@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/ast-rules/helpers/context-detection.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * AST Context Detection Helpers
+ *
+ * Detects file-level and function-level context: LLM code,
+ * route handlers, middleware, server/client directives, auth checks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLLMContextFile = isLLMContextFile;
+exports.isRouteHandler = isRouteHandler;
+exports.hasMiddlewarePattern = hasMiddlewarePattern;
+exports.getFileDirective = getFileDirective;
+exports.isServerFile = isServerFile;
+exports.findAuthChecks = findAuthChecks;
+exports.hasAuthImports = hasAuthImports;
+const ast_1 = require("../../../parse/ast");
+const import_analysis_1 = require("./import-analysis");
+const call_analysis_1 = require("./call-analysis");
+// ============================================================================
+// LLM / AI Context
+// ============================================================================
+/** AI/LLM SDK module patterns */
+const AI_SDK_MODULES = [
+    /^openai$/i,
+    /^@anthropic-ai\//,
+    /^anthropic$/,
+    /^@langchain\//,
+    /^langchain/,
+    /^@google-ai\//,
+    /^@google\/generative-ai$/,
+    /^cohere-ai$/,
+    /^ai$/, // Vercel AI SDK
+    /^@ai-sdk\//,
+    /^llamaindex/,
+    /^@huggingface\//,
+];
+/**
+ * Detect if a file contains AI/LLM code from AST analysis.
+ * Checks imports, API call patterns, and message array structures.
+ */
+const LLM_CONTENT_QUICK_CHECK = /openai|anthropic|langchain|@google.*generative|cohere|@ai-sdk|llamaindex|huggingface|completions?\.create|messages\.create|generateText|streamText|generateObject|role['"]?\s*:\s*['"](?:system|user|assistant)/i;
+function isLLMContextFile(root, content) {
+    // Quick content pre-check — skip files that can't have LLM patterns
+    if (content && !LLM_CONTENT_QUICK_CHECK.test(content))
+        return false;
+    const modules = (0, import_analysis_1.getImportedModules)(root);
+    // Check for AI SDK imports
+    for (const mod of modules) {
+        if (AI_SDK_MODULES.some(p => p.test(mod)))
+            return true;
+    }
+    // Check for common AI API patterns in code
+    let hasAIPattern = false;
+    (0, ast_1.walkAST)(root, (node) => {
+        if (hasAIPattern)
+            return true; // short-circuit
+        // chat.completions.create(), openai.createChatCompletion(), etc.
+        if (node.type === 'call_expression') {
+            const chain = (0, call_analysis_1.getReceiverChain)(node.childForFieldName('function') ?? node);
+            const chainStr = chain.join('.');
+            if (/completions?\.create/i.test(chainStr) ||
+                /chat\.completions/i.test(chainStr) ||
+                /messages\.create/i.test(chainStr) ||
+                /generateText|streamText|generateObject/i.test(chainStr)) {
+                hasAIPattern = true;
+                return true;
+            }
+        }
+        // Message array with role/content objects
+        if (node.type === 'object' && node.parent?.type === 'array') {
+            const hasRole = node.namedChildren.some(c => c.type === 'pair' && c.childForFieldName('key')?.text === 'role');
+            const hasContent = node.namedChildren.some(c => c.type === 'pair' && c.childForFieldName('key')?.text === 'content');
+            if (hasRole && hasContent) {
+                hasAIPattern = true;
+                return true;
+            }
+        }
+        return false;
+    });
+    return hasAIPattern;
+}
+// ============================================================================
+// Route Handler Detection
+// ============================================================================
+/**
+ * Detect if a function node is an Express/Next.js/Fastify route handler.
+ * Checks: parameter patterns, export names, decorator patterns.
