,eAAO,MAAM,SAAS,sBAAsB,CAAC"}

package/dist/extract/annotations.js

@@ -0,0 +1,5 @@
+/** Annotation keys the scope analysis writes onto identifier nodes for the recognizers to read. */
+export const FOLDED = "$frostjsFolded";
+export const FREE = "$frostjsFree";
+export const AMBIGUOUS = "$frostjsAmbiguous";
+//# sourceMappingURL=annotations.js.map

package/dist/extract/annotations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.js","sourceRoot":"","sources":["../../src/extract/annotations.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,CAAC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AACvC,MAAM,CAAC,MAAM,IAAI,GAAG,cAAc,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC"}

package/dist/extract/ast.d.ts

@@ -0,0 +1,45 @@
+import type { Program, Node } from "oxc-parser";
+export type { Program, Node };
+/** An AST node with its fields open for inspection. oxc's typed tree is narrower than the walkers need. */
+export type AnyNode = Node & Record<string, unknown>;
+export declare const isNode: (v: unknown) => v is AnyNode;
+export interface ParseError {
+    file: string;
+    line: number;
+    column: number;
+    message: string;
+}
+export interface Comment {
+    type: "Line" | "Block";
+    value: string;
+    start: number;
+    end: number;
+}
+export interface ParsedFile {
+    file: string;
+    source: string;
+    program: Program;
+    comments: Comment[];
+    errors: ParseError[];
+    lines: LineIndex;
+}
+/** Offsets of the first character of each line. */
+export type LineIndex = readonly number[];
+/** Offsets of the first character of each line, for mapping byte offsets to positions. */
+export declare function lineIndex(source: string): LineIndex;
+/** Map a character offset to a 1-based line and column. */
+export declare function positionAt(lines: LineIndex, offset: number): {
+    line: number;
+    column: number;
+};
+/**
+ * Parse source text. `.mjs`/`.mts` are modules, `.cjs`/`.cts` are scripts,
+ * anything else is detected from the content. The language comes from the
+ * extension (oxc handles .ts/.tsx/.jsx natively). A `.js` file that does
+ * not parse is retried as JSX, since React and Docusaurus projects put JSX
+ * in `.js` files as a matter of course.
+ */
+export declare function parseSource(file: string, source: string): ParsedFile;
+/** Read and parse a file from disk. */
+export declare function parseFile(file: string): ParsedFile;
+//# sourceMappingURL=ast.d.ts.map

package/dist/extract/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../src/extract/ast.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEhD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAE9B,2GAA2G;AAC3G,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,eAAO,MAAM,MAAM,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,OACkD,CAAC;AAE5F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,mDAAmD;AACnD,MAAM,MAAM,SAAS,GAAG,SAAS,MAAM,EAAE,CAAC;AAE1C,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAMnD;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS7F;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAgBpE;AAED,uCAAuC;AACvC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAElD"}

