@warlock.js/core 5.31.0 → 5.32.0

package/esm/tooling/check/security-conventions.mjs

@@ -1,12 +1,12 @@
 import { isAuthGuardName, isMutatingHttpMethod } from "../../router/route-guard-names.mjs";
+import { expressionOf, isArrayLiteralExpression, isArrowFunction, isAsExpression, isAwaitExpression, isBinaryExpression, isCallExpression, isConditionalExpression, isElementAccessExpression, isFunctionExpression, isIdentifier, isIfStatement, isJsxAttribute, isJsxExpression, isJsxOpeningElement, isJsxSelfClosingElement, isNewExpression, isNonNullExpression, isObjectLiteralExpression, isOmittedExpression, isParenthesizedExpression, isPropertyAssignment, isRegularExpressionLiteral, isSatisfiesExpression, isShorthandPropertyAssignment, isSpreadAssignment, isSpreadElement, isTemplateExpression, isTypeAssertionExpression, isVariableDeclaration, nameNode, parentOf, valueText } from "../syntax/ast.mjs";
 import { ancestors, calleeName, isFunctionLike, isMemberAccess, keyName, literalString, memberName, referencesOf, resolveInitializer, rootIdentifier, unwrap, walk } from "./source-ast.mjs";
 import { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, requestMemberAccess } from "./request-input.mjs";
 import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from "@warlock.js/logger";
-import ts from "typescript";
 
 //#region ../../packages/core/src/tooling/check/security-conventions.ts
 /** Request methods that return every input the client sent, validated or not. */
-const UNFILTERED_METHODS = new Set([
+const UNFILTERED_METHODS = /* @__PURE__ */ new Set([
 	"all",
 	"allExceptParams",
 	"heavy",
@@ -16,7 +16,7 @@ const UNFILTERED_METHODS = new Set([
 * Responses and loggers are not the data sinks `WL9005` guards: echoing input
 * back is not mass assignment, and logging it is `WL9008`'s concern.
 */
-const IGNORED_RECEIVERS = new Set([
+const IGNORED_RECEIVERS = /* @__PURE__ */ new Set([
 	"response",
 	"reply",
 	"res",
@@ -26,11 +26,11 @@ const IGNORED_RECEIVERS = new Set([
 ]);
 function displayCallee(callee) {
 	const target = unwrap(callee);
-	if (ts.isIdentifier(target)) return `${target.text}()`;
+	if (isIdentifier(target)) return `${valueText(target)}()`;
 	if (isMemberAccess(target)) {
 		const name = memberName(target);
-		const object = unwrap(target.expression);
-		const owner = ts.isIdentifier(object) ? `${object.text}.` : "";
+		const object = unwrap(expressionOf(target));
+		const owner = isIdentifier(object) ? `${valueText(object)}.` : "";
 		return name ? `${owner}${name}()` : "a call";
 	}
 	return "a call";
@@ -38,21 +38,21 @@ function displayCallee(callee) {
 function isIgnoredReceiver(callee) {
 	const target = unwrap(callee);
 	if (!isMemberAccess(target)) return false;
-	const object = unwrap(target.expression);
-	return ts.isIdentifier(object) && IGNORED_RECEIVERS.has(object.text);
+	const object = unwrap(expressionOf(target));
+	return isIdentifier(object) && IGNORED_RECEIVERS.has(valueText(object));
 }
 /** When `node` flows into a call's arguments, the callee's display name. */
 function callReceiving(node) {
 	let current = node;
 	for (;;) {
-		const parent = current.parent;
+		const parent = parentOf(current);
 		if (!parent) return void 0;
-		if (ts.isCallExpression(parent) || ts.isNewExpression(parent)) {
+		if (isCallExpression(parent) || isNewExpression(parent)) {
 			if (!(parent.arguments ?? []).some((argument) => argument === current)) return void 0;
-			if (isIgnoredReceiver(parent.expression)) return void 0;
-			return displayCallee(parent.expression);
+			if (isIgnoredReceiver(expressionOf(parent))) return void 0;
