@securecode-ai/mcp 0.1.0

package/dist/project-map/confidence.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Phase 4 — confidence scoring + runtime-confirmed upgrade.
+ *
+ * Centralizes the README's confidence model so Layer 1, Layer 2, the
+ * runtime trace merger, and the cache all share one definition.
+ *
+ * 1.0  — STATIC_LITERAL      (string-literal path, directly-registered middleware)
+ * 0.8  — RUNTIME_CONFIRMED   (trace hook observed the relationship)
+ * 0.6  — INTRA_FILE_DATAFLOW (resolved from a same-file const/variable)
+ * 0.2  — UNRESOLVED          (could not statically resolve; not yet traced)
+ * 0.15 — META_PROGRAMMING    (new Function / vm.runIn* / dynamic require)
+ * 0.1  — FULLY_UNRESOLVED    (no usable evidence)
+ * 0.0  — DYNAMIC_PATTERN     (D1-D10 flagged but un-confirmed)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateConfidence = aggregateConfidence;
+exports.patternMetaConfidence = patternMetaConfidence;
+exports.applyRuntimeConfirmation = applyRuntimeConfirmation;
+exports.markUnresolved = markUnresolved;
+const types_1 = require("./types");
+/**
+ * Pick the lowest confidence among the evidence gathered for the record.
+ *
+ * `pathConfidence` counts as evidence: a route registered at a string-literal
+ * path is well-understood even if it has no middleware, params or calls.
+ *
+ * A record with NO evidence at all — nothing resolved about the path and no
+ * relationships — scores FULLY_UNRESOLVED. Scoring it STATIC_LITERAL would
+ * report maximum certainty about an endpoint we know nothing about, and this
+ * value travels into EndpointContext and on to the AI scan stages.
+ */
+function aggregateConfidence(record) {
+    const cs = [];
+    if (typeof record.pathConfidence === 'number')
+        cs.push(record.pathConfidence);
+    for (const m of record.middleware)
+        cs.push(m.confidence);
+    for (const p of record.params)
+        cs.push(p.confidence);
+    for (const c of record.callGraph)
+        cs.push(c.confidence);
+    if (cs.length === 0)
+        return types_1.Confidence.FULLY_UNRESOLVED;
+    return Math.min(...cs);
+}
+/**
+ * Map a Layer 2 pattern type to the META_PROGRAMMING confidence the
+ * record gets if that pattern is the only evidence for a relationship.
+ * (D1-D10 all start at 0.0; once a runtime trace confirms them, they
+ * jump to 0.8.)
+ */
+function patternMetaConfidence(_patternType) {
+    return types_1.Confidence.META_PROGRAMMING;
+}
+/**
+ * Upgrade a record's confidence after a runtime trace confirms it.
+ * Per the README: confirmed-but-previously-unresolved entries go 0.2 -> 0.8.
+ * Records that were META_PROGRAMMING (0.15) also upgrade to 0.8 on confirmation.
+ *
+ * Absence of evidence (trace ran, endpoint not hit) does NOT downgrade —
+ * the spec is explicit: we leave confidence low, we don't mark "absent".
+ */
+function applyRuntimeConfirmation(record) {
+    const upgraded = {
+        ...record,
+        runtimeConfirmed: true,
+        middleware: record.middleware.map(m => m.confidence === types_1.Confidence.UNRESOLVED || m.confidence === types_1.Confidence.META_PROGRAMMING
+            ? { ...m, confidence: types_1.Confidence.RUNTIME_CONFIRMED }
+            : m),
+    };
+    upgraded.confidence = aggregateConfidence(upgraded);
+    return upgraded;
+}
+/**
+ * Cross-file middleware resolution: given a middleware entry whose
+ * sourceFile is unknown (because the import was dynamic or unresolvable),
+ * set it to UNRESOLVED confidence. Used by the builder when an import
+ * could not be resolved to a file.