package/dist/extract/ast.js

@@ -0,0 +1,60 @@
+/**
+ * Adapter over oxc-parser. Everything downstream imports AST types and the
+ * parse entry points from here, never from oxc-parser directly, so a change
+ * in oxc's AST shape is absorbed in one file.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { parseSync } from "oxc-parser";
+export const isNode = (v) => typeof v === "object" && v !== null && typeof v.type === "string";
+/** Offsets of the first character of each line, for mapping byte offsets to positions. */
+export function lineIndex(source) {
+    const starts = [0];
+    for (let i = 0; i < source.length; i++) {
+        if (source.charCodeAt(i) === 10)
+            starts.push(i + 1);
+    }
+    return starts;
+}
+/** Map a character offset to a 1-based line and column. */
+export function positionAt(lines, offset) {
+    let lo = 0;
+    let hi = lines.length - 1;
+    while (lo < hi) {
+        const mid = (lo + hi + 1) >> 1;
+        if (lines[mid] <= offset)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    return { line: lo + 1, column: offset - lines[lo] + 1 };
+}
+/**
+ * Parse source text. `.mjs`/`.mts` are modules, `.cjs`/`.cts` are scripts,
+ * anything else is detected from the content. The language comes from the
+ * extension (oxc handles .ts/.tsx/.jsx natively). A `.js` file that does
+ * not parse is retried as JSX, since React and Docusaurus projects put JSX
+ * in `.js` files as a matter of course.
+ */
+export function parseSource(file, source) {
+    const ext = path.extname(file).toLowerCase();
+    const sourceType = ext === ".mjs" || ext === ".mts" ? "module" : ext === ".cjs" || ext === ".cts" ? "script" : "unambiguous";
+    let result = parseSync(file, source, { sourceType });
+    if (result.errors.length > 0 && (ext === ".js" || ext === ".mjs" || ext === ".cjs")) {
+        const asJsx = parseSync(file, source, { sourceType, lang: "jsx" });
+        if (asJsx.errors.length === 0)
+            result = asJsx;
+    }
+    const lines = lineIndex(source);
+    const errors = result.errors.map((e) => {
+        const offset = e.labels?.[0]?.start ?? 0;
+        const pos = positionAt(lines, offset);
+        return { file, line: pos.line, column: pos.column, message: e.message };
+    });
+    return { file, source, program: result.program, comments: result.comments, errors, lines };
+}
+/** Read and parse a file from disk. */
+export function parseFile(file) {
+    return parseSource(file, fs.readFileSync(file, "utf8"));
+}
+//# sourceMappingURL=ast.js.map

package/dist/extract/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/extract/ast.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgB,EAAE,CACjD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CAAC;AA4B5F,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,MAAc;IACzD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,GAAG,CAAE,IAAI,MAAM;YAAE,EAAE,GAAG,GAAG,CAAC;;YAC/B,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,UAAU,GACd,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IAC5G,IAAI,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAiB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1G,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/extract/capability.d.ts

@@ -0,0 +1,22 @@
+/** How sure the extractor is that this use is real. See REQUIREMENTS 6.1. */
+export type Confidence = "certain" | "probable" | "possible";
+/** Where a use came from: the project's own code, a vendored file admitted by the registry, or a script block in HTML. */
+export type Origin = "first-party" | "vendored" | "inline-html";
+export interface CapabilityUse {
+    /** Stable code, e.g. "storage.local", "network.fetch". */
+    capability: string;
+    /** Resolved URL or host if statically knowable, else null. */
+    target: string | null;
+    file: string;
+    /** 1-based. */
+    line: number;
+    /** 1-based. */
+    column: number;
+    /** Source text of the enclosing expression. */
+    expression: string;
+    confidence: Confidence;
+    origin: Origin;
+    /** An inline `frostjs: ignore` comment covers this use. */
+    suppressed: boolean;
+}
+//# sourceMappingURL=capability.d.ts.map

package/dist/extract/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/extract/capability.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,0HAA0H;AAC1H,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,eAAe;IACf,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAC;CACrB"}

package/dist/extract/capability.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capability.js.map

package/dist/extract/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/extract/capability.ts"],"names":[],"mappings":""}

package/dist/extract/html.d.ts

@@ -0,0 +1,15 @@
+import { type ParsedFile } from "./ast.js";
+export interface ScriptBlock {
+    /** Offset of the first character of the block's content. */
+    start: number;
+    /** Offset just past the last character of the content. */
+    end: number;
+    module: boolean;
+}
+/** Offsets of every inline JavaScript block: no `src`, a JavaScript (or no) `type`, and some content. */
+export declare function scriptBlocks(html: string): ScriptBlock[];
+/** Replace every character outside [start, end) with a space, keeping newlines. */
+export declare function mask(source: string, start: number, end: number): string;
+/** Parse each inline script block of an HTML file as its own ParsedFile positioned in the HTML. */
+export declare function parseHtml(file: string, source: string): ParsedFile[];
+//# sourceMappingURL=html.d.ts.map