+			return displayCallee(expressionOf(parent));
 		}
-		if (ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent) || ts.isObjectLiteralExpression(parent) || ts.isArrayLiteralExpression(parent) || ts.isPropertyAssignment(parent) && parent.initializer === current || ts.isShorthandPropertyAssignment(parent) || ts.isAsExpression(parent) || ts.isNonNullExpression(parent) || ts.isSatisfiesExpression(parent) || ts.isTypeAssertionExpression(parent) || ts.isParenthesizedExpression(parent) || ts.isAwaitExpression(parent)) {
+		if (isSpreadElement(parent) || isSpreadAssignment(parent) || isObjectLiteralExpression(parent) || isArrayLiteralExpression(parent) || isPropertyAssignment(parent) && parent.value === current || isShorthandPropertyAssignment(parent) || isAsExpression(parent) || isNonNullExpression(parent) || isSatisfiesExpression(parent) || isTypeAssertionExpression(parent) || isParenthesizedExpression(parent) || isAwaitExpression(parent)) {
 			current = parent;
 			continue;
 		}
@@ -67,18 +67,18 @@ function callReceiving(node) {
 function receivingCall(node) {
 	const direct = callReceiving(node);
 	if (direct) return direct;
-	const parent = node.parent;
-	if (parent && ts.isVariableDeclaration(parent) && parent.initializer === node && ts.isIdentifier(parent.name)) for (const reference of referencesOf(parent)) {
+	const parent = parentOf(node);
+	if (parent && isVariableDeclaration(parent) && parent.init === node && isIdentifier(parent.id)) for (const reference of referencesOf(parent)) {
 		const name = callReceiving(reference);
 		if (name) return name;
 	}
 }
 function checkRequestAll(node, findings) {
-	if (!ts.isCallExpression(node)) return;
-	const callee = unwrap(node.expression);
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
 	if (!isMemberAccess(callee)) return;
-	const object = unwrap(callee.expression);
-	if (!ts.isIdentifier(object) || !REQUEST_NAMES.has(object.text)) return;
+	const object = unwrap(expressionOf(callee));
+	if (!isIdentifier(object) || !REQUEST_NAMES.has(valueText(object))) return;
 	const method = memberName(callee);
 	if (!method || !UNFILTERED_METHODS.has(method)) return;
 	const target = receivingCall(node);
@@ -86,21 +86,21 @@ function checkRequestAll(node, findings) {
 	findings.push({
 		code: "WL9005",
 		node,
-		message: `\`${object.text}.${method}()\` passes every client-sent field to \`${target}\`. Use \`${object.text}.validated()\` so only the fields the validation schema accepted reach it.`
+		message: `\`${valueText(object)}.${method}()\` passes every client-sent field to \`${target}\`. Use \`${valueText(object)}.validated()\` so only the fields the validation schema accepted reach it.`
 	});
 }
-const ROUTER_NAMES = new Set(["router"]);
+const ROUTER_NAMES = /* @__PURE__ */ new Set(["router"]);
 /** Wrappers whose callback routes are guarded, e.g. `guarded(() => …)`. */
-const GUARD_FUNCTIONS = new Set(["guarded"]);
+const GUARD_FUNCTIONS = /* @__PURE__ */ new Set(["guarded"]);
 /** `router.post(…)` and friends. */
-const MUTATING_ROUTER_METHODS = new Set([
+const MUTATING_ROUTER_METHODS = /* @__PURE__ */ new Set([
 	"post",
 	"put",
 	"patch",
 	"delete"
 ]);
 /** Route builder methods (`router.route(path).create(…)`) that register a mutating route. */
-const MUTATING_BUILDER_METHODS = new Set([
+const MUTATING_BUILDER_METHODS = /* @__PURE__ */ new Set([
 	"post",
 	"postOne",
 	"put",
@@ -113,14 +113,14 @@ const MUTATING_BUILDER_METHODS = new Set([
 	"update",
 	"destroy"
 ]);
-const READ_ONLY_RESOURCE_METHODS = new Set([
+const READ_ONLY_RESOURCE_METHODS = /* @__PURE__ */ new Set([
