@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/engine/walk.js

@@ -0,0 +1,156 @@
+/**
+ * FILE DISCOVERY
+ *
+ * Turning "scan this path" into "here is the list of files". Boring code, but
+ * two decisions in it matter:
+ *
+ * 1. We skip dependency and build directories. Scanning node_modules finds
+ *    thousands of "vulnerabilities" in other people's code that you cannot fix
+ *    and did not write. Dependency risk is a real and separate problem
+ *    (Software Composition Analysis) and it deserves its own tool, not noise
+ *    inside this one.
+ *
+ * 2. We record the extensions we skipped. That list feeds the coverage report,
+ *    so a scan of a repo that is 70% Ruby says "we did not look at 412 .rb
+ *    files" instead of quietly reporting "no issues found".
+ */
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { runtimeFileKind } from '../platform/runtime-version.js';
+const IGNORED_DIRECTORIES = new Set([
+    '.git', '.hg', '.svn',
+    'node_modules', 'bower_components', 'jspm_packages',
+    'dist', 'build', 'out', 'target', 'bin', 'obj',
+    'vendor', 'third_party',
+    '.venv', 'venv', 'env', '__pycache__', '.tox', 'site-packages', '.mypy_cache',
+    '.next', '.nuxt', '.svelte-kit', '.turbo', '.parcel-cache',
+    'coverage', '.nyc_output', '.gradle', '.m2',
+    '.idea', '.vscode', '.cache', '.pytest_cache',
+]);
+/** 2 MB. Anything larger is almost always generated, minified or a data blob. */
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+/**
+ * Turn a glob into a regular expression.
+ *
+ * Supported, deliberately a small subset:
+ *   **   any number of path segments
+ *   *    anything except a path separator
+ *   ?    one character
+ * A pattern with no wildcards and no separator (e.g. `vendor`) matches any path
+ * SEGMENT with that name, which is what people mean by `--exclude=vendor`.
+ *
+ * Everything is matched against the path with forward slashes, so the same
+ * pattern works on Windows and Unix.
+ */
+export function globToRegExp(pattern) {
+    const cleaned = pattern.trim().replace(/\\/g, '/').replace(/\/+$/, '');
+    const bare = !/[*?/]/.test(cleaned);
+    const escaped = cleaned
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '\u0000')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\?/g, '[^/]')
+        .replace(/\u0000/g, '.*');
+    // `vendor` -> matches the segment anywhere in the path.
+    if (bare)
+        return new RegExp(`(^|/)${escaped}(/|$)`);
+    // `src/**/test.js` or `*.spec.ts` -> match anywhere the shape fits.
+    return new RegExp(`(^|/)${escaped}$|^${escaped}$`);
+}
+export async function collectFiles(target, options) {
+    const scannable = new Set(options.scannable.map((e) => e.toLowerCase()));
+    const maxBytes = options.maxBytes ?? MAX_FILE_BYTES;
+    const excludePatterns = (options.exclude ?? []).map(globToRegExp);
+    let excludedCount = 0;
+    const excludedDirectories = [];
+    /** Matched against the path relative to the scan target, slashes normalised. */
+    const isExcluded = (fullPath) => {
+        if (excludePatterns.length === 0)
+            return false;
+        const relative = path.relative(target, fullPath).split(path.sep).join('/');
+        return excludePatterns.some((pattern) => pattern.test(relative));
+    };
+    const files = [];
+    const skipped = new Map();
+    const oversized = [];
+    const runtimeFiles = [];
+    const info = await stat(target);
+    if (info.isFile()) {
+        // An explicitly named file is always scanned - if the user pointed at it,
+        // they meant it, even if it is huge or in node_modules.
+        files.push(target);
+        return {
+            files,
+            skippedByExtension: skipped,
+            oversizedFiles: oversized,
+            excludedCount,
+            excludedDirectories,
+            runtimeFiles: runtimeFileKind(path.basename(target)) ? [target] : [],
+        };
+    }
+    const queue = [target];
+    while (queue.length > 0) {
+        const dir = queue.pop();
+        if (!dir)
+            break;
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // unreadable directory - permissions, broken symlink, race
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (IGNORED_DIRECTORIES.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.') && entry.name !== '.')
+                    continue;
+                // Pruning an excluded directory here saves walking its whole subtree.
+                if (isExcluded(full)) {
+                    excludedDirectories.push(path.relative(target, full).split(path.sep).join('/'));
+                    continue;
+                }
+                queue.push(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (isExcluded(full)) {
+                excludedCount++;
+                continue;
+            }
+            if (runtimeFileKind(entry.name))
+                runtimeFiles.push(full);
+            const ext = path.extname(entry.name).toLowerCase();
+            if (!scannable.has(ext)) {
+                if (ext)
+                    skipped.set(ext, (skipped.get(ext) ?? 0) + 1);
+                continue;
+            }
+            try {
+                const fileInfo = await stat(full);
+                if (fileInfo.size > maxBytes) {
+                    oversized.push(full);
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            files.push(full);
+        }
+    }
+    files.sort();
+    excludedDirectories.sort();
+    return {
+        files,
+        skippedByExtension: skipped,
+        oversizedFiles: oversized,
+        excludedCount,
+        excludedDirectories,
+        runtimeFiles,
+    };
+}
+//# sourceMappingURL=walk.js.map

