@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/helpers/import-analysis.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * AST Import Analysis Helpers
+ *
+ * Extended import tracking: quick checks, module listing,
+ * CJS require tracking, and source-module matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectImportBindings = void 0;
+exports.hasImport = hasImport;
+exports.getImportedModules = getImportedModules;
+exports.isImportedFrom = isImportedFrom;
+exports.collectRequireCalls = collectRequireCalls;
+exports.getLocalImportName = getLocalImportName;
+const ast_1 = require("../../../parse/ast");
+const index_1 = require("../index");
+Object.defineProperty(exports, "collectImportBindings", { enumerable: true, get: function () { return index_1.collectImportBindings; } });
+// ============================================================================
+// Quick Import Checks
+// ============================================================================
+/**
+ * Quick check: does the file import `name` from `module`?
+ * module can be a string (exact match) or regex.
+ */
+function hasImport(root, module, name) {
+    const bindings = (0, index_1.collectImportBindings)(root);
+    for (const [local, binding] of bindings) {
+        const moduleMatch = typeof module === 'string'
+            ? binding.module === module
+            : module.test(binding.module);
+        if (!moduleMatch)
+            continue;
+        if (!name)
+            return true; // Any import from this module
+        if (binding.originalName === name || local === name)
+            return true;
+    }
+    return false;
+}
+/**
+ * Get all imported module names (unique set).
+ */
+function getImportedModules(root) {
+    const modules = new Set();
+    const bindings = (0, index_1.collectImportBindings)(root);
+    for (const binding of bindings.values()) {
+        modules.add(binding.module);
+    }
+    // Also scan for dynamic imports and requires not caught by collectImportBindings
+    (0, ast_1.walkAST)(root, (node) => {
+        // Dynamic import: import('module')
+        if (node.type === 'call_expression') {
+            const fn = node.childForFieldName('function');
+            if (fn?.type === 'import') {
+                const args = node.childForFieldName('arguments');
+                const firstArg = args?.namedChildren[0];
+                if (firstArg?.type === 'string') {
+                    const val = firstArg.text.replace(/^['"`]|['"`]$/g, '');
+                    modules.add(val);
+                }
+            }
+        }
+        return false;
+    });
+    return modules;
+}
+/**
+ * Check if a local name was imported from a module matching a pattern.
+ */
+function isImportedFrom(root, localName, modulePattern) {
+    const bindings = (0, index_1.collectImportBindings)(root);
+    const binding = bindings.get(localName);
+    if (!binding)
+        return false;
+    if (typeof modulePattern === 'string') {
+        return binding.module === modulePattern;
+    }
+    return modulePattern.test(binding.module);
+}
+/**
+ * Collect all require() calls with argument tracking.
+ * Handles:
+ * - const x = require('mod')
+ * - const { a, b } = require('mod')
+ * - require('mod') (bare)
+ */
+function collectRequireCalls(root) {
+    const requires = [];
+    (0, ast_1.walkAST)(root, (node) => {
+        if (node.type !== 'call_expression')
+            return false;
+        const fn = node.childForFieldName('function');
+        if (fn?.type !== 'identifier' || fn.text !== 'require')
+            return false;
+        const args = node.childForFieldName('arguments');
+        const firstArg = args?.namedChildren[0];
+        if (!firstArg || firstArg.type !== 'string')
+            return false;
+        const moduleName = firstArg.text.replace(/^['"`]|['"`]$/g, '');
+        // Check if this require is in a variable declaration
+        const declarator = node.parent?.type === 'variable_declarator' ? node.parent : null;
+        const nameNode = declarator?.childForFieldName('name');
+        let localName = null;
+        let isDestructured = false;
+        const destructuredNames = [];
+        if (nameNode?.type === 'identifier') {
+            localName = nameNode.text;
+        }
+        else if (nameNode?.type === 'object_pattern') {
+            isDestructured = true;
+            for (const prop of nameNode.namedChildren) {
+                if (prop.type === 'shorthand_property_identifier_pattern') {
+                    destructuredNames.push(prop.text);
+                }
+                else if (prop.type === 'pair_pattern') {
+                    const value = prop.childForFieldName('value');
+                    if (value)
+                        destructuredNames.push(value.text);
+                }
+            }
+        }
+        requires.push({
+            node,
+            module: moduleName,
+            localName,
+            isDestructured,
+            destructuredNames,
+        });
+        return false;
+    });
+    return requires;
+}
+/**
+ * Get the local name used for a specific import from a module.
+ * Returns the first matching local binding name, or null.