 	"list",
 	"get",
 	"show"
 ]);
 function isRouter(node) {
 	const target = unwrap(node);
-	return ts.isIdentifier(target) && ROUTER_NAMES.has(target.text);
+	return isIdentifier(target) && ROUTER_NAMES.has(valueText(target));
 }
 function isGuardName(name) {
 	return name !== void 0 && isAuthGuardName(name);
@@ -129,16 +129,17 @@ function isGuardName(name) {
 function isMarkedGuard(identifier) {
 	const initializer = resolveInitializer(identifier);
 	const value = initializer ? unwrap(initializer) : void 0;
-	return value !== void 0 && ts.isCallExpression(value) && calleeName(value) === "markAuthGuard" && value.arguments[1]?.kind !== ts.SyntaxKind.FalseKeyword;
+	return value !== void 0 && isCallExpression(value) && calleeName(value) === "markAuthGuard" && !(value.arguments[1]?.type === "Literal" && value.arguments[1].value === false);
 }
 function middlewareHasGuard(node) {
 	const value = unwrap(node);
-	if (!ts.isArrayLiteralExpression(value)) return true;
+	if (!isArrayLiteralExpression(value)) return true;
 	return value.elements.some((element) => {
-		if (ts.isSpreadElement(element)) return true;
+		if (!element) return false;
+		if (isSpreadElement(element)) return true;
 		const item = unwrap(element);
-		if (ts.isIdentifier(item)) return isGuardName(item.text) || isMarkedGuard(item);
-		if (ts.isCallExpression(item)) return isGuardName(calleeName(item));
+		if (isIdentifier(item)) return isGuardName(valueText(item)) || isMarkedGuard(item);
+		if (isCallExpression(item)) return isGuardName(calleeName(item));
 		if (isMemberAccess(item)) return isGuardName(memberName(item));
 		return false;
 	});
@@ -147,24 +148,24 @@ function middlewareHasGuard(node) {
 function optionsGuard(node) {
 	if (!node) return "none";
 	const value = unwrap(node);
-	if (!ts.isObjectLiteralExpression(value)) return "guarded";
+	if (!isObjectLiteralExpression(value)) return "guarded";
 	let verdict = "unguarded";
 	for (const property of value.properties) {
-		if (ts.isSpreadAssignment(property)) {
+		if (isSpreadAssignment(property)) {
 			verdict = "guarded";
 			continue;
 		}
 		let key;
 		let propertyValue;
-		if (ts.isPropertyAssignment(property)) {
-			key = keyName(property.name);
-			propertyValue = unwrap(property.initializer);
-		} else if (ts.isShorthandPropertyAssignment(property)) {
-			key = property.name.text;
-			propertyValue = property.name;
+		if (isPropertyAssignment(property)) {
+			key = keyName(property.key);
+			propertyValue = unwrap(property.value);
+		} else if (isShorthandPropertyAssignment(property)) {
+			key = valueText(property.key);
+			propertyValue = property.key;
 		}
 		if (!propertyValue) continue;
-		if (key === "public" && propertyValue.kind === ts.SyntaxKind.TrueKeyword) return "guarded";
+		if (key === "public" && propertyValue.type === "Literal" && propertyValue.value === true) return "guarded";
 		if (key === "middleware" && middlewareHasGuard(propertyValue)) return "guarded";
 	}
 	return verdict;
@@ -172,14 +173,14 @@ function optionsGuard(node) {
 /** Whether an enclosing function is a guarded (or public) group callback. */
 function insideGuardedGroup(node) {
 	for (const ancestor of ancestors(node)) {
-		if (!ts.isArrowFunction(ancestor) && !ts.isFunctionExpression(ancestor)) continue;
-		const parent = ancestor.parent;
-		if (!parent || !ts.isCallExpression(parent)) continue;
+		if (!isArrowFunction(ancestor) && !isFunctionExpression(ancestor)) continue;
+		const parent = parentOf(ancestor);
+		if (!parent || !isCallExpression(parent)) continue;
 		if (!parent.arguments.some((argument) => argument === ancestor)) continue;
