@warlock.js/core 5.30.0 → 5.32.0

package/esm/tooling/check/security-conventions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-conventions.mjs","names":["ast.isIdentifier","ast.valueText","ast.expressionOf","ast.parentOf","ast.isCallExpression","ast.isNewExpression","ast.isSpreadElement","ast.isSpreadAssignment","ast.isObjectLiteralExpression","ast.isArrayLiteralExpression","ast.isPropertyAssignment","ast.isShorthandPropertyAssignment","ast.isAsExpression","ast.isNonNullExpression","ast.isSatisfiesExpression","ast.isTypeAssertionExpression","ast.isParenthesizedExpression","ast.isAwaitExpression","ast.isVariableDeclaration","ast.isArrowFunction","ast.isFunctionExpression","ast.isIfStatement","ast.isConditionalExpression","ast.isJsxAttribute","ast.nameNode","ast.isJsxOpeningElement","ast.isJsxSelfClosingElement","ast.isJsxExpression","ast.isElementAccessExpression","ast.isTemplateExpression","ast.isBinaryExpression","ast.isOmittedExpression","ast.isRegularExpressionLiteral"],"sources":["../../../../../../../../../packages/core/src/tooling/check/security-conventions.ts"],"sourcesContent":["import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from \"@warlock.js/logger\";\nimport * as ast from \"../syntax/ast\";\nimport { isAuthGuardName, isMutatingHttpMethod } from \"../../router/route-guard-names\";\nimport {\n  containsRequestInput,\n  REQUEST_BODY_MEMBERS,\n  REQUEST_NAMES,\n  requestMemberAccess,\n} from \"./request-input\";\nimport {\n  ancestors,\n  calleeName,\n  isFunctionLike,\n  isMemberAccess,\n  keyName,\n  literalString,\n  memberName,\n  referencesOf,\n  resolveInitializer,\n  rootIdentifier,\n  type SourceFinding,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n// ── WL9005: request.all() into a query, a service or inApp() ────────────────\n\n/** Request methods that return every input the client sent, validated or not. */\nconst UNFILTERED_METHODS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n]);\n\n/**\n * Responses and loggers are not the data sinks `WL9005` guards: echoing input\n * back is not mass assignment, and logging it is `WL9008`'s concern.\n */\nconst IGNORED_RECEIVERS: ReadonlySet<string> = new Set([\n  \"response\",\n  \"reply\",\n  \"res\",\n  \"console\",\n  \"log\",\n  \"logger\",\n]);\n\nfunction displayCallee(callee: ast.Node): string {\n  const target = unwrap(callee);\n\n  if (ast.isIdentifier(target)) return `${ast.valueText(target)}()`;\n\n  if (isMemberAccess(target)) {\n    const name = memberName(target);\n    const object = unwrap(ast.expressionOf(target));\n    const owner = ast.isIdentifier(object) ? `${ast.valueText(object)}.` : \"\";\n\n    return name ? `${owner}${name}()` : \"a call\";\n  }\n\n  return \"a call\";\n}\n\nfunction isIgnoredReceiver(callee: ast.Node): boolean {\n  const target = unwrap(callee);\n\n  if (!isMemberAccess(target)) return false;\n\n  const object = unwrap(ast.expressionOf(target));\n\n  return ast.isIdentifier(object) && IGNORED_RECEIVERS.has(ast.valueText(object));\n}\n\n/** When `node` flows into a call's arguments, the callee's display name. */\nfunction callReceiving(node: ast.Node): string | undefined {\n  let current = node;\n\n  for (;;) {\n    const parent = ast.parentOf(current);\n\n    if (!parent) return undefined;\n\n    if (ast.isCallExpression(parent) || ast.isNewExpression(parent)) {\n      if (!(parent.arguments ?? []).some((argument) => argument === current)) return undefined;\n      if (isIgnoredReceiver(ast.expressionOf(parent))) return undefined;\n\n      return displayCallee(ast.expressionOf(parent));\n    }\n\n    if (\n      ast.isSpreadElement(parent) ||\n      ast.isSpreadAssignment(parent) ||\n      ast.isObjectLiteralExpression(parent) ||\n      ast.isArrayLiteralExpression(parent) ||\n      (ast.isPropertyAssignment(parent) && parent.value === current) ||\n      ast.isShorthandPropertyAssignment(parent) ||\n      ast.isAsExpression(parent) ||\n      ast.isNonNullExpression(parent) ||\n      ast.isSatisfiesExpression(parent) ||\n      ast.isTypeAssertionExpression(parent) ||\n      ast.isParenthesizedExpression(parent) ||\n      ast.isAwaitExpression(parent)\n    ) {\n      current = parent;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/**\n * The call that ends up receiving this value: directly as an argument, spread\n * into an object/array argument, or through a local constant later passed to\n * a call.\n */\nfunction receivingCall(node: ast.Node): string | undefined {\n  const direct = callReceiving(node);\n\n  if (direct) return direct;\n\n  // `const data = request.all(); await Model.create(data);`\n  const parent = ast.parentOf(node);\n\n  if (\n    parent &&\n    ast.isVariableDeclaration(parent) &&\n    parent.init === node &&\n    ast.isIdentifier(parent.id)\n  ) {\n    for (const reference of referencesOf(parent)) {\n      const name = callReceiving(reference);\n      if (name) return name;\n    }\n  }\n\n  return undefined;\n}\n\nfunction checkRequestAll(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const object = unwrap(ast.expressionOf(callee));\n\n  if (!ast.isIdentifier(object) || !REQUEST_NAMES.has(ast.valueText(object))) return;\n\n  const method = memberName(callee);\n\n  if (!method || !UNFILTERED_METHODS.has(method)) return;\n\n  const target = receivingCall(node);\n\n  if (!target) return;\n\n  findings.push({\n    code: \"WL9005\",\n    node,\n    message: `\\`${ast.valueText(object)}.${method}()\\` passes every client-sent field to \\`${target}\\`. Use \\`${ast.valueText(object)}.validated()\\` so only the fields the validation schema accepted reach it.`,\n  });\n}\n\n// ── WL9006: a mutating route with no auth guard and no public: true ─────────\n\nconst ROUTER_NAMES: ReadonlySet<string> = new Set([\"router\"]);\n\n/** Wrappers whose callback routes are guarded, e.g. `guarded(() => …)`. */\nconst GUARD_FUNCTIONS: ReadonlySet<string> = new Set([\"guarded\"]);\n\n/** `router.post(…)` and friends. */\nconst MUTATING_ROUTER_METHODS: ReadonlySet<string> = new Set([\"post\", \"put\", \"patch\", \"delete\"]);\n\n/** Route builder methods (`router.route(path).create(…)`) that register a mutating route. */\nconst MUTATING_BUILDER_METHODS: ReadonlySet<string> = new Set([\n  \"post\",\n  \"postOne\",\n  \"put\",\n  \"updateOne\",\n  \"patch\",\n  \"patchOne\",\n  \"delete\",\n  \"deleteOne\",\n  \"create\",\n  \"update\",\n  \"destroy\",\n]);\n\nconst READ_ONLY_RESOURCE_METHODS: ReadonlySet<string> = new Set([\"list\", \"get\", \"show\"]);\n\nfunction isRouter(node: ast.Node): boolean {\n  const target = unwrap(node);\n\n  return ast.isIdentifier(target) && ROUTER_NAMES.has(ast.valueText(target));\n}\n\nfunction isGuardName(name: string | undefined): boolean {\n  return name !== undefined && isAuthGuardName(name);\n}\n\n/** Whether a constant is initialised with `markAuthGuard(fn)` (not `markAuthGuard(fn, false)`). */\nfunction isMarkedGuard(identifier: ast.Identifier): boolean {\n  const initializer = resolveInitializer(identifier);\n  const value = initializer ? unwrap(initializer) : undefined;\n\n  return (\n    value !== undefined &&\n    ast.isCallExpression(value) &&\n    calleeName(value) === \"markAuthGuard\" &&\n    !(value.arguments[1]?.type === \"Literal\" && value.arguments[1].value === false)\n  );\n}\n\nfunction middlewareHasGuard(node: ast.Node): boolean {\n  const value = unwrap(node);\n\n  // A variable or a call: the check cannot see into it, so it trusts it.\n  if (!ast.isArrayLiteralExpression(value)) return true;\n\n  return value.elements.some((element) => {\n    if (!element) return false;\n    if (ast.isSpreadElement(element)) return true;\n\n    const item = unwrap(element);\n\n    if (ast.isIdentifier(item)) return isGuardName(ast.valueText(item)) || isMarkedGuard(item);\n    if (ast.isCallExpression(item)) return isGuardName(calleeName(item));\n    if (isMemberAccess(item)) return isGuardName(memberName(item));\n\n    return false;\n  });\n}\n\n/** `public: true`, a guard in `middleware`, or an options value the check cannot see into. */\nfunction optionsGuard(node: ast.Node | undefined): \"guarded\" | \"unguarded\" | \"none\" {\n  if (!node) return \"none\";\n\n  const value = unwrap(node);\n\n  if (!ast.isObjectLiteralExpression(value)) return \"guarded\";\n\n  let verdict: \"guarded\" | \"unguarded\" = \"unguarded\";\n\n  for (const property of value.properties) {\n    if (ast.isSpreadAssignment(property)) {\n      verdict = \"guarded\";\n      continue;\n    }\n\n    let key: string | undefined;\n    let propertyValue: ast.Node | undefined;\n\n    if (ast.isPropertyAssignment(property)) {\n      key = keyName(property.key);\n      propertyValue = unwrap(property.value);\n    } else if (ast.isShorthandPropertyAssignment(property)) {\n      key = ast.valueText(property.key);\n      propertyValue = property.key;\n    }\n\n    if (!propertyValue) continue;\n    if (key === \"public\" && propertyValue.type === \"Literal\" && propertyValue.value === true)\n      return \"guarded\";\n    if (key === \"middleware\" && middlewareHasGuard(propertyValue)) return \"guarded\";\n  }\n\n  return verdict;\n}\n\n/** Whether an enclosing function is a guarded (or public) group callback. */\nfunction insideGuardedGroup(node: ast.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    if (!ast.isArrowFunction(ancestor) && !ast.isFunctionExpression(ancestor)) continue;\n\n    const parent = ast.parentOf(ancestor);\n\n    if (!parent || !ast.isCallExpression(parent)) continue;\n    if (!parent.arguments.some((argument) => argument === ancestor)) continue;\n\n    const name = calleeName(parent);\n\n    if (name !== undefined && GUARD_FUNCTIONS.has(name)) return true;\n\n    const callee = unwrap(ast.expressionOf(parent));\n\n    if (\n      isMemberAccess(callee) &&\n      memberName(callee) === \"group\" &&\n      isRouter(ast.expressionOf(callee)) &&\n      optionsGuard(parent.arguments[0]) === \"guarded\"\n    ) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nfunction pathText(node: ast.Node | undefined): string {\n  return literalString(node) ?? \"(dynamic path)\";\n}\n\n/**\n * Walk a builder chain back to `router.route(path, options)`, collecting every\n * options object passed along the way (`route()`, `nest()`).\n */\nfunction builderChain(node: ast.Node): { path: string; optionNodes: ast.Node[] } | undefined {\n  const optionNodes: ast.Node[] = [];\n  let current = unwrap(node);\n\n  while (ast.isCallExpression(current)) {\n    const callee = unwrap(ast.expressionOf(current));\n\n    if (!isMemberAccess(callee)) return undefined;\n\n    const name = memberName(callee);\n\n    if (name === \"route\" && isRouter(ast.expressionOf(callee))) {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n\n      return { path: pathText(current.arguments[0]), optionNodes };\n    }\n\n    if (name === \"nest\") {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n    }\n\n    current = unwrap(ast.expressionOf(callee));\n  }\n\n  return undefined;\n}\n\nfunction resourceIsReadOnly(node: ast.Node | undefined): boolean {\n  if (!node) return false;\n\n  const value = unwrap(node);\n\n  if (!ast.isObjectLiteralExpression(value)) return false;\n\n  for (const property of value.properties) {\n    if (!ast.isPropertyAssignment(property) || keyName(property.key) !