+ */
+function getLocalImportName(root, module, originalName) {
+    const bindings = (0, index_1.collectImportBindings)(root);
+    for (const [local, binding] of bindings) {
+        const moduleMatch = typeof module === 'string'
+            ? binding.module === module
+            : module.test(binding.module);
+        if (moduleMatch && binding.originalName === originalName) {
+            return local;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=import-analysis.js.map

package/dist/detect/ast-rules/helpers/import-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-analysis.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/import-analysis.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAiBH,8BAmBC;AAKD,gDA0BC;AAKD,wCAaC;AAqBD,kDAiDC;AAMD,gDAkBC;AAhLD,4CAA4C;AAC5C,oCAAgD;AAGvC,sGAHA,6BAAqB,OAGA;AAE9B,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,SAAS,CACvB,IAAuB,EACvB,MAAuB,EACvB,IAAa;IAEb,MAAM,QAAQ,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAA;IAE5C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ;YAC5C,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAE/B,IAAI,CAAC,WAAW;YAAE,SAAQ;QAE1B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA,CAAC,8BAA8B;QACrD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IAClE,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAuB;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,QAAQ,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAA;IAE5C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,iFAAiF;IACjF,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,mCAAmC;QACnC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,EAAE,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBAChD,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;gBACvC,IAAI,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;oBACvD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,IAAuB,EACvB,SAAiB,EACjB,aAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,KAAK,aAAa,CAAA;IACzC,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC3C,CAAC;AAcD;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAElC,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAA;QAEjD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAEpE,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAEzD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;QAE9D,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,MAAM,QAAQ,GAAG,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAEtD,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,cAAc,GAAG,KAAK,CAAA;QAC1B,MAAM,iBAAiB,GAAa,EAAE,CAAA;QAEtC,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC3B,CAAC;aAAM,IAAI,QAAQ,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC/C,cAAc,GAAG,IAAI,CAAA;YACrB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,uCAAuC,EAAE,CAAC;oBAC1D,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACnC,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC7C,IAAI,KAAK;wBAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,MAAM,EAAE,UAAU;YAClB,SAAS;YACT,cAAc;YACd,iBAAiB;SAClB,CAAC,CAAA;QAEF,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,IAAuB,EACvB,MAAuB,EACvB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAA;IAE5C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ;YAC5C,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAE/B,IAAI,WAAW,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/detect/ast-rules/helpers/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AST Helper Barrel Export
+ *
+ * All shared AST analysis utilities for rule implementations.
+ * Import from here: `import { isInsideTryCatch, resolveCallTarget } from './helpers'`
+ */
+export { collectVariableDeclarations, resolveVariableValue, isInScope, getAssignmentTarget, getAssignmentValue, isConstant, collectVariableAliases, type VariableBinding, } from './scope-analysis';
+export { isInsideTryCatch, isInsideCatchClause, isInsideConditionalGuard, hasEarlyReturnGuard, isInsideIfBranch, isDeadCode, getEnclosingBlock, } from './control-flow';
+export { resolveCallTarget, getCallArguments, getCallArgument, isMethodCallOn, getReceiverChain, isConstructorCall, getObjectLiteralProperty, getObjectLiteralProperties, findCallsTo, type ResolvedCallTarget, } from './call-analysis';
+export { extractAllStringLiterals, isTemplateLiteralWithExpressions, getTemplateLiteralParts, extractStringValue, matchesPattern, isStringConcatenation, collectConcatenationParts, isStringLike, type ExtractedString, type TemplateParts, } from './string-analysis';
+export { isUserInputExpression, isLLMOutputExpression, isDangerousSink, isDangerousPropertyAssignment, isRequestHandler, getUserInputSources, } from './user-input';
+export { collectImportBindings, hasImport, getImportedModules, isImportedFrom, collectRequireCalls, getLocalImportName, type RequireCall, } from './import-analysis';
+export { isLLMContextFile, isRouteHandler, hasMiddlewarePattern, getFileDirective, isServerFile, findAuthChecks, hasAuthImports, } from './context-detection';
+export { collectPythonImportBindings, hasPythonImport, getPythonImportedModules, isPythonImportedFrom, resolvePythonCallTarget, isPythonCallTo, getPythonCallArguments, getPythonCallArgument, getPythonKeywordArgument, isPythonMethodCallOn, getPythonAttributeChain, collectPythonVariableDeclarations, collectPythonVariableAliases, extractPythonStringValue, getPythonFirstStringArg, isPythonFString, getPythonFStringParts, isInsidePythonTryExcept, isInsidePythonExceptClause, getEnclosingPythonBlock, getPythonDecorators, hasPythonDecorator, isPythonUserInputExpression, isPythonDynamicString, isPythonLLMOutputExpression, type PythonResolvedCallTarget, type PythonVariableBinding, } from './python-helpers';
+export { extractParameterTypes, extractReturnType, extractVariableType, isSecurityRelevantType, extractGenericConstraints, hasZodInferredType, hasRequestType, hasAnyType, type ParameterType, } from './type-extraction';
+//# sourceMappingURL=index.d.ts.map

package/dist/detect/ast-rules/helpers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,WAAW,EACX,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,6BAA6B,EAC7B,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,iCAAiC,EACjC,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA"}

package/dist/detect/ast-rules/helpers/index.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * AST Helper Barrel Export
+ *
+ * All shared AST analysis utilities for rule implementations.