package/dist/extract/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/extract/html.ts"],"names":[],"mappings":"AAWA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAEhF,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;CACjB;AAiBD,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBxD;AAED,mFAAmF;AACnF,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAcpE"}

package/dist/extract/html.js

@@ -0,0 +1,69 @@
+/**
+ * Inline <script> blocks in HTML. Each block is parsed as JavaScript with
+ * everything outside it masked to whitespace (newlines kept), so every
+ * offset, line and column already refers to the HTML file and expression
+ * text slices straight out of it. No HTML parser: a regular expression
+ * finds script elements, which is adequate for the markup people write by
+ * hand and wrong only for markup designed to confuse it, which the threat
+ * model already excludes.
+ */
+import path from "node:path";
+import { parseSync } from "oxc-parser";
+import { lineIndex, positionAt } from "./ast.js";
+const SCRIPT = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+const ATTR = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*(?:=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+/** Script types that carry JavaScript. Anything else (json, importmap, templates) is data. */
+const JS_TYPES = new Set([
+    "",
+    "text/javascript",
+    "application/javascript",
+    "text/ecmascript",
+    "application/ecmascript",
+    "module",
+    "text/jsx",
+    "text/babel",
+]);
+/** Offsets of every inline JavaScript block: no `src`, a JavaScript (or no) `type`, and some content. */
+export function scriptBlocks(html) {
+    const out = [];
+    for (const m of html.matchAll(SCRIPT)) {
+        const attrs = new Map();
+        for (const a of (m[1] ?? "").matchAll(ATTR)) {
+            attrs.set(a[1].toLowerCase(), (a[2] ?? a[3] ?? a[4] ?? "").trim().toLowerCase());
+        }
+        if (attrs.has("src"))
+            continue;
+        const type = attrs.get("type") ?? "";
+        if (!JS_TYPES.has(type))
+            continue;
+        const content = m[2] ?? "";
+        if (content.trim() === "")
+            continue;
+        const open = m.index + m[0].indexOf(">") + 1;
+        out.push({ start: open, end: open + content.length, module: type === "module" });
+    }
+    return out;
+}
+/** Replace every character outside [start, end) with a space, keeping newlines. */
+export function mask(source, start, end) {
+    const before = source.slice(0, start).replace(/[^\n]/g, " ");
+    const after = source.slice(end).replace(/[^\n]/g, " ");
+    return before + source.slice(start, end) + after;
+}
+/** Parse each inline script block of an HTML file as its own ParsedFile positioned in the HTML. */
+export function parseHtml(file, source) {
+    const lines = lineIndex(source);
+    return scriptBlocks(source).map((block) => {
+        const masked = mask(source, block.start, block.end);
+        const result = parseSync(path.basename(file) + ".js", masked, {
+            lang: "js",
+            sourceType: block.module ? "module" : "unambiguous",
+        });
+        const errors = result.errors.map((e) => {
+            const pos = positionAt(lines, e.labels?.[0]?.start ?? block.start);
+            return { file, line: pos.line, column: pos.column, message: e.message };
+        });
+        return { file, source: masked, program: result.program, comments: result.comments, errors, lines };
+    });
+}
+//# sourceMappingURL=html.js.map

package/dist/extract/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/extract/html.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiC,MAAM,UAAU,CAAC;AAUhF,MAAM,MAAM,GAAG,4CAA4C,CAAC;AAC5D,MAAM,IAAI,GAAG,iFAAiF,CAAC;AAE/F,8FAA8F;AAC9F,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC;IAC5C,EAAE;IACF,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,wBAAwB;IACxB,QAAQ;IACR,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AACnD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAc;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE;YAC5D,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;SACpD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/extract/index.d.ts