package/dist/src/engine/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../../src/engine/walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,MAAM;IACrB,cAAc,EAAE,kBAAkB,EAAE,eAAe;IACnD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK;IAC9C,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa;IAC7E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe;IAC1D,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK;IAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe;CAC9C,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAiCvC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,wDAAwD;IACxD,IAAI,IAAI;QAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,OAAO,OAAO,CAAC,CAAC;IACpD,oEAAoE;IACpE,OAAO,IAAI,MAAM,CAAC,QAAQ,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAoB;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACpD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,mBAAmB,GAAa,EAAE,CAAC;IAEzC,gFAAgF;IAChF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAW,EAAE;QAC/C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,0EAA0E;QAC1E,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO;YACL,KAAK;YACL,kBAAkB,EAAE,OAAO;YAC3B,cAAc,EAAE,SAAS;YACzB,aAAa;YACb,mBAAmB;YACnB,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM;QAEhB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,2DAA2D;QACvE,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAExC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;oBAAE,SAAS;gBAC/D,sEAAsE;gBACtE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAE9B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,aAAa,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,GAAG;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;oBAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,mBAAmB,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO;QACL,KAAK;QACL,kBAAkB,EAAE,OAAO;QAC3B,cAAc,EAAE,SAAS;QACzB,aAAa;QACb,mBAAmB;QACnB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/src/parse/astDump.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A human-readable printer for syntax trees.
+ *
+ * This exists purely so you can SEE what the parser sees. Run:
+ *     npm run ast -- somefile.js
+ * and compare the output to the source. Once the shape of the tree stops
+ * looking mysterious, writing detection rules becomes ordinary programming.
+ *
+ * Two concepts show up in the output:
+ *
+ *   NAMED vs ANONYMOUS nodes. `db.query(x)` contains the parentheses and the
+ *   dot as nodes too, but they carry no meaning of their own - tree-sitter calls
+ *   those "anonymous". By default we hide them, because rules almost never care.
+ *
+ *   FIELDS. Some children have a role, not just a position. In
+ *   `binary_expression`, the children are labelled `left`, `operator`, `right`.
+ *   Fields are how a rule says "the thing being called" instead of "child #0",
+ *   which is what makes rules survive grammar updates.
+ */
+import type { Node } from 'web-tree-sitter';
+export interface AstDumpOptions {
+    /** Show punctuation/keyword nodes too. Default false. */
+    readonly includeAnonymous?: boolean;
+    /** Stop after this depth. Default 12. */
+    readonly maxDepth?: number;
+    /** Stop after this many lines, so a huge file doesn't flood the terminal. */
+    readonly maxLines?: number;
+    /** Show the source text of leaf nodes. Default true. */
+    readonly showText?: boolean;
+}
+export declare function dumpAst(root: Node, options?: AstDumpOptions): string;