+ * Import from here: `import { isInsideTryCatch, resolveCallTarget } from './helpers'`
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasAuthImports = exports.findAuthChecks = exports.isServerFile = exports.getFileDirective = exports.hasMiddlewarePattern = exports.isRouteHandler = exports.isLLMContextFile = exports.getLocalImportName = exports.collectRequireCalls = exports.isImportedFrom = exports.getImportedModules = exports.hasImport = exports.collectImportBindings = exports.getUserInputSources = exports.isRequestHandler = exports.isDangerousPropertyAssignment = exports.isDangerousSink = exports.isLLMOutputExpression = exports.isUserInputExpression = exports.isStringLike = exports.collectConcatenationParts = exports.isStringConcatenation = exports.matchesPattern = exports.extractStringValue = exports.getTemplateLiteralParts = exports.isTemplateLiteralWithExpressions = exports.extractAllStringLiterals = exports.findCallsTo = exports.getObjectLiteralProperties = exports.getObjectLiteralProperty = exports.isConstructorCall = exports.getReceiverChain = exports.isMethodCallOn = exports.getCallArgument = exports.getCallArguments = exports.resolveCallTarget = exports.getEnclosingBlock = exports.isDeadCode = exports.isInsideIfBranch = exports.hasEarlyReturnGuard = exports.isInsideConditionalGuard = exports.isInsideCatchClause = exports.isInsideTryCatch = exports.collectVariableAliases = exports.isConstant = exports.getAssignmentValue = exports.getAssignmentTarget = exports.isInScope = exports.resolveVariableValue = exports.collectVariableDeclarations = void 0;
+exports.hasAnyType = exports.hasRequestType = exports.hasZodInferredType = exports.extractGenericConstraints = exports.isSecurityRelevantType = exports.extractVariableType = exports.extractReturnType = exports.extractParameterTypes = exports.isPythonLLMOutputExpression = exports.isPythonDynamicString = exports.isPythonUserInputExpression = exports.hasPythonDecorator = exports.getPythonDecorators = exports.getEnclosingPythonBlock = exports.isInsidePythonExceptClause = exports.isInsidePythonTryExcept = exports.getPythonFStringParts = exports.isPythonFString = exports.getPythonFirstStringArg = exports.extractPythonStringValue = exports.collectPythonVariableAliases = exports.collectPythonVariableDeclarations = exports.getPythonAttributeChain = exports.isPythonMethodCallOn = exports.getPythonKeywordArgument = exports.getPythonCallArgument = exports.getPythonCallArguments = exports.isPythonCallTo = exports.resolvePythonCallTarget = exports.isPythonImportedFrom = exports.getPythonImportedModules = exports.hasPythonImport = exports.collectPythonImportBindings = void 0;
+// Scope & Variable Analysis
+var scope_analysis_1 = require("./scope-analysis");
+Object.defineProperty(exports, "collectVariableDeclarations", { enumerable: true, get: function () { return scope_analysis_1.collectVariableDeclarations; } });
+Object.defineProperty(exports, "resolveVariableValue", { enumerable: true, get: function () { return scope_analysis_1.resolveVariableValue; } });
+Object.defineProperty(exports, "isInScope", { enumerable: true, get: function () { return scope_analysis_1.isInScope; } });
+Object.defineProperty(exports, "getAssignmentTarget", { enumerable: true, get: function () { return scope_analysis_1.getAssignmentTarget; } });
+Object.defineProperty(exports, "getAssignmentValue", { enumerable: true, get: function () { return scope_analysis_1.getAssignmentValue; } });
+Object.defineProperty(exports, "isConstant", { enumerable: true, get: function () { return scope_analysis_1.isConstant; } });
+Object.defineProperty(exports, "collectVariableAliases", { enumerable: true, get: function () { return scope_analysis_1.collectVariableAliases; } });
+// Control Flow
+var control_flow_1 = require("./control-flow");
+Object.defineProperty(exports, "isInsideTryCatch", { enumerable: true, get: function () { return control_flow_1.isInsideTryCatch; } });
+Object.defineProperty(exports, "isInsideCatchClause", { enumerable: true, get: function () { return control_flow_1.isInsideCatchClause; } });
+Object.defineProperty(exports, "isInsideConditionalGuard", { enumerable: true, get: function () { return control_flow_1.isInsideConditionalGuard; } });
+Object.defineProperty(exports, "hasEarlyReturnGuard", { enumerable: true, get: function () { return control_flow_1.hasEarlyReturnGuard; } });
+Object.defineProperty(exports, "isInsideIfBranch", { enumerable: true, get: function () { return control_flow_1.isInsideIfBranch; } });