@@ -0,0 +1,9 @@
+import type { ParsedFile } from "./ast.js";
+import type { CapabilityUse, Origin } from "./capability.js";
+export interface ExtractOptions {
+    /** Where the file came from; stamped on every use. Defaults to first-party. */
+    origin?: Origin;
+}
+/** Run every recognizer over every node and return the flat list of uses. */
+export declare function extract(parsed: ParsedFile, opts?: ExtractOptions): CapabilityUse[];
+//# sourceMappingURL=index.d.ts.map

package/dist/extract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/extract/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,UAAU,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4B7D,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,cAAmB,GAAG,aAAa,EAAE,CAmCtF"}

package/dist/extract/index.js

@@ -0,0 +1,95 @@
+import { positionAt } from "./ast.js";
+import { walk } from "./walk.js";
+import { analyzeScopes } from "./scope.js";
+import { AMBIGUOUS, FOLDED, FREE } from "./annotations.js";
+import { isFoldedMember } from "./recognizers/resolve.js";
+import { suppressions, isSuppressed } from "./suppress.js";
+import { storage } from "./recognizers/storage.js";
+import { network } from "./recognizers/network.js";
+import { codegen } from "./recognizers/codegen.js";
+import { domEscape } from "./recognizers/dom-escape.js";
+import { identity } from "./recognizers/identity.js";
+import { navigation } from "./recognizers/navigation.js";
+import { globals } from "./recognizers/globals.js";
+import { worker } from "./recognizers/worker.js";
+/** One recognizer per capability family. */
+const RECOGNIZERS = [
+    storage,
+    network,
+    codegen,
+    domEscape,
+    identity,
+    navigation,
+    globals,
+    worker,
+];
+/** Run every recognizer over every node and return the flat list of uses. */
+export function extract(parsed, opts = {}) {
+    const origin = opts.origin ?? "first-party";
+    annotate(parsed.program);
+    const ignores = suppressions(parsed);
+    const out = [];
+    walk(parsed.program, (visit) => {
+        for (const recognize of RECOGNIZERS) {
+            const m = recognize(visit);
+            if (!m)
+                continue;
+            // The identifier the match rests on must be a free reference, i.e. the
+            // global. A local of the same name is not a use of the capability at
+            // all. Inside `with` nothing resolves, so the use is only possible.
+            let confidence = m.confidence;
+            if (m.via !== null) {
+                const via = m.via;
+                if (via[AMBIGUOUS])
+                    confidence = "possible";
+                else if (!via[FREE])
+                    continue;
+            }
+            if (isFoldedMember(m.node) && confidence === "certain")
+                confidence = "probable";
+            const expr = enclosingExpression(m.node, visit.ancestors);
+            const pos = positionAt(parsed.lines, expr.start);
+            out.push({
+                capability: m.capability,
+                target: m.target,
+                file: parsed.file,
+                line: pos.line,
+                column: pos.column,
+                expression: parsed.source.slice(expr.start, expr.end),
+                confidence,
+                origin,
+                suppressed: isSuppressed(ignores.get(pos.line), m.capability),
+            });
+        }
+    });
+    return out;
+}
+/** Run the scope analysis and write its answers onto the identifier nodes for the recognizers to read. */
+function annotate(program) {
+    const info = analyzeScopes(program);
+    for (const n of info.free)
+        n[FREE] = true;
+    for (const n of info.ambiguous)
+        n[AMBIGUOUS] = true;
+    for (const [n, v] of info.constants)
+        n[FOLDED] = v;
+}
+/**
+ * Grow outward from the matched node through the member/call chain it heads,
+ * so `localStorage` inside `localStorage.getItem('k').trim()` reports the
+ * whole chain.
+ */
+function enclosingExpression(node, ancestors) {
+    let current = node;
+    for (const parent of ancestors) {
+        const continues = (parent.type === "MemberExpression" && parent["object"] === current) ||
+            (parent.type === "CallExpression" && parent["callee"] === current) ||
+            (parent.type === "NewExpression" && parent["callee"] === current) ||
+            (parent.type === "ChainExpression" && parent["expression"] === current);
+        if (!continues)
+            break;
+        current = parent;
+    }
+    return current;
+}
+//# sourceMappingURL=index.js.map