+ */
+function markUnresolved(entry) {
+    if (entry.sourceFile === '' || entry.sourceFile === '?') {
+        return { ...entry, sourceFile: '', confidence: types_1.Confidence.UNRESOLVED };
+    }
+    return entry;
+}
+//# sourceMappingURL=confidence.js.map

package/dist/project-map/confidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confidence.js","sourceRoot":"","sources":["../../src/project-map/confidence.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAeH,kDAQC;AAQD,sDAEC;AAUD,4DAYC;AAQD,wCAKC;AAlED,mCAAsE;AAEtE;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,MAAsB;IACtD,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU;QAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS;QAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAU,CAAC,gBAAgB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,YAAoB;IACtD,OAAO,kBAAU,CAAC,gBAAgB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CAAC,MAAsB;IAC3D,MAAM,QAAQ,GAAmB;QAC7B,GAAG,MAAM;QACT,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAClC,CAAC,CAAC,UAAU,KAAK,kBAAU,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,kBAAU,CAAC,gBAAgB;YAClF,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,kBAAU,CAAC,iBAAiB,EAAE;YACpD,CAAC,CAAC,CAAC,CACV;KACJ,CAAC;IACF,QAAQ,CAAC,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,KAAsB;IACjD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,kBAAU,CAAC,UAAU,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/project-map/crossFile.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Phase 4 — the facts Layer 1 needs from OUTSIDE the file it is extracting.
+ *
+ * Three questions cannot be answered from one file, and all three change the
+ * security reading of an endpoint:
+ *
+ *   1. What does this middleware actually check? `requireApiKey` is just a
+ *      name until the module defining it is read.
+ *   2. What is this router mounted behind? A route file registered by
+ *      `app.use('/api', requireAuth)` somewhere else is authenticated, and
+ *      contains no evidence of it.
+ *   3. Is this imported singleton a data layer? `lib/prisma.ts` constructs the
+ *      client so that route files never import `@prisma/client` themselves.
+ *
+ * The types live here so `layer1.ts` stays a pure AST function; `cache.ts`,
+ * which owns the filesystem, builds the context.
+ */
+import { TreeSitterNode } from './parserLoader';
+import { AuthScheme } from './types';
+/** A parsed dependency of the file being extracted. */
+export interface DepFile {
+    /** Workspace-relative path. */
+    file: string;
+    source: string;
+    root: TreeSitterNode;
+    imports: Map<string, string>;
+}
+/**
+ * Middleware that applies to every route in a file because of where the file's
+ * router was mounted, resolved at the mount site (which is the only place the
+ * prefix and the middleware order are both visible).
+ */
+export interface InheritedMiddleware {
+    name: string;
+    /** File the middleware is defined in, or the mounting file. */
+    sourceFile: string;
+    registrationLine: number;
+    confidence: number;
+    /** Auth scheme this middleware implements, resolved where it was mounted. */
+    auth: AuthScheme;
+    /** True when the middleware expression could not be resolved at all. */
+    dynamic: boolean;
+}
+/** Where a file's router is mounted, and what guards it there. */
+export interface MountPoint {
+    /** Path prefix the router is mounted under ('/api/users'). */
+    prefix: string;
+    /** File that performed the mount. */
+    mountedBy: string;
+    registrationLine: number;
+    /** Middleware registered before the mount that covers this prefix. */
+    inherited: InheritedMiddleware[];
+}
+export interface CrossFileContext {
+    /** Import spec as written in this file -> the parsed dependency. */
+    deps: Map<string, DepFile>;
+    /** Middleware applying to every route in this file. */
+    inherited: InheritedMiddleware[];
+    /**
+     * Prefix this file's router is mounted under, or '' when it is not mounted
+     * anywhere we can see. Kept separate from `EndpointRecord.path`, which the
+     * contract defines as the path AS REGISTERED at the route site.
+     */
+    mountPrefix: string;
+    /** Next.js edge middleware guarding routes whose path matches. */
+    nextMiddleware?: {
+        matchers: string[];
+        auth: AuthScheme;
+        file: string;
+    };
+}
+/** Join a mount prefix and a router-local path into the external path. */
+export declare function joinMountedPath(prefix: string, routePath: string): string;

package/dist/project-map/crossFile.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * Phase 4 — the facts Layer 1 needs from OUTSIDE the file it is extracting.
+ *
+ * Three questions cannot be answered from one file, and all three change the
+ * security reading of an endpoint:
+ *
+ *   1. What does this middleware actually check? `requireApiKey` is just a
+ *      name until the module defining it is read.