+Object.defineProperty(exports, "isDeadCode", { enumerable: true, get: function () { return control_flow_1.isDeadCode; } });
+Object.defineProperty(exports, "getEnclosingBlock", { enumerable: true, get: function () { return control_flow_1.getEnclosingBlock; } });
+// Call Expression Analysis
+var call_analysis_1 = require("./call-analysis");
+Object.defineProperty(exports, "resolveCallTarget", { enumerable: true, get: function () { return call_analysis_1.resolveCallTarget; } });
+Object.defineProperty(exports, "getCallArguments", { enumerable: true, get: function () { return call_analysis_1.getCallArguments; } });
+Object.defineProperty(exports, "getCallArgument", { enumerable: true, get: function () { return call_analysis_1.getCallArgument; } });
+Object.defineProperty(exports, "isMethodCallOn", { enumerable: true, get: function () { return call_analysis_1.isMethodCallOn; } });
+Object.defineProperty(exports, "getReceiverChain", { enumerable: true, get: function () { return call_analysis_1.getReceiverChain; } });
+Object.defineProperty(exports, "isConstructorCall", { enumerable: true, get: function () { return call_analysis_1.isConstructorCall; } });
+Object.defineProperty(exports, "getObjectLiteralProperty", { enumerable: true, get: function () { return call_analysis_1.getObjectLiteralProperty; } });
+Object.defineProperty(exports, "getObjectLiteralProperties", { enumerable: true, get: function () { return call_analysis_1.getObjectLiteralProperties; } });
+Object.defineProperty(exports, "findCallsTo", { enumerable: true, get: function () { return call_analysis_1.findCallsTo; } });
+// String Analysis
+var string_analysis_1 = require("./string-analysis");
+Object.defineProperty(exports, "extractAllStringLiterals", { enumerable: true, get: function () { return string_analysis_1.extractAllStringLiterals; } });
+Object.defineProperty(exports, "isTemplateLiteralWithExpressions", { enumerable: true, get: function () { return string_analysis_1.isTemplateLiteralWithExpressions; } });
+Object.defineProperty(exports, "getTemplateLiteralParts", { enumerable: true, get: function () { return string_analysis_1.getTemplateLiteralParts; } });
+Object.defineProperty(exports, "extractStringValue", { enumerable: true, get: function () { return string_analysis_1.extractStringValue; } });
+Object.defineProperty(exports, "matchesPattern", { enumerable: true, get: function () { return string_analysis_1.matchesPattern; } });
+Object.defineProperty(exports, "isStringConcatenation", { enumerable: true, get: function () { return string_analysis_1.isStringConcatenation; } });
+Object.defineProperty(exports, "collectConcatenationParts", { enumerable: true, get: function () { return string_analysis_1.collectConcatenationParts; } });
+Object.defineProperty(exports, "isStringLike", { enumerable: true, get: function () { return string_analysis_1.isStringLike; } });
+// User Input & Sink Detection
+var user_input_1 = require("./user-input");
+Object.defineProperty(exports, "isUserInputExpression", { enumerable: true, get: function () { return user_input_1.isUserInputExpression; } });
+Object.defineProperty(exports, "isLLMOutputExpression", { enumerable: true, get: function () { return user_input_1.isLLMOutputExpression; } });
+Object.defineProperty(exports, "isDangerousSink", { enumerable: true, get: function () { return user_input_1.isDangerousSink; } });
+Object.defineProperty(exports, "isDangerousPropertyAssignment", { enumerable: true, get: function () { return user_input_1.isDangerousPropertyAssignment; } });
+Object.defineProperty(exports, "isRequestHandler", { enumerable: true, get: function () { return user_input_1.isRequestHandler; } });
+Object.defineProperty(exports, "getUserInputSources", { enumerable: true, get: function () { return user_input_1.getUserInputSources; } });
+// Import Analysis
+var import_analysis_1 = require("./import-analysis");
+Object.defineProperty(exports, "collectImportBindings", { enumerable: true, get: function () { return import_analysis_1.collectImportBindings; } });
+Object.defineProperty(exports, "hasImport", { enumerable: true, get: function () { return import_analysis_1.hasImport; } });
+Object.defineProperty(exports, "getImportedModules", { enumerable: true, get: function () { return import_analysis_1.getImportedModules; } });
+Object.defineProperty(exports, "isImportedFrom", { enumerable: true, get: function () { return import_analysis_1.isImportedFrom; } });
