@mondaydotcomorg/atp-compiler 0.22.2 → 0.23.0

package/__tests__/unit/api-call-analyzer.test.ts

@@ -0,0 +1,387 @@
+import { describe, test, expect } from '@jest/globals';
+import { analyzeApiCalls } from '../../src/api-call-analyzer';
+
+describe('analyzeApiCalls', () => {
+	test('extracts a single api.<group>.<op>(...) call', () => {
+		const r = analyzeApiCalls(`return api.calendar.events_list({ calendarId: 'primary' });`);
+		expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		expect(r.dynamicCallsDetected).toBe(false);
+	});
+
+	test('extracts nested await + multiple calls in the same group', () => {
+		const code = `
+      const c = await api.calendar.calendars_get({ calendarId: 'primary' });
+      return await api.calendar.events_list({ calendarId: c.id, maxResults: 10 });
+    `;
+		const r = analyzeApiCalls(code);
+		const sorted = r.apiCalls.slice().sort((a, b) => a.operationId.localeCompare(b.operationId));
+		expect(sorted).toEqual([
+			{ apiGroup: 'calendar', operationId: 'calendars_get' },
+			{ apiGroup: 'calendar', operationId: 'events_list' },
+		]);
+		expect(r.dynamicCallsDetected).toBe(false);
+	});
+
+	test('extracts cross-group calls', () => {
+		const r = analyzeApiCalls(`
+      await api.calendar.events_list({});
+      await api.gmail.messages_list({});
+    `);
+		expect(r.apiCalls).toEqual(
+			expect.arrayContaining([
+				{ apiGroup: 'calendar', operationId: 'events_list' },
+				{ apiGroup: 'gmail', operationId: 'messages_list' },
+			])
+		);
+	});
+
+	test('deduplicates repeated calls to the same api.<group>.<op>', () => {
+		const r = analyzeApiCalls(`
+      await api.calendar.events_list({ maxResults: 1 });
+      await api.calendar.events_list({ maxResults: 2 });
+    `);
+		expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+	});
+
+	test('flags dynamic dispatch via computed operation member', () => {
+		const r = analyzeApiCalls(`return api.calendar[fn]({});`);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('flags dynamic dispatch via computed group member', () => {
+		const r = analyzeApiCalls(`return api[g].events_list({});`);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('flags destructured api: const { calendar } = api', () => {
+		const r = analyzeApiCalls(`
+      const { calendar } = api;
+      return calendar.events_list({});
+    `);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('flags destructure-with-rename: const { calendar: c } = api', () => {
+		const r = analyzeApiCalls(`
+      const { calendar: c } = api;
+      return c.events_list({});
+    `);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('flags aliasing: const x = api.calendar', () => {
+		const r = analyzeApiCalls(`
+      const x = api.calendar;
+      return x.events_list({});
+    `);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('flags aliasing: const x = api', () => {
+		const r = analyzeApiCalls(`
+      const x = api;
+      return x.calendar.events_list({});
+    `);
+		expect(r.dynamicCallsDetected).toBe(true);
+	});
+
+	test('returns empty calls + no dynamic flag for trivial code', () => {
+		const r = analyzeApiCalls(`return 42;`);
+		expect(r.apiCalls).toEqual([]);
+		expect(r.dynamicCallsDetected).toBe(false);
+	});
+
+	test('fails closed with dynamicCallsDetected=true on syntax error', () => {
+		const r = analyzeApiCalls(`return api.calendar.events_list(`);
+		expect(r.dynamicCallsDetected).toBe(true);
+		expect(r.apiCalls).toEqual([]);
+	});
+
+	test('handles empty string input', () => {
+		const r = analyzeApiCalls('');
+		expect(r.apiCalls).toEqual([]);
+		expect(r.dynamicCallsDetected).toBe(false);