+ */
+function isRouteHandler(fnNode) {
+    // Check parameter pattern (req, res)
+    const params = fnNode.childForFieldName('parameters');
+    if (params) {
+        const paramNames = params.namedChildren
+            .map(p => {
+            if (p.type === 'identifier')
+                return p.text;
+            const pattern = p.childForFieldName('pattern');
+            return pattern?.text ?? '';
+        });
+        if (paramNames.length >= 2) {
+            const [first, second] = paramNames;
+            if (/^req(uest)?$/i.test(first) && /^res(ponse)?$/i.test(second))
+                return true;
+        }
+        // Type annotation check
+        const firstParam = params.namedChildren[0];
+        if (firstParam) {
+            const typeNode = firstParam.childForFieldName('type');
+            if (typeNode && /Request|NextRequest|NextApiRequest|IncomingMessage/.test(typeNode.text)) {
+                return true;
+            }
+        }
+    }
+    // Check if this is an exported HTTP method function (Next.js App Router)
+    const exportParent = fnNode.parent;
+    if (exportParent?.type === 'export_statement') {
+        const fnName = fnNode.childForFieldName('name')?.text;
+        if (fnName && /^(GET|POST|PUT|DELETE|PATCH|HEAD)$/.test(fnName))
+            return true;
+    }
+    // Check if assigned to a variable with HTTP method name
+    if (fnNode.parent?.type === 'variable_declarator') {
+        const varName = fnNode.parent.childForFieldName('name')?.text;
+        if (varName && /^(GET|POST|PUT|DELETE|PATCH|HEAD)$/.test(varName))
+            return true;
+    }
+    return false;
+}
+// ============================================================================
+// Middleware Detection
+// ============================================================================
+/**
+ * Detect app.use() middleware setup patterns in the root.
+ */
+function hasMiddlewarePattern(root) {
+    let found = false;
+    (0, ast_1.walkAST)(root, (node) => {
+        if (found)
+            return true;
+        if (node.type === 'call_expression') {
+            if ((0, call_analysis_1.isMethodCallOn)(node, /^(app|router|server)$/, ['use', 'middleware'])) {
+                found = true;
+                return true;
+            }
+        }
+        return false;
+    });
+    return found;
+}
+// ============================================================================
+// Server / Client Detection
+// ============================================================================
+/**
+ * Detect 'use client' or 'use server' directives at the top of the file.
+ */
+function getFileDirective(root) {
+    // Look at the first expression statement
+    for (const child of root.namedChildren) {
+        if (child.type === 'expression_statement') {
+            const expr = child.namedChildren[0];
+            if (expr?.type === 'string') {
+                const val = expr.text.replace(/^['"`]|['"`]$/g, '');
+                if (val === 'use client')
+                    return 'use client';
+                if (val === 'use server')
+                    return 'use server';
+            }
+        }
+        // Only check the first few statements
+        if (child.startPosition.row > 5)
+            break;
+    }
+    return null;
+}
+/**
+ * Detect if a file is server-side from AST.
+ * Checks: 'use server' directive, server-only imports, Node.js APIs.
+ */
+function isServerFile(root) {
+    // 'use server' directive
+    if (getFileDirective(root) === 'use server')
+        return true;
+    // Server-only module imports
+    const modules = (0, import_analysis_1.getImportedModules)(root);
+    const serverModules = ['fs', 'path', 'crypto', 'http', 'https', 'net', 'child_process',
+        'server-only', 'next/server', '@supabase/supabase-js', 'pg', 'mysql2', 'mongodb'];
+    for (const mod of modules) {
+        if (serverModules.includes(mod))
+            return true;
+        if (mod.startsWith('node:'))
+            return true;
+    }
+    return false;
+}
+// ============================================================================
+// Auth Check Detection
+// ============================================================================
+/** Known auth helper function names / patterns */
+const AUTH_CHECK_PATTERNS = [
+    /^(require|check|verify|validate|ensure|assert)(Auth|Authentication|Session|Token|User|Login|Permission|Access)/i,
+    /^(getCurrentUser|getSession|getServerSession|auth|getAuth|useAuth|useSession)/i,
+    /^(isAuthenticated|isAuthorized|isLoggedIn|hasPermission|hasRole)/i,
+    /^(protect|guard|authenticate|authorize)/i,
+    /^(clerkMiddleware|withAuth|requireAuth)/i,
+];
+/**
+ * Find auth check calls within a function body.
+ * Returns the call nodes that appear to be auth checks.