+ *   2. What is this router mounted behind? A route file registered by
+ *      `app.use('/api', requireAuth)` somewhere else is authenticated, and
+ *      contains no evidence of it.
+ *   3. Is this imported singleton a data layer? `lib/prisma.ts` constructs the
+ *      client so that route files never import `@prisma/client` themselves.
+ *
+ * The types live here so `layer1.ts` stays a pure AST function; `cache.ts`,
+ * which owns the filesystem, builds the context.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.joinMountedPath = joinMountedPath;
+/** Join a mount prefix and a router-local path into the external path. */
+function joinMountedPath(prefix, routePath) {
+    if (!prefix)
+        return routePath;
+    if (routePath === '?' || routePath === '')
+        return prefix;
+    if (routePath === '/')
+        return prefix;
+    const left = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+    const right = routePath.startsWith('/') ? routePath : '/' + routePath;
+    return left + right;
+}
+//# sourceMappingURL=crossFile.js.map

package/dist/project-map/crossFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossFile.js","sourceRoot":"","sources":["../../src/project-map/crossFile.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AA0DH,0CAOC;AARD,0EAA0E;AAC1E,SAAgB,eAAe,CAAC,MAAc,EAAE,SAAiB;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,SAAS,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;IACtE,OAAO,IAAI,GAAG,KAAK,CAAC;AACxB,CAAC"}

package/dist/project-map/detectors.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Phase 4 Layer 1 — framework / library detectors.
+ *
+ * Each detector takes the file's source text + the assignments map + the
+ * imports map and returns a label (or 'unknown'). Keeping these in one
+ * place means Layer 1 extraction can stay focused on routing structure.
+ */
+import { TreeSitterNode } from './parserLoader';
+import type { DataLayer } from './types';
+export type AuthMatch = 'jwt' | 'session' | 'api-key' | 'oauth' | 'basic' | 'none';
+/** Detect auth scheme from imports + call sites. */
+export declare function detectAuth(imports: Map<string, string>, root: TreeSitterNode, source: string): AuthMatch;
+export type DataLayerMatch = 'prisma' | 'typeorm' | 'sequelize' | 'knex' | 'mongoose' | 'raw-sql' | 'supabase' | 'sqlalchemy' | 'django-orm' | 'none';
+/** Detect ORM / data layer from imports. */
+export declare function detectDataLayer(imports: Map<string, string>): DataLayerMatch;
+/**
+ * Map an internal detector match to the public `DataLayer` taxonomy.
+ *
+ * The Project Map ground truth deliberately uses `"unknown"` (not `"none"`)
+ * for a handler that DOES touch a data client the taxonomy cannot name.
+ * Supabase/PostgREST is now labeled `"supabase"`. `"none"` is reserved for
+ * "the handler touches no data layer at all".
+ */
+export declare function toDataLayer(layer: DataLayerMatch): DataLayer;
+/**
+ * Local names that stand for the data layer in this file: the imported client
+ * itself plus anything constructed from it (`const prisma = new PrismaClient()`,
+ * `const supabase = createClient(...)`).
+ *
+ * Used to decide whether a given handler actually touches the data layer, as
+ * opposed to merely living in a file that imports one.
+ */
+export declare function dataLayerBindings(layer: DataLayerMatch, imports: Map<string, string>, root: TreeSitterNode, source: string, seed?: Iterable<string>): Set<string>;
+export type ValidatorMatch = 'zod' | 'joi' | 'express-validator' | 'yup' | 'ajv' | 'pydantic' | 'marshmallow' | 'none';
+/** Detect validator library from imports. */
+export declare function detectValidator(imports: Map<string, string>): ValidatorMatch;
+/** True iff a call node is a route registration: app.get('/x', handler) etc. */
+export declare function isRouteRegistration(callNode: TreeSitterNode, source: string): {
+    receiver: string | null;
+    method: string;
+    args: TreeSitterNode[];
+    line: number;
+} | null;
+/**
+ * True iff a call is a Django URLconf entry: `path("articles/", views.list)`.
+ *
+ * These are bare calls with no receiver, so they cannot be told from any other
+ * one-word function call by shape alone. Membership of a `urlpatterns` list is
+ * what makes them a route, and it is also how Django itself decides.