 		const name = calleeName(parent);
 		if (name !== void 0 && GUARD_FUNCTIONS.has(name)) return true;
-		const callee = unwrap(parent.expression);
-		if (isMemberAccess(callee) && memberName(callee) === "group" && isRouter(callee.expression) && optionsGuard(parent.arguments[0]) === "guarded") return true;
+		const callee = unwrap(expressionOf(parent));
+		if (isMemberAccess(callee) && memberName(callee) === "group" && isRouter(expressionOf(callee)) && optionsGuard(parent.arguments[0]) === "guarded") return true;
 	}
 	return false;
 }
@@ -193,11 +194,11 @@ function pathText(node) {
 function builderChain(node) {
 	const optionNodes = [];
 	let current = unwrap(node);
-	while (ts.isCallExpression(current)) {
-		const callee = unwrap(current.expression);
+	while (isCallExpression(current)) {
+		const callee = unwrap(expressionOf(current));
 		if (!isMemberAccess(callee)) return void 0;
 		const name = memberName(callee);
-		if (name === "route" && isRouter(callee.expression)) {
+		if (name === "route" && isRouter(expressionOf(callee))) {
 			const options = current.arguments[1];
 			if (options) optionNodes.push(options);
 			return {
@@ -209,18 +210,19 @@ function builderChain(node) {
 			const options = current.arguments[1];
 			if (options) optionNodes.push(options);
 		}
-		current = unwrap(callee.expression);
+		current = unwrap(expressionOf(callee));
 	}
 }
 function resourceIsReadOnly(node) {
 	if (!node) return false;
 	const value = unwrap(node);
-	if (!ts.isObjectLiteralExpression(value)) return false;
+	if (!isObjectLiteralExpression(value)) return false;
 	for (const property of value.properties) {
-		if (!ts.isPropertyAssignment(property) || keyName(property.name) !== "only") continue;
-		const only = unwrap(property.initializer);
-		if (!ts.isArrayLiteralExpression(only)) return false;
+		if (!isPropertyAssignment(property) || keyName(property.key) !== "only") continue;
+		const only = unwrap(property.value);
+		if (!isArrayLiteralExpression(only)) return false;
 		return only.elements.every((element) => {
+			if (!element) return false;
 			const method = literalString(element);
 			return method !== void 0 && READ_ONLY_RESOURCE_METHODS.has(method);
 		});
@@ -235,13 +237,13 @@ function unguardedRoute(node, route) {
 	};
 }
 function checkRouteGuard(node, findings) {
-	if (!ts.isCallExpression(node)) return;
-	const callee = unwrap(node.expression);
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
 	if (!isMemberAccess(callee)) return;
 	const method = memberName(callee);
 	if (!method) return;
 	const guarded = (options) => optionsGuard(options) === "guarded" || insideGuardedGroup(node);
-	if (isRouter(callee.expression)) {
+	if (isRouter(expressionOf(callee))) {
 		if (MUTATING_ROUTER_METHODS.has(method)) {
 			if (!guarded(node.arguments[2])) findings.push(unguardedRoute(node, `${method.toUpperCase()} ${pathText(node.arguments[0])}`));
 			return;
@@ -259,7 +261,7 @@ function checkRouteGuard(node, findings) {
 		return;
 	}
 	if (!MUTATING_BUILDER_METHODS.has(method)) return;
-	const chain = builderChain(callee.expression);
+	const chain = builderChain(expressionOf(callee));
 	if (!chain) return;
 	if (optionsGuard(node.arguments[1]) === "guarded") return;
 	if (chain.optionNodes.some((options) => optionsGuard(options) === "guarded")) return;
@@ -267,37 +269,37 @@ function checkRouteGuard(node, findings) {
 	findings.push(unguardedRoute(node, `${method} ${chain.path}`));
 }
 /** Calls that turn their first argument into a redirect or a navigation. */
-const REDIRECT_CALLS = new Set([