package/dist/src/parse/astDump.js

@@ -0,0 +1,66 @@
+/**
+ * A human-readable printer for syntax trees.
+ *
+ * This exists purely so you can SEE what the parser sees. Run:
+ *     npm run ast -- somefile.js
+ * and compare the output to the source. Once the shape of the tree stops
+ * looking mysterious, writing detection rules becomes ordinary programming.
+ *
+ * Two concepts show up in the output:
+ *
+ *   NAMED vs ANONYMOUS nodes. `db.query(x)` contains the parentheses and the
+ *   dot as nodes too, but they carry no meaning of their own - tree-sitter calls
+ *   those "anonymous". By default we hide them, because rules almost never care.
+ *
+ *   FIELDS. Some children have a role, not just a position. In
+ *   `binary_expression`, the children are labelled `left`, `operator`, `right`.
+ *   Fields are how a rule says "the thing being called" instead of "child #0",
+ *   which is what makes rules survive grammar updates.
+ */
+export function dumpAst(root, options = {}) {
+    const includeAnonymous = options.includeAnonymous ?? false;
+    const maxDepth = options.maxDepth ?? 12;
+    const maxLines = options.maxLines ?? 400;
+    const showText = options.showText ?? true;
+    const lines = [];
+    const walk = (node, depth, fieldName, prefix, isLast) => {
+        if (lines.length >= maxLines)
+            return;
+        const connector = depth === 0 ? '' : isLast ? '└─ ' : '├─ ';
+        const label = fieldName ? `${fieldName}: ${node.type}` : node.type;
+        const position = `[${node.startPosition.row + 1}:${node.startPosition.column + 1}]`;
+        // Show source text only for leaves - printing it for a whole function is noise.
+        let text = '';
+        if (showText && node.namedChildCount === 0) {
+            const raw = (node.text ?? '').replace(/\s+/g, ' ').trim();
+            if (raw.length > 0)
+                text = `  "${raw.length > 48 ? `${raw.slice(0, 47)}…` : raw}"`;
+        }
+        lines.push(`${prefix}${connector}${label} ${position}${text}`);
+        if (depth >= maxDepth) {
+            if (node.namedChildCount > 0) {
+                lines.push(`${prefix}${isLast ? '   ' : '│  '}└─ … (${node.namedChildCount} more, depth limit)`);
+            }
+            return;
+        }
+        const children = [];
+        for (let i = 0; i < node.childCount; i++) {
+            const child = node.child(i);
+            if (!child)
+                continue;
+            if (!includeAnonymous && !child.isNamed)
+                continue;
+            children.push({ node: child, field: node.fieldNameForChild(i) });
+        }
+        const childPrefix = depth === 0 ? '' : prefix + (isLast ? '   ' : '│  ');
+        children.forEach((child, index) => {
+            walk(child.node, depth + 1, child.field, childPrefix, index === children.length - 1);
+        });
+    };
+    walk(root, 0, null, '', true);
+    if (lines.length >= maxLines) {
+        lines.push(`… output truncated at ${maxLines} lines (use --max-lines to raise)`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=astDump.js.map

package/dist/src/parse/astDump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"astDump.js","sourceRoot":"","sources":["../../../src/parse/astDump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH,MAAM,UAAU,OAAO,CAAC,IAAU,EAAE,UAA0B,EAAE;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,CAAC,IAAU,EAAE,KAAa,EAAE,SAAwB,EAAE,MAAc,EAAE,MAAe,EAAQ,EAAE;QAC1G,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QAErC,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;QAEpF,gFAAgF;QAChF,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC;QAE/D,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,eAAe,qBAAqB,CAAC,CAAC;YACnG,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAgD,EAAE,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,SAAS;YAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,yBAAyB,QAAQ,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/parse/languages.d.ts