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Dedup — same (group, op) through different syntactic paths
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('dedup', () => {
+		test('same op called in both branches of a ternary', () => {
+			const r = analyzeApiCalls(`
+        return flag
+          ? api.calendar.events_list({ a: 1 })
+          : api.calendar.events_list({ a: 2 });
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+
+		test('same op called inside a loop is reported once', () => {
+			const r = analyzeApiCalls(`
+        for (const id of ids) {
+          await api.calendar.events_list({ calendarId: id });
+        }
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('same op across try/catch/finally reports once', () => {
+			const r = analyzeApiCalls(`
+        try {
+          await api.calendar.events_list({});
+        } catch (e) {
+          await api.calendar.events_list({ retry: true });
+        } finally {
+          api.calendar.events_list({ cleanup: true });
+        }
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('same op across multiple statements is reported once', () => {
+			const r = analyzeApiCalls(`
+        const a = await api.calendar.events_list({ maxResults: 1 });
+        const b = await api.calendar.events_list({ maxResults: 2 });
+        const c = await api.calendar.events_list({ maxResults: 3 });
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Complex control-flow / realistic code shapes
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('complex control flow', () => {
+		test('IIFE (immediately-invoked async function)', () => {
+			const r = analyzeApiCalls(`
+        return (async () => await api.calendar.events_list({}))();
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+
+		test('Promise.all with multiple awaits', () => {
+			const r = analyzeApiCalls(`
+        return await Promise.all([
+          api.calendar.events_list({}),
+          api.gmail.messages_list({}),
+          api.drive.files_list({}),
+        ]);
+      `);
+			const sorted = r.apiCalls
+				.slice()
+				.sort((a, b) => (a.apiGroup + '.' + a.operationId).localeCompare(b.apiGroup + '.' + b.operationId));
+			expect(sorted).toEqual([
+				{ apiGroup: 'calendar', operationId: 'events_list' },
+				{ apiGroup: 'drive', operationId: 'files_list' },
+				{ apiGroup: 'gmail', operationId: 'messages_list' },
+			]);
+		});
+
+		test('arrow inside .then() chain', () => {
+			const r = analyzeApiCalls(`
+        return api.calendar.events_list({})
+          .then((list) => api.calendar.events_get({ eventId: list.items[0].id }))
+          .then((ev) => api.calendar.calendars_get({ calendarId: ev.calendarId }));
+      `);
+			expect(r.apiCalls.sort((a, b) => a.operationId.localeCompare(b.operationId))).toEqual([
+				{ apiGroup: 'calendar', operationId: 'calendars_get' },
+				{ apiGroup: 'calendar', operationId: 'events_get' },
+				{ apiGroup: 'calendar', operationId: 'events_list' },
+			]);
+		});
+
+		test('class method body', () => {
+			const r = analyzeApiCalls(`
+        class Scheduler {
+          async listEvents() {
+            return await api.calendar.events_list({ calendarId: 'primary' });
+          }
+        }
+        return new Scheduler().listEvents();
+      `);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('nested try/catch/finally across multiple groups', () => {
+			const r = analyzeApiCalls(`
+        try {
+          await api.calendar.events_list({});
+        } catch (e) {
+          await api.gmail.messages_list({ label: 'errors' });
+        } finally {
+          api.drive.files_list({});
+        }
+      `);
+			expect(r.apiCalls.length).toBe(3);
+		});
+