+ */
+export declare function isDjangoRouteRegistration(callNode: TreeSitterNode, source: string): {
+    path: TreeSitterNode;
+    view: TreeSitterNode | null;
+    line: number;
+} | null;
+/** True iff a call node is app.use(...) (global/route middleware registration). */
+export declare function isUseRegistration(callNode: TreeSitterNode, source: string): {
+    receiver: string | null;
+    args: TreeSitterNode[];
+    line: number;
+} | null;
+/** HTTP method normalization for the EndpointRecord. */
+export declare function normalizeMethod(m: string): 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS' | 'ALL';
+/**
+ * Free response constructors. Django and Flask build the response by calling a
+ * function rather than by calling a method on a response object, so the shape
+ * is carried by the callee name instead of the receiver.
+ */
+export declare const RESPONSE_CONSTRUCTORS: Record<string, 'json' | 'html' | 'redirect' | 'stream' | 'file' | 'text'>;
+/** Detect response shape from the handler's return / res.send / res.json calls. */
+export declare function detectResponseShape(handlerRoot: TreeSitterNode, source: string): 'json' | 'html' | 'redirect' | 'stream' | 'file' | 'text' | 'unknown';
+/**
+ * Detect the auth scheme a specific FUNCTION implements, from evidence inside
+ * its own body.
+ *
+ * Distinct from `detectAuth`, which answers "does this FILE deal in auth" from
+ * its imports. That question is the wrong one for a middleware or a FastAPI
+ * dependency: `get_db` and `get_current_user` live in the same module, and only
+ * one of them is a guard.
+ */
+export declare function detectAuthInFunction(fnRoot: TreeSitterNode, source: string): AuthMatch;
+/** Quick check: does the file import any framework we recognize at all? */
+export declare function isLikelyFrameworkFile(imports: Map<string, string>): boolean;

package/dist/project-map/detectors.js

@@ -0,0 +1,376 @@
+"use strict";
+/**
+ * Phase 4 Layer 1 — framework / library detectors.
+ *
+ * Each detector takes the file's source text + the assignments map + the
+ * imports map and returns a label (or 'unknown'). Keeping these in one
+ * place means Layer 1 extraction can stay focused on routing structure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESPONSE_CONSTRUCTORS = void 0;
+exports.detectAuth = detectAuth;
+exports.detectDataLayer = detectDataLayer;
+exports.toDataLayer = toDataLayer;
+exports.dataLayerBindings = dataLayerBindings;
+exports.detectValidator = detectValidator;
+exports.isRouteRegistration = isRouteRegistration;
+exports.isDjangoRouteRegistration = isDjangoRouteRegistration;
+exports.isUseRegistration = isUseRegistration;
+exports.normalizeMethod = normalizeMethod;
+exports.detectResponseShape = detectResponseShape;
+exports.detectAuthInFunction = detectAuthInFunction;
+exports.isLikelyFrameworkFile = isLikelyFrameworkFile;
+const astHelpers_1 = require("./astHelpers");
+/** Detect auth scheme from imports + call sites. */
+function detectAuth(imports, root, source) {
+    const from = (mod) => [...imports.values()].some(s => s.includes(mod));
+    if (from('passport-jwt') || from('jsonwebtoken') || from('fastapi-jwt') || from('jose'))
+        return 'jwt';
+    if (from('express-session') || from('cookie-session') || from('django.contrib.sessions') || from('starlette.sessions'))
+        return 'session';
+    if (from('passport-google') || from('passport-github') || from('authlib') || from('itsdangerous'))
+        return 'oauth';
+    if (from('passport-http') || from('http-auth'))
+        return 'basic';
+    // api-key: look for x-api-key access or a Depends(api_key) in the file
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        if (n.type === 'subscript_expression' || n.type === 'subscript') {
+            const txt = source.slice(n.startIndex, n.endIndex);
+            if (/x-api-key|apiKey|api_key/i.test(txt))
+                return 'api-key';
+        }
+    }
+    // JWT heuristic: jsonwebtoken.verify call
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        if (n.type === 'call_expression' || n.type === 'call') {