@@ -0,0 +1,70 @@
+/**
+ * LANGUAGE REGISTRY
+ * =================
+ *
+ * A scanner has to answer "what language is this file?" before it can answer
+ * "is this file dangerous?". This file is the single place that knows.
+ *
+ * ARCHITECTURAL DECISION (matters in Phase 5, language expansion):
+ * languages are DATA, not code. Adding Ruby later means adding one object to
+ * the array below plus one query file per rule - it does not mean editing the
+ * parser, the engine, the CLI, or any existing rule. If adding a language ever
+ * requires touching the engine, we designed it wrong.
+ *
+ * WHY WASM GRAMMARS INSTEAD OF NATIVE ONES:
+ * Tree-sitter ships two ways to run a grammar - a native C module you compile
+ * on your machine, or a WebAssembly (.wasm) file that runs anywhere. We chose
+ * WASM for three reasons:
+ *   1. No compiler toolchain needed. `npm install` just works, on any OS.
+ *   2. The SAME grammar files run in a browser. Phase 2 is a browser UI - it
+ *      will run this identical engine instead of a reimplementation of it.
+ *   3. The tree-sitter-wasms package already ships 36 grammars, so Phase 5's
+ *      language expansion is mostly unlocking files we already have on disk.
+ */
+/** The languages Defuse supports. */
+export type LanguageId = 'javascript' | 'typescript' | 'python' | 'java' | 'go' | 'php' | 'c' | 'cpp';
+export interface Dialect {
+    /** File extensions handled by this dialect. */
+    readonly extensions: readonly string[];
+    /** Grammar name inside tree-sitter-wasms, i.e. tree-sitter-<name>.wasm */
+    readonly grammar: string;
+}
+export interface LanguageSpec {
+    readonly id: LanguageId;
+    readonly displayName: string;
+    /** Primary extensions -> primary grammar. */
+    readonly extensions: readonly string[];
+    readonly grammar: string;
+    /**
+     * Variants of the same language that need a DIFFERENT grammar file but share
+     * rules. e.g. .tsx needs the tsx grammar, but a SQL-injection rule written for
+     * TypeScript matches .tsx code perfectly well.
+     */
+    readonly dialects?: readonly Dialect[];
+    /** Interpreter names seen in a `#!` shebang line, for extensionless scripts. */
+    readonly shebangs?: readonly string[];
+    /** Honest notes about what this language's support does and does not include. */
+    readonly notes: string;
+}
+export declare const LANGUAGES: readonly LanguageSpec[];
+export interface LanguageMatch {
+    readonly spec: LanguageSpec;
+    /** Which .wasm grammar to actually load (may differ from spec.grammar for dialects). */
+    readonly grammar: string;
+    /** How we decided. Reported in --json so detection is auditable, never magic. */
+    readonly detectedBy: 'extension' | 'shebang';
+}
+/**
+ * Decide which language a file is.
+ *
+ * Step 1: file extension. Boring, fast, right ~99% of the time.
+ * Step 2: if there is no useful extension, read the first line and look for a
+ *         "shebang" - the `#!/usr/bin/env python3` line that tells Unix which
+ *         interpreter to run. This is how we catch a CLI script named `deploy`
+ *         with no extension at all.
+ *
+ * Returns null for "we don't handle this", which is a normal answer, not an error.
+ */
+export declare function detectLanguage(filePath: string, firstLine?: string): LanguageMatch | null;
+/** Every extension we will attempt to open. Used by the file walker. */
+export declare const SCANNABLE_EXTENSIONS: readonly string[];