== \"only\") continue;\n\n    const only = unwrap(property.value);\n\n    if (!ast.isArrayLiteralExpression(only)) return false;\n\n    return only.elements.every((element) => {\n      if (!element) return false;\n      const method = literalString(element);\n      return method !== undefined && READ_ONLY_RESOURCE_METHODS.has(method);\n    });\n  }\n\n  return false;\n}\n\nfunction unguardedRoute(node: ast.Node, route: string): SourceFinding {\n  return {\n    code: \"WL9006\",\n    node,\n    message: `Mutating route \\`${route}\\` has no auth middleware. Add an auth guard (\\`middleware: [authMiddleware()]\\`, or register it inside a guarded group) or mark it intentionally open with \\`public: true\\`.`,\n  };\n}\n\nfunction checkRouteGuard(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const guarded = (options: ast.Node | undefined) =>\n    optionsGuard(options) === \"guarded\" || insideGuardedGroup(node);\n\n  if (isRouter(ast.expressionOf(callee))) {\n    // router.post(path, handler, options)\n    if (MUTATING_ROUTER_METHODS.has(method)) {\n      if (!guarded(node.arguments[2])) {\n        findings.push(\n          unguardedRoute(node, `${method.toUpperCase()} ${pathText(node.arguments[0])}`),\n        );\n      }\n\n      return;\n    }\n\n    // router.add(\"POST\", path, handler, options)\n    if (method === \"add\") {\n      const httpMethod = literalString(node.arguments[0])?.toUpperCase();\n\n      if (!httpMethod || !isMutatingHttpMethod(httpMethod)) return;\n\n      if (!guarded(node.arguments[3])) {\n        findings.push(unguardedRoute(node, `${httpMethod} ${pathText(node.arguments[1])}`));\n      }\n\n      return;\n    }\n\n    // router.restfulResource(path, resource, options)\n    if (method === \"restfulResource\") {\n      if (resourceIsReadOnly(node.arguments[2])) return;\n\n      if (!guarded(node.arguments[2])) {\n        findings.push(unguardedRoute(node, `resource ${pathText(node.arguments[0])}`));\n      }\n    }\n\n    return;\n  }\n\n  // router.route(path, options).create(handler, options)\n  if (!MUTATING_BUILDER_METHODS.has(method)) return;\n\n  const chain = builderChain(ast.expressionOf(callee));\n\n  if (!chain) return;\n  if (optionsGuard(node.arguments[1]) === \"guarded\") return;\n  if (chain.optionNodes.some((options) => optionsGuard(options) === \"guarded\")) return;\n  if (insideGuardedGroup(node)) return;\n\n  findings.push(unguardedRoute(node, `${method} ${chain.path}`));\n}\n\n// ── WL9007: a redirect or link target from request input ────────────────────\n\n/** Calls that turn their first argument into a redirect or a navigation. */\nconst REDIRECT_CALLS: ReadonlySet<string> = new Set([\n  \"redirect\",\n  \"permanentRedirect\",\n  \"navigateTo\",\n]);\n\n/** Components whose `to`/`href` prop navigates. */\nconst LINK_COMPONENTS: ReadonlySet<string> = new Set([\"Link\", \"NavLink\"]);\n\n/** Helpers that return an allowed target (or a fallback) for any input. */\nconst REDIRECT_SANITIZERS: ReadonlySet<string> = new Set([\"safeRedirect\", \"safeRedirectTarget\"]);\n\n/** Predicates that, used in an enclosing `if` or `? :`, prove the target was checked. */\nconst REDIRECT_VALIDATORS: ReadonlySet<string> = new Set([\"isSafeRedirect\", \"isSafeRedirectUrl\"]);\n\n/** Client-side input: query-string hooks. */\nconst CLIENT_INPUT_CALLS: ReadonlySet<string> = new Set([\n  \"useQueryString\",\n  \"useSearchParams\",\n  \"useParams\",\n]);\n\n/** Identifiers whose members are client-controlled (a loader's `query`, URLSearchParams). */\nconst CLIENT_INPUT_NAMES: ReadonlySet<string> = new Set([\"query\", \"searchParams\"]);\n\nfunction isClientSource(node: ast.Node): boolean {\n  if (ast.isCallExpression(node)) {\n    const name = calleeName(node);\n    if (name !== undefined && CLIENT_INPUT_CALLS.has(name)) return true;\n  }\n\n  if (isMemberAccess(node)) {\n    const root = rootIdentifier(node);\n\n    if (root && CLIENT_INPUT_NAMES.has(ast.valueText(root))) return true;\n\n    // location.search / window.location.hash\n    const name = memberName(node);\n\n    if (name === \"search\" || name === \"hash\") {\n      const object = unwrap(ast.expressionOf(node));\n\n      if (ast.isIdentifier(object) && ast.valueText(object) === \"location\") return true;\n      if (isMemberAccess(object) && memberName(object) === \"location\") return true;\n    }\n  }\n\n  return false;\n}\n\nfunction isRedirectTainted(node: ast.Node): boolean {\n  return containsRequestInput(node, { sanitizers: REDIRECT_SANITIZERS, isSource: isClientSource });\n}\n\n/** An enclosing `if (isSafeRedirect(x))` or `isSafeRedirect(x) ? … : …` validated the target. */\nfunction checkedByValidator(node: ast.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    let test: ast.Node | undefined;\n\n    if (ast.isIfStatement(ancestor)) test = ast.expressionOf(ancestor);\n    else if (ast.isConditionalExpression(ancestor)) test = ancestor.test;\n    else continue;\n\n    let validated = false;\n\n    walk(test, (child) => {\n      if (ast.isCallExpression(child)) {\n        const name = calleeName(child);\n        if (name !== undefined && REDIRECT_VALIDATORS.has(name)) validated = true;\n      }\n\n      return undefined;\n    });\n\n    if (validated) return true;\n  }\n\n  return false;\n}\n\nfunction unsafeRedirect(node: ast.Node, what: string, helper: string, from: string): SourceFinding {\n  return {\n    code: \"WL9007\",\n    node,\n    message: `This ${what} target comes from request input. Pass it through \\`${helper}()\\` from \\`${from}\\` so only same-origin paths and allow-listed origins are followed (open redirects and \\`javascript:\\` URLs otherwise).`,\n  };\n}\n\nfunction checkRedirect(node: ast.Node, findings: SourceFinding[]): void {\n  if (ast.isCallExpression(node)) {\n    const name = calleeName(node);\n\n    if (name === undefined || !REDIRECT_CALLS.has(name)) return;\n\n    // `router.redirect(from, to)` registers a static redirect, not a request-time one.\n    const callee = unwrap(ast.expressionOf(node));\n\n    if (isMemberAccess(callee)) {\n      const owner = unwrap(ast.expressionOf(callee));\n      if (ast.isIdentifier(owner) && ast.valueText(owner) === \"router\") return;\n    }\n\n    const target = node.arguments[0];\n\n    if (!target || ast.isSpreadElement(target)) return;\n    if (!isRedirectTainted(target) || checkedByValidator(node)) return;\n\n    findings.push(\n      name === \"navigateTo\"\n        ? unsafeRedirect(target, \"navigation\", \"safeRedirectTarget\", \"@warlock.js/web\")\n        : unsafeRedirect(target, \"redirect\", \"safeRedirect\", \"@warlock.js/core\"),\n    );\n\n    return;\n  }\n\n  if (!ast.isJsxAttribute(node) || ast.nameNode(node).type !== \"JSXIdentifier\") return;\n  if (ast.valueText(ast.nameNode(node)) !== \"to\" && ast.valueText(ast.nameNode(node)) !== \"href\")\n    return;\n\n  const element = ast.parentOf(node);\n\n  if (!element || (!ast.isJsxOpeningElement(element) && !ast.isJsxSelfClosingElement(element)))\n    return;\n  if (element.name.type !== \"JSXIdentifier\" || !LINK_COMPONENTS.has(element.name.name)) return;\n\n  const initializer = node.value;\n\n  if (!initializer || !ast.isJsxExpression(initializer) || !initializer.expression) return;\n\n  const expression = initializer.expression;\n\n  if (!isRedirectTainted(expression) || checkedByValidator(expression)) return;\n\n  findings.push(unsafeRedirect(expression, \"link\", \"safeRedirectTarget\", \"@warlock.js/web\"));\n}\n\n// ── WL9008: raw emails, credentials and request bodies in logs ──────────────\n\nconst LOGGER_NAMES: ReadonlySet<string> = new Set([\"log\", \"logger\", \"console\"]);\n\nconst LOG_METHODS: ReadonlySet<string> = new Set([\n  \"info\",\n  \"warn\",\n  \"error\",\n  \"debug\",\n  \"success\",\n  \"fatal\",\n  \"log\",\n  \"assert\",\n  \"trace\",\n]);\n\n/** Helpers that make a value safe to log; their arguments are not inspected. */\nconst REDACTORS: ReadonlySet<string> = new Set([\n  \"maskEmail\",\n  \"maskEmailsInText\",\n  \"redact\",\n  \"redactHeaders\",\n  \"redactError\",\n  \"redactUrlCredentials\",\n  \"redactQueryCredentials\",\n  \"escapeLogValue\",\n  \"toLogSnapshot\",\n]);\n\n/** Name endings that mark a value as a credential. */\nconst SECRET_SUFFIXES = [\n  \"token\",\n  \"password\",\n  \"passwd\",\n  \"secret\",\n  \"apikey\",\n  \"authorization\",\n  \"cookie\",\n  \"cookies\",\n  \"otp\",\n  \"jwt\",\n  \"privatekey\",\n];\n\n/**\n * Whether the logger censors this key by default (`DEFAULT_REDACT_KEYS` from\n * `@warlock.js/logger`). A secret logged under one of them never reaches a\n * channel. Emails are not on that list: they are not censored by default.\n */\nfunction isCensoredKey(key: string): boolean {\n  return DEFAULT_REDACT_KEY_SET.has(normalizeRedactKey(key));\n}\n\n/** `email` for addresses, `secret` for credentials, otherwise `undefined`. */\nfunction sensitiveCategory(name: string): \"email\" | \"secret\" | undefined {\n  const normalized = normalizeRedactKey(name);\n\n  if (normalized.endsWith(\"email\") || normalized.endsWith(\"emailaddress\")) return \"email\";\n  if (DEFAULT_REDACT_KEY_SET.has(normalized)) return \"secret\";\n  if (SECRET_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return \"secret\";\n\n  return undefined;\n}\n\nfunction describeCategory(category: \"email\" | \"secret\", name: string | undefined): string {\n  if (category === \"email\") return \"a raw email address\";\n\n  return name ? `the credential \\`${name}\\`` : \"a credential\";\n}\n\nfunction describeMember(member: string): string {\n  if (member === \"headers\" || member === \"cookies\") return member;\n\n  return `body (\\`${member}\\`)`;\n}\n\n/** `request.all()` / `request.body` itself, not `request.body.title`. */\nfunction isWholeAccess(node: ast.Node, member: string): boolean {\n  if (ast.isCallExpression(node)) {\n    const callee = unwrap(ast.expressionOf(node));\n    return isMemberAccess(callee) && memberName(callee) === member;\n  }\n\n  return isMemberAccess(node) && memberName(node) === member;\n}\n\ntype LogFinding = { node: ast.Node; what: string };\n\nfunction inspectLogged(node: ast.Node, censoredKey: boolean, found: LogFinding[]): void {\n  const value = unwrap(node);\n\n  if (isFunctionLike(value)) return;\n\n  if (ast.isCallExpression(value)) {\n    const name = calleeName(value);\n    if (name !== undefined && REDACTORS.has(name)) return;\n  }\n\n  // request.all() / request.body / request.headers / request.input(\"email\")\n  if (ast.isCallExpression(value) || isMemberAccess(value)) {\n    const member = requestMemberAccess(value);\n\n    if (member !== undefined && isWholeAccess(value, member)) {\n      if (REQUEST_BODY_MEMBERS.has(member)) {\n        found.push({ node: value, what: `the request ${describeMember(member)}` });\n        return;\n      }\n\n      if (member === \"email\") {\n        found.push({ node: value, what: \"a raw email address\" });\n        return;\n      }\n    }\n\n    if (ast.isCallExpression(value) && member !== undefined) {\n      const key = literalString(value.arguments[0]);\n      const category = key ? sensitiveCategory(key) : undefined;\n\n      if (category && !