+Object.defineProperty(exports, "collectRequireCalls", { enumerable: true, get: function () { return import_analysis_1.collectRequireCalls; } });
+Object.defineProperty(exports, "getLocalImportName", { enumerable: true, get: function () { return import_analysis_1.getLocalImportName; } });
+// Context Detection
+var context_detection_1 = require("./context-detection");
+Object.defineProperty(exports, "isLLMContextFile", { enumerable: true, get: function () { return context_detection_1.isLLMContextFile; } });
+Object.defineProperty(exports, "isRouteHandler", { enumerable: true, get: function () { return context_detection_1.isRouteHandler; } });
+Object.defineProperty(exports, "hasMiddlewarePattern", { enumerable: true, get: function () { return context_detection_1.hasMiddlewarePattern; } });
+Object.defineProperty(exports, "getFileDirective", { enumerable: true, get: function () { return context_detection_1.getFileDirective; } });
+Object.defineProperty(exports, "isServerFile", { enumerable: true, get: function () { return context_detection_1.isServerFile; } });
+Object.defineProperty(exports, "findAuthChecks", { enumerable: true, get: function () { return context_detection_1.findAuthChecks; } });
+Object.defineProperty(exports, "hasAuthImports", { enumerable: true, get: function () { return context_detection_1.hasAuthImports; } });
+// Python Helpers
+var python_helpers_1 = require("./python-helpers");
+Object.defineProperty(exports, "collectPythonImportBindings", { enumerable: true, get: function () { return python_helpers_1.collectPythonImportBindings; } });
+Object.defineProperty(exports, "hasPythonImport", { enumerable: true, get: function () { return python_helpers_1.hasPythonImport; } });
+Object.defineProperty(exports, "getPythonImportedModules", { enumerable: true, get: function () { return python_helpers_1.getPythonImportedModules; } });
+Object.defineProperty(exports, "isPythonImportedFrom", { enumerable: true, get: function () { return python_helpers_1.isPythonImportedFrom; } });
+Object.defineProperty(exports, "resolvePythonCallTarget", { enumerable: true, get: function () { return python_helpers_1.resolvePythonCallTarget; } });
+Object.defineProperty(exports, "isPythonCallTo", { enumerable: true, get: function () { return python_helpers_1.isPythonCallTo; } });
+Object.defineProperty(exports, "getPythonCallArguments", { enumerable: true, get: function () { return python_helpers_1.getPythonCallArguments; } });
+Object.defineProperty(exports, "getPythonCallArgument", { enumerable: true, get: function () { return python_helpers_1.getPythonCallArgument; } });
+Object.defineProperty(exports, "getPythonKeywordArgument", { enumerable: true, get: function () { return python_helpers_1.getPythonKeywordArgument; } });
+Object.defineProperty(exports, "isPythonMethodCallOn", { enumerable: true, get: function () { return python_helpers_1.isPythonMethodCallOn; } });
+Object.defineProperty(exports, "getPythonAttributeChain", { enumerable: true, get: function () { return python_helpers_1.getPythonAttributeChain; } });
+Object.defineProperty(exports, "collectPythonVariableDeclarations", { enumerable: true, get: function () { return python_helpers_1.collectPythonVariableDeclarations; } });
+Object.defineProperty(exports, "collectPythonVariableAliases", { enumerable: true, get: function () { return python_helpers_1.collectPythonVariableAliases; } });
+Object.defineProperty(exports, "extractPythonStringValue", { enumerable: true, get: function () { return python_helpers_1.extractPythonStringValue; } });
+Object.defineProperty(exports, "getPythonFirstStringArg", { enumerable: true, get: function () { return python_helpers_1.getPythonFirstStringArg; } });
+Object.defineProperty(exports, "isPythonFString", { enumerable: true, get: function () { return python_helpers_1.isPythonFString; } });
+Object.defineProperty(exports, "getPythonFStringParts", { enumerable: true, get: function () { return python_helpers_1.getPythonFStringParts; } });
+Object.defineProperty(exports, "isInsidePythonTryExcept", { enumerable: true, get: function () { return python_helpers_1.isInsidePythonTryExcept; } });
+Object.defineProperty(exports, "isInsidePythonExceptClause", { enumerable: true, get: function () { return python_helpers_1.isInsidePythonExceptClause; } });
+Object.defineProperty(exports, "getEnclosingPythonBlock", { enumerable: true, get: function () { return python_helpers_1.getEnclosingPythonBlock; } });
+Object.defineProperty(exports, "getPythonDecorators", { enumerable: true, get: function () { return python_helpers_1.getPythonDecorators; } });