+            const p = (0, astHelpers_1.callParts)(n, source);
+            if (!p)
+                continue;
+            if (p.receiver === 'jwt' && p.method === 'verify')
+                return 'jwt';
+            if (p.receiver === 'passport' && p.method === 'authenticate') {
+                return 'oauth'; // passport.authenticate('google', ...) default
+            }
+        }
+    }
+    return 'none';
+}
+/** Module specs that identify each data layer, most specific first. */
+const DATA_LAYER_SPECS = [
+    { layer: 'prisma', test: s => s.includes('@prisma/client') },
+    { layer: 'typeorm', test: s => s.includes('typeorm') },
+    { layer: 'sequelize', test: s => s.includes('sequelize') },
+    { layer: 'knex', test: s => s === 'knex' || s.includes('/knex') },
+    { layer: 'mongoose', test: s => s.includes('mongoose') },
+    { layer: 'supabase', test: s => s.includes('@supabase/') || s === 'supabase' || s.startsWith('supabase.') },
+    { layer: 'sqlalchemy', test: s => s === 'sqlalchemy' || s.startsWith('sqlalchemy.') },
+    { layer: 'django-orm', test: s => s === 'django' || s.startsWith('django.') },
+];
+/** Detect ORM / data layer from imports. */
+function detectDataLayer(imports) {
+    const specs = [...imports.values()];
+    for (const { layer, test } of DATA_LAYER_SPECS) {
+        if (specs.some(test))
+            return layer;
+    }
+    return 'none';
+}
+/**
+ * Map an internal detector match to the public `DataLayer` taxonomy.
+ *
+ * The Project Map ground truth deliberately uses `"unknown"` (not `"none"`)
+ * for a handler that DOES touch a data client the taxonomy cannot name.
+ * Supabase/PostgREST is now labeled `"supabase"`. `"none"` is reserved for
+ * "the handler touches no data layer at all".
+ */
+function toDataLayer(layer) {
+    switch (layer) {
+        case 'supabase': return 'supabase';
+        default: return layer;
+    }
+}
+/**
+ * Local names that stand for the data layer in this file: the imported client
+ * itself plus anything constructed from it (`const prisma = new PrismaClient()`,
+ * `const supabase = createClient(...)`).
+ *
+ * Used to decide whether a given handler actually touches the data layer, as
+ * opposed to merely living in a file that imports one.
+ */
+function dataLayerBindings(layer, imports, root, source, seed) {
+    const names = new Set(seed ?? []);
+    if (layer === 'none')
+        return names;
+    const match = DATA_LAYER_SPECS.find(d => d.layer === layer);
+    for (const [local, spec] of imports) {
+        if (match ? match.test(spec) : false)
+            names.add(local);
+    }
+    // Anything built from one of those names is also the data layer.
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        if (n.type !== 'variable_declarator' && n.type !== 'assignment')
+            continue;
+        const target = n.child(0);
+        const value = n.child(n.childCount - 1);
+        if (!target || !value || target === value)
+            continue;
+        if (target.type !== 'identifier')
+            continue;
+        const valueText = source.slice(value.startIndex, value.endIndex);
+        if ([...names].some(b => new RegExp(`\\b${escapeForRegExp(b)}\\b`).test(valueText))) {
+            names.add(source.slice(target.startIndex, target.endIndex));
+        }
+    }
+    return names;
+}
+function escapeForRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Detect validator library from imports. */
+function detectValidator(imports) {
+    const specs = [...imports.values()];
+    if (specs.some(s => s === 'zod' || s.startsWith('zod/')))
+        return 'zod';
+    if (specs.some(s => s.includes('joi')))
+        return 'joi';
+    if (specs.some(s => s.includes('express-validator')))
+        return 'express-validator';
+    if (specs.some(s => s === 'yup' || s.startsWith('yup/')))
+        return 'yup';
+    if (specs.some(s => s.includes('ajv')))
+        return 'ajv';
+    if (specs.some(s => s === 'pydantic' || s.startsWith('pydantic.')))
+        return 'pydantic';
+    if (specs.some(s => s === 'marshmallow' || s.startsWith('marshmallow.')))