package/dist/src/parse/languages.js

@@ -0,0 +1,174 @@
+/**
+ * LANGUAGE REGISTRY
+ * =================
+ *
+ * A scanner has to answer "what language is this file?" before it can answer
+ * "is this file dangerous?". This file is the single place that knows.
+ *
+ * ARCHITECTURAL DECISION (matters in Phase 5, language expansion):
+ * languages are DATA, not code. Adding Ruby later means adding one object to
+ * the array below plus one query file per rule - it does not mean editing the
+ * parser, the engine, the CLI, or any existing rule. If adding a language ever
+ * requires touching the engine, we designed it wrong.
+ *
+ * WHY WASM GRAMMARS INSTEAD OF NATIVE ONES:
+ * Tree-sitter ships two ways to run a grammar - a native C module you compile
+ * on your machine, or a WebAssembly (.wasm) file that runs anywhere. We chose
+ * WASM for three reasons:
+ *   1. No compiler toolchain needed. `npm install` just works, on any OS.
+ *   2. The SAME grammar files run in a browser. Phase 2 is a browser UI - it
+ *      will run this identical engine instead of a reimplementation of it.
+ *   3. The tree-sitter-wasms package already ships 36 grammars, so Phase 5's
+ *      language expansion is mostly unlocking files we already have on disk.
+ */
+export const LANGUAGES = [
+    {
+        id: 'javascript',
+        displayName: 'JavaScript',
+        extensions: ['.js', '.mjs', '.cjs', '.jsx'],
+        grammar: 'javascript',
+        shebangs: ['node'],
+        notes: 'The javascript grammar parses JSX natively, so .jsx needs no separate grammar. ' +
+            'Vue/Svelte single-file components are NOT supported - their <script> blocks are ' +
+            'not extracted. Documented gap, not a silent one.',
+    },
+    {
+        id: 'typescript',
+        displayName: 'TypeScript',
+        extensions: ['.ts', '.mts', '.cts'],
+        grammar: 'typescript',
+        dialects: [{ extensions: ['.tsx'], grammar: 'tsx' }],
+        notes: 'Type annotations are parsed but NOT used for analysis. Knowing that ' +
+            'a parameter is typed `string` tells us nothing about whether it is attacker-' +
+            'controlled, so we deliberately do not pretend it does. .d.ts files are skipped.',
+    },
+    {
+        id: 'python',
+        displayName: 'Python',
+        extensions: ['.py', '.pyi'],
+        grammar: 'python',
+        shebangs: ['python', 'python2', 'python3'],
+        notes: 'Python 3 grammar. Python 2 print-statements will produce parse errors, which we ' +
+            'report rather than swallow.',
+    },
+    {
+        id: 'java',
+        displayName: 'Java',
+        extensions: ['.java'],
+        grammar: 'java',
+        notes: 'Plain Java only. .jsp, .kt (Kotlin) and .scala are separate languages and are not ' +
+            'covered by these rules even though a Java-ish pattern might appear in them.',
+    },
+    {
+        id: 'php',
+        displayName: 'PHP',
+        extensions: ['.php', '.phtml'],
+        grammar: 'php',
+        notes: 'PHP source only. A .php file is parsed as a whole document, so HTML outside ' +
+            '<?php ?> is text rather than markup - an XSS sink written in raw HTML with a ' +
+            'short echo tag (<?= $x ?>) IS matched, but HTML attributes around it are not ' +
+            'analysed. Blade (.blade.php) and Twig (.twig) templates are NOT parsed.',
+    },
+    {
+        id: 'go',
+        displayName: 'Go',
+        extensions: ['.go'],
+        grammar: 'go',
+        notes: 'Go source only; go.mod, go.sum and generated protobuf files are skipped as noise.',
+    },
+    {
+        id: 'c',
+        displayName: 'C',
+        extensions: ['.c'],
+        grammar: 'c',
+        notes: 'MEMORY SAFETY IS NOT ANALYSED. C is famous for buffer overflows, use-after-free, ' +
+            'double-free and integer overflow, and this engine models none of them - it tracks ' +
+            'values, not sizes, allocations or pointer aliasing. What IS analysed is the same ' +
+            'thing analysed in every other language: attacker-controlled data reaching a ' +
+            'dangerous call. In C that means shells (system, popen, exec*), format strings ' +