(censoredKey && category === \"secret\")) {\n        found.push({ node: value, what: describeCategory(category, key) });\n        return;\n      }\n    }\n  }\n\n  if (ast.isIdentifier(value) || isMemberAccess(value)) {\n    const name = ast.isIdentifier(value) ? ast.valueText(value) : memberName(value);\n    const category = name ? sensitiveCategory(name) : undefined;\n\n    if (category && !(censoredKey && category === \"secret\")) {\n      found.push({ node: value, what: describeCategory(category, name) });\n      return;\n    }\n\n    // `request.body.title` reads one field; only the whole body is reported.\n    if (isMemberAccess(value) && requestMemberAccess(value) === undefined) {\n      inspectLogged(ast.expressionOf(value), false, found);\n\n      if (ast.isElementAccessExpression(value)) inspectLogged(value.property, false, found);\n    }\n\n    return;\n  }\n\n  if (ast.isObjectLiteralExpression(value)) {\n    for (const property of value.properties) {\n      if (ast.isSpreadAssignment(property)) {\n        inspectLogged(ast.expressionOf(property), false, found);\n      } else if (ast.isPropertyAssignment(property)) {\n        const key = keyName(property.key);\n        inspectLogged(property.value, key !== undefined && isCensoredKey(key), found);\n      } else if (ast.isShorthandPropertyAssignment(property)) {\n        inspectLogged(property.key, isCensoredKey(ast.valueText(property.key)), found);\n      }\n    }\n\n    return;\n  }\n\n  if (ast.isTemplateExpression(value)) {\n    for (const expression of value.expressions) inspectLogged(expression, false, found);\n    return;\n  }\n\n  if (ast.isBinaryExpression(value)) {\n    inspectLogged(value.left, false, found);\n    inspectLogged(value.right, false, found);\n    return;\n  }\n\n  if (ast.isConditionalExpression(value)) {\n    inspectLogged(value.consequent, censoredKey, found);\n    inspectLogged(value.alternate, censoredKey, found);\n    return;\n  }\n\n  if (ast.isArrayLiteralExpression(value)) {\n    for (const element of value.elements) {\n      if (ast.isOmittedExpression(element)) continue;\n      inspectLogged(\n        ast.isSpreadElement(element) ? ast.expressionOf(element) : element,\n        false,\n        found,\n      );\n    }\n\n    return;\n  }\n\n  if (ast.isCallExpression(value)) {\n    // JSON.stringify(request.all()), String(user.email), user.email.trim()\n    const callee = unwrap(ast.expressionOf(value));\n\n    if (isMemberAccess(callee)) inspectLogged(ast.expressionOf(callee), false, found);\n\n    for (const argument of value.arguments) {\n      inspectLogged(\n        ast.isSpreadElement(argument) ? ast.expressionOf(argument) : argument,\n        false,\n        found,\n      );\n    }\n\n    return;\n  }\n\n  if (ast.isAwaitExpression(value)) inspectLogged(ast.expressionOf(value), censoredKey, found);\n}\n\nfunction checkSensitiveLog(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method || !LOG_METHODS.has(method)) return;\n\n  const owner = unwrap(ast.expressionOf(callee));\n\n  if (!ast.isIdentifier(owner)) return;\n\n  // log.info(…), console.log(…), and request.log(…)\n  const isLogger =\n    LOGGER_NAMES.has(ast.valueText(owner)) ||\n    (REQUEST_NAMES.has(ast.valueText(owner)) && method === \"log\");\n\n  if (!isLogger) return;\n\n  const found: LogFinding[] = [];\n\n  for (const argument of node.arguments) {\n    inspectLogged(\n      ast.isSpreadElement(argument) ? ast.expressionOf(argument) : argument,\n      false,\n      found,\n    );\n  }\n\n  for (const finding of found) {\n    findings.push({\n      code: \"WL9008\",\n      node: finding.node,\n      message: `Do not log ${finding.what} as-is. Pass it through a redaction helper (\\`maskEmail()\\`, \\`redact()\\`, \\`request.toLogSnapshot()\\`), or log it under a key the logger censors.`,\n    });\n  }\n}\n\n// ── WL9009: unbounded regex quantifiers on request input ────────────────────\n\n/** `regex.test(input)` / `regex.exec(input)`. */\nconst REGEX_METHODS: ReadonlySet<string> = new Set([\"test\", \"exec\"]);\n\n/** `input.match(regex)` and friends: the regex is the first argument. */\nconst STRING_METHODS: ReadonlySet<string> = new Set([\n  \"match\",\n  \"matchAll\",\n  \"replace\",\n  \"replaceAll\",\n  \"search\",\n  \"split\",\n]);\n\n/**\n * The first unbounded quantifier in a regex source (`*`, `+`, `{n,}`), skipping\n * escapes and character classes, or `undefined` when every repetition is\n * bounded.\n */\nexport function findUnboundedQuantifier(source: string): string | undefined {\n  let inClass = false;\n\n  for (let index = 0; index < source.length; index++) {\n    const char = source[index];\n\n    if (char === \"\\\\\") {\n      index++;\n      continue;\n    }\n\n    if (inClass) {\n      if (char === \"]\") inClass = false;\n      continue;\n    }\n\n    if (char === \"[\") {\n      inClass = true;\n      continue;\n    }\n\n    if (char === \"*\" || char === \"+\") {\n      return `${char}${source[index + 1] === \"?\" ? \"?\" : \"\"}`;\n    }\n\n    if (char === \"{\") {\n      const match = /^\\{(\\d+),\\}/.exec(source.slice(index));\n      if (match) return match[0];\n    }\n  }\n\n  return undefined;\n}\n\n/** The pattern of a regex literal, `new RegExp(\"…\")`, or a constant holding either. */\nfunction regexSource(node: ast.Node | undefined, depth = 0): string | undefined {\n  if (!node || depth > 8) return undefined;\n\n  const value = unwrap(node);\n\n  if (ast.isRegularExpressionLiteral(value)) {\n    return ast.valueText(value).slice(1, ast.valueText(value).lastIndexOf(\"/\"));\n  }\n\n  if (\n    (ast.isNewExpression(value) || ast.isCallExpression(value)) &&\n    ast.isIdentifier(ast.expressionOf(value)) &&\n    ast.valueText(ast.expressionOf(value)) === \"RegExp\"\n  ) {\n    return literalString(value.arguments?.[0]);\n  }\n\n  if (ast.isIdentifier(value)) {\n    const initializer = resolveInitializer(value);\n    return initializer ? regexSource(initializer, depth + 1) : undefined;\n  }\n\n  return undefined;\n}\n\nfunction checkUnboundedRegex(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const first = node.arguments[0];\n  const firstArgument = first && !ast.isSpreadElement(first) ? first : undefined;\n  let regex: ast.Node | undefined;\n  let input: ast.Node | undefined;\n\n  if (REGEX_METHODS.has(method)) {\n    regex = ast.expressionOf(callee);\n    input = firstArgument;\n  } else if (STRING_METHODS.has(method)) {\n    regex = firstArgument;\n    input = ast.expressionOf(callee);\n  } else {\n    return;\n  }\n\n  if (!input) return;\n\n  const source = regexSource(regex);\n\n  if (source === undefined) return;\n\n  const quantifier = findUnboundedQuantifier(source);\n\n  if (!quantifier || !containsRequestInput(input)) return;\n\n  findings.push({\n    code: \"WL9009\",\n    node,\n    message: `This regex has an unbounded quantifier (\\`${quantifier}\\`) and runs on request input, so a crafted input can make it backtrack for a long time (ReDoS). Bound the repetition, e.g. \\`{1,256}\\`, or cap the input length before matching.`,\n  });\n}\n\n/**\n * The security conventions in one parsed file:\n *\n * - `WL9005` `request.all()` (or `heavy()`, `allExceptParams()`) passed to a\n *   query, a service or `inApp()`;\n * - `WL9006` a POST/PUT/PATCH/DELETE route with no auth middleware and no\n *   `public: true`;\n * - `WL9007` a `redirect()` / `navigateTo()` / `<Link to|href>` target taken\n *   from request input without `safeRedirect()` / `safeRedirectTarget()` or an\n *   `isSafeRedirect()` check;\n * - `WL9008` a raw email, credential or request body passed to a logger;\n * - `WL9009` a regex with an unbounded quantifier run on request input.\n */\nexport function securityFindings(sourceFile: ast.SourceFile): SourceFinding[] {\n  const findings: SourceFinding[] = [];\n\n  walk(\n    sourceFile,\n    (node) => {\n      checkRequestAll(node, findings);\n      checkRouteGuard(node, findings);\n      checkRedirect(node, findings);\n      checkSensitiveLog(node, findings);\n      checkUnboundedRegex(node, findings);\n\n      return undefined;\n    },\n    true,\n  );\n\n  return findings;\n}\n"],"mappings":";;;;;;;;AA4BA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,MAAM,oCAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,cAAc,QAA0B;CAC/C,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAIA,aAAiB,MAAM,GAAG,OAAO,GAAGC,UAAc,MAAM,EAAE;CAE9D,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;EAC9C,MAAM,QAAQF,aAAiB,MAAM,IAAI,GAAGC,UAAc,MAAM,EAAE,KAAK;EAEvE,OAAO,OAAO,GAAG,QAAQ,KAAK,MAAM;CACtC;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,QAA2B;CACpD,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;CAEpC,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;CAE9C,OAAOF,aAAiB,MAAM,KAAK,kBAAkB,IAAIC,UAAc,MAAM,CAAC;AAChF;;AAGA,SAAS,cAAc,MAAoC;CACzD,IAAI,UAAU;CAEd,SAAS;EACP,MAAM,SAASE,SAAa,OAAO;EAEnC,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAIC,iBAAqB,MAAM,KAAKC,gBAAoB,MAAM,GAAG;GAC/D,IAAI,EAAE,OAAO,aAAa,CAAC,EAAC,CAAE,MAAM,aAAa,aAAa,OAAO,GAAG,OAAO;GAC/E,IAAI,kBAAkBH,aAAiB,MAAM,CAAC,GAAG,OAAO;GAExD,OAAO,cAAcA,aAAiB,MAAM,CAAC;EAC/C;EAEA,IACEI,gBAAoB,MAAM,KAC1BC,mBAAuB,MAAM,KAC7BC,0BAA8B,MAAM,KACpCC,yBAA6B,MAAM,KAClCC,qBAAyB,MAAM,KAAK,OAAO,UAAU,WACtDC,8BAAkC,MAAM,KACxCC,eAAmB,MAAM,KACzBC,oBAAwB,MAAM,KAC9BC,sBAA0B,MAAM,KAChCC,0BAA8B,MAAM,KACpCC,0BAA8B,MAAM,KACpCC,kBAAsB,MAAM,GAC5B;GACA,UAAU;GACV;EACF;EAEA;CACF;AACF;;;;;;AAOA,SAAS,cAAc,MAAoC;CACzD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,QAAQ,OAAO;CAGnB,MAAM,SAASd,SAAa,IAAI;CAEhC,IACE,UACAe,sBAA0B,MAAM,KAChC,OAAO,SAAS,QAChBlB,aAAiB,OAAO,EAAE,GAE1B,KAAK,MAAM,aAAa,aAAa,MAAM,GAAG;EAC5C,MAAM,OAAO,cAAc,SAAS;EACpC,IAAI,MAAM,OAAO;CACnB;AAIJ;AAEA,SAAS,gBAAgB,MAAgB,UAAiC;CACxE,IAAI,CAACI,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,OAAOA,aAAiB,MAAM,CAAC;CAE9C,IAAI,CAACF,aAAiB,MAAM,KAAK,CAAC,cAAc,IAAIC,UAAc,MAAM,CAAC,GAAG;CAE5E,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,mBAAmB,IAAI,MAAM,GAAG;CAEhD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,CAAC,QAAQ;CAEb,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,KAAKA,UAAc,MAAM,EAAE,GAAG,OAAO,2CAA2C,OAAO,YAAYA,UAAc,MAAM,EAAE;CACpI,CAAC;AACH;AAIA,MAAM,+BAAoC,IAAI,IAAI,CAAC,QAAQ,CAAC;;AAG5D,MAAM,kCAAuC,IAAI,IAAI,CAAC,SAAS,CAAC;;AAGhE,MAAM,0CAA+C,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAG/F,MAAM,2CAAgD,IAAI,IAAI;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,6CAAkD,IAAI,IAAI;CAAC;CAAQ;CAAO;AAAM,CAAC;AAEvF,SAAS,SAAS,MAAyB;CACzC,MAAM,SAAS,OAAO,IAAI;CAE1B,OAAOD,aAAiB,MAAM,KAAK,aAAa,IAAIC,UAAc,MAAM,CAAC;AAC3E;AAEA,SAAS,YAAY,MAAmC;CACtD,OAAO,SAAS,UAAa,gBAAgB,IAAI;AACnD;;AAGA,SAAS,cAAc,YAAqC;CAC1D,MAAM,cAAc,mBAAmB,UAAU;CACjD,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;CAElD,OACE,UAAU,UACVG,iBAAqB,KAAK,KAC1B,WAAW,KAAK,MAAM,mBACtB,EAAE,MAAM,UAAU,EAAE,EAAE,SAAS,aAAa,MAAM,UAAU,EAAE,CAAC,UAAU;AAE7E;AAEA,SAAS,mBAAmB,MAAyB;CACnD,MAAM,QAAQ,OAAO,IAAI;CAGzB,IAAI,CAACK,yBAA6B,KAAK,GAAG,OAAO;CAEjD,OAAO,MAAM,SAAS,MAAM,YAAY;EACtC,IAAI,CAAC,SAAS,OAAO;EACrB,IAAIH,gBAAoB,OAAO,GAAG,OAAO;EAEzC,MAAM,OAAO,OAAO,OAAO;EAE3B,IAAIN,aAAiB,IAAI,GAAG,OAAO,YAAYC,UAAc,IAAI,CAAC,KAAK,cAAc,IAAI;EACzF,IAAIG,iBAAqB,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EACnE,IAAI,eAAe,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EAE7D,OAAO;CACT,CAAC;AACH;;AAGA,SAAS,aAAa,MAA8D;CAClF,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAACI,0BAA8B,KAAK,GAAG,OAAO;CAElD,IAAI,UAAmC;CAEvC,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAID,mBAAuB,QAAQ,GAAG;GACpC,UAAU;GACV;EACF;EAEA,IAAI;EACJ,IAAI;EAEJ,IAAIG,qBAAyB,QAAQ,GAAG;GACtC,MAAM,QAAQ,SAAS,GAAG;GAC1B,gBAAgB,OAAO,SAAS,KAAK;EACvC,OAAO,IAAIC,8BAAkC,QAAQ,GAAG;GACtD,MAAMV,UAAc,SAAS,GAAG;GAChC,gBAAgB,SAAS;EAC3B;EAEA,IAAI,CAAC,eAAe;EACpB,IAAI,QAAQ,YAAY,cAAc,SAAS,aAAa,cAAc,UAAU,MAClF,OAAO;EACT,IAAI,QAAQ,gBAAgB,mBAAmB,aAAa,GAAG,OAAO;CACxE;CAEA,OAAO;AACT;;AAGA,SAAS,mBAAmB,MAAyB;CACnD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI,CAACkB,gBAAoB,QAAQ,KAAK,CAACC,qBAAyB,QAAQ,GAAG;EAE3E,MAAM,SAASjB,SAAa,QAAQ;EAEpC,IAAI,CAAC,UAAU,CAACC,iBAAqB,MAAM,GAAG;EAC9C,IAAI,CAAC,OAAO,UAAU,MAAM,aAAa,aAAa,QAAQ,GAAG;EAEjE,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,UAAa,gBAAgB,IAAI,IAAI,GAAG,OAAO;EAE5D,MAAM,SAAS,OAAOF,aAAiB,MAAM,CAAC;EAE9C,IACE,eAAe,MAAM,KACrB,WAAW,MAAM,MAAM,WACvB,SAASA,aAAiB,MAAM,CAAC,KACjC,aAAa,OAAO,UAAU,EAAE,MAAM,WAEtC,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAS,SAAS,MAAoC;CACpD,OAAO,cAAc,IAAI,KAAK;AAChC;;;;;AAMA,SAAS,aAAa,MAAuE;CAC3F,MAAM,cAA0B,CAAC;CACjC,IAAI,UAAU,OAAO,IAAI;CAEzB,OAAOE,iBAAqB,OAAO,GAAG;EACpC,MAAM,SAAS,OAAOF,aAAiB,OAAO,CAAC;EAE/C,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;EAEpC,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,WAAW,SAASA,aAAiB,MAAM,CAAC,GAAG;GAC1D,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;GAErC,OAAO;IAAE,MAAM,SAAS,QAAQ,UAAU,EAAE;IAAG;GAAY;EAC7D;EAEA,IAAI,SAAS,QAAQ;GACnB,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;EACvC;EAEA,UAAU,OAAOA,aAAiB,MAAM,CAAC;CAC3C;AAGF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAACM,0BAA8B,KAAK,GAAG,OAAO;CAElD,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAI,CAACE,qBAAyB,QAAQ,KAAK,QAAQ,SAAS,GAAG,MAAM,QAAQ;EAE7E,MAAM,OAAO,OAAO,SAAS,KAAK;EAElC,IAAI,CAACD,yBAA6B,IAAI,GAAG,OAAO;EAEhD,OAAO,KAAK,SAAS,OAAO,YAAY;GACtC,IAAI,CAAC,SAAS,OAAO;GACrB,MAAM,SAAS,cAAc,OAAO;GACpC,OAAO,WAAW,UAAa,2BAA2B,IAAI,MAAM;EACtE,CAAC;CACH;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAgB,OAA8B;CACpE,OAAO;EACL,MAAM;EACN;EACA,SAAS,oBAAoB,MAAM;CACrC;AACF;AAEA,SAAS,gBAAgB,MAAgB,UAAiC;CACxE,IAAI,CAACL,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,WAAW,YACf,aAAa,OAAO,MAAM,aAAa,mBAAmB,IAAI;CAEhE,IAAI,SAASA,aAAiB,MAAM,CAAC,GAAG;EAEtC,IAAI,wBAAwB,IAAI,MAAM,GAAG;GACvC,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KACP,eAAe,MAAM,GAAG,OAAO,YAAY,EAAE,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAC/E;GAGF;EACF;EAGA,IAAI,WAAW,OAAO;GACpB,MAAM,aAAa,cAAc,KAAK,UAAU,EAAE,CAAC,EAAE,YAAY;GAEjE,IAAI,CAAC,cAAc,CAAC,qBAAqB,UAAU,GAAG;GAEtD,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,GAAG,WAAW,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;GAGpF;EACF;EAGA,IAAI,WAAW,mBAAmB;GAChC,IAAI,mBAAmB,KAAK,UAAU,EAAE,GAAG;GAE3C,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,YAAY,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;EAEjF;EAEA;CACF;CAGA,IAAI,CAAC,yBAAyB,IAAI,MAAM,GAAG;CAE3C,MAAM,QAAQ,aAAaA,aAAiB,MAAM,CAAC;CAEnD,IAAI,CAAC,OAAO;CACZ,IAAI,aAAa,KAAK,UAAU,EAAE,MAAM,WAAW;CACnD,IAAI,MAAM,YAAY,MAAM,YAAY,aAAa,OAAO,MAAM,SAAS,GAAG;CAC9E,IAAI,mBAAmB,IAAI,GAAG;CAE9B,SAAS,KAAK,eAAe,MAAM,GAAG,OAAO,GAAG,MAAM,MAAM,CAAC;AAC/D;;AAKA,MAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kCAAuC,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;;AAGxE,MAAM,sCAA2C,IAAI,IAAI,CAAC,gBAAgB,oBAAoB,CAAC;;AAG/F,MAAM,sCAA2C,IAAI,IAAI,CAAC,kBAAkB,mBAAmB,CAAC;;AAGhG,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,qCAA0C,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAEjF,SAAS,eAAe,MAAyB;CAC/C,IAAIE,iBAAqB,IAAI,GAAG;EAC9B,MAAM,OAAO,WAAW,IAAI;EAC5B,IAAI,SAAS,UAAa,mBAAmB,IAAI,IAAI,GAAG,OAAO;CACjE;CAEA,IAAI,eAAe,IAAI,GAAG;EACxB,MAAM,OAAO,eAAe,IAAI;EAEhC,IAAI,QAAQ,mBAAmB,IAAIH,UAAc,IAAI,CAAC,GAAG,OAAO;EAGhE,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,YAAY,SAAS,QAAQ;GACxC,MAAM,SAAS,OAAOC,aAAiB,IAAI,CAAC;GAE5C,IAAIF,aAAiB,MAAM,KAAKC,UAAc,MAAM,MAAM,YAAY,OAAO;GAC7E,IAAI,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM,YAAY,OAAO;EAC1E;CACF;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,MAAyB;CAClD,OAAO,qBAAqB,MAAM;EAAE,YAAY;EAAqB,UAAU;CAAe,CAAC;AACjG;;AAGA,SAAS,mBAAmB,MAAyB;CACnD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI;EAEJ,IAAIoB,cAAkB,QAAQ,GAAG,OAAOnB,aAAiB,QAAQ;OAC5D,IAAIoB,wBAA4B,QAAQ,GAAG,OAAO,SAAS;OAC3D;EAEL,IAAI,YAAY;EAEhB,KAAK,OAAO,UAAU;GACpB,IAAIlB,iBAAqB,KAAK,GAAG;IAC/B,MAAM,OAAO,WAAW,KAAK;IAC7B,IAAI,SAAS,UAAa,oBAAoB,IAAI,IAAI,GAAG,YAAY;GACvE;EAGF,CAAC;EAED,IAAI,WAAW,OAAO;CACxB;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAgB,MAAc,QAAgB,MAA6B;CACjG,OAAO;EACL,MAAM;EACN;EACA,SAAS,QAAQ,KAAK,sDAAsD,OAAO,cAAc,KAAK;CACxG;AACF;AAEA,SAAS,cAAc,MAAgB,UAAiC;CACtE,IAAIA,iBAAqB,IAAI,GAAG;EAC9B,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,UAAa,CAAC,eAAe,IAAI,IAAI,GAAG;EAGrD,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;EAE5C,IAAI,eAAe,MAAM,GAAG;GAC1B,MAAM,QAAQ,OAAOA,aAAiB,MAAM,CAAC;GAC7C,IAAIF,aAAiB,KAAK,KAAKC,UAAc,KAAK,MAAM,UAAU;EACpE;EAEA,MAAM,SAAS,KAAK,UAAU;EAE9B,IAAI,CAAC,UAAUK,gBAAoB,MAAM,GAAG;EAC5C,IAAI,CAAC,kBAAkB,MAAM,KAAK,mBAAmB,IAAI,GAAG;EAE5D,SAAS,KACP,SAAS,eACL,eAAe,QAAQ,cAAc,sBAAsB,iBAAiB,IAC5E,eAAe,QAAQ,YAAY,gBAAgB,kBAAkB,CAC3E;EAEA;CACF;CAEA,IAAI,CAACiB,eAAmB,IAAI,KAAKC,SAAa,IAAI,CAAC,CAAC,SAAS,iBAAiB;CAC9E,IAAIvB,UAAcuB,SAAa,IAAI,CAAC,MAAM,QAAQvB,UAAcuB,SAAa,IAAI,CAAC,MAAM,QACtF;CAEF,MAAM,UAAUrB,SAAa,IAAI;CAEjC,IAAI,CAAC,WAAY,CAACsB,oBAAwB,OAAO,KAAK,CAACC,wBAA4B,OAAO,GACxF;CACF,IAAI,QAAQ,KAAK,SAAS,mBAAmB,CAAC,gBAAgB,IAAI,QAAQ,KAAK,IAAI,GAAG;CAEtF,MAAM,cAAc,KAAK;CAEzB,IAAI,CAAC,eAAe,CAACC,gBAAoB,WAAW,KAAK,CAAC,YAAY,YAAY;CAElF,MAAM,aAAa,YAAY;CAE/B,IAAI,CAAC,kBAAkB,UAAU,KAAK,mBAAmB,UAAU,GAAG;CAEtE,SAAS,KAAK,eAAe,YAAY,QAAQ,sBAAsB,iBAAiB,CAAC;AAC3F;AAIA,MAAM,+BAAoC,IAAI,IAAI;CAAC;CAAO;CAAU;AAAS,CAAC;AAE9E,MAAM,8BAAmC,IAAI,IAAI;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,4BAAiC,IAAI,IAAI;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;AAOA,SAAS,cAAc,KAAsB;CAC3C,OAAO,uBAAuB,IAAI,mBAAmB,GAAG,CAAC;AAC3D;;AAGA,SAAS,kBAAkB,MAA8C;CACvE,MAAM,aAAa,mBAAmB,IAAI;CAE1C,IAAI,WAAW,SAAS,OAAO,KAAK,WAAW,SAAS,cAAc,GAAG,OAAO;CAChF,IAAI,uBAAuB,IAAI,UAAU,GAAG,OAAO;CACnD,IAAI,gBAAgB,MAAM,WAAW,WAAW,SAAS,MAAM,CAAC,GAAG,OAAO;AAG5E;AAEA,SAAS,iBAAiB,UAA8B,MAAkC;CACxF,IAAI,aAAa,SAAS,OAAO;CAEjC,OAAO,OAAO,oBAAoB,KAAK,MAAM;AAC/C;AAEA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,aAAa,WAAW,WAAW,OAAO;CAEzD,OAAO,WAAW,OAAO;AAC3B;;AAGA,SAAS,cAAc,MAAgB,QAAyB;CAC9D,IAAIvB,iBAAqB,IAAI,GAAG;EAC9B,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;EAC5C,OAAO,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM;CAC1D;CAEA,OAAO,eAAe,IAAI,KAAK,WAAW,IAAI,MAAM;AACtD;AAIA,SAAS,cAAc,MAAgB,aAAsB,OAA2B;CACtF,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,eAAe,KAAK,GAAG;CAE3B,IAAIE,iBAAqB,KAAK,GAAG;EAC/B,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,UAAa,UAAU,IAAI,IAAI,GAAG;CACjD;CAGA,IAAIA,iBAAqB,KAAK,KAAK,eAAe,KAAK,GAAG;EACxD,MAAM,SAAS,oBAAoB,KAAK;EAExC,IAAI,WAAW,UAAa,cAAc,OAAO,MAAM,GAAG;GACxD,IAAI,qBAAqB,IAAI,MAAM,GAAG;IACpC,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,eAAe,eAAe,MAAM;IAAI,CAAC;IACzE;GACF;GAEA,IAAI,WAAW,SAAS;IACtB,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM;IAAsB,CAAC;IACvD;GACF;EACF;EAEA,IAAIA,iBAAqB,KAAK,KAAK,WAAW,QAAW;GACvD,MAAM,MAAM,cAAc,MAAM,UAAU,EAAE;GAC5C,MAAM,WAAW,MAAM,kBAAkB,GAAG,IAAI;GAEhD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;IACvD,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,iBAAiB,UAAU,GAAG;IAAE,CAAC;IACjE;GACF;EACF;CACF;CAEA,IAAIJ,aAAiB,KAAK,KAAK,eAAe,KAAK,GAAG;EACpD,MAAM,OAAOA,aAAiB,KAAK,IAAIC,UAAc,KAAK,IAAI,WAAW,KAAK;EAC9E,MAAM,WAAW,OAAO,kBAAkB,IAAI,IAAI;EAElD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;GACvD,MAAM,KAAK;IAAE,MAAM;IAAO,MAAM,iBAAiB,UAAU,IAAI;GAAE,CAAC;GAClE;EACF;EAGA,IAAI,eAAe,KAAK,KAAK,oBAAoB,KAAK,MAAM,QAAW;GACrE,cAAcC,aAAiB,KAAK,GAAG,OAAO,KAAK;GAEnD,IAAI0B,0BAA8B,KAAK,GAAG,cAAc,MAAM,UAAU,OAAO,KAAK;EACtF;EAEA;CACF;CAEA,IAAIpB,0BAA8B,KAAK,GAAG;EACxC,KAAK,MAAM,YAAY,MAAM,YAC3B,IAAID,mBAAuB,QAAQ,GACjC,cAAcL,aAAiB,QAAQ,GAAG,OAAO,KAAK;OACjD,IAAIQ,qBAAyB,QAAQ,GAAG;GAC7C,MAAM,MAAM,QAAQ,SAAS,GAAG;GAChC,cAAc,SAAS,OAAO,QAAQ,UAAa,cAAc,GAAG,GAAG,KAAK;EAC9E,OAAO,IAAIC,8BAAkC,QAAQ,GACnD,cAAc,SAAS,KAAK,cAAcV,UAAc,SAAS,GAAG,CAAC,GAAG,KAAK;EAIjF;CACF;CAEA,IAAI4B,qBAAyB,KAAK,GAAG;EACnC,KAAK,MAAM,cAAc,MAAM,aAAa,cAAc,YAAY,OAAO,KAAK;EAClF;CACF;CAEA,IAAIC,mBAAuB,KAAK,GAAG;EACjC,cAAc,MAAM,MAAM,OAAO,KAAK;EACtC,cAAc,MAAM,OAAO,OAAO,KAAK;EACvC;CACF;CAEA,IAAIR,wBAA4B,KAAK,GAAG;EACtC,cAAc,MAAM,YAAY,aAAa,KAAK;EAClD,cAAc,MAAM,WAAW,aAAa,KAAK;EACjD;CACF;CAEA,IAAIb,yBAA6B,KAAK,GAAG;EACvC,KAAK,MAAM,WAAW,MAAM,UAAU;GACpC,IAAIsB,oBAAwB,OAAO,GAAG;GACtC,cACEzB,gBAAoB,OAAO,IAAIJ,aAAiB,OAAO,IAAI,SAC3D,OACA,KACF;EACF;EAEA;CACF;CAEA,IAAIE,iBAAqB,KAAK,GAAG;EAE/B,MAAM,SAAS,OAAOF,aAAiB,KAAK,CAAC;EAE7C,IAAI,eAAe,MAAM,GAAG,cAAcA,aAAiB,MAAM,GAAG,OAAO,KAAK;EAEhF,KAAK,MAAM,YAAY,MAAM,WAC3B,cACEI,gBAAoB,QAAQ,IAAIJ,aAAiB,QAAQ,IAAI,UAC7D,OACA,KACF;EAGF;CACF;CAEA,IAAIe,kBAAsB,KAAK,GAAG,cAAcf,aAAiB,KAAK,GAAG,aAAa,KAAK;AAC7F;AAEA,SAAS,kBAAkB,MAAgB,UAAiC;CAC1E,IAAI,CAACE,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,GAAG;CAEzC,MAAM,QAAQ,OAAOA,aAAiB,MAAM,CAAC;CAE7C,IAAI,CAACF,aAAiB,KAAK,GAAG;CAO9B,IAAI,EAHF,aAAa,IAAIC,UAAc,KAAK,CAAC,KACpC,cAAc,IAAIA,UAAc,KAAK,CAAC,KAAK,WAAW,QAE1C;CAEf,MAAM,QAAsB,CAAC;CAE7B,KAAK,MAAM,YAAY,KAAK,WAC1B,cACEK,gBAAoB,QAAQ,IAAIJ,aAAiB,QAAQ,IAAI,UAC7D,OACA,KACF;CAGF,KAAK,MAAM,WAAW,OACpB,SAAS,KAAK;EACZ,MAAM;EACN,MAAM,QAAQ;EACd,SAAS,cAAc,QAAQ,KAAK;CACtC,CAAC;AAEL;;AAKA,MAAM,gCAAqC,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC;;AAGnE,MAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,wBAAwB,QAAoC;CAC1E,IAAI,UAAU;CAEd,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,OAAO,OAAO;EAEpB,IAAI,SAAS,MAAM;GACjB;GACA;EACF;EAEA,IAAI,SAAS;GACX,IAAI,SAAS,KAAK,UAAU;GAC5B;EACF;EAEA,IAAI,SAAS,KAAK;GAChB,UAAU;GACV;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,KAC3B,OAAO,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;EAGrD,IAAI,SAAS,KAAK;GAChB,MAAM,QAAQ,cAAc,KAAK,OAAO,MAAM,KAAK,CAAC;GACpD,IAAI,OAAO,OAAO,MAAM;EAC1B;CACF;AAGF;;AAGA,SAAS,YAAY,MAA4B,QAAQ,GAAuB;CAC9E,IAAI,CAAC,QAAQ,QAAQ,GAAG,OAAO;CAE/B,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI8B,2BAA+B,KAAK,GACtC,OAAO/B,UAAc,KAAK,CAAC,CAAC,MAAM,GAAGA,UAAc,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC;CAG5E,KACGI,gBAAoB,KAAK,KAAKD,iBAAqB,KAAK,MACzDJ,aAAiBE,aAAiB,KAAK,CAAC,KACxCD,UAAcC,aAAiB,KAAK,CAAC,MAAM,UAE3C,OAAO,cAAc,MAAM,YAAY,EAAE;CAG3C,IAAIF,aAAiB,KAAK,GAAG;EAC3B,MAAM,cAAc,mBAAmB,KAAK;EAC5C,OAAO,cAAc,YAAY,aAAa,QAAQ,CAAC,IAAI;CAC7D;AAGF;AAEA,SAAS,oBAAoB,MAAgB,UAAiC;CAC5E,IAAI,CAACI,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,QAAQ,KAAK,UAAU;CAC7B,MAAM,gBAAgB,SAAS,CAACI,gBAAoB,KAAK,IAAI,QAAQ;CACrE,IAAI;CACJ,IAAI;CAEJ,IAAI,cAAc,IAAI,MAAM,GAAG;EAC7B,QAAQJ,aAAiB,MAAM;EAC/B,QAAQ;CACV,OAAO,IAAI,eAAe,IAAI,MAAM,GAAG;EACrC,QAAQ;EACR,QAAQA,aAAiB,MAAM;CACjC,OACE;CAGF,IAAI,CAAC,OAAO;CAEZ,MAAM,SAAS,YAAY,KAAK;CAEhC,IAAI,WAAW,QAAW;CAE1B,MAAM,aAAa,wBAAwB,MAAM;CAEjD,IAAI,CAAC,cAAc,CAAC,qBAAqB,KAAK,GAAG;CAEjD,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,6CAA6C,WAAW;CACnE,CAAC;AACH;;;;;;;;;;;;;;AAeA,SAAgB,iBAAiB,YAA6C;CAC5E,MAAM,WAA4B,CAAC;CAEnC,KACE,aACC,SAAS;EACR,gBAAgB,MAAM,QAAQ;EAC9B,gBAAgB,MAAM,QAAQ;EAC9B,cAAc,MAAM,QAAQ;EAC5B,kBAAkB,MAAM,QAAQ;EAChC,oBAAoB,MAAM,QAAQ;CAGpC,GACA,IACF;CAEA,OAAO;AACT"}