+const REDIRECT_CALLS = /* @__PURE__ */ new Set([
 	"redirect",
 	"permanentRedirect",
 	"navigateTo"
 ]);
 /** Components whose `to`/`href` prop navigates. */
-const LINK_COMPONENTS = new Set(["Link", "NavLink"]);
+const LINK_COMPONENTS = /* @__PURE__ */ new Set(["Link", "NavLink"]);
 /** Helpers that return an allowed target (or a fallback) for any input. */
-const REDIRECT_SANITIZERS = new Set(["safeRedirect", "safeRedirectTarget"]);
+const REDIRECT_SANITIZERS = /* @__PURE__ */ new Set(["safeRedirect", "safeRedirectTarget"]);
 /** Predicates that, used in an enclosing `if` or `? :`, prove the target was checked. */
-const REDIRECT_VALIDATORS = new Set(["isSafeRedirect", "isSafeRedirectUrl"]);
+const REDIRECT_VALIDATORS = /* @__PURE__ */ new Set(["isSafeRedirect", "isSafeRedirectUrl"]);
 /** Client-side input: query-string hooks. */
-const CLIENT_INPUT_CALLS = new Set([
+const CLIENT_INPUT_CALLS = /* @__PURE__ */ new Set([
 	"useQueryString",
 	"useSearchParams",
 	"useParams"
 ]);
 /** Identifiers whose members are client-controlled (a loader's `query`, URLSearchParams). */
-const CLIENT_INPUT_NAMES = new Set(["query", "searchParams"]);
+const CLIENT_INPUT_NAMES = /* @__PURE__ */ new Set(["query", "searchParams"]);
 function isClientSource(node) {
-	if (ts.isCallExpression(node)) {
+	if (isCallExpression(node)) {
 		const name = calleeName(node);
 		if (name !== void 0 && CLIENT_INPUT_CALLS.has(name)) return true;
 	}
 	if (isMemberAccess(node)) {
 		const root = rootIdentifier(node);
-		if (root && CLIENT_INPUT_NAMES.has(root.text)) return true;
+		if (root && CLIENT_INPUT_NAMES.has(valueText(root))) return true;
 		const name = memberName(node);
 		if (name === "search" || name === "hash") {
-			const object = unwrap(node.expression);
-			if (ts.isIdentifier(object) && object.text === "location") return true;
+			const object = unwrap(expressionOf(node));
+			if (isIdentifier(object) && valueText(object) === "location") return true;
 			if (isMemberAccess(object) && memberName(object) === "location") return true;
 		}
 	}
@@ -313,12 +315,12 @@ function isRedirectTainted(node) {
 function checkedByValidator(node) {
 	for (const ancestor of ancestors(node)) {
 		let test;
-		if (ts.isIfStatement(ancestor)) test = ancestor.expression;
-		else if (ts.isConditionalExpression(ancestor)) test = ancestor.condition;
+		if (isIfStatement(ancestor)) test = expressionOf(ancestor);
+		else if (isConditionalExpression(ancestor)) test = ancestor.test;
 		else continue;
 		let validated = false;
 		walk(test, (child) => {
-			if (ts.isCallExpression(child)) {
+			if (isCallExpression(child)) {
 				const name = calleeName(child);
 				if (name !== void 0 && REDIRECT_VALIDATORS.has(name)) validated = true;
 			}
@@ -335,37 +337,37 @@ function unsafeRedirect(node, what, helper, from) {
 	};
 }
 function checkRedirect(node, findings) {
-	if (ts.isCallExpression(node)) {
+	if (isCallExpression(node)) {
 		const name = calleeName(node);
 		if (name === void 0 || !REDIRECT_CALLS.has(name)) return;
-		const callee = unwrap(node.expression);
+		const callee = unwrap(expressionOf(node));
 		if (isMemberAccess(callee)) {
-			const owner = unwrap(callee.expression);
-			if (ts.isIdentifier(owner) && owner.text === "router") return;
+			const owner = unwrap(expressionOf(callee));
+			if (isIdentifier(owner) && valueText(owner) === "router") return;
 		}
 		const target = node.arguments[0];
-		if (!target || ts.isSpreadElement(target)) return;
+		if (!target || isSpreadElement(target)) return;
 		if (!isRedirectTainted(target) || checkedByValidator(node)) return;