+ */
+function findAuthChecks(fnBody) {
+    const authCalls = [];
+    (0, ast_1.walkAST)(fnBody, (node) => {
+        if (node.type === 'call_expression') {
+            const fn = node.childForFieldName('function');
+            if (!fn)
+                return false;
+            const fnName = fn.type === 'identifier'
+                ? fn.text
+                : fn.type === 'member_expression'
+                    ? fn.childForFieldName('property')?.text ?? ''
+                    : '';
+            if (AUTH_CHECK_PATTERNS.some(p => p.test(fnName))) {
+                authCalls.push(node);
+            }
+        }
+        // await auth() pattern (Clerk, etc.)
+        if (node.type === 'await_expression') {
+            const child = node.namedChildren[0];
+            if (child?.type === 'call_expression') {
+                const fn = child.childForFieldName('function');
+                if (fn?.type === 'identifier' && AUTH_CHECK_PATTERNS.some(p => p.test(fn.text))) {
+                    authCalls.push(child);
+                }
+            }
+        }
+        return false;
+    });
+    return authCalls;
+}
+/**
+ * Check if a file has any auth-related imports.
+ */
+const AUTH_IMPORT_QUICK_CHECK = /clerk|next-auth|auth0|supabase|passport|jsonwebtoken|jose/i;
+function hasAuthImports(root, content) {
+    // Quick content pre-check — skip files without auth library mentions
+    if (content && !AUTH_IMPORT_QUICK_CHECK.test(content))
+        return false;
+    return ((0, import_analysis_1.hasImport)(root, /clerk/) ||
+        (0, import_analysis_1.hasImport)(root, /next-auth/) ||
+        (0, import_analysis_1.hasImport)(root, /auth0/) ||
+        (0, import_analysis_1.hasImport)(root, /supabase/, 'auth') ||
+        (0, import_analysis_1.hasImport)(root, /passport/) ||
+        (0, import_analysis_1.hasImport)(root, /jsonwebtoken/) ||
+        (0, import_analysis_1.hasImport)(root, /jose/));
+}
+//# sourceMappingURL=context-detection.js.map

package/dist/detect/ast-rules/helpers/context-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-detection.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/context-detection.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAiCH,4CAiDC;AAUD,wCAwCC;AASD,oDAaC;AASD,4CAeC;AAMD,oCAcC;AAmBD,wCAkCC;AAOD,wCAaC;AA5QD,4CAA4C;AAC5C,uDAAiE;AACjE,mDAAkE;AAElE,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,iCAAiC;AACjC,MAAM,cAAc,GAAG;IACrB,WAAW;IACX,kBAAkB;IAClB,aAAa;IACb,eAAe;IACf,YAAY;IACZ,eAAe;IACf,0BAA0B;IAC1B,aAAa;IACb,MAAM,EAAG,gBAAgB;IACzB,YAAY;IACZ,aAAa;IACb,iBAAiB;CAClB,CAAA;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,kNAAkN,CAAA;AAElP,SAAgB,gBAAgB,CAAC,IAAuB,EAAE,OAAgB;IACxE,oEAAoE;IACpE,IAAI,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnE,MAAM,OAAO,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC,CAAA;IAExC,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IACxD,CAAC;IAED,2CAA2C;IAC3C,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,YAAY;YAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;QAE9C,iEAAiE;QACjE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAA;YAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,IACE,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACnC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAClC,yCAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,EACxD,CAAC;gBACD,YAAY,GAAG,IAAI,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1C,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,MAAM,CACjE,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,SAAS,CACpE,CAAA;YACD,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBAC1B,YAAY,GAAG,IAAI,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB;IACtD,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE;YACP,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAA;YAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;YAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEJ,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,UAAU,CAAA;YAClC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC/E,CAAC;QAED,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACrD,IAAI,QAAQ,IAAI,oDAAoD,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;IAClC,IAAI,YAAY,