package/esm/tooling/check/source-ast.mjs

@@ -0,0 +1,155 @@
+import { declarationName, expressionOf, forEachChild, isNoSubstitutionTemplateLiteral, isStringLiteral, keyName as keyName$1, parentOf, positionOf as positionOf$1, sourceOf } from "../syntax/ast.mjs";
+
+//#region ../../packages/core/src/tooling/check/source-ast.ts
+const isMemberAccess = (node) => node.type === "MemberExpression";
+const keyName = keyName$1;
+const positionOf = positionOf$1;
+function unwrap(node) {
+	let current = node;
+	while ([
+		"ParenthesizedExpression",
+		"TSAsExpression",
+		"TSNonNullExpression",
+		"TSTypeAssertion",
+		"TSSatisfiesExpression",
+		"ChainExpression"
+	].includes(current.type)) current = expressionOf(current);
+	return current;
+}
+function literalString(node) {
+	if (!node) return void 0;
+	const value = unwrap(node);
+	if (isStringLiteral(value)) return value.value;
+	if (isNoSubstitutionTemplateLiteral(value)) return value.quasis[0]?.value.cooked ?? void 0;
+}
+function memberName(node) {
+	return node.computed ? literalString(node.property) : keyName$1(node.property);
+}
+function calleeName(call) {
+	const callee = unwrap(call.callee);
+	return callee.type === "Identifier" ? callee.name : isMemberAccess(callee) ? memberName(callee) : void 0;
+}
+function rootIdentifier(node) {
+	let current = unwrap(node);
+	for (;;) {
+		if (current.type === "Identifier") return current;
+		if (isMemberAccess(current) || current.type === "CallExpression") current = unwrap(expressionOf(current));
+		else return void 0;
+	}
+}
+function isFunctionLike(node) {
+	return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
+}
+function walk(node, visit, enterFunctions = false) {
+	if (visit(node) === false || !enterFunctions && isFunctionLike(node)) return;
+	forEachChild(node, (child) => {
+		if (!child.type.startsWith("TS") || "expression" in child && typeof child.expression === "object") walk(child, visit, enterFunctions);
+	});
+}
+function ancestors(node) {
+	const list = [];
+	let current = parentOf(node);
+	while (current) {
+		list.push(current);
+		current = parentOf(current);
+	}
+	return list;
+}
+function isValueReference(identifier) {
+	const parent = parentOf(identifier);
+	if (!parent) return true;
+	if (parent.type === "MemberExpression") return parent.object === identifier || parent.computed;
+	if (parent.type === "Property") return parent.value === identifier || parent.computed;
+	if (parent.type === "VariableDeclarator") return parent.id !== identifier;
+	if ((isFunctionLike(parent) || parent.type === "ClassDeclaration" || parent.type === "ClassExpression") && parent.id === identifier) return false;
+	return ![
+		"ImportSpecifier",
+		"ImportDefaultSpecifier",
+		"ImportNamespaceSpecifier",
+		"ExportSpecifier",
+		"JSXAttribute",
+		"LabeledStatement",
+		"BreakStatement",
+		"ContinueStatement",
+		"TSPropertySignature",
+		"PropertyDefinition",
+		"MethodDefinition",
+		"RestElement",
+		"ArrayPattern",
+		"ObjectPattern"
+	].includes(parent.type);
+}
+function bindingDeclares(binding, name) {
+	if (binding.type === "Identifier") return binding.name === name;
+	if (binding.type === "RestElement") return bindingDeclares(binding.argument, name);
+	if (binding.type === "AssignmentPattern") return bindingDeclares(binding.left, name);
+	if (binding.type === "ObjectPattern") return binding.properties.some((property) => bindingDeclares(property.type === "RestElement" ? property.argument : property.value, name));
+	if (binding.type === "ArrayPattern") return binding.elements.some((element) => element !== null && bindingDeclares(element, name));
+	return false;
+}
+function declarationsDeclare(list, name) {
+	for (const declaration of list.declarations) if (bindingDeclares(declaration.id, name)) return declaration.id.type === "Identifier" ? declaration : "other";
+}
+function statementsDeclare(statements, name) {
+	for (let statement of statements) {
+		if (statement.type === "ExportNamedDeclaration" && statement.declaration) statement = statement.declaration;
+		if (statement.type === "VariableDeclaration") {
+			const found = declarationsDeclare(statement, name);
+			if (found) return found;
+		} else if (declarationName(statement) === name) return "other";
+		else if (statement.type === "ImportDeclaration" && statement.specifiers.some((specifier) => specifier.local.name === name)) return "other";
+	}
+}
+function scopeDeclares(scope, name) {
+	if (scope.type === "Program" || scope.type === "BlockStatement" || scope.type === "TSModuleBlock") return statementsDeclare(scope.body, name);
+	if (scope.type === "SwitchStatement") for (const clause of scope.cases) {
+		const found = statementsDeclare(clause.consequent, name);
+		if (found) return found;
+	}
+	if (isFunctionLike(scope)) {
+		if (scope.params.some((parameter) => bindingDeclares(parameter, name))) return "other";
+		if (scope.type === "FunctionExpression" && scope.id?.name === name) return "other";
+	}
+	if (scope.type === "ForStatement" || scope.type === "ForInStatement" || scope.type === "ForOfStatement") {
+		const initializer = scope.type === "ForStatement" ? scope.init : scope.left;
+		if (initializer?.type === "VariableDeclaration" && declarationsDeclare(initializer, name)) return "other";
+	}
+	if (scope.type === "CatchClause" && scope.param && bindingDeclares(scope.param, name)) return "other";
+}
+function findDeclaration(identifier) {
+	for (const scope of ancestors(identifier)) {
+		const found = scopeDeclares(scope, identifier.name);
+		if (found) return found;
+	}
+}
+function isReassigned(declaration) {
+	const name = declaration.id;
+	if (name.type !== "Identifier") return true;
+	let reassigned = false;
+	walk(sourceOf(declaration), (node) => {
+		if (reassigned) return false;
+		const target = node.type === "AssignmentExpression" ? unwrap(node.left) : node.type === "UpdateExpression" ? unwrap(node.argument) : void 0;
+		if (target?.type === "Identifier" && target.name === name.name && findDeclaration(target) === declaration) reassigned = true;
+	}, true);
+	return reassigned;
+}
+function resolveInitializer(identifier) {
+	const declaration = findDeclaration(identifier);
+	if (!declaration || declaration === "other" || !declaration.init) return void 0;
+	const list = parentOf(declaration);
+	if (!(list?.type === "VariableDeclaration" && list.kind === "const") && isReassigned(declaration)) return void 0;
+	return declaration.init;
+}
+function referencesOf(declaration) {
+	const name = declaration.id;
+	if (name.type !== "Identifier") return [];
+	const found = [];
+	walk(sourceOf(declaration), (node) => {
+		if (node.type === "Identifier" && node !== name && node.name === name.name && isValueReference(node) && findDeclaration(node) === declaration) found.push(node);
+	}, true);
+	return found;
+}
+
+//#endregion
+export { ancestors, calleeName, findDeclaration, isFunctionLike, isMemberAccess, isValueReference, keyName, literalString, memberName, positionOf, referencesOf, resolveInitializer, rootIdentifier, unwrap, walk };
+//# sourceMappingURL=source-ast.mjs.map