+		test('switch statement with api calls per case', () => {
+			const r = analyzeApiCalls(`
+        switch (kind) {
+          case 'a': return api.calendar.events_list({});
+          case 'b': return api.calendar.events_get({ eventId: x });
+          default: return api.calendar.calendars_get({ calendarId: 'primary' });
+        }
+      `);
+			expect(r.apiCalls.length).toBe(3);
+		});
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Multi-group realism — many sources + many ops
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('multi-group', () => {
+		test('realistic Google Suite workload (6 groups, 11 ops)', () => {
+			const r = analyzeApiCalls(`
+        const events = await api.calendar.events_list({ calendarId: 'primary' });
+        const cal = await api.calendar.calendars_get({ calendarId: 'primary' });
+        const messages = await api.gmail.messages_list({});
+        const thread = await api.gmail.threads_get({ id: '1' });
+        const sheet = await api.sheets.spreadsheets_get({ spreadsheetId: 'x' });
+        const values = await api.sheets.spreadsheets_values_get({ spreadsheetId: 'x', range: 'A1' });
+        const drive = await api.drive.files_list({});
+        const file = await api.drive.files_get({ fileId: 'x' });
+        const deck = await api.slides.presentations_get({ presentationId: 'x' });
+        const doc = await api.docs.documents_get({ documentId: 'x' });
+        const batch = await api.sheets.spreadsheets_batchUpdate({ spreadsheetId: 'x' });
+        return { events, cal, messages, thread, sheet, values, drive, file, deck, doc, batch };
+      `);
+
+			const groupsTouched = new Set(r.apiCalls.map((c) => c.apiGroup));
+			expect(groupsTouched).toEqual(new Set(['calendar', 'gmail', 'sheets', 'drive', 'slides', 'docs']));
+			expect(r.apiCalls).toHaveLength(11);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+
+		test('mixed groups with some dedup', () => {
+			const r = analyzeApiCalls(`
+        await api.calendar.events_list({});
+        await api.gmail.messages_list({});
+        await api.calendar.events_list({});   // dup
+        await api.gmail.messages_list({});    // dup
+        await api.calendar.events_get({ eventId: 'x' });
+      `);
+			expect(r.apiCalls).toHaveLength(3);
+			expect(r.apiCalls.map((c) => c.apiGroup + '.' + c.operationId).sort()).toEqual([
+				'calendar.events_get',
+				'calendar.events_list',
+				'gmail.messages_list',
+			]);
+		});
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Additional dynamic-dispatch escape patterns
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('dynamic dispatch — additional escapes', () => {
+		test('flags optional-chained operation member', () => {
+			const r = analyzeApiCalls(`return api.calendar?.events_list?.({});`);
+			// Detected statically OR dynamic — either outcome denies a grant
+			// that doesn't cover the target. This implementation DETECTS
+			// because the static path is resolvable; no dynamic flag needed.
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('flags .call() redirection as a regular static call', () => {
+			const r = analyzeApiCalls(`api.calendar.events_list.call(null, {});`);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('flags .apply() redirection', () => {
+			const r = analyzeApiCalls(`api.calendar.events_list.apply(null, [{}]);`);
+			expect(r.apiCalls).toEqual([{ apiGroup: 'calendar', operationId: 'events_list' }]);
+		});
+
+		test('flags .bind() + later call', () => {
+			const r = analyzeApiCalls(`
+        const boundList = api.calendar.events_list.bind(null);
+        return boundList({});
+      `);
+			// .bind still surfaces the underlying call target.