 		findings.push(name === "navigateTo" ? unsafeRedirect(target, "navigation", "safeRedirectTarget", "@warlock.js/web") : unsafeRedirect(target, "redirect", "safeRedirect", "@warlock.js/core"));
 		return;
 	}
-	if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name)) return;
-	if (node.name.text !== "to" && node.name.text !== "href") return;
-	const element = node.parent.parent;
-	if (!ts.isJsxOpeningElement(element) && !ts.isJsxSelfClosingElement(element)) return;
-	if (!ts.isIdentifier(element.tagName) || !LINK_COMPONENTS.has(element.tagName.text)) return;
-	const initializer = node.initializer;
-	if (!initializer || !ts.isJsxExpression(initializer) || !initializer.expression) return;
+	if (!isJsxAttribute(node) || nameNode(node).type !== "JSXIdentifier") return;
+	if (valueText(nameNode(node)) !== "to" && valueText(nameNode(node)) !== "href") return;
+	const element = parentOf(node);
+	if (!element || !isJsxOpeningElement(element) && !isJsxSelfClosingElement(element)) return;
+	if (element.name.type !== "JSXIdentifier" || !LINK_COMPONENTS.has(element.name.name)) return;
+	const initializer = node.value;
+	if (!initializer || !isJsxExpression(initializer) || !initializer.expression) return;
 	const expression = initializer.expression;
 	if (!isRedirectTainted(expression) || checkedByValidator(expression)) return;
 	findings.push(unsafeRedirect(expression, "link", "safeRedirectTarget", "@warlock.js/web"));
 }
-const LOGGER_NAMES = new Set([
+const LOGGER_NAMES = /* @__PURE__ */ new Set([
 	"log",
 	"logger",
 	"console"
 ]);
-const LOG_METHODS = new Set([
+const LOG_METHODS = /* @__PURE__ */ new Set([
 	"info",
 	"warn",
 	"error",
@@ -377,7 +379,7 @@ const LOG_METHODS = new Set([
 	"trace"
 ]);
 /** Helpers that make a value safe to log; their arguments are not inspected. */
-const REDACTORS = new Set([
+const REDACTORS = /* @__PURE__ */ new Set([
 	"maskEmail",
 	"maskEmailsInText",
 	"redact",
@@ -427,8 +429,8 @@ function describeMember(member) {
 }
 /** `request.all()` / `request.body` itself, not `request.body.title`. */
 function isWholeAccess(node, member) {
-	if (ts.isCallExpression(node)) {
-		const callee = unwrap(node.expression);
+	if (isCallExpression(node)) {
+		const callee = unwrap(expressionOf(node));
 		return isMemberAccess(callee) && memberName(callee) === member;
 	}
 	return isMemberAccess(node) && memberName(node) === member;
@@ -436,11 +438,11 @@ function isWholeAccess(node, member) {
 function inspectLogged(node, censoredKey, found) {
 	const value = unwrap(node);
 	if (isFunctionLike(value)) return;
-	if (ts.isCallExpression(value)) {
+	if (isCallExpression(value)) {
 		const name = calleeName(value);
 		if (name !== void 0 && REDACTORS.has(name)) return;
 	}
-	if (ts.isCallExpression(value) || isMemberAccess(value)) {
+	if (isCallExpression(value) || isMemberAccess(value)) {
 		const member = requestMemberAccess(value);
 		if (member !== void 0 && isWholeAccess(value, member)) {
 			if (REQUEST_BODY_MEMBERS.has(member)) {
@@ -458,7 +460,7 @@ function inspectLogged(node, censoredKey, found) {
 				return;
 			}
 		}
-		if (ts.isCallExpression(value) && member !== void 0) {
+		if (isCallExpression(value) && member !== void 0) {
 			const key = literalString(value.arguments[0]);
 			const category = key ? sensitiveCategory(key) : void 0;
 			if (category && !(censoredKey && category === "secret")) {
@@ -470,8 +472,8 @@ function inspectLogged(node, censoredKey, found) {
 			}
 		}
 	}
-	if (ts.isIdentifier(value) || isMemberAccess(value)) {
-		const name = ts.isIdentifier(value) ? value.text : memberName(value);