package/esm/tooling/check/source-ast.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-ast.mjs","names":["ast.keyName","ast.positionOf","ast.expressionOf","ast.isStringLiteral","ast.isNoSubstitutionTemplateLiteral","ast.parentOf","ast.declarationName","ast.sourceOf"],"sources":["../../../../../../../../../packages/core/src/tooling/check/source-ast.ts"],"sourcesContent":["import * as ast from \"../syntax/ast\";\nimport type { WarlockErrorCode } from \"../../errors/error-codes\";\n\nexport type SourceFinding = {\n  code: WarlockErrorCode;\n  node: ast.Node;\n  message: string;\n  severity?: \"error\" | \"warning\";\n};\nexport type MemberAccess = ast.MemberExpression;\nexport const isMemberAccess = (node: ast.Node): node is MemberAccess =>\n  node.type === \"MemberExpression\";\nexport const keyName = ast.keyName;\nexport const positionOf = ast.positionOf;\n\nexport function unwrap(node: ast.Node): ast.Node {\n  let current = node;\n  while (\n    [\n      \"ParenthesizedExpression\",\n      \"TSAsExpression\",\n      \"TSNonNullExpression\",\n      \"TSTypeAssertion\",\n      \"TSSatisfiesExpression\",\n      \"ChainExpression\",\n    ].includes(current.type)\n  )\n    current = ast.expressionOf(current);\n  return current;\n}\nexport function literalString(node: ast.Node | null | undefined): string | undefined {\n  if (!node) return undefined;\n  const value = unwrap(node);\n  if (ast.isStringLiteral(value)) return value.value;\n  if (ast.isNoSubstitutionTemplateLiteral(value)) return value.quasis[0]?.value.cooked ?? undefined;\n  return undefined;\n}\nexport function memberName(node: MemberAccess): string | undefined {\n  return node.computed ? literalString(node.property) : ast.keyName(node.property);\n}\nexport function calleeName(call: ast.CallExpression | ast.NewExpression): string | undefined {\n  const callee = unwrap(call.callee);\n  return callee.type === \"Identifier\"\n    ? callee.name\n    : isMemberAccess(callee)\n      ? memberName(callee)\n      : undefined;\n}\nexport function rootIdentifier(node: ast.Node): ast.Identifier | undefined {\n  let current = unwrap(node);\n  for (;;) {\n    if (current.type === \"Identifier\") return current;\n    if (isMemberAccess(current) || current.type === \"CallExpression\")\n      current = unwrap(ast.expressionOf(current));\n    else return undefined;\n  }\n}\nexport function isFunctionLike(\n  node: ast.Node,\n): node is ast.FunctionDeclaration | ast.FunctionExpression | ast.ArrowFunctionExpression {\n  return (\n    node.type === \"FunctionDeclaration\" ||\n    node.type === \"FunctionExpression\" ||\n    node.type === \"ArrowFunctionExpression\"\n  );\n}\nexport function walk(\n  node: ast.Node,\n  visit: (node: ast.Node) => boolean | void,\n  enterFunctions = false,\n): void {\n  if (visit(node) === false || (!enterFunctions && isFunctionLike(node))) return;\n  ast.forEachChild(node, (child) => {\n    if (\n      !child.type.startsWith(\"TS\") ||\n      (\"expression\" in child && typeof child.expression === \"object\")\n    )\n      walk(child, visit, enterFunctions);\n  });\n}\nexport function ancestors(node: ast.Node): ast.Node[] {\n  const list: ast.Node[] = [];\n  let current = ast.parentOf(node);\n  while (current) {\n    list.push(current);\n    current = ast.parentOf(current);\n  }\n  return list;\n}\nexport function isValueReference(identifier: ast.Identifier): boolean {\n  const parent = ast.parentOf(identifier);\n  if (!parent) return true;\n  if (parent.type === \"MemberExpression\") return parent.object === identifier || parent.computed;\n  if (parent.type === \"Property\") return parent.value === identifier || parent.computed;\n  if (parent.type === \"VariableDeclarator\") return parent.id !== identifier;\n  if (\n    (isFunctionLike(parent) ||\n      parent.type === \"ClassDeclaration\" ||\n      parent.type === \"ClassExpression\") &&\n    parent.id === identifier\n  )\n    return false;\n  return ![\n    \"ImportSpecifier\",\n    \"ImportDefaultSpecifier\",\n    \"ImportNamespaceSpecifier\",\n    \"ExportSpecifier\",\n    \"JSXAttribute\",\n    \"LabeledStatement\",\n    \"BreakStatement\",\n    \"ContinueStatement\",\n    \"TSPropertySignature\",\n    \"PropertyDefinition\",\n    \"MethodDefinition\",\n    \"RestElement\",\n    \"ArrayPattern\",\n    \"ObjectPattern\",\n  ].includes(parent.type);\n}\n\ntype Declaration = ast.VariableDeclarator | \"other\";\nfunction bindingDeclares(binding: ast.Node, name: string): boolean {\n  if (binding.type === \"Identifier\") return binding.name === name;\n  if (binding.type === \"RestElement\") return bindingDeclares(binding.argument, name);\n  if (binding.type === \"AssignmentPattern\") return bindingDeclares(binding.left, name);\n  if (binding.type === \"ObjectPattern\")\n    return binding.properties.some((property) =>\n      bindingDeclares(property.type === \"RestElement\" ? property.argument : property.value, name),\n    );\n  if (binding.type === \"ArrayPattern\")\n    return binding.elements.some((element) => element !== null && bindingDeclares(element, name));\n  return false;\n}\nfunction declarationsDeclare(list: ast.VariableDeclaration, name: string): Declaration | undefined {\n  for (const declaration of list.declarations) {\n    if (bindingDeclares(declaration.id, name))\n      return declaration.id.type === \"Identifier\" ? declaration : \"other\";\n  }\n  return undefined;\n}\nfunction statementsDeclare(\n  statements: readonly ast.Statement[],\n  name: string,\n): Declaration | undefined {\n  for (let statement of statements) {\n    if (statement.type === \"ExportNamedDeclaration\" && statement.declaration)\n      statement = statement.declaration;\n    if (statement.type === \"VariableDeclaration\") {\n      const found = declarationsDeclare(statement, name);\n      if (found) return found;\n    } else if (ast.declarationName(statement) === name) return \"other\";\n    else if (\n      statement.type === \"ImportDeclaration\" &&\n      statement.specifiers.some((specifier) => specifier.local.name === name)\n    )\n      return \"other\";\n  }\n  return undefined;\n}\nfunction scopeDeclares(scope: ast.Node, name: string): Declaration | undefined {\n  if (scope.type === \"Program\" || scope.type === \"BlockStatement\" || scope.type === \"TSModuleBlock\")\n    return statementsDeclare(scope.body, name);\n  if (scope.type === \"SwitchStatement\") {\n    for (const clause of scope.cases) {\n      const found = statementsDeclare(clause.consequent, name);\n      if (found) return found;\n    }\n  }\n  if (isFunctionLike(scope)) {\n    if (scope.params.some((parameter) => bindingDeclares(parameter, name))) return \"other\";\n    if (scope.type === \"FunctionExpression\" && scope.id?.name === name) return \"other\";\n  }\n  if (\n    scope.type === \"ForStatement\" ||\n    scope.type === \"ForInStatement\" ||\n    scope.type === \"ForOfStatement\"\n  ) {\n    const initializer = scope.type === \"ForStatement\" ? scope.init : scope.left;\n    if (initializer?.type === \"VariableDeclaration\" && declarationsDeclare(initializer, name))\n      return \"other\";\n  }\n  if (scope.type === \"CatchClause\" && scope.param && bindingDeclares(scope.param, name))\n    return \"other\";\n  return undefined;\n}\nexport function findDeclaration(identifier: ast.Identifier): Declaration | undefined {\n  for (const scope of ancestors(identifier)) {\n    const found = scopeDeclares(scope, identifier.name);\n    if (found) return found;\n  }\n  return undefined;\n}\nfunction isReassigned(declaration: ast.VariableDeclarator): boolean {\n  const name = declaration.id;\n  if (name.type !== \"Identifier\") return true;\n  let reassigned = false;\n  walk(\n    ast.sourceOf(declaration),\n    (node) => {\n      if (reassigned) return false;\n      const target =\n        node.type === \"AssignmentExpression\"\n          ? unwrap(node.left)\n          : node.type === \"UpdateExpression\"\n            ? unwrap(node.argument)\n            : undefined;\n      if (\n        target?.type === \"Identifier\" &&\n        target.name === name.name &&\n        findDeclaration(target) === declaration\n      )\n        reassigned = true;\n      return undefined;\n    },\n    true,\n  );\n  return reassigned;\n}\nexport function resolveInitializer(identifier: ast.Identifier): ast.Expression | undefined {\n  const declaration = findDeclaration(identifier);\n  if (!declaration || declaration === \"other\" || !declaration.init) return undefined;\n  const list = ast.parentOf(declaration);\n  if (!(list?.type === \"VariableDeclaration\" && list.kind === \"const\") && isReassigned(declaration))\n    return undefined;\n  return declaration.init;\n}\nexport function referencesOf(declaration: ast.VariableDeclarator): ast.Identifier[] {\n  const name = declaration.id;\n  if (name.type !== \"Identifier\") return [];\n  const found: ast.Identifier[] = [];\n  walk(\n    ast.sourceOf(declaration),\n    (node) => {\n      if (\n        node.type === \"Identifier\" &&\n        node !== name &&\n        node.name === name.name &&\n        isValueReference(node) &&\n        findDeclaration(node) === declaration\n      )\n        found.push(node);\n      return undefined;\n    },\n    true,\n  );\n  return found;\n}\n"],"mappings":";;;AAUA,MAAa,kBAAkB,SAC7B,KAAK,SAAS;AAChB,MAAa,UAAUA;AACvB,MAAa,aAAaC;AAE1B,SAAgB,OAAO,MAA0B;CAC/C,IAAI,UAAU;CACd,OACE;EACE;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,QAAQ,IAAI,GAEvB,UAAUC,aAAiB,OAAO;CACpC,OAAO;AACT;AACA,SAAgB,cAAc,MAAuD;CACnF,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAIC,gBAAoB,KAAK,GAAG,OAAO,MAAM;CAC7C,IAAIC,gCAAoC,KAAK,GAAG,OAAO,MAAM,OAAO,EAAE,EAAE,MAAM,UAAU;AAE1F;AACA,SAAgB,WAAW,MAAwC;CACjE,OAAO,KAAK,WAAW,cAAc,KAAK,QAAQ,IAAIJ,UAAY,KAAK,QAAQ;AACjF;AACA,SAAgB,WAAW,MAAkE;CAC3F,MAAM,SAAS,OAAO,KAAK,MAAM;CACjC,OAAO,OAAO,SAAS,eACnB,OAAO,OACP,eAAe,MAAM,IACnB,WAAW,MAAM,IACjB;AACR;AACA,SAAgB,eAAe,MAA4C;CACzE,IAAI,UAAU,OAAO,IAAI;CACzB,SAAS;EACP,IAAI,QAAQ,SAAS,cAAc,OAAO;EAC1C,IAAI,eAAe,OAAO,KAAK,QAAQ,SAAS,kBAC9C,UAAU,OAAOE,aAAiB,OAAO,CAAC;OACvC,OAAO;CACd;AACF;AACA,SAAgB,eACd,MACwF;CACxF,OACE,KAAK,SAAS,yBACd,KAAK,SAAS,wBACd,KAAK,SAAS;AAElB;AACA,SAAgB,KACd,MACA,OACA,iBAAiB,OACX;CACN,IAAI,MAAM,IAAI,MAAM,SAAU,CAAC,kBAAkB,eAAe,IAAI,GAAI;CACxE,aAAiB,OAAO,UAAU;EAChC,IACE,CAAC,MAAM,KAAK,WAAW,IAAI,KAC1B,gBAAgB,SAAS,OAAO,MAAM,eAAe,UAEtD,KAAK,OAAO,OAAO,cAAc;CACrC,CAAC;AACH;AACA,SAAgB,UAAU,MAA4B;CACpD,MAAM,OAAmB,CAAC;CAC1B,IAAI,UAAUG,SAAa,IAAI;CAC/B,OAAO,SAAS;EACd,KAAK,KAAK,OAAO;EACjB,UAAUA,SAAa,OAAO;CAChC;CACA,OAAO;AACT;AACA,SAAgB,iBAAiB,YAAqC;CACpE,MAAM,SAASA,SAAa,UAAU;CACtC,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,OAAO,SAAS,oBAAoB,OAAO,OAAO,WAAW,cAAc,OAAO;CACtF,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,UAAU,cAAc,OAAO;CAC7E,IAAI,OAAO,SAAS,sBAAsB,OAAO,OAAO,OAAO;CAC/D,KACG,eAAe,MAAM,KACpB,OAAO,SAAS,sBAChB,OAAO,SAAS,sBAClB,OAAO,OAAO,YAEd,OAAO;CACT,OAAO,CAAC;EACN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,OAAO,IAAI;AACxB;AAGA,SAAS,gBAAgB,SAAmB,MAAuB;CACjE,IAAI,QAAQ,SAAS,cAAc,OAAO,QAAQ,SAAS;CAC3D,IAAI,QAAQ,SAAS,eAAe,OAAO,gBAAgB,QAAQ,UAAU,IAAI;CACjF,IAAI,QAAQ,SAAS,qBAAqB,OAAO,gBAAgB,QAAQ,MAAM,IAAI;CACnF,IAAI,QAAQ,SAAS,iBACnB,OAAO,QAAQ,WAAW,MAAM,aAC9B,gBAAgB,SAAS,SAAS,gBAAgB,SAAS,WAAW,SAAS,OAAO,IAAI,CAC5F;CACF,IAAI,QAAQ,SAAS,gBACnB,OAAO,QAAQ,SAAS,MAAM,YAAY,YAAY,QAAQ,gBAAgB,SAAS,IAAI,CAAC;CAC9F,OAAO;AACT;AACA,SAAS,oBAAoB,MAA+B,MAAuC;CACjG,KAAK,MAAM,eAAe,KAAK,cAC7B,IAAI,gBAAgB,YAAY,IAAI,IAAI,GACtC,OAAO,YAAY,GAAG,SAAS,eAAe,cAAc;AAGlE;AACA,SAAS,kBACP,YACA,MACyB;CACzB,KAAK,IAAI,aAAa,YAAY;EAChC,IAAI,UAAU,SAAS,4BAA4B,UAAU,aAC3D,YAAY,UAAU;EACxB,IAAI,UAAU,SAAS,uBAAuB;GAC5C,MAAM,QAAQ,oBAAoB,WAAW,IAAI;GACjD,IAAI,OAAO,OAAO;EACpB,OAAO,IAAIC,gBAAoB,SAAS,MAAM,MAAM,OAAO;OACtD,IACH,UAAU,SAAS,uBACnB,UAAU,WAAW,MAAM,cAAc,UAAU,MAAM,SAAS,IAAI,GAEtE,OAAO;CACX;AAEF;AACA,SAAS,cAAc,OAAiB,MAAuC;CAC7E,IAAI,MAAM,SAAS,aAAa,MAAM,SAAS,oBAAoB,MAAM,SAAS,iBAChF,OAAO,kBAAkB,MAAM,MAAM,IAAI;CAC3C,IAAI,MAAM,SAAS,mBACjB,KAAK,MAAM,UAAU,MAAM,OAAO;EAChC,MAAM,QAAQ,kBAAkB,OAAO,YAAY,IAAI;EACvD,IAAI,OAAO,OAAO;CACpB;CAEF,IAAI,eAAe,KAAK,GAAG;EACzB,IAAI,MAAM,OAAO,MAAM,cAAc,gBAAgB,WAAW,IAAI,CAAC,GAAG,OAAO;EAC/E,IAAI,MAAM,SAAS,wBAAwB,MAAM,IAAI,SAAS,MAAM,OAAO;CAC7E;CACA,IACE,MAAM,SAAS,kBACf,MAAM,SAAS,oBACf,MAAM,SAAS,kBACf;EACA,MAAM,cAAc,MAAM,SAAS,iBAAiB,MAAM,OAAO,MAAM;EACvE,IAAI,aAAa,SAAS,yBAAyB,oBAAoB,aAAa,IAAI,GACtF,OAAO;CACX;CACA,IAAI,MAAM,SAAS,iBAAiB,MAAM,SAAS,gBAAgB,MAAM,OAAO,IAAI,GAClF,OAAO;AAEX;AACA,SAAgB,gBAAgB,YAAqD;CACnF,KAAK,MAAM,SAAS,UAAU,UAAU,GAAG;EACzC,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;EAClD,IAAI,OAAO,OAAO;CACpB;AAEF;AACA,SAAS,aAAa,aAA8C;CAClE,MAAM,OAAO,YAAY;CACzB,IAAI,KAAK,SAAS,cAAc,OAAO;CACvC,IAAI,aAAa;CACjB,KACEC,SAAa,WAAW,IACvB,SAAS;EACR,IAAI,YAAY,OAAO;EACvB,MAAM,SACJ,KAAK,SAAS,yBACV,OAAO,KAAK,IAAI,IAChB,KAAK,SAAS,qBACZ,OAAO,KAAK,QAAQ,IACpB;EACR,IACE,QAAQ,SAAS,gBACjB,OAAO,SAAS,KAAK,QACrB,gBAAgB,MAAM,MAAM,aAE5B,aAAa;CAEjB,GACA,IACF;CACA,OAAO;AACT;AACA,SAAgB,mBAAmB,YAAwD;CACzF,MAAM,cAAc,gBAAgB,UAAU;CAC9C,IAAI,CAAC,eAAe,gBAAgB,WAAW,CAAC,YAAY,MAAM,OAAO;CACzE,MAAM,OAAOF,SAAa,WAAW;CACrC,IAAI,EAAE,MAAM,SAAS,yBAAyB,KAAK,SAAS,YAAY,aAAa,WAAW,GAC9F,OAAO;CACT,OAAO,YAAY;AACrB;AACA,SAAgB,aAAa,aAAuD;CAClF,MAAM,OAAO,YAAY;CACzB,IAAI,KAAK,SAAS,cAAc,OAAO,CAAC;CACxC,MAAM,QAA0B,CAAC;CACjC,KACEE,SAAa,WAAW,IACvB,SAAS;EACR,IACE,KAAK,SAAS,gBACd,SAAS,QACT,KAAK,SAAS,KAAK,QACnB,iBAAiB,IAAI,KACrB,gBAAgB,IAAI,MAAM,aAE1B,MAAM,KAAK,IAAI;CAEnB,GACA,IACF;CACA,OAAO;AACT"}

package/esm/tooling/check/source-files.mjs

@@ -0,0 +1,27 @@
+import glob from "fast-glob";
+
+//#region ../../packages/core/src/tooling/check/source-files.ts
+/** The project source files a full `warlock check` lints and convention-checks. */
+async function listSourceFiles(cwd) {
+	return (await glob(["src/**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}"], {
+		cwd,
+		onlyFiles: true,
+		ignore: ["**/node_modules/**"]
+	})).sort();
+}
+/** Test files, wherever they live (outside node_modules). */
+async function listTestFiles(cwd) {
+	return glob(["**/*.{test,spec}.{ts,tsx,js,jsx,mts,cts,mjs,cjs}"], {
+		cwd,
+		onlyFiles: true,
+		ignore: [
+			"**/node_modules/**",
+			"**/dist/**",
+			"**/.warlock/**"
+		]
+	});
+}
+
+//#endregion
+export { listSourceFiles, listTestFiles };
+//# sourceMappingURL=source-files.mjs.map