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;QACrD,IAAI,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;IAC9E,CAAC;IAED,wDAAwD;IACxD,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;QAC7D,IAAI,OAAO,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IAChF,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,KAAK;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,IAAI,IAAA,8BAAc,EAAC,IAAI,EAAE,uBAAuB,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;gBACzE,KAAK,GAAG,IAAI,CAAA;gBACZ,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,gBAAgB,CAAC,IAAuB;IACtD,yCAAyC;IACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;gBACnD,IAAI,GAAG,KAAK,YAAY;oBAAE,OAAO,YAAY,CAAA;gBAC7C,IAAI,GAAG,KAAK,YAAY;oBAAE,OAAO,YAAY,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,sCAAsC;QACtC,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAAE,MAAK;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,IAAuB;IAClD,yBAAyB;IACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAExD,6BAA6B;IAC7B,MAAM,OAAO,GAAG,IAAA,oCAAkB,EAAC,IAAI,CAAC,CAAA;IACxC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe;QACpF,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IACnF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;IAC1C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,mBAAmB,GAAG;IAC1B,iHAAiH;IACjH,gFAAgF;IAChF,mEAAmE;IACnE,0CAA0C;IAC1C,0CAA0C;CAC3C,CAAA;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB;IACtD,MAAM,SAAS,GAAwB,EAAE,CAAA;IAEzC,IAAA,aAAO,EAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAA;YAErB,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,YAAY;gBACrC,CAAC,CAAC,EAAE,CAAC,IAAI;gBACT,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,mBAAmB;oBAC/B,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAA;YAER,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAClD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;gBAC9C,IAAI,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAChF,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,uBAAuB,GAAG,4DAA4D,CAAA;AAE5F,SAAgB,cAAc,CAAC,IAAuB,EAAE,OAAgB;IACtE,qEAAqE;IACrE,IAAI,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnE,OAAO,CACL,IAAA,2BAAS,EAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAA,2BAAS,EAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAA,2BAAS,EAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAA,2BAAS,EAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;QACnC,IAAA,2BAAS,EAAC,IAAI,EAAE,UAAU,CAAC;QAC3B,IAAA,2BAAS,EAAC,IAAI,EAAE,cAAc,CAAC;QAC/B,IAAA,2BAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CACxB,CAAA;AACH,CAAC"}

package/dist/detect/ast-rules/helpers/control-flow.d.ts

@@ -0,0 +1,40 @@
+/**
+ * AST Control Flow Analysis Helpers
+ *
+ * Determines try-catch wrapping, conditional guards, dead code,
+ * and block-level containment for findings.
+ */
+import type Parser from 'tree-sitter';
+/**
+ * Check if a node is inside a try block (not the catch/finally).
+ */
+export declare function isInsideTryCatch(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a node is inside a catch clause.
+ */
+export declare function isInsideCatchClause(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a node is preceded by an if-return/throw guard in the same function.
+ * A guard is: if (condition) { return | throw }
+ * This means any code after the guard only runs when the condition is false.
+ */
+export declare function isInsideConditionalGuard(node: Parser.SyntaxNode): boolean;
+/**
+ * Check if a function has an early return/throw guard before a given point.
+ * The checkFn callback tests whether the guard condition is relevant.
+ */
+export declare function hasEarlyReturnGuard(fnNode: Parser.SyntaxNode, checkFn?: (guardNode: Parser.SyntaxNode) => boolean): boolean;
+/**
+ * Check which branch (consequent/alternate) of an if statement a node is in.
+ * Returns 'consequent', 'alternate', or null.
+ */
+export declare function isInsideIfBranch(node: Parser.SyntaxNode): 'consequent' | 'alternate' | null;
+/**
+ * Check if a node is after an unconditional return/throw in the same block.
+ */
+export declare function isDeadCode(node: Parser.SyntaxNode): boolean;
+/**
+ * Get the nearest enclosing block statement (statement_block).