+            '(printf-family, where a tainted FORMAT argument is CWE-134 and a taint engine ' +
+            'catches it exactly), and copies with no length bound (strcpy, strcat, sprintf, ' +
+            'gets). A finding that data reaches an unbounded copy is NOT a claim that the ' +
+            'destination is too small - that needs size analysis we do not have - so the ' +
+            'wording says "reaches a copy with no length bound" and means only that. ' +
+            'THE PREPROCESSOR IS NOT RUN: #include is not followed, #ifdef branches are all ' +
+            'parsed as though taken, and a macro that hides a sink (#define RUN(x) system(x)) ' +
+            'is invisible.',
+    },
+    {
+        id: 'cpp',
+        displayName: 'C++',
+        extensions: ['.cpp', '.cc', '.cxx', '.c++', '.hpp', '.hh', '.hxx', '.h'],
+        grammar: 'cpp',
+        notes: 'Every C limitation applies, plus: templates are parsed but not instantiated, so a ' +
+            'sink reached only through a template specialisation is missed, and operator ' +
+            'overloading is not resolved - a custom operator<< that executes a command reads ' +
+            'as an ordinary stream write. ' +
+            'THE .h EXTENSION IS TREATED AS C++, deliberately and against appearances. It is ' +
+            'ambiguous - most .h files in the world are C - but the two grammars are not ' +
+            'symmetric: measured on this project\'s own fixtures, the C++ grammar parses C ' +
+            'with zero error nodes while the C grammar produces eleven on C++. Choosing the ' +
+            'superset costs a C project a cosmetic mislabel in the per-language counts; ' +
+            'choosing C would cost a C++ header every std:: sink in it, silently. A wrong ' +
+            'label is better than a missing finding.',
+    },
+];
+/** Extension -> { language, grammar-to-use }. Built once at module load. */
+const BY_EXTENSION = new Map();
+for (const spec of LANGUAGES) {
+    for (const ext of spec.extensions) {
+        BY_EXTENSION.set(ext, { spec, grammar: spec.grammar });
+    }
+    for (const dialect of spec.dialects ?? []) {
+        for (const ext of dialect.extensions) {
+            BY_EXTENSION.set(ext, { spec, grammar: dialect.grammar });
+        }
+    }
+}
+/** Files we never scan, because scanning them is noise, not security. */
+const SKIP_FILE_PATTERNS = [
+    /\.d\.ts$/,
+    /\.min\.js$/,
+    /\.bundle\.js$/,
+    /\.pb\.go$/,
+    /_pb2\.py$/,
+    /\.generated\./,
+];
+/**
+ * Decide which language a file is.
+ *
+ * Step 1: file extension. Boring, fast, right ~99% of the time.
+ * Step 2: if there is no useful extension, read the first line and look for a
+ *         "shebang" - the `#!/usr/bin/env python3` line that tells Unix which
+ *         interpreter to run. This is how we catch a CLI script named `deploy`
+ *         with no extension at all.
+ *
+ * Returns null for "we don't handle this", which is a normal answer, not an error.
+ */
+export function detectLanguage(filePath, firstLine) {
+    const lower = filePath.toLowerCase();
+    for (const pattern of SKIP_FILE_PATTERNS) {
+        if (pattern.test(lower))
+            return null;
+    }
+    const dot = lower.lastIndexOf('.');
+    const slash = Math.max(lower.lastIndexOf('/'), lower.lastIndexOf('\\'));
+    if (dot > slash) {
+        const hit = BY_EXTENSION.get(lower.slice(dot));
+        if (hit)
+            return { spec: hit.spec, grammar: hit.grammar, detectedBy: 'extension' };
+    }
+    if (firstLine?.startsWith('#!')) {
+        // "#!/usr/bin/env python3" -> we want the word "python3"
+        const words = firstLine.slice(2).trim().split(/[\s/]+/);
+        for (const spec of LANGUAGES) {
+            if (spec.shebangs?.some((s) => words.includes(s))) {
+                return { spec, grammar: spec.grammar, detectedBy: 'shebang' };
+            }
+        }
+    }
+    return null;
+}
+/** Every extension we will attempt to open. Used by the file walker. */
+export const SCANNABLE_EXTENSIONS = [...BY_EXTENSION.keys()];
+//# sourceMappingURL=languages.js.map