+			expect(r.apiCalls).toContainEqual({ apiGroup: 'calendar', operationId: 'events_list' });
+		});
+
+		test('flags Object.values(api) as dynamic', () => {
+			const r = analyzeApiCalls(`
+        const groups = Object.values(api);
+        return groups.map((g) => Object.keys(g));
+      `);
+			expect(r.dynamicCallsDetected).toBe(true);
+		});
+
+		test('flags Object.keys(api) as dynamic', () => {
+			const r = analyzeApiCalls(`return Object.keys(api);`);
+			expect(r.dynamicCallsDetected).toBe(true);
+		});
+
+		test('flags spread {...api} as dynamic', () => {
+			const r = analyzeApiCalls(`const x = { ...api }; return x;`);
+			expect(r.dynamicCallsDetected).toBe(true);
+		});
+
+		test('flags passing api as function argument', () => {
+			const r = analyzeApiCalls(`
+        const use = (a) => a.calendar.events_list({});
+        return use(api);
+      `);
+			expect(r.dynamicCallsDetected).toBe(true);
+		});
+
+		test('flags returning bare api', () => {
+			const r = analyzeApiCalls(`return api;`);
+			expect(r.dynamicCallsDetected).toBe(true);
+		});
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Not-false-positive — identifiers named "api" that aren't the global
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('does not false-positive on unrelated "api" identifiers', () => {
+		test('this.api.foo.bar(...) is ignored (not the global api)', () => {
+			const r = analyzeApiCalls(`return this.api.foo.bar({});`);
+			expect(r.apiCalls).toEqual([]);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+
+		test('someObj.api.foo.bar(...) is ignored', () => {
+			const r = analyzeApiCalls(`
+        const wrapper = { api: null };
+        return wrapper.api?.foo?.bar?.({});
+      `);
+			expect(r.apiCalls).toEqual([]);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+
+		test('deep api.x.y.z(...) — not valid ATP syntax — silently ignored', () => {
+			// Sandbox's runtime namespace would throw on this; static analyzer
+			// ignores it so we don't over-flag invalid code as dynamic.
+			const r = analyzeApiCalls(`return api.x.y.z({});`);
+			expect(r.apiCalls).toEqual([]);
+			expect(r.dynamicCallsDetected).toBe(false);
+		});
+	});
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Idempotency — deterministic output across calls
+	// ────────────────────────────────────────────────────────────────────────
+
+	describe('idempotency', () => {
+		test('calling analyzeApiCalls twice on same code yields identical output', () => {
+			const code = `
+        await api.calendar.events_list({});
+        await api.gmail.messages_list({});
+        const { calendar } = api;
+      `;
+			const a = analyzeApiCalls(code);
+			const b = analyzeApiCalls(code);
+			expect(a).toEqual(b);
+		});
+	});
+});

package/dist/api-call-analyzer.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pre-dispatch static analysis of ATP agent code.
+ *
+ * Extracts every `api.<group>.<op>(...)` call chain from submitted code
+ * and flags patterns that defeat static analysis (dynamic dispatch,
+ * aliasing, destructuring).
+ *
+ * Intended caller: governance layers that need to know WHICH api groups
+ * and operations code will touch BEFORE dispatching it to the sandbox.
+ * Paired with runtime `filterApiGroups` enforcement in atp-server for
+ * defense-in-depth; the static pass catches unauthorized references
+ * up-front without paying sandbox startup cost.
+ *
+ * @example
+ *   const { apiCalls, dynamicCallsDetected } = analyzeApiCalls(code);
+ *   for (const call of apiCalls) {
+ *     // check (call.apiGroup, call.operationId) against a grant
+ *   }
+ *   if (dynamicCallsDetected) {
+ *     // deny unless the grant explicitly allows dynamic dispatch
+ *   }
+ */
+export interface DetectedApiCall {
+    apiGroup: string;
+    operationId: string;
+}
+export interface AnalysisResult {
+    /** Unique `(apiGroup, operationId)` pairs statically visible in the code. */
+    apiCalls: DetectedApiCall[];
+    /**
+     * True iff the code contains patterns we cannot statically resolve to a
+     * concrete `(apiGroup, operationId)` — e.g. `api[varName].fn(...)`,
+     * destructuring (`const { calendar } = api`), or aliasing
+     * (`const x = api.calendar`). Governance layers should fail-closed on
+     * this flag unless the caller's policy opts into dynamic dispatch.
+     */
+    dynamicCallsDetected: boolean;
+}
+/**
+ * Analyze agent code and return its statically-visible api.* call set plus a
+ * dynamic-dispatch flag. Pure function, no I/O, fail-closed on parse errors
+ * (returns `{ apiCalls: [], dynamicCallsDetected: true }`).