+ */
+export declare function getEnclosingBlock(node: Parser.SyntaxNode): Parser.SyntaxNode | null;
+//# sourceMappingURL=control-flow.d.ts.map

package/dist/detect/ast-rules/helpers/control-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-flow.d.ts","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/control-flow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAOrC;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAWjE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAOpE;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAmBzE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,UAAU,EACzB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,GAClD,OAAO,CAcT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,YAAY,GAAG,WAAW,GAAG,IAAI,CAcnC;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAa3D;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAOnF"}

package/dist/detect/ast-rules/helpers/control-flow.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * AST Control Flow Analysis Helpers
+ *
+ * Determines try-catch wrapping, conditional guards, dead code,
+ * and block-level containment for findings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInsideTryCatch = isInsideTryCatch;
+exports.isInsideCatchClause = isInsideCatchClause;
+exports.isInsideConditionalGuard = isInsideConditionalGuard;
+exports.hasEarlyReturnGuard = hasEarlyReturnGuard;
+exports.isInsideIfBranch = isInsideIfBranch;
+exports.isDeadCode = isDeadCode;
+exports.getEnclosingBlock = getEnclosingBlock;
+const ast_1 = require("../../../parse/ast");
+// ============================================================================
+// Try-Catch Detection
+// ============================================================================
+/**
+ * Check if a node is inside a try block (not the catch/finally).
+ */
+function isInsideTryCatch(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'try_statement') {
+            // Verify the node is in the try body, not catch/finally
+            const tryBody = current.childForFieldName('body');
+            if (tryBody && isDescendantOf(node, tryBody))
+                return true;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+/**
+ * Check if a node is inside a catch clause.
+ */
+function isInsideCatchClause(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'catch_clause')
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+// ============================================================================
+// Conditional Guards
+// ============================================================================
+/**
+ * Check if a node is preceded by an if-return/throw guard in the same function.
+ * A guard is: if (condition) { return | throw }
+ * This means any code after the guard only runs when the condition is false.
+ */
+function isInsideConditionalGuard(node) {
+    const fn = (0, ast_1.findEnclosingFunction)(node);
+    if (!fn)
+        return false;
+    const body = fn.childForFieldName('body');
+    if (!body)
+        return false;
+    // Look for if statements before this node's line
+    for (const child of body.namedChildren) {
+        if (child.startPosition.row >= node.startPosition.row)
+            break;
+        if (child.type === 'if_statement') {
+            const consequence = child.childForFieldName('consequence');
+            if (consequence && hasTerminator(consequence)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Check if a function has an early return/throw guard before a given point.
+ * The checkFn callback tests whether the guard condition is relevant.
+ */
+function hasEarlyReturnGuard(fnNode, checkFn) {
+    const body = fnNode.childForFieldName('body');
+    if (!body)
+        return false;
+    for (const child of body.namedChildren) {
+        if (child.type === 'if_statement') {
+            const consequence = child.childForFieldName('consequence');
+            if (consequence && hasTerminator(consequence)) {
+                if (!checkFn || checkFn(child))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Check which branch (consequent/alternate) of an if statement a node is in.
+ * Returns 'consequent', 'alternate', or null.
+ */
+function isInsideIfBranch(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.parent?.type === 'if_statement') {
+            const ifStmt = current.parent;
+            const consequence = ifStmt.childForFieldName('consequence');
+            const alternate = ifStmt.childForFieldName('alternative');
+            if (consequence && isDescendantOf(node, consequence))
+                return 'consequent';
+            if (alternate && isDescendantOf(node, alternate))
+                return 'alternate';
+        }
+        current = current.parent;
+    }
+    return null;
+}
+// ============================================================================
+// Dead Code Detection
+// ============================================================================
+/**
+ * Check if a node is after an unconditional return/throw in the same block.
+ */
+function isDeadCode(node) {
+    const block = getEnclosingBlock(node);
+    if (!block)
+        return false;
+    for (const child of block.namedChildren) {
+        if (child.startPosition.row >= node.startPosition.row)
+            break;
+        if (child.type === 'return_statement' || child.type === 'throw_statement') {
+            // Only unconditional: not inside an if
+            if (child.parent === block)
+                return true;
+        }
+    }
+    return false;
+}
+// ============================================================================
+// Block Helpers
+// ============================================================================
+/**
+ * Get the nearest enclosing block statement (statement_block).
+ */
+function getEnclosingBlock(node) {
+    let current = node.parent;
+    while (current) {
+        if (current.type === 'statement_block')
+            return current;
+        current = current.parent;
+    }
+    return null;
+}
+// ============================================================================
+// Internal Helpers
+// ============================================================================
+function isDescendantOf(node, ancestor) {
+    let current = node;
+    while (current) {
+        if (current.id === ancestor.id)
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+/**
+ * Check if a block has a terminating statement (return or throw).