+Object.defineProperty(exports, "hasPythonDecorator", { enumerable: true, get: function () { return python_helpers_1.hasPythonDecorator; } });
+Object.defineProperty(exports, "isPythonUserInputExpression", { enumerable: true, get: function () { return python_helpers_1.isPythonUserInputExpression; } });
+Object.defineProperty(exports, "isPythonDynamicString", { enumerable: true, get: function () { return python_helpers_1.isPythonDynamicString; } });
+Object.defineProperty(exports, "isPythonLLMOutputExpression", { enumerable: true, get: function () { return python_helpers_1.isPythonLLMOutputExpression; } });
+// Type Extraction
+var type_extraction_1 = require("./type-extraction");
+Object.defineProperty(exports, "extractParameterTypes", { enumerable: true, get: function () { return type_extraction_1.extractParameterTypes; } });
+Object.defineProperty(exports, "extractReturnType", { enumerable: true, get: function () { return type_extraction_1.extractReturnType; } });
+Object.defineProperty(exports, "extractVariableType", { enumerable: true, get: function () { return type_extraction_1.extractVariableType; } });
+Object.defineProperty(exports, "isSecurityRelevantType", { enumerable: true, get: function () { return type_extraction_1.isSecurityRelevantType; } });
+Object.defineProperty(exports, "extractGenericConstraints", { enumerable: true, get: function () { return type_extraction_1.extractGenericConstraints; } });
+Object.defineProperty(exports, "hasZodInferredType", { enumerable: true, get: function () { return type_extraction_1.hasZodInferredType; } });
+Object.defineProperty(exports, "hasRequestType", { enumerable: true, get: function () { return type_extraction_1.hasRequestType; } });
+Object.defineProperty(exports, "hasAnyType", { enumerable: true, get: function () { return type_extraction_1.hasAnyType; } });
+//# sourceMappingURL=index.js.map

package/dist/detect/ast-rules/helpers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;AAEH,4BAA4B;AAC5B,mDASyB;AARvB,6HAAA,2BAA2B,OAAA;AAC3B,sHAAA,oBAAoB,OAAA;AACpB,2GAAA,SAAS,OAAA;AACT,qHAAA,mBAAmB,OAAA;AACnB,oHAAA,kBAAkB,OAAA;AAClB,4GAAA,UAAU,OAAA;AACV,wHAAA,sBAAsB,OAAA;AAIxB,eAAe;AACf,+CAQuB;AAPrB,gHAAA,gBAAgB,OAAA;AAChB,mHAAA,mBAAmB,OAAA;AACnB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,gHAAA,gBAAgB,OAAA;AAChB,0GAAA,UAAU,OAAA;AACV,iHAAA,iBAAiB,OAAA;AAGnB,2BAA2B;AAC3B,iDAWwB;AAVtB,kHAAA,iBAAiB,OAAA;AACjB,iHAAA,gBAAgB,OAAA;AAChB,gHAAA,eAAe,OAAA;AACf,+GAAA,cAAc,OAAA;AACd,iHAAA,gBAAgB,OAAA;AAChB,kHAAA,iBAAiB,OAAA;AACjB,yHAAA,wBAAwB,OAAA;AACxB,2HAAA,0BAA0B,OAAA;AAC1B,4GAAA,WAAW,OAAA;AAIb,kBAAkB;AAClB,qDAW0B;AAVxB,2HAAA,wBAAwB,OAAA;AACxB,mIAAA,gCAAgC,OAAA;AAChC,0HAAA,uBAAuB,OAAA;AACvB,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AACd,wHAAA,qBAAqB,OAAA;AACrB,4HAAA,yBAAyB,OAAA;AACzB,+GAAA,YAAY,OAAA;AAKd,8BAA8B;AAC9B,2CAOqB;AANnB,mHAAA,qBAAqB,OAAA;AACrB,mHAAA,qBAAqB,OAAA;AACrB,6GAAA,eAAe,OAAA;AACf,2HAAA,6BAA6B,OAAA;AAC7B,8GAAA,gBAAgB,OAAA;AAChB,iHAAA,mBAAmB,OAAA;AAGrB,kBAAkB;AAClB,qDAQ0B;AAPxB,wHAAA,qBAAqB,OAAA;AACrB,4GAAA,SAAS,OAAA;AACT,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AACd,sHAAA,mBAAmB,OAAA;AACnB,qHAAA,kBAAkB,OAAA;AAIpB,oBAAoB;AACpB,yDAQ4B;AAP1B,qHAAA,gBAAgB,OAAA;AAChB,mHAAA,cAAc,OAAA;AACd,yHAAA,oBAAoB,OAAA;AACpB,qHAAA,gBAAgB,OAAA;AAChB,iHAAA,YAAY,OAAA;AACZ,mHAAA,cAAc,OAAA;AACd,mHAAA,cAAc,OAAA;AAGhB,iBAAiB;AACjB,mDA4ByB;AA3BvB,6HAAA,2BAA2B,OAAA;AAC3B,iHAAA,eAAe,OAAA;AACf,0HAAA,wBAAwB,OAAA;AACxB,sHAAA,oBAAoB,OAAA;AACpB,yHAAA,uBAAuB,OAAA;AACvB,gHAAA,cAAc,OAAA;AACd,wHAAA,sBAAsB,OAAA;AACtB,uHAAA,qBAAqB,OAAA;AACrB,0HAAA,wBAAwB,OAAA;AACxB,sHAAA,oBAAoB,OAAA;AACpB,yHAAA,uBAAuB,OAAA;AACvB,mIAAA,iCAAiC,OAAA;AACjC,8HAAA,4BAA4B,OAAA;AAC5B,0HAAA,wBAAwB,OAAA;AACxB,yHAAA,uBAAuB,OAAA;AACvB,iHAAA,eAAe,OAAA;AACf,uHAAA,qBAAqB,OAAA;AACrB,yHAAA,uBAAuB,OAAA;AACvB,4HAAA,0BAA0B,OAAA;AAC1B,yHAAA,uBAAuB,OAAA;AACvB,qHAAA,mBAAmB,OAAA;AACnB,oHAAA,kBAAkB,OAAA;AAClB,6HAAA,2BAA2B,OAAA;AAC3B,uHAAA,qBAAqB,OAAA;AACrB,6HAAA,2BAA2B,OAAA;AAK7B,kBAAkB;AAClB,qDAU0B;AATxB,wHAAA,qBAAqB,OAAA;AACrB,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,yHAAA,sBAAsB,OAAA;AACtB,4HAAA,yBAAyB,OAAA;AACzB,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AACd,6GAAA,UAAU,OAAA"}

package/dist/detect/ast-rules/helpers/python-helpers.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Python AST Analysis Helpers
+ *
+ * Python-specific equivalents of JS/TS helpers.
+ * Kept separate because Python AST nodes are structurally different
+ * (different node types, field names, scoping rules).