+ */
+export declare function analyzeApiCalls(code: string): AnalysisResult;
+//# sourceMappingURL=api-call-analyzer.d.ts.map

package/dist/api-call-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-call-analyzer.d.ts","sourceRoot":"","sources":["../src/api-call-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,6EAA6E;IAC7E,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B;;;;;;OAMG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAgL5D"}

package/dist/api-call-analyzer.js

@@ -0,0 +1,192 @@
+/**
+ * Pre-dispatch static analysis of ATP agent code.
+ *
+ * Extracts every `api.<group>.<op>(...)` call chain from submitted code
+ * and flags patterns that defeat static analysis (dynamic dispatch,
+ * aliasing, destructuring).
+ *
+ * Intended caller: governance layers that need to know WHICH api groups
+ * and operations code will touch BEFORE dispatching it to the sandbox.
+ * Paired with runtime `filterApiGroups` enforcement in atp-server for
+ * defense-in-depth; the static pass catches unauthorized references
+ * up-front without paying sandbox startup cost.
+ *
+ * @example
+ *   const { apiCalls, dynamicCallsDetected } = analyzeApiCalls(code);
+ *   for (const call of apiCalls) {
+ *     // check (call.apiGroup, call.operationId) against a grant
+ *   }
+ *   if (dynamicCallsDetected) {
+ *     // deny unless the grant explicitly allows dynamic dispatch
+ *   }
+ */
+import { parse } from '@babel/parser';
+// @babel/traverse exports default; interop handles the CJS/ESM quirk
+// (see https://github.com/babel/babel/issues/13855).
+import _traverse from '@babel/traverse';
+import * as t from '@babel/types';
+const traverse = (_traverse.default ??
+    _traverse);
+/**
+ * Analyze agent code and return its statically-visible api.* call set plus a
+ * dynamic-dispatch flag. Pure function, no I/O, fail-closed on parse errors
+ * (returns `{ apiCalls: [], dynamicCallsDetected: true }`).
+ */
+export function analyzeApiCalls(code) {
+    const calls = [];
+    const seen = new Set();
+    let dynamicCallsDetected = false;
+    let ast;
+    try {
+        ast = parse(code, {
+            sourceType: 'module',
+            allowReturnOutsideFunction: true,
+            plugins: ['typescript'],
+        });
+    }
+    catch {
+        // Fail-closed: syntax error → treat as dynamic so governance denies.
+        return { apiCalls: [], dynamicCallsDetected: true };
+    }
+    // Helper records a static api.<group>.<op>(...) call, or flips
+    // dynamicCallsDetected when the call expression escapes static resolution.
+    const tryRecordCall = (calleeNode) => {
+        let callee = calleeNode;
+        // Unwrap one `.call` / `.apply` / `.bind` redirection:
+        //   api.calendar.events_list.call(null, {...})
+        // has callee = MemberExpression { object: api.calendar.events_list, property: 'call' }
+        if ((t.isMemberExpression(callee) || t.isOptionalMemberExpression(callee)) &&
+            !callee.computed &&
+            t.isIdentifier(callee.property) &&
+            (callee.property.name === 'call' ||
+                callee.property.name === 'apply' ||
+                callee.property.name === 'bind')) {
+            callee = callee.object;
+        }
+        if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
+            return;
+        const groupExpr = callee.object;
+        if (!t.isMemberExpression(groupExpr) && !t.isOptionalMemberExpression(groupExpr))
+            return;
+        if (!t.isIdentifier(groupExpr.object, { name: 'api' }))
+            return;
+        // api[groupVar].op(...) or api.group[fnVar](...) → dynamic
+        if (groupExpr.computed || callee.computed) {
+            dynamicCallsDetected = true;
+            return;
+        }
+        const groupNode = groupExpr.property;
+        const opNode = callee.property;
+        if (!t.isIdentifier(groupNode) || !t.isIdentifier(opNode)) {
+            dynamicCallsDetected = true;
+            return;
+        }
+        const key = `${groupNode.name}.${opNode.name}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            calls.push({ apiGroup: groupNode.name, operationId: opNode.name });
+        }
+    };
+    try {
+        traverse(ast, {
+            // Assignments / destructures that alias `api` or `api.<group>` — any of
+            // these lets the code reach an api group via an opaque identifier later.