+	if (isIdentifier(value) || isMemberAccess(value)) {
+		const name = isIdentifier(value) ? valueText(value) : memberName(value);
 		const category = name ? sensitiveCategory(name) : void 0;
 		if (category && !(censoredKey && category === "secret")) {
 			found.push({
@@ -481,59 +483,59 @@ function inspectLogged(node, censoredKey, found) {
 			return;
 		}
 		if (isMemberAccess(value) && requestMemberAccess(value) === void 0) {
-			inspectLogged(value.expression, false, found);
-			if (ts.isElementAccessExpression(value)) inspectLogged(value.argumentExpression, false, found);
+			inspectLogged(expressionOf(value), false, found);
+			if (isElementAccessExpression(value)) inspectLogged(value.property, false, found);
 		}
 		return;
 	}
-	if (ts.isObjectLiteralExpression(value)) {
-		for (const property of value.properties) if (ts.isSpreadAssignment(property)) inspectLogged(property.expression, false, found);
-		else if (ts.isPropertyAssignment(property)) {
-			const key = keyName(property.name);
-			inspectLogged(property.initializer, key !== void 0 && isCensoredKey(key), found);
-		} else if (ts.isShorthandPropertyAssignment(property)) inspectLogged(property.name, isCensoredKey(property.name.text), found);
+	if (isObjectLiteralExpression(value)) {
+		for (const property of value.properties) if (isSpreadAssignment(property)) inspectLogged(expressionOf(property), false, found);
+		else if (isPropertyAssignment(property)) {
+			const key = keyName(property.key);
+			inspectLogged(property.value, key !== void 0 && isCensoredKey(key), found);
+		} else if (isShorthandPropertyAssignment(property)) inspectLogged(property.key, isCensoredKey(valueText(property.key)), found);
 		return;
 	}
-	if (ts.isTemplateExpression(value)) {
-		for (const span of value.templateSpans) inspectLogged(span.expression, false, found);
+	if (isTemplateExpression(value)) {
+		for (const expression of value.expressions) inspectLogged(expression, false, found);
 		return;
 	}
-	if (ts.isBinaryExpression(value)) {
+	if (isBinaryExpression(value)) {
 		inspectLogged(value.left, false, found);
 		inspectLogged(value.right, false, found);
 		return;
 	}
-	if (ts.isConditionalExpression(value)) {
-		inspectLogged(value.whenTrue, censoredKey, found);
-		inspectLogged(value.whenFalse, censoredKey, found);
+	if (isConditionalExpression(value)) {
+		inspectLogged(value.consequent, censoredKey, found);
+		inspectLogged(value.alternate, censoredKey, found);
 		return;
 	}
-	if (ts.isArrayLiteralExpression(value)) {
+	if (isArrayLiteralExpression(value)) {
 		for (const element of value.elements) {
-			if (ts.isOmittedExpression(element)) continue;
-			inspectLogged(ts.isSpreadElement(element) ? element.expression : element, false, found);
+			if (isOmittedExpression(element)) continue;
+			inspectLogged(isSpreadElement(element) ? expressionOf(element) : element, false, found);
 		}
 		return;
 	}
-	if (ts.isCallExpression(value)) {
-		const callee = unwrap(value.expression);
-		if (isMemberAccess(callee)) inspectLogged(callee.expression, false, found);
-		for (const argument of value.arguments) inspectLogged(ts.isSpreadElement(argument) ? argument.expression : argument, false, found);
+	if (isCallExpression(value)) {
+		const callee = unwrap(expressionOf(value));
+		if (isMemberAccess(callee)) inspectLogged(expressionOf(callee), false, found);
+		for (const argument of value.arguments) inspectLogged(isSpreadElement(argument) ? expressionOf(argument) : argument, false, found);
 		return;
 	}
-	if (ts.isAwaitExpression(value)) inspectLogged(value.expression, censoredKey, found);