package/esm/tooling/check/source-files.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-files.mjs","names":["fg"],"sources":["../../../../../../../../../packages/core/src/tooling/check/source-files.ts"],"sourcesContent":["import fg from \"fast-glob\";\n\n/** The project source files a full `warlock check` lints and convention-checks. */\nexport async function listSourceFiles(cwd: string): Promise<string[]> {\n  const files = await fg([\"src/**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}\"], {\n    cwd,\n    onlyFiles: true,\n    ignore: [\"**/node_modules/**\"],\n  });\n\n  return files.sort();\n}\n\n/** Test files, wherever they live (outside node_modules). */\nexport async function listTestFiles(cwd: string): Promise<string[]> {\n  return fg([\"**/*.{test,spec}.{ts,tsx,js,jsx,mts,cts,mjs,cjs}\"], {\n    cwd,\n    onlyFiles: true,\n    ignore: [\"**/node_modules/**\", \"**/dist/**\", \"**/.warlock/**\"],\n  });\n}\n"],"mappings":";;;;AAGA,eAAsB,gBAAgB,KAAgC;CAOpE,QAAO,MANaA,KAAG,CAAC,0CAA0C,GAAG;EACnE;EACA,WAAW;EACX,QAAQ,CAAC,oBAAoB;CAC/B,CAAC,EAEW,CAAC,KAAK;AACpB;;AAGA,eAAsB,cAAc,KAAgC;CAClE,OAAOA,KAAG,CAAC,kDAAkD,GAAG;EAC9D;EACA,WAAW;EACX,QAAQ;GAAC;GAAsB;GAAc;EAAgB;CAC/D,CAAC;AACH"}

package/esm/tooling/check/tests-step.d.mts

@@ -0,0 +1,33 @@
+import { ToolingProblem } from "../problem.mjs";
+//#region ../../packages/core/src/tooling/check/tests-step.d.ts
+/** How a vitest run ended: its exit code, output, and the JSON report if one was written. */
+export type VitestRun = {
+  code: number | null;
+  signal: string | null;
+  stdout: string;
+  stderr: string;
+  /** The `--reporter=json` report, parsed; `undefined` when none was written. */
+  report: unknown;
+};
+/** Runs the app's vitest with the given arguments. Injectable for tests. */
+export type VitestRunner = (binary: string, args: readonly string[], cwd: string) => Promise<VitestRun>;
+/**
+ * The app's own vitest CLI entry, resolved from the app root — never a global
+ * install — or `undefined` when the app does not have vitest.
+ */
+export declare function findVitest(cwd: string): string | undefined;
+/**
+ * The default {@link VitestRunner}: `node <vitest> <args> --reporter=json
+ * --outputFile=<tmp>`, reading the report back from the file so test output on
+ * stdout cannot corrupt it.
+ */
+export declare const runVitest: VitestRunner;
+/**
+ * Turn vitest's JSON report (the Jest-compatible shape `--reporter=json`
+ * writes) into problems: a failed test is `WL7301`, a file that failed before
+ * its tests ran is `WL7302`, and a failure caused by an unreachable service or
+ * a busy port is the matching environment code instead.
+ */
+export declare function parseVitestReport(report: unknown, cwd: string): ToolingProblem[];
+//#endregion
+//# sourceMappingURL=tests-step.d.mts.map

package/esm/tooling/check/tests-step.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/tests-step.ts"],"mappings":";;;YASY;EACV;EACA;EACA;EACA;;EAEA;;;YAIU,gBACV,gBACA,yBACA,gBACG,QAAQ;;;;;wBASG,WAAW;;;;;;qBA6Bd,WAAW;;;;;;;wBA0FR,kBAAkB,iBAAiB,cAAc"}

package/esm/tooling/check/tests-step.mjs

@@ -0,0 +1,177 @@
+import { errorCodeOf } from "../../errors/error-codes.mjs";
+import { createProblem } from "../problem.mjs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { execFile } from "node:child_process";
+import os from "node:os";
+
+//#region ../../packages/core/src/tooling/check/tests-step.ts
+/** Ten minutes: a suite slower than that is reported as a crashed tool, not a failure. */
+const TEST_TIMEOUT_MS = 6e5;
+/**
+* The app's own vitest CLI entry, resolved from the app root — never a global
+* install — or `undefined` when the app does not have vitest.
+*/
+function findVitest(cwd) {
+	try {
+		const manifestPath = createRequire(path.join(cwd, "package.json")).resolve("vitest/package.json");
+		const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+		const bin = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "bin") : void 0;
+		const entry = typeof bin === "string" ? bin : typeof bin === "object" && bin !== null ? Reflect.get(bin, "vitest") : void 0;
+		if (typeof entry !== "string") return void 0;
+		const binary = path.resolve(path.dirname(manifestPath), entry);
+		return existsSync(binary) ? binary : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The default {@link VitestRunner}: `node <vitest> <args> --reporter=json
+* --outputFile=<tmp>`, reading the report back from the file so test output on
+* stdout cannot corrupt it.
+*/
+const runVitest = (binary, args, cwd) => {
+	const directory = mkdtempSync(path.join(os.tmpdir(), "warlock-check-vitest-"));
+	const outputFile = path.join(directory, "report.json");
+	return new Promise((resolve) => {
+		execFile(process.execPath, [
+			binary,
+			...args,
+			"--reporter=json",
+			`--outputFile=${outputFile}`
+		], {
+			cwd,
+			encoding: "utf8",
+			windowsHide: true,
+			timeout: TEST_TIMEOUT_MS,
+			maxBuffer: 67108864,
+			env: {
+				...process.env,
+				CI: process.env.CI ?? "1"
+			}
+		}, (error, stdout, stderr) => {
+			let report;
+			try {
+				report = JSON.parse(readFileSync(outputFile, "utf8"));
+			} catch {
+				report = void 0;
+			}
+			rmSync(directory, {
+				recursive: true,
+				force: true
+			});
+			resolve({
+				code: error === null ? 0 : typeof error.code === "number" ? error.code : null,
+				signal: error?.signal ?? null,
+				stdout,
+				stderr,
+				report
+			});
+		});
+	});
+};
+/**
+* The vitest arguments for a run. Verified against `vitest --help` (4.1):
+* `run` executes once without watch; `related <files> --run` runs only the
+* tests that import the given source files; `--passWithNoTests` exits 0 when
+* nothing matches; `--reporter=json --outputFile=<file>` writes the report.
+*/
+function vitestArguments(files) {
+	if (files === null) return ["run", "--passWithNoTests"];
+	return [
+		"related",
+		...files,
+		"--run",
+		"--passWithNoTests"
+	];
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** ANSI color sequences, which vitest leaves in failure messages. */
+const ANSI_SEQUENCE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+/** The first meaningful lines of a failure message, bounded for one JSON field. */
+function summarize(message) {
+	const text = message.replace(ANSI_SEQUENCE, "").trim();
+	return text.length > 1e3 ? `${text.slice(0, 1e3)}…` : text;
+}
+/**
+* Whether a failure message shows the machine rather than the code: a
+* refused/unreachable service (`WL8003`) or a port already taken (`WL8004`).
+*/
+function environmentCodeOf(message) {
+	const errno = /\b(ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|EADDRINUSE)\b/.exec(message)?.[1];
+	if (!errno) return void 0;
+	const code = errorCodeOf({ code: errno });
+	return code === "WL8003" || code === "WL8004" ? code : void 0;
+}
+function relative$1(cwd, file) {
+	if (typeof file !== "string" || file.length === 0) return null;
+	return (path.isAbsolute(file) ? path.relative(cwd, file) : file).split(path.sep).join("/");
+}
+/**
+* Turn vitest's JSON report (the Jest-compatible shape `--reporter=json`
+* writes) into problems: a failed test is `WL7301`, a file that failed before
+* its tests ran is `WL7302`, and a failure caused by an unreachable service or
+* a busy port is the matching environment code instead.
+*/
+function parseVitestReport(report, cwd) {
+	if (!isRecord(report) || !Array.isArray(report.testResults)) return [];
+	const problems = [];
+	for (const suite of report.testResults) {
+		if (!isRecord(suite)) continue;
+		const file = relative$1(cwd, suite.name);
+		const failed = (Array.isArray(suite.assertionResults) ? suite.assertionResults : []).filter((assertion) => isRecord(assertion) && assertion.status === "failed");
+		for (const assertion of failed) {
+			const message = summarize((Array.isArray(assertion.failureMessages) ? assertion.failureMessages.filter((message) => typeof message === "string") : []).join("\n") || "Test failed.");
+			const location = isRecord(assertion.location) ? assertion.location : void 0;
+			const name = typeof assertion.fullName === "string" ? assertion.fullName : typeof assertion.title === "string" ? assertion.title : null;
+			const environment = environmentCodeOf(message);
+			problems.push(createProblem({
+				code: environment ?? "WL7301",
+				source: environment ? "environment" : "vitest",
+				message,
+				file,
+				line: typeof location?.line === "number" ? location.line : null,
+				column: typeof location?.column === "number" ? location.column : null,
+				rule: name
+			}));
+		}
+		const suiteMessage = typeof suite.message === "string" ? suite.message.trim() : "";
+		if (suite.status === "failed" && failed.length === 0) {
+			const message = summarize(suiteMessage || "The test file failed before its tests ran.");
+			const environment = environmentCodeOf(message);
+			problems.push(createProblem({
+				code: environment ?? "WL7302",
+				source: environment ? "environment" : "vitest",
+				message,
+				file
+			}));
+		}
+	}
+	return problems;
+}
+/**
+* Problems for a vitest run that produced no report: a crash, a timeout or a
+* signal is the tool (`WL8007`); an exit without a report after a config or
+* import error is the code (`WL7302`).
+*/
+function vitestRunFailure(run) {
+	const output = summarize(`${run.stderr}\n${run.stdout}`) || "vitest wrote no report.";
+	if (run.signal !== null || run.code === null || run.code > 1 || /heap out of memory/i.test(output)) return [createProblem({
+		code: "WL8007",
+		source: "environment",
+		message: `vitest ${run.signal ? `was killed (${run.signal})` : `exited with ${run.code ?? "no code"}`}: ${output}`
+	})];
+	const environment = environmentCodeOf(output);
+	return [createProblem({
+		code: environment ?? "WL7302",
+		source: environment ? "environment" : "vitest",
+		message: output
+	})];
+}
+
+//#endregion
+export { environmentCodeOf, findVitest, parseVitestReport, runVitest, vitestArguments, vitestRunFailure };
+//# sourceMappingURL=tests-step.mjs.map