+            VariableDeclarator(path) {
+                const init = path.node.init;
+                if (!init)
+                    return;
+                // const { calendar } = api
+                if (t.isObjectPattern(path.node.id) && t.isIdentifier(init, { name: 'api' })) {
+                    dynamicCallsDetected = true;
+                    return;
+                }
+                // const x = api
+                if (t.isIdentifier(path.node.id) && t.isIdentifier(init, { name: 'api' })) {
+                    dynamicCallsDetected = true;
+                    return;
+                }
+                // const x = api.<group>   OR   const x = api['<group>']
+                if (t.isIdentifier(path.node.id) &&
+                    t.isMemberExpression(init) &&
+                    t.isIdentifier(init.object, { name: 'api' })) {
+                    dynamicCallsDetected = true;
+                }
+            },
+            // Any other mention of `api` that hands it off to an opaque consumer:
+            //   fn(api)                      — alias escape via function argument
+            //   Object.values(api) / keys(…) — enumeration
+            //   { ...api } / [ ...api ]      — spread
+            //   return api                   — caller gets the alias
+            //   api = x (reassignment)       — later reads hit a different object
+            //
+            // The api.<group>.<op>(...) pattern is recognised by the CallExpression
+            // visitor below; skip it here via parent-shape whitelisting.
+            Identifier(path) {
+                if (path.node.name !== 'api')
+                    return;
+                // Skip the PROPERTY position of a member expression — e.g.
+                // `this.api`, `window.api`, `someObj.api`. That's not the
+                // global `api` binding we care about.
+                if ((t.isMemberExpression(path.parent) || t.isOptionalMemberExpression(path.parent)) &&
+                    path.parent.property === path.node &&
+                    !path.parent.computed) {
+                    return;
+                }
+                // `api.<group>` (non-computed member) — safe, handled by CallExpression.
+                if ((t.isMemberExpression(path.parent) || t.isOptionalMemberExpression(path.parent)) &&
+                    path.parent.object === path.node &&
+                    !path.parent.computed) {
+                    return;
+                }
+                // Left-hand side of `const x = api` / `const { calendar } = api`
+                // — handled by VariableDeclarator above (dynamic flag set there).
+                if (t.isVariableDeclarator(path.parent) && path.parent.init === path.node) {
+                    return;
+                }
+                // Skip declaration positions where `api` is a local binding name,
+                // not a reference:
+                //   { api: value }           — object property key
+                //   function f(api) { ... }  — param name
+                //   class { api() {...} }    — method name
+                //   function api() {}        — function name
+                //   class api {}             — class name
+                if ((t.isObjectProperty(path.parent) || t.isObjectMethod(path.parent)) &&
+                    path.parent.key === path.node &&
+                    !path.parent.computed) {
+                    return;
+                }
+                if (t.isClassMethod(path.parent) && path.parent.key === path.node && !path.parent.computed) {
+                    return;
+                }
+                if ((t.isFunctionDeclaration(path.parent) ||
+                    t.isFunctionExpression(path.parent) ||
+                    t.isClassDeclaration(path.parent) ||
+                    t.isClassExpression(path.parent)) &&
+                    path.parent.id === path.node) {
+                    return;
+                }
+                if (path.parentPath?.isFunction() && path.listKey === 'params') {
+                    return;
+                }
+                if (t.isImportSpecifier(path.parent) || t.isImportDefaultSpecifier(path.parent) || t.isImportNamespaceSpecifier(path.parent)) {
+                    return;
+                }
+                // Anything else (`Object.values(api)`, `fn(api)`, `{ ...api }`,
+                // `return api`, `api = ...`) escapes static resolution.