+        return 'marshmallow';
+    return 'none';
+}
+/** Known route-registration method names across Express/Fastify/Koa/Python. */
+const ROUTE_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'all', 'route']);
+const KNOWN_RECEIVERS = new Set(['app', 'router', 'server', 'fastify', 'api', 'route', 'controller', 'rtr']);
+/** Node types a route path can legitimately be written as. */
+function isPathExpression(node) {
+    return (0, astHelpers_1.isStringLiteral)(node)
+        || node.type === 'identifier'
+        || node.type === 'template_string'
+        || node.type === 'template_literal';
+}
+/** True iff a call node is a route registration: app.get('/x', handler) etc. */
+function isRouteRegistration(callNode, source) {
+    if (callNode.type !== 'call_expression' && callNode.type !== 'call')
+        return null;
+    const p = (0, astHelpers_1.callParts)(callNode, source);
+    if (!p || !p.receiver)
+        return null;
+    if (!KNOWN_RECEIVERS.has(p.receiver))
+        return null;
+    if (!ROUTE_METHODS.has(p.method.toLowerCase()))
+        return null;
+    if (p.args.length < 1)
+        return null;
+    // The path may be a constant or a template literal, not just a literal.
+    // Resolution (and the '?' fallback for a genuinely dynamic path) belongs to
+    // the caller; dropping the registration here loses the endpoint entirely.
+    if (!isPathExpression(p.args[0]))
+        return null;
+    // A non-literal single argument is far more likely to be a getter
+    // (`app.get(setting)`) than a route, so require a handler alongside it.
+    if (!(0, astHelpers_1.isStringLiteral)(p.args[0]) && p.args.length < 2)
+        return null;
+    return p;
+}
+/** Django URLconf registration functions. */
+const DJANGO_ROUTE_FUNCTIONS = new Set(['path', 're_path', 'url']);
+/**
+ * True iff a call is a Django URLconf entry: `path("articles/", views.list)`.
+ *
+ * These are bare calls with no receiver, so they cannot be told from any other
+ * one-word function call by shape alone. Membership of a `urlpatterns` list is
+ * what makes them a route, and it is also how Django itself decides.
+ */
+function isDjangoRouteRegistration(callNode, source) {
+    if (callNode.type !== 'call')
+        return null;
+    const p = (0, astHelpers_1.callParts)(callNode, source);
+    if (!p || p.receiver !== null)
+        return null;
+    if (!DJANGO_ROUTE_FUNCTIONS.has(p.method))
+        return null;
+    if (p.args.length < 1 || !(0, astHelpers_1.isStringLiteral)(p.args[0]))
+        return null;
+    if (!(0, astHelpers_1.firstAncestor)(callNode, n => isUrlpatternsAssignment(n, source)))
+        return null;
+    const positional = p.args.filter(a => a.type !== 'keyword_argument');
+    return { path: positional[0], view: positional[1] ?? null, line: p.line };
+}
+/** True iff a node is the `urlpatterns = [...]` assignment. */
+function isUrlpatternsAssignment(node, source) {
+    if (node.type !== 'assignment')
+        return false;
+    const target = node.child(0);
+    if (!target)
+        return false;
+    return source.slice(target.startIndex, target.endIndex).trim() === 'urlpatterns';
+}
+/** True iff a call node is app.use(...) (global/route middleware registration). */
+function isUseRegistration(callNode, source) {
+    if (callNode.type !== 'call_expression' && callNode.type !== 'call')
+        return null;
+    const p = (0, astHelpers_1.callParts)(callNode, source);
+    if (!p || !p.receiver)
+        return null;
+    if (p.method !== 'use')
+        return null;
+    if (!KNOWN_RECEIVERS.has(p.receiver))
+        return null;
+    return { receiver: p.receiver, args: p.args, line: p.line };
+}
+/** HTTP method normalization for the EndpointRecord. */
+function normalizeMethod(m) {
+    const u = m.toUpperCase();
+    if (u === 'ROUTE' || u === 'ALL')
+        return 'ALL';
+    return u;
+}
+/** Response objects whose methods describe the body being sent. */
+const RESPONSE_OBJECTS = new Set(['res', 'response', 'reply', 'ctx', 'NextResponse', 'Response']);
+/**
+ * Free response constructors. Django and Flask build the response by calling a
+ * function rather than by calling a method on a response object, so the shape
+ * is carried by the callee name instead of the receiver.