package/dist/src/parse/languages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"languages.js","sourceRoot":"","sources":["../../../src/parse/languages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAsCH,MAAM,CAAC,MAAM,SAAS,GAA4B;IAChD;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,YAAY;QACzB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC3C,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,KAAK,EACH,iFAAiF;YACjF,kFAAkF;YAClF,kDAAkD;KACrD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,YAAY;QACzB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;QACnC,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpD,KAAK,EACH,sEAAsE;YACtE,8EAA8E;YAC9E,iFAAiF;KACpF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,QAAQ;QACrB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC3B,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;QAC1C,KAAK,EACH,kFAAkF;YAClF,6BAA6B;KAChC;IACD;QACE,EAAE,EAAE,MAAM;QACV,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,OAAO,EAAE,MAAM;QACf,KAAK,EACH,oFAAoF;YACpF,6EAA6E;KAChF;IACD;QACE,EAAE,EAAE,KAAK;QACT,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC9B,OAAO,EAAE,KAAK;QACd,KAAK,EACH,8EAA8E;YAC9E,+EAA+E;YAC/E,+EAA+E;YAC/E,yEAAyE;KAC5E;IACD;QACE,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,OAAO,EAAE,IAAI;QACb,KAAK,EACH,mFAAmF;KACtF;IACD;QACE,EAAE,EAAE,GAAG;QACP,WAAW,EAAE,GAAG;QAChB,UAAU,EAAE,CAAC,IAAI,CAAC;QAClB,OAAO,EAAE,GAAG;QACZ,KAAK,EACH,mFAAmF;YACnF,oFAAoF;YACpF,mFAAmF;YACnF,8EAA8E;YAC9E,gFAAgF;YAChF,gFAAgF;YAChF,iFAAiF;YACjF,+EAA+E;YAC/E,8EAA8E;YAC9E,0EAA0E;YAC1E,iFAAiF;YACjF,mFAAmF;YACnF,eAAe;KAClB;IACD;QACE,EAAE,EAAE,KAAK;QACT,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;QACxE,OAAO,EAAE,KAAK;QACd,KAAK,EACH,oFAAoF;YACpF,8EAA8E;YAC9E,kFAAkF;YAClF,+BAA+B;YAC/B,kFAAkF;YAClF,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,6EAA6E;YAC7E,+EAA+E;YAC/E,yCAAyC;KAC5C;CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmD,CAAC;AAChF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAUD,yEAAyE;AACzE,MAAM,kBAAkB,GAAsB;IAC5C,UAAU;IACV,YAAY;IACZ,eAAe;IACf,WAAW;IACX,WAAW;IACX,eAAe;CAChB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAkB;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,yDAAyD;QACzD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/src/parse/location.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Turning a tree-sitter node into a human-readable, reproducible location.
+ *
+ * Tree-sitter counts rows and columns from 0. Editors, terminals and humans
+ * count from 1. Every off-by-one bug in a scanner's output lives right here, so
+ * the conversion happens in exactly ONE place: this file.
+ */
+import type { Node } from 'web-tree-sitter';
+import type { CodeLocation } from '../core/finding.js';
+/** Walk up the tree collecting node types: "program > call_expression > ...". */
+export declare function astPath(node: Node, maxDepth?: number): string;
+/**
+ * Build the location record that goes into a finding.
+ * `file` is passed in because a node does not know which file it came from -
+ * tree-sitter only ever sees a string of text.
+ */
+export declare function nodeLocation(node: Node, file: string): CodeLocation;