+                dynamicCallsDetected = true;
+            },
+            CallExpression(path) {
+                tryRecordCall(path.node.callee);
+            },
+            OptionalCallExpression(path) {
+                tryRecordCall(path.node.callee);
+            },
+        });
+    }
+    catch {
+        // Visitor error → fail-closed (should be unreachable under our plugin set).
+        return { apiCalls: [], dynamicCallsDetected: true };
+    }
+    return { apiCalls: calls, dynamicCallsDetected };
+}
+//# sourceMappingURL=api-call-analyzer.js.map

package/dist/api-call-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-call-analyzer.js","sourceRoot":"","sources":["../src/api-call-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,qEAAqE;AACrE,qDAAqD;AACrD,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAElC,MAAM,QAAQ,GAAG,CAAE,SAAuD,CAAC,OAAO;IACjF,SAAS,CAAqB,CAAC;AAoBhC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACJ,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE;YACjB,UAAU,EAAE,QAAQ;YACpB,0BAA0B,EAAE,IAAI;YAChC,OAAO,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;QACrE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,+DAA+D;IAC/D,2EAA2E;IAC3E,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAE,EAAE;QAC5C,IAAI,MAAM,GAAW,UAAU,CAAC;QAEhC,uDAAuD;QACvD,+CAA+C;QAC/C,uFAAuF;QACvF,IACC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC,MAAM,CAAC,QAAQ;YAChB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM;gBAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;gBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,EAChC,CAAC;YACF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;YAAE,OAAO;QAEnF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;YAAE,OAAO;QACzF,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO;QAE/D,2DAA2D;QAC3D,IAAI,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,oBAAoB,GAAG,IAAI,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,oBAAoB,GAAG,IAAI,CAAC;YAC5B,OAAO;QACR,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACF,CAAC,CAAC;IAEF,IAAI,CAAC;QACJ,QAAQ,CAAC,GAAG,EAAE;YACb,wEAAwE;YACxE,yEAAyE;YACzE,kBAAkB,CAAC,IAAI;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAElB,2BAA2B;gBAC3B,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBAC9E,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,OAAO;gBACR,CAAC;gBACD,gBAAgB;gBAChB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBAC3E,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,OAAO;gBACR,CAAC;gBACD,wDAAwD;gBACxD,IACC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAC3C,CAAC;oBACF,oBAAoB,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACF,CAAC;YAED,sEAAsE;YACtE,sEAAsE;YACtE,+CAA+C;YAC/C,0CAA0C;YAC1C,yDAAyD;YACzD,sEAAsE;YACtE,EAAE;YACF,wEAAwE;YACxE,6DAA6D;YAC7D,UAAU,CAAC,IAAI;gBACd,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO;gBAErC,2DAA2D;gBAC3D,0DAA0D;gBAC1D,sCAAsC;gBACtC,IACC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI;oBAClC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,yEAAyE;gBACzE,IACC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAChF,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;oBAChC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC3E,OAAO;gBACR,CAAC;gBACD,kEAAkE;gBAClE,mBAAmB;gBACnB,mDAAmD;gBACnD,0CAA0C;gBAC1C,2CAA2C;gBAC3C,6CAA6C;gBAC7C,0CAA0C;gBAC1C,IACC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClE,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI;oBAC7B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC5F,OAAO;gBACR,CAAC;gBACD,IACC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAC3B,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChE,OAAO;gBACR,CAAC;gBACD,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9H,OAAO;gBACR,CAAC;gBAED,gEAAgE;gBAChE,wDAAwD;gBACxD,oBAAoB,GAAG,IAAI,CAAC;YAC7B,CAAC;YAED,cAAc,CAAC,IAAI;gBAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,sBAAsB,CAAC,IAAI;gBAC1B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,4EAA4E;QAC5E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AAClD,CAAC"}