+ */
+exports.RESPONSE_CONSTRUCTORS = {
+    JsonResponse: 'json',
+    jsonify: 'json',
+    render: 'html',
+    render_template: 'html',
+    redirect: 'redirect',
+    HttpResponseRedirect: 'redirect',
+    FileResponse: 'file',
+    send_file: 'file',
+    StreamingHttpResponse: 'stream',
+    HttpResponse: 'text',
+};
+/** Detect response shape from the handler's return / res.send / res.json calls. */
+function detectResponseShape(handlerRoot, source) {
+    let sawJson = false, sawRender = false, sawRedirect = false, sawSend = false, sawStream = false, sawFile = false;
+    const note = (shape) => {
+        switch (shape) {
+            case 'json':
+                sawJson = true;
+                break;
+            case 'html':
+                sawRender = true;
+                break;
+            case 'redirect':
+                sawRedirect = true;
+                break;
+            case 'text':
+                sawSend = true;
+                break;
+            case 'stream':
+                sawStream = true;
+                break;
+            case 'file':
+                sawFile = true;
+                break;
+        }
+    };
+    for (const n of (0, astHelpers_1.walk)(handlerRoot)) {
+        if (n.type !== 'call_expression' && n.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(n, source);
+        if (!p)
+            continue;
+        if (!p.receiver) {
+            const shape = exports.RESPONSE_CONSTRUCTORS[p.method];
+            if (shape)
+                note(shape);
+            continue;
+        }
+        if (RESPONSE_OBJECTS.has(p.receiver)) {
+            switch (p.method) {
+                case 'json':
+                    sawJson = true;
+                    break;
+                case 'render':
+                    sawRender = true;
+                    break;
+                case 'redirect':
+                    sawRedirect = true;
+                    break;
+                case 'send':
+                    sawSend = true;
+                    break;
+                case 'sendStream':
+                case 'stream':
+                case 'pipe':
+                    sawStream = true;
+                    break;
+                case 'sendFile':
+                case 'download':
+                case 'attachment':
+                    sawFile = true;
+                    break;
+            }
+        }
+    }
+    if (sawRedirect)
+        return 'redirect';
+    if (sawRender)
+        return 'html';
+    if (sawFile)
+        return 'file';
+    if (sawStream)
+        return 'stream';
+    if (sawJson)
+        return 'json';
+    if (sawSend)
+        return 'text';
+    return 'unknown';
+}
+/**
+ * Detect the auth scheme a specific FUNCTION implements, from evidence inside
+ * its own body.
+ *
+ * Distinct from `detectAuth`, which answers "does this FILE deal in auth" from
+ * its imports. That question is the wrong one for a middleware or a FastAPI
+ * dependency: `get_db` and `get_current_user` live in the same module, and only
+ * one of them is a guard.
+ */
+function detectAuthInFunction(fnRoot, source) {
+    const text = source.slice(fnRoot.startIndex, fnRoot.endIndex);
+    if (/x-api-key|\bapi_key\b|\bapiKey\b/i.test(text))
+        return 'api-key';
+    for (const n of (0, astHelpers_1.walk)(fnRoot)) {
+        if (n.type !== 'call_expression' && n.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(n, source);
+        if (!p)
+            continue;
+        const receiver = (p.receiver ?? '').toLowerCase();
+        if (/^(jwt|jose|jsonwebtoken|jwtlib)$/.test(receiver)
+            && ['verify', 'decode', 'sign'].includes(p.method)) {
+            return 'jwt';
+        }
+        if (receiver === 'passport' && p.method === 'authenticate')
+            return 'oauth';
+        // `req.cookies.get('sb-access-token')` / `request.session[...]`.
+        if (/\bcookies?\b|\bsession\b/i.test(p.receiverText ?? ''))
+            return 'session';
+    }
+    if (/\bsession\b/i.test(text))
+        return 'session';
+    return 'none';
+}
+/** Quick check: does the file import any framework we recognize at all? */
+function isLikelyFrameworkFile(imports) {
+    const specs = [...imports.values()];
+    return specs.some(s => s === 'express' || s.startsWith('express/') ||
+        s === 'fastify' || s.startsWith('fastify/') ||
+        s === 'koa' || s.startsWith('koa/') ||
+        s === 'koa-router' || s === '@koa/router' ||
+        s === 'fastapi' ||
+        s === 'django' || s.startsWith('django.'));
+}
+//# sourceMappingURL=detectors.js.map