package/esm/tooling/check/tests-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests-step.mjs","names":["relative"],"sources":["../../../../../../../../../packages/core/src/tooling/check/tests-step.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { existsSync, mkdtempSync, readFileSync, rmSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { errorCodeOf } from \"../../errors/error-codes\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/** How a vitest run ended: its exit code, output, and the JSON report if one was written. */\nexport type VitestRun = {\n  code: number | null;\n  signal: string | null;\n  stdout: string;\n  stderr: string;\n  /** The `--reporter=json` report, parsed; `undefined` when none was written. */\n  report: unknown;\n};\n\n/** Runs the app's vitest with the given arguments. Injectable for tests. */\nexport type VitestRunner = (\n  binary: string,\n  args: readonly string[],\n  cwd: string,\n) => Promise<VitestRun>;\n\n/** Ten minutes: a suite slower than that is reported as a crashed tool, not a failure. */\nconst TEST_TIMEOUT_MS = 10 * 60 * 1000;\n\n/**\n * The app's own vitest CLI entry, resolved from the app root — never a global\n * install — or `undefined` when the app does not have vitest.\n */\nexport function findVitest(cwd: string): string | undefined {\n  try {\n    const require = createRequire(path.join(cwd, \"package.json\"));\n    const manifestPath = require.resolve(\"vitest/package.json\");\n    const manifest: unknown = JSON.parse(readFileSync(manifestPath, \"utf8\"));\n    const bin =\n      typeof manifest === \"object\" && manifest !== null ? Reflect.get(manifest, \"bin\") : undefined;\n    const entry =\n      typeof bin === \"string\"\n        ? bin\n        : typeof bin === \"object\" && bin !== null\n          ? Reflect.get(bin, \"vitest\")\n          : undefined;\n\n    if (typeof entry !== \"string\") return undefined;\n\n    const binary = path.resolve(path.dirname(manifestPath), entry);\n\n    return existsSync(binary) ? binary : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The default {@link VitestRunner}: `node <vitest> <args> --reporter=json\n * --outputFile=<tmp>`, reading the report back from the file so test output on\n * stdout cannot corrupt it.\n */\nexport const runVitest: VitestRunner = (binary, args, cwd) => {\n  const directory = mkdtempSync(path.join(os.tmpdir(), \"warlock-check-vitest-\"));\n  const outputFile = path.join(directory, \"report.json\");\n\n  return new Promise((resolve) => {\n    execFile(\n      process.execPath,\n      [binary, ...args, \"--reporter=json\", `--outputFile=${outputFile}`],\n      {\n        cwd,\n        encoding: \"utf8\",\n        windowsHide: true,\n        timeout: TEST_TIMEOUT_MS,\n        maxBuffer: 64 * 1024 * 1024,\n        env: { ...process.env, CI: process.env.CI ?? \"1\" },\n      },\n      (error, stdout, stderr) => {\n        let report: unknown;\n\n        try {\n          report = JSON.parse(readFileSync(outputFile, \"utf8\"));\n        } catch {\n          report = undefined;\n        }\n\n        rmSync(directory, { recursive: true, force: true });\n        resolve({\n          code: error === null ? 0 : typeof error.code === \"number\" ? error.code : null,\n          signal: error?.signal ?? null,\n          stdout,\n          stderr,\n          report,\n        });\n      },\n    );\n  });\n};\n\n/**\n * The vitest arguments for a run. Verified against `vitest --help` (4.1):\n * `run` executes once without watch; `related <files> --run` runs only the\n * tests that import the given source files; `--passWithNoTests` exits 0 when\n * nothing matches; `--reporter=json --outputFile=<file>` writes the report.\n */\nexport function vitestArguments(files: readonly string[] | null): string[] {\n  if (files === null) return [\"run\", \"--passWithNoTests\"];\n\n  return [\"related\", ...files, \"--run\", \"--passWithNoTests\"];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** ANSI color sequences, which vitest leaves in failure messages. */\nconst ANSI_SEQUENCE = new RegExp(`${String.fromCharCode(27)}\\\\[[0-9;]*m`, \"g\");\n\n/** The first meaningful lines of a failure message, bounded for one JSON field. */\nfunction summarize(message: string): string {\n  const text = message.replace(ANSI_SEQUENCE, \"\").trim();\n\n  return text.length > 1000 ? `${text.slice(0, 1000)}…` : text;\n}\n\n/**\n * Whether a failure message shows the machine rather than the code: a\n * refused/unreachable service (`WL8003`) or a port already taken (`WL8004`).\n */\nexport function environmentCodeOf(message: string): \"WL8003\" | \"WL8004\" | undefined {\n  const errno = /\\b(ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|EADDRINUSE)\\b/.exec(message)?.[1];\n\n  if (!errno) return undefined;\n\n  const code = errorCodeOf({ code: errno });\n\n  return code === \"WL8003\" || code === \"WL8004\" ? code : undefined;\n}\n\nfunction relative(cwd: string, file: unknown): string | null {\n  if (typeof file !== \"string\" || file.length === 0) return null;\n\n  return (path.isAbsolute(file) ? path.relative(cwd, file) : file).split(path.sep).join(\"/\");\n}\n\n/**\n * Turn vitest's JSON report (the Jest-compatible shape `--reporter=json`\n * writes) into problems: a failed test is `WL7301`, a file that failed before\n * its tests ran is `WL7302`, and a failure caused by an unreachable service or\n * a busy port is the matching environment code instead.\n */\nexport function parseVitestReport(report: unknown, cwd: string): ToolingProblem[] {\n  if (!isRecord(report) || !Array.isArray(report.testResults)) return [];\n\n  const problems: ToolingProblem[] = [];\n\n  for (const suite of report.testResults) {\n    if (!isRecord(suite)) continue;\n\n    const file = relative(cwd, suite.name);\n    const assertions = Array.isArray(suite.assertionResults) ? suite.assertionResults : [];\n    const failed = assertions.filter(\n      (assertion): assertion is Record<string, unknown> =>\n        isRecord(assertion) && assertion.status === \"failed\",\n    );\n\n    for (const assertion of failed) {\n      const messages = Array.isArray(assertion.failureMessages)\n        ? assertion.failureMessages.filter(\n            (message): message is string => typeof message === \"string\",\n          )\n        : [];\n      const message = summarize(messages.join(\"\\n\") || \"Test failed.\");\n      const location = isRecord(assertion.location) ? assertion.location : undefined;\n      const name =\n        typeof assertion.fullName === \"string\"\n          ? assertion.fullName\n          : typeof assertion.title === \"string\"\n            ? assertion.title\n            : null;\n      const environment = environmentCodeOf(message);\n\n      problems.push(\n        createProblem({\n          code: environment ?? \"WL7301\",\n          source: environment ? \"environment\" : \"vitest\",\n          message,\n          file,\n          line: typeof location?.line === \"number\" ? location.line : null,\n          column: typeof location?.column === \"number\" ? location.column : null,\n          rule: name,\n        }),\n      );\n    }\n\n    const suiteMessage = typeof suite.message === \"string\" ? suite.message.trim() : \"\";\n\n    if (suite.status === \"failed\" && failed.length === 0) {\n      const message = summarize(suiteMessage || \"The test file failed before its tests ran.\");\n      const environment = environmentCodeOf(message);\n\n      problems.push(\n        createProblem({\n          code: environment ?? \"WL7302\",\n          source: environment ? \"environment\" : \"vitest\",\n          message,\n          file,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\n/**\n * Problems for a vitest run that produced no report: a crash, a timeout or a\n * signal is the tool (`WL8007`); an exit without a report after a config or\n * import error is the code (`WL7302`).\n */\nexport function vitestRunFailure(run: VitestRun): ToolingProblem[] {\n  const output = summarize(`${run.stderr}\\n${run.stdout}`) || \"vitest wrote no report.\";\n\n  if (\n    run.signal !== null ||\n    run.code === null ||\n    run.code > 1 ||\n    /heap out of memory/i.test(output)\n  ) {\n    return [\n      createProblem({\n        code: \"WL8007\",\n        source: \"environment\",\n        message: `vitest ${run.signal ? `was killed (${run.signal})` : `exited with ${run.code ?? \"no code\"}`}: ${output}`,\n      }),\n    ];\n  }\n\n  const environment = environmentCodeOf(output);\n\n  return [\n    createProblem({\n      code: environment ?? \"WL7302\",\n      source: environment ? \"environment\" : \"vitest\",\n      message: output,\n    }),\n  ];\n}\n"],"mappings":";;;;;;;;;;AA0BA,MAAM,kBAAkB;;;;;AAMxB,SAAgB,WAAW,KAAiC;CAC1D,IAAI;EAEF,MAAM,eADU,cAAc,KAAK,KAAK,KAAK,cAAc,CAChC,CAAC,CAAC,QAAQ,qBAAqB;EAC1D,MAAM,WAAoB,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC;EACvE,MAAM,MACJ,OAAO,aAAa,YAAY,aAAa,OAAO,QAAQ,IAAI,UAAU,KAAK,IAAI;EACrF,MAAM,QACJ,OAAO,QAAQ,WACX,MACA,OAAO,QAAQ,YAAY,QAAQ,OACjC,QAAQ,IAAI,KAAK,QAAQ,IACzB;EAER,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,SAAS,KAAK,QAAQ,KAAK,QAAQ,YAAY,GAAG,KAAK;EAE7D,OAAO,WAAW,MAAM,IAAI,SAAS;CACvC,QAAQ;EACN;CACF;AACF;;;;;;AAOA,MAAa,aAA2B,QAAQ,MAAM,QAAQ;CAC5D,MAAM,YAAY,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,uBAAuB,CAAC;CAC7E,MAAM,aAAa,KAAK,KAAK,WAAW,aAAa;CAErD,OAAO,IAAI,SAAS,YAAY;EAC9B,SACE,QAAQ,UACR;GAAC;GAAQ,GAAG;GAAM;GAAmB,gBAAgB;EAAY,GACjE;GACE;GACA,UAAU;GACV,aAAa;GACb,SAAS;GACT,WAAW;GACX,KAAK;IAAE,GAAG,QAAQ;IAAK,IAAI,QAAQ,IAAI,MAAM;GAAI;EACnD,IACC,OAAO,QAAQ,WAAW;GACzB,IAAI;GAEJ,IAAI;IACF,SAAS,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;GACtD,QAAQ;IACN,SAAS;GACX;GAEA,OAAO,WAAW;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;GAClD,QAAQ;IACN,MAAM,UAAU,OAAO,IAAI,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;IACzE,QAAQ,OAAO,UAAU;IACzB;IACA;IACA;GACF,CAAC;EACH,CACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,gBAAgB,OAA2C;CACzE,IAAI,UAAU,MAAM,OAAO,CAAC,OAAO,mBAAmB;CAEtD,OAAO;EAAC;EAAW,GAAG;EAAO;EAAS;CAAmB;AAC3D;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,MAAM,gBAAgB,IAAI,OAAO,GAAG,OAAO,aAAa,EAAE,EAAE,cAAc,GAAG;;AAG7E,SAAS,UAAU,SAAyB;CAC1C,MAAM,OAAO,QAAQ,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAErD,OAAO,KAAK,SAAS,MAAO,GAAG,KAAK,MAAM,GAAG,GAAI,EAAE,KAAK;AAC1D;;;;;AAMA,SAAgB,kBAAkB,SAAkD;CAClF,MAAM,QAAQ,uDAAuD,KAAK,OAAO,CAAC,GAAG;CAErF,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,OAAO,YAAY,EAAE,MAAM,MAAM,CAAC;CAExC,OAAO,SAAS,YAAY,SAAS,WAAW,OAAO;AACzD;AAEA,SAASA,WAAS,KAAa,MAA8B;CAC3D,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG,OAAO;CAE1D,QAAQ,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,IAAI,KAAI,CAAE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AAC3F;;;;;;;AAQA,SAAgB,kBAAkB,QAAiB,KAA+B;CAChF,IAAI,CAAC,SAAS,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,WAAW,GAAG,OAAO,CAAC;CAErE,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,SAAS,OAAO,aAAa;EACtC,IAAI,CAAC,SAAS,KAAK,GAAG;EAEtB,MAAM,OAAOA,WAAS,KAAK,MAAM,IAAI;EAErC,MAAM,UADa,MAAM,QAAQ,MAAM,gBAAgB,IAAI,MAAM,mBAAmB,CAAC,EAC5D,CAAC,QACvB,cACC,SAAS,SAAS,KAAK,UAAU,WAAW,QAChD;EAEA,KAAK,MAAM,aAAa,QAAQ;GAM9B,MAAM,UAAU,WALC,MAAM,QAAQ,UAAU,eAAe,IACpD,UAAU,gBAAgB,QACvB,YAA+B,OAAO,YAAY,QACrD,IACA,CAAC,EAC6B,CAAC,KAAK,IAAI,KAAK,cAAc;GAC/D,MAAM,WAAW,SAAS,UAAU,QAAQ,IAAI,UAAU,WAAW;GACrE,MAAM,OACJ,OAAO,UAAU,aAAa,WAC1B,UAAU,WACV,OAAO,UAAU,UAAU,WACzB,UAAU,QACV;GACR,MAAM,cAAc,kBAAkB,OAAO;GAE7C,SAAS,KACP,cAAc;IACZ,MAAM,eAAe;IACrB,QAAQ,cAAc,gBAAgB;IACtC;IACA;IACA,MAAM,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO;IAC3D,QAAQ,OAAO,UAAU,WAAW,WAAW,SAAS,SAAS;IACjE,MAAM;GACR,CAAC,CACH;EACF;EAEA,MAAM,eAAe,OAAO,MAAM,YAAY,WAAW,MAAM,QAAQ,KAAK,IAAI;EAEhF,IAAI,MAAM,WAAW,YAAY,OAAO,WAAW,GAAG;GACpD,MAAM,UAAU,UAAU,gBAAgB,4CAA4C;GACtF,MAAM,cAAc,kBAAkB,OAAO;GAE7C,SAAS,KACP,cAAc;IACZ,MAAM,eAAe;IACrB,QAAQ,cAAc,gBAAgB;IACtC;IACA;GACF,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,iBAAiB,KAAkC;CACjE,MAAM,SAAS,UAAU,GAAG,IAAI,OAAO,IAAI,IAAI,QAAQ,KAAK;CAE5D,IACE,IAAI,WAAW,QACf,IAAI,SAAS,QACb,IAAI,OAAO,KACX,sBAAsB,KAAK,MAAM,GAEjC,OAAO,CACL,cAAc;EACZ,MAAM;EACN,QAAQ;EACR,SAAS,UAAU,IAAI,SAAS,eAAe,IAAI,OAAO,KAAK,eAAe,IAAI,QAAQ,YAAY,IAAI;CAC5G,CAAC,CACH;CAGF,MAAM,cAAc,kBAAkB,MAAM;CAE5C,OAAO,CACL,cAAc;EACZ,MAAM,eAAe;EACrB,QAAQ,cAAc,gBAAgB;EACtC,SAAS;CACX,CAAC,CACH;AACF"}

package/esm/tooling/dev-state/dev-server-state.d.mts

@@ -0,0 +1,43 @@
+//#region ../../packages/core/src/tooling/dev-state/dev-server-state.d.ts
+/** Where `warlock dev` records the address of the running server, under the project root. */
+export declare const DEV_SERVER_STATE_FILE = ".warlock/dev-server.json";
+/**
+ * What a running `warlock dev` worker records about itself, so `warlock trace`
+ * and `warlock mcp` can find it without guessing a port.
+ *
+ * Written once the server is ready, rewritten when `--mcp` starts, and removed
+ * when the worker shuts down. A crashed worker can leave a stale file behind,
+ * so readers confirm the server answers before trusting it.
+ */
+export type DevServerState = {
+  schemaVersion: 1;
+  /** The worker process id (informational: readers never signal it). */
+  pid: number;
+  /** The address to send requests to, e.g. `http://localhost:2030`. */
+  url: string;
+  /** ISO time the worker became ready. */
+  startedAt: string;
+  /** The devtools mount, when `@warlock.js/devtools` was registered. */
+  devtools: {
+    path: string;
+  } | null;
+  /** The MCP endpoint `warlock dev --mcp` serves, when it is on. */
+  mcp: {
+    url: string;
+  } | null;
+};
+/** Narrow parsed JSON to a {@link DevServerState}; `undefined` for anything else. */
+export declare function parseDevServerState(value: unknown): DevServerState | undefined;
+/** The recorded state, or `undefined` when no dev server recorded one. */
+export declare function readDevServerState(cwd?: string): DevServerState | undefined;
+/** Record the state atomically (temp file + rename), creating `.warlock/` when needed. */
+export declare function writeDevServerState(state: DevServerState, cwd?: string): void;
+/** Merge fields into the recorded state; a no-op when there is none. */
+export declare function updateDevServerState(patch: Partial<Omit<DevServerState, "schemaVersion">>, cwd?: string): void;
+/**
+ * Remove the state file — only when it still belongs to `pid`, so a worker
+ * that shuts down late never deletes the record of the worker that replaced it.
+ */
+export declare function removeDevServerState(pid?: number, cwd?: string): void;
+//#endregion
+//# sourceMappingURL=dev-server-state.d.mts.map

package/esm/tooling/dev-state/dev-server-state.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-server-state.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/dev-state/dev-server-state.ts"],"mappings":";;qBAIa;;;;;;;;;YAUD;EACV;;EAEA;;EAEA;;EAEA;;EAEA;IAAY;;;EAEZ;IAAO;;;;wBAYO,oBAAoB,iBAAiB;;wBAsBrC,mBAAmB,eAAsB;;wBAazC,oBAAoB,OAAO,gBAAgB;;wBAU3C,qBACd,OAAO,QAAQ,KAAK,mCACpB;;;;;wBAac,qBAAqB,cAAmB"}