+	if (isAwaitExpression(value)) inspectLogged(expressionOf(value), censoredKey, found);
 }
 function checkSensitiveLog(node, findings) {
-	if (!ts.isCallExpression(node)) return;
-	const callee = unwrap(node.expression);
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
 	if (!isMemberAccess(callee)) return;
 	const method = memberName(callee);
 	if (!method || !LOG_METHODS.has(method)) return;
-	const owner = unwrap(callee.expression);
-	if (!ts.isIdentifier(owner)) return;
-	if (!(LOGGER_NAMES.has(owner.text) || REQUEST_NAMES.has(owner.text) && method === "log")) return;
+	const owner = unwrap(expressionOf(callee));
+	if (!isIdentifier(owner)) return;
+	if (!(LOGGER_NAMES.has(valueText(owner)) || REQUEST_NAMES.has(valueText(owner)) && method === "log")) return;
 	const found = [];
-	for (const argument of node.arguments) inspectLogged(ts.isSpreadElement(argument) ? argument.expression : argument, false, found);
+	for (const argument of node.arguments) inspectLogged(isSpreadElement(argument) ? expressionOf(argument) : argument, false, found);
 	for (const finding of found) findings.push({
 		code: "WL9008",
 		node: finding.node,
@@ -541,9 +543,9 @@ function checkSensitiveLog(node, findings) {
 	});
 }
 /** `regex.test(input)` / `regex.exec(input)`. */
-const REGEX_METHODS = new Set(["test", "exec"]);
+const REGEX_METHODS = /* @__PURE__ */ new Set(["test", "exec"]);
 /** `input.match(regex)` and friends: the regex is the first argument. */
-const STRING_METHODS = new Set([
+const STRING_METHODS = /* @__PURE__ */ new Set([
 	"match",
 	"matchAll",
 	"replace",
@@ -583,29 +585,29 @@ function findUnboundedQuantifier(source) {
 function regexSource(node, depth = 0) {
 	if (!node || depth > 8) return void 0;
 	const value = unwrap(node);
-	if (ts.isRegularExpressionLiteral(value)) return value.text.slice(1, value.text.lastIndexOf("/"));
-	if ((ts.isNewExpression(value) || ts.isCallExpression(value)) && ts.isIdentifier(value.expression) && value.expression.text === "RegExp") return literalString(value.arguments?.[0]);
-	if (ts.isIdentifier(value)) {
+	if (isRegularExpressionLiteral(value)) return valueText(value).slice(1, valueText(value).lastIndexOf("/"));
+	if ((isNewExpression(value) || isCallExpression(value)) && isIdentifier(expressionOf(value)) && valueText(expressionOf(value)) === "RegExp") return literalString(value.arguments?.[0]);
+	if (isIdentifier(value)) {
 		const initializer = resolveInitializer(value);
 		return initializer ? regexSource(initializer, depth + 1) : void 0;
 	}
 }
 function checkUnboundedRegex(node, findings) {
-	if (!ts.isCallExpression(node)) return;
-	const callee = unwrap(node.expression);
+	if (!isCallExpression(node)) return;
+	const callee = unwrap(expressionOf(node));
 	if (!isMemberAccess(callee)) return;
 	const method = memberName(callee);
 	if (!method) return;
 	const first = node.arguments[0];
-	const firstArgument = first && !ts.isSpreadElement(first) ? first : void 0;
+	const firstArgument = first && !isSpreadElement(first) ? first : void 0;
 	let regex;
 	let input;
 	if (REGEX_METHODS.has(method)) {
-		regex = callee.expression;
+		regex = expressionOf(callee);
 		input = firstArgument;
 	} else if (STRING_METHODS.has(method)) {
 		regex = firstArgument;
-		input = callee.expression;
+		input = expressionOf(callee);
 	} else return;
 	if (!input) return;
 	const source = regexSource(regex);
@@ -644,5 +646,5 @@ function securityFindings(sourceFile) {
 }
 
 //#endregion
-export { securityFindings };
+export { findUnboundedQuantifier, securityFindings };
 //# sourceMappingURL=security-conventions.mjs.map