package/dist/src/parse/location.js

@@ -0,0 +1,38 @@
+/**
+ * Turning a tree-sitter node into a human-readable, reproducible location.
+ *
+ * Tree-sitter counts rows and columns from 0. Editors, terminals and humans
+ * count from 1. Every off-by-one bug in a scanner's output lives right here, so
+ * the conversion happens in exactly ONE place: this file.
+ */
+const MAX_SNIPPET = 160;
+/** Walk up the tree collecting node types: "program > call_expression > ...". */
+export function astPath(node, maxDepth = 5) {
+    const parts = [];
+    let current = node;
+    while (current && parts.length < maxDepth) {
+        parts.unshift(current.type);
+        current = current.parent;
+    }
+    return parts.join(' > ');
+}
+/**
+ * Build the location record that goes into a finding.
+ * `file` is passed in because a node does not know which file it came from -
+ * tree-sitter only ever sees a string of text.
+ */
+export function nodeLocation(node, file) {
+    const raw = node.text ?? '';
+    const collapsed = raw.replace(/\s+/g, ' ').trim();
+    return {
+        file,
+        startLine: node.startPosition.row + 1,
+        startColumn: node.startPosition.column + 1,
+        endLine: node.endPosition.row + 1,
+        endColumn: node.endPosition.column + 1,
+        astNodeType: node.type,
+        astNodePath: astPath(node),
+        snippet: collapsed.length > MAX_SNIPPET ? `${collapsed.slice(0, MAX_SNIPPET - 1)}…` : collapsed,
+    };
+}
+//# sourceMappingURL=location.js.map

package/dist/src/parse/location.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"location.js","sourceRoot":"","sources":["../../../src/parse/location.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,IAAU,EAAE,QAAQ,GAAG,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAgB,IAAI,CAAC;IAChC,OAAO,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC1C,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACtC,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC;QAC1B,OAAO,EACL,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACzF,CAAC;AACJ,CAAC"}

package/dist/src/parse/node-grammars.d.ts

@@ -0,0 +1,12 @@
+/**
+ * THE NODE SHELL for grammar loading and file reading.
+ *
+ * Everything in here is the half of the tool that only makes sense on a
+ * machine with a filesystem. The browser has its own equivalent in
+ * ui/worker.js, and the analysis code in between never learns which one it got.
+ */
+import { type ParseOutcome } from './parser.js';
+/** Point the parser at node_modules. Called once, before any scan. */
+export declare function useNodeGrammars(): void;
+/** Read a file off disk, then hand the text to the platform-agnostic parser. */
+export declare function parseFile(filePath: string): Promise<ParseOutcome>;

package/dist/src/parse/node-grammars.js

@@ -0,0 +1,35 @@
+/**
+ * THE NODE SHELL for grammar loading and file reading.
+ *
+ * Everything in here is the half of the tool that only makes sense on a
+ * machine with a filesystem. The browser has its own equivalent in
+ * ui/worker.js, and the analysis code in between never learns which one it got.
+ */
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { configureParsing, parseSourceFile } from './parser.js';
+const require = createRequire(import.meta.url);
+/** Folder inside node_modules that holds the prebuilt .wasm grammar files. */
+const GRAMMAR_DIR = path.join(path.dirname(require.resolve('tree-sitter-wasms/package.json')), 'out');
+/** Point the parser at node_modules. Called once, before any scan. */
+export function useNodeGrammars() {
+    configureParsing({
+        loadGrammar: (grammar) => path.join(GRAMMAR_DIR, `tree-sitter-${grammar}.wasm`),
+    });
+}
+/** Read a file off disk, then hand the text to the platform-agnostic parser. */
+export async function parseFile(filePath) {
+    try {
+        const source = await readFile(filePath, 'utf8');
+        return parseSourceFile(filePath, source);
+    }
+    catch (error) {
+        return {
+            status: 'skipped',
+            path: filePath,
+            reason: `unreadable: ${error.message}`,
+        };
+    }
+}
+//# sourceMappingURL=node-grammars.js.map

package/dist/src/parse/node-grammars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-grammars.js","sourceRoot":"","sources":["../../../src/parse/node-grammars.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AAEnF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,EAC/D,KAAK,CACN,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,eAAe;IAC7B,gBAAgB,CAAC;QACf,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,OAAO,OAAO,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,eAAgB,KAAe,CAAC,OAAO,EAAE;SAClD,CAAC;IACJ,CAAC;AACH,CAAC"}