+ */
+function hasTerminator(block) {
+    for (const child of block.namedChildren) {
+        if (child.type === 'return_statement' || child.type === 'throw_statement') {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=control-flow.js.map

package/dist/detect/ast-rules/helpers/control-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-flow.js","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/control-flow.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAYH,4CAWC;AAKD,kDAOC;AAWD,4DAmBC;AAMD,kDAiBC;AAMD,4CAgBC;AASD,gCAaC;AASD,8CAOC;AAjJD,4CAA0D;AAE1D,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,gBAAgB,CAAC,IAAuB;IACtD,IAAI,OAAO,GAA6B,IAAI,CAAC,MAAM,CAAA;IACnD,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACrC,wDAAwD;YACxD,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC3D,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,IAAI,OAAO,GAA6B,IAAI,CAAC,MAAM,CAAA;IACnD,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAA;QAChD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,EAAE,GAAG,IAAA,2BAAqB,EAAC,IAAI,CAAC,CAAA;IACtC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAErB,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,iDAAiD;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG;YAAE,MAAK;QAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YAC1D,IAAI,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,MAAyB,EACzB,OAAmD;IAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YAC1D,IAAI,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,IAAuB;IAEvB,IAAI,OAAO,GAA6B,IAAI,CAAC,MAAM,CAAA;IACnD,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YAEzD,IAAI,WAAW,IAAI,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,OAAO,YAAY,CAAA;YACzE,IAAI,SAAS,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;gBAAE,OAAO,WAAW,CAAA;QACtE,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG;YAAE,MAAK;QAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1E,uCAAuC;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAA;QACzC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,iBAAiB,CAAC,IAAuB;IACvD,IAAI,OAAO,GAA6B,IAAI,CAAC,MAAM,CAAA;IACnD,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,OAAO,CAAA;QACtD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,SAAS,cAAc,CAAC,IAAuB,EAAE,QAA2B;IAC1E,IAAI,OAAO,GAA6B,IAAI,CAAA;IAC5C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAC3C,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAwB;IAC7C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/detect/ast-rules/helpers/import-analysis.d.ts

@@ -0,0 +1,43 @@
+/**
+ * AST Import Analysis Helpers
+ *
+ * Extended import tracking: quick checks, module listing,
+ * CJS require tracking, and source-module matching.
+ */
+import type Parser from 'tree-sitter';
+import { collectImportBindings } from '../index';
+export { collectImportBindings };
+/**
+ * Quick check: does the file import `name` from `module`?
+ * module can be a string (exact match) or regex.
+ */
+export declare function hasImport(root: Parser.SyntaxNode, module: string | RegExp, name?: string): boolean;
+/**
+ * Get all imported module names (unique set).
+ */
+export declare function getImportedModules(root: Parser.SyntaxNode): Set<string>;
+/**
+ * Check if a local name was imported from a module matching a pattern.
+ */
+export declare function isImportedFrom(root: Parser.SyntaxNode, localName: string, modulePattern: string | RegExp): boolean;
+export interface RequireCall {
+    node: Parser.SyntaxNode;
+    module: string;
+    localName: string | null;
+    isDestructured: boolean;
+    destructuredNames: string[];
+}
+/**
+ * Collect all require() calls with argument tracking.
+ * Handles:
+ * - const x = require('mod')
+ * - const { a, b } = require('mod')
+ * - require('mod') (bare)
+ */
+export declare function collectRequireCalls(root: Parser.SyntaxNode): RequireCall[];
+/**
+ * Get the local name used for a specific import from a module.
+ * Returns the first matching local binding name, or null.
+ */
+export declare function getLocalImportName(root: Parser.SyntaxNode, module: string | RegExp, originalName: string): string | null;
+//# sourceMappingURL=import-analysis.d.ts.map

package/dist/detect/ast-rules/helpers/import-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-analysis.d.ts","sourceRoot":"","sources":["../../../../src/detect/ast-rules/helpers/import-analysis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAMhC;;;GAGG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAeT;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CA0BvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GAAG,MAAM,GAC7B,OAAO,CAST;AAMD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,EAAE,CAiD1E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,IAAI,CAcf"}