package/dist/extract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extract/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,WAAW,GAA0B;IACzC,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;CACP,CAAC;AAOF,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,OAAuB,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7B,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAc,CAAC;gBAC7B,IAAI,GAAG,CAAC,SAAS,CAAC;oBAAE,UAAU,GAAG,UAAU,CAAC;qBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;YAChC,CAAC;YACD,IAAI,cAAc,CAAC,CAAC,CAAC,IAAe,CAAC,IAAI,UAAU,KAAK,SAAS;gBAAE,UAAU,GAAG,UAAU,CAAC;YAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;gBACrD,UAAU;gBACV,MAAM;gBACN,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,SAAS,QAAQ,CAAC,OAAa;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI;QAAG,CAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS;QAAG,CAAa,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACjE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS;QAAG,CAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAU,EAAE,SAA0B;IACjE,IAAI,OAAO,GAAG,IAAe,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,SAAsB,EAAE,CAAC;QAC5C,MAAM,SAAS,GACb,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;YACpE,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;YAClE,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;YACjE,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS;YAAE,MAAM;QACtB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/extract/recognizers/codegen.d.ts

@@ -0,0 +1,10 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Turning strings into code: eval (direct, indirect, or via the global
+ * object), Function only when it is actually called or constructed (a bare
+ * `Function` reference such as `instanceof Function` is everywhere and is
+ * not codegen), timers only when the first argument is string-valued, and
+ * document.write.
+ */
+export declare const codegen: Recognizer;
+//# sourceMappingURL=codegen.d.ts.map

package/dist/extract/recognizers/codegen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/codegen.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAM9D;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,UA0BrB,CAAC"}

package/dist/extract/recognizers/codegen.js

@@ -0,0 +1,39 @@
+import { callArgs, match } from "./types.js";
+import { asGlobalIn, asNamedGlobal, memberName } from "./resolve.js";
+import { leadingLiteral } from "../target.js";
+const CODEGEN_NAMES = new Set(["eval", "Function", "setTimeout", "setInterval"]);
+/**
+ * Turning strings into code: eval (direct, indirect, or via the global
+ * object), Function only when it is actually called or constructed (a bare
+ * `Function` reference such as `instanceof Function` is everywhere and is
+ * not codegen), timers only when the first argument is string-valued, and
+ * document.write.
+ */
+export const codegen = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    const parent = ancestors[0];
+    if (n.type === "MemberExpression") {
+        const prop = memberName(n);
+        if (prop === "write" || prop === "writeln") {
+            const r = asNamedGlobal(n["object"], "document");
+            return r && callArgs(node, parent) ? match("codegen.write", r, node) : null;
+        }
+    }
+    const g = asGlobalIn(n, CODEGEN_NAMES);
+    if (!g)
+        return null;
+    const args = callArgs(node, parent, true);
+    switch (g.name) {
+        case "eval":
+            return match("codegen.eval", g.r, node);
+        case "Function":
+            return args ? match("codegen.function", g.r, node) : null;
+        default: {
+            const first = args?.[0];
+            return first && leadingLiteral(first) !== null ? match("codegen.timer", g.r, node) : null;
+        }
+    }
+};
+//# sourceMappingURL=codegen.js.map

package/dist/extract/recognizers/codegen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen.js","sourceRoot":"","sources":["../../../src/extract/recognizers/codegen.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IAEnD,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/extract/recognizers/dom-escape.d.ts

@@ -0,0 +1,11 @@
+import { type Recognizer } from "./types.js";
+/**
+ * DOM escape hatches: anything that turns a string into markup or creates
+ * an element that runs code. The object is not checked - `el.innerHTML = x`
+ * is injection whatever `el` is - but only writes and calls count; reading
+ * innerHTML is not injection. In JSX, `dangerouslySetInnerHTML` and
+ * `srcdoc` attributes and intrinsic `<script>` / `<iframe>` elements count;
+ * component names do not.
+ */
+export declare const domEscape: Recognizer;
+//# sourceMappingURL=dom-escape.d.ts.map

package/dist/extract/recognizers/dom-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom-escape.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAelF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,UAmCvB,CAAC"}