+ *
+ * Node type mapping (JS → Python):
+ *   call_expression → call
+ *   member_expression → attribute
+ *   import_statement → import_statement / import_from_statement
+ *   statement_block → block
+ *   catch_clause → except_clause
+ *   string (with backticks) → string (with f-prefix for f-strings)
+ *   template_substitution → interpolation
+ */
+import type Parser from "tree-sitter";
+export interface PythonResolvedCallTarget {
+    /** 'direct' = fn(), 'member' = obj.fn() */
+    type: "direct" | "member";
+    /** The function/method name being called */
+    name: string;
+    /** For member calls, the object expression text */
+    object?: string;
+    /** Full chain: 'a.b.c' */
+    fullChain: string;
+    /** Whether resolved via alias */
+    aliased: boolean;
+}
+export interface PythonVariableBinding {
+    name: string;
+    node: Parser.SyntaxNode;
+    initValue: Parser.SyntaxNode | null;
+    kind: "assignment" | "annotated" | "parameter" | "for" | "with" | "except";
+}
+/**
+ * Collect all import bindings from a Python file.
+ *
+ * Handles:
+ *   import os                     → { 'os': { module: 'os', originalName: 'default' } }
+ *   import os.path                → { 'os': { module: 'os.path', originalName: 'default' } }
+ *   from os import path           → { 'path': { module: 'os', originalName: 'path' } }
+ *   from os.path import join      → { 'join': { module: 'os.path', originalName: 'join' } }
+ *   from os import path as p     → { 'p': { module: 'os', originalName: 'path' } }
+ *   from . import utils           → { 'utils': { module: '.', originalName: 'utils' } }
+ */
+export declare function collectPythonImportBindings(root: Parser.SyntaxNode): Map<string, {
+    module: string;
+    originalName: string;
+}>;
+/**
+ * Quick check: does the Python file import `name` from `module`?
+ */
+export declare function hasPythonImport(root: Parser.SyntaxNode, module: string | RegExp, name?: string): boolean;
+/**
+ * Get all imported module names (unique set).
+ */
+export declare function getPythonImportedModules(root: Parser.SyntaxNode): Set<string>;
+/**
+ * Check if a local name was imported from a module matching a pattern.
+ */
+export declare function isPythonImportedFrom(root: Parser.SyntaxNode, localName: string, modulePattern: string | RegExp): string | null;
+/**
+ * Resolve the target of a Python `call` node.
+ * Python uses 'call' (not 'call_expression') and 'attribute' (not 'member_expression').
+ */
+export declare function resolvePythonCallTarget(node: Parser.SyntaxNode, aliases?: Map<string, string>): PythonResolvedCallTarget | null;
+/**
+ * Check if a `call` node calls a specific function name.
+ * Handles both direct calls and attribute (member) calls.
+ */
+export declare function isPythonCallTo(node: Parser.SyntaxNode, name: string): boolean;
+/**
+ * Get positional arguments from a Python call node.
+ * Excludes keyword_argument, list_splat, and dictionary_splat.
+ */
+export declare function getPythonCallArguments(node: Parser.SyntaxNode): Parser.SyntaxNode[];
+/**
+ * Get the Nth positional argument (0-indexed).
+ */
+export declare function getPythonCallArgument(node: Parser.SyntaxNode, index: number): Parser.SyntaxNode | null;
+/**
+ * Extract a keyword argument value from a Python call.
+ * e.g., foo(model='gpt-4') → getPythonKeywordArgument(node, 'model') → string node
+ */
+export declare function getPythonKeywordArgument(node: Parser.SyntaxNode, keyword: string): Parser.SyntaxNode | null;
+/**
+ * Check if a call matches `obj.method(...)` pattern.
+ */
+export declare function isPythonMethodCallOn(node: Parser.SyntaxNode, objectPattern: string | RegExp, methodName: string | string[]): boolean;
+/**
+ * Extract the full attribute chain from nested attribute nodes.
+ * e.g., `a.b.c.d` → ['a', 'b', 'c', 'd']
+ */
+export declare function getPythonAttributeChain(node: Parser.SyntaxNode): string[];
+/**
+ * Collect variable declarations/assignments in a Python file.
+ *
+ * Handles:
+ *   x = 1                (assignment)
+ *   x: int = 2           (annotated assignment)
+ *   def foo(x, y=1)      (parameters)
+ *   for x in items       (for variable)
+ *   with open(f) as fh   (with variable)
+ *   except E as e        (except variable)
+ */
+export declare function collectPythonVariableDeclarations(root: Parser.SyntaxNode): Map<string, PythonVariableBinding>;
+/**
+ * Build alias map: tracks `e = eval` style variable aliases.
+ * Only tracks simple identifier-to-identifier or identifier-to-attribute assignments.
+ */
+export declare function collectPythonVariableAliases(root: Parser.SyntaxNode): Map<string, string>;
+/**
+ * Resolve a Python variable identifier to its assigned value node.
+ * Walks backward from the reference to find the most recent assignment
+ * where the left side matches the identifier name.
+ *
+ * Example: resolves `user_query` in `execute(text(user_query))` to the
+ * value node of `user_query = f"SELECT * FROM users WHERE username = '{username}'"`
+ */
+export declare function resolvePythonVariableDefinition(fromNode: Parser.SyntaxNode, name: string): Parser.SyntaxNode | null;
+/**
+ * Extract the string value from a Python string node.
+ * Handles single, double, triple-quoted strings.
+ * Returns the content text (without quotes/prefix).
+ */
+export declare function extractPythonStringValue(node: Parser.SyntaxNode): string | null;
+/**
+ * Get the first positional string argument from a Python call.
+ */
+export declare function getPythonFirstStringArg(callNode: Parser.SyntaxNode): string | null;
+/**
+ * Check if a Python string node is an f-string.
+ * In tree-sitter-python, f-strings are `string` nodes whose string_start begins with 'f' or 'F'.
+ */
+export declare function isPythonFString(node: Parser.SyntaxNode): boolean;
+/**
+ * Get the static and dynamic parts of an f-string.
+ */
+export declare function getPythonFStringParts(node: Parser.SyntaxNode): {
+    staticParts: string[];
+    dynamicParts: Parser.SyntaxNode[];
+};
+/**
+ * Check if a node is inside a Python try block (not except/finally).
+ */
+export declare function isInsidePythonTryExcept(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a node is inside an except clause.
+ */
+export declare function isInsidePythonExceptClause(node: Parser.SyntaxNode): boolean;
+/**
+ * Get the nearest enclosing Python block node.
+ */
+export declare function getEnclosingPythonBlock(node: Parser.SyntaxNode): Parser.SyntaxNode | null;
+/**
+ * Get decorator names for a function_definition or class_definition.
+ * Looks at the parent decorated_definition node for decorator children.
+ *
+ * @app.route('/api') → 'app.route'
+ * @login_required → 'login_required'
+ * @staticmethod → 'staticmethod'
+ */
+export declare function getPythonDecorators(node: Parser.SyntaxNode): string[];
+/**
+ * Check if a function_definition has a specific decorator (exact or regex).
+ */
+export declare function hasPythonDecorator(node: Parser.SyntaxNode, pattern: string | RegExp): boolean;
+/**
+ * Check if a Python node accesses user input.
+ *
+ * Handles:
+ *   request.form, request.args, request.json, request.data, request.GET, etc.
+ *   sys.argv, os.environ
+ *   request.form['key'], request.args.get('key')
+ *   input()
+ */
+export declare function isPythonUserInputExpression(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a Python expression contains dynamic string content.
+ *
+ * Returns true for:
+ *   - f-strings with interpolation: f"Hello {name}"
+ *   - .format() calls: "Hello {}".format(name)
+ *   - % formatting: "Hello %s" % name
+ *   - String concatenation with non-literals: "Hello " + name
+ */
+export declare function isPythonDynamicString(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a Python node accesses LLM output content.
+ *
+ * Handles:
+ *   response.choices[0].message.content (OpenAI)
+ *   response.content[0].text (Anthropic)
+ *   result.content, response.text
+ *   result["output"], response["text"]
+ */
+export declare function isPythonLLMOutputExpression(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a Python AST node is a constant expression.
+ * Used to skip static/hardcoded values when classifying LLM sinks.
+ */
+export declare function isPyConstantExpression(node: Parser.SyntaxNode): boolean;
+/**
+ * Extract a value from a Python dictionary literal by key.
+ * Handles both string keys {"role": "system"} and identifier keys {role: "system"}.
+ */
+export declare function getPythonDictProperty(node: Parser.SyntaxNode, key: string): Parser.SyntaxNode | null;
+/**
+ * Classify a Python message dictionary as system_prompt or prompt_construction.
+ * Examines {"role": "system"|"user", "content": <dynamic>} patterns.
+ * Returns null if content is static or missing.
+ */
+export declare function classifyPythonMessageDict(dictNode: Parser.SyntaxNode): "system_prompt" | "prompt_construction" | null;
+//# sourceMappingURL=python-helpers.d.ts.map

package/dist/detect/ast-rules/helpers/python-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-helpers.d.ts","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/python-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAYtC,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;CAC5E;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,GAAG,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAuGvD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAcT;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAO7E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GAAG,MAAM,GAC7B,MAAM,GAAG,IAAI,CASf;AAMD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,wBAAwB,GAAG,IAAI,CA2CjC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAe7E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,MAAM,CAAC,UAAU,EAAE,CAUrB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,UAAU,GAAG,IAAI,CAG1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,UAAU,GAAG,IAAI,CAc1B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,aAAa,EAAE,MAAM,GAAG,MAAM,EAC9B,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAC5B,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAgBzE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAkGpC;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrB;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,CAAC,UAAU,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,UAAU,GAAG,IAAI,CA4B1B;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,MAAM,GAAG,IAAI,CA4Cf;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,CAAC,UAAU,GAC1B,MAAM,GAAG,IAAI,CAIf;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAKhE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;CACnC,CAeA;AAMD;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAWxE;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAO3E;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,MAAM,CAAC,UAAU,GAAG,IAAI,CAO1B;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAuBrE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,OAAO,EAAE,MAAM,GAAG,MAAM,GACvB,OAAO,CAUT;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CA4C5E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAgDtE;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAO5E;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAWvE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,UAAU,GAAG,IAAI,CAe1B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,UAAU,GAC1B,eAAe,GAAG,qBAAqB,GAAG,IAAI,CAYhD"}