@warlock.js/core 5.31.0 → 5.32.0

package/esm/tooling/check/security-conventions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security-conventions.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/security-conventions.ts"],"sourcesContent":["import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from \"@warlock.js/logger\";\nimport ts from \"typescript\";\nimport { isAuthGuardName, isMutatingHttpMethod } from \"../../router/route-guard-names\";\nimport {\n  containsRequestInput,\n  REQUEST_BODY_MEMBERS,\n  REQUEST_NAMES,\n  requestMemberAccess,\n} from \"./request-input\";\nimport {\n  ancestors,\n  calleeName,\n  isFunctionLike,\n  isMemberAccess,\n  keyName,\n  literalString,\n  memberName,\n  referencesOf,\n  resolveInitializer,\n  rootIdentifier,\n  type SourceFinding,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n// ── WL9005: request.all() into a query, a service or inApp() ────────────────\n\n/** Request methods that return every input the client sent, validated or not. */\nconst UNFILTERED_METHODS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n]);\n\n/**\n * Responses and loggers are not the data sinks `WL9005` guards: echoing input\n * back is not mass assignment, and logging it is `WL9008`'s concern.\n */\nconst IGNORED_RECEIVERS: ReadonlySet<string> = new Set([\n  \"response\",\n  \"reply\",\n  \"res\",\n  \"console\",\n  \"log\",\n  \"logger\",\n]);\n\nfunction displayCallee(callee: ts.Node): string {\n  const target = unwrap(callee);\n\n  if (ts.isIdentifier(target)) return `${target.text}()`;\n\n  if (isMemberAccess(target)) {\n    const name = memberName(target);\n    const object = unwrap(target.expression);\n    const owner = ts.isIdentifier(object) ? `${object.text}.` : \"\";\n\n    return name ? `${owner}${name}()` : \"a call\";\n  }\n\n  return \"a call\";\n}\n\nfunction isIgnoredReceiver(callee: ts.Node): boolean {\n  const target = unwrap(callee);\n\n  if (!isMemberAccess(target)) return false;\n\n  const object = unwrap(target.expression);\n\n  return ts.isIdentifier(object) && IGNORED_RECEIVERS.has(object.text);\n}\n\n/** When `node` flows into a call's arguments, the callee's display name. */\nfunction callReceiving(node: ts.Node): string | undefined {\n  let current = node;\n\n  for (;;) {\n    const parent = current.parent;\n\n    if (!parent) return undefined;\n\n    if (ts.isCallExpression(parent) || ts.isNewExpression(parent)) {\n      if (!(parent.arguments ?? []).some((argument) => argument === current)) return undefined;\n      if (isIgnoredReceiver(parent.expression)) return undefined;\n\n      return displayCallee(parent.expression);\n    }\n\n    if (\n      ts.isSpreadElement(parent) ||\n      ts.isSpreadAssignment(parent) ||\n      ts.isObjectLiteralExpression(parent) ||\n      ts.isArrayLiteralExpression(parent) ||\n      (ts.isPropertyAssignment(parent) && parent.initializer === current) ||\n      ts.isShorthandPropertyAssignment(parent) ||\n      ts.isAsExpression(parent) ||\n      ts.isNonNullExpression(parent) ||\n      ts.isSatisfiesExpression(parent) ||\n      ts.isTypeAssertionExpression(parent) ||\n      ts.isParenthesizedExpression(parent) ||\n      ts.isAwaitExpression(parent)\n    ) {\n      current = parent;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/**\n * The call that ends up receiving this value: directly as an argument, spread\n * into an object/array argument, or through a local constant later passed to\n * a call.\n */\nfunction receivingCall(node: ts.Node): string | undefined {\n  const direct = callReceiving(node);\n\n  if (direct) return direct;\n\n  // `const data = request.all(); await Model.create(data);`\n  const parent = node.parent;\n\n  if (\n    parent &&\n    ts.isVariableDeclaration(parent) &&\n    parent.initializer === node &&\n    ts.isIdentifier(parent.name)\n  ) {\n    for (const reference of referencesOf(parent)) {\n      const name = callReceiving(reference);\n      if (name) return name;\n    }\n  }\n\n  return undefined;\n}\n\nfunction checkRequestAll(node: ts.Node, findings: SourceFinding[]): void {\n  if (!ts.isCallExpression(node)) return;\n\n  const callee = unwrap(node.expression);\n\n  if (!isMemberAccess(callee)) return;\n\n  const object = unwrap(callee.expression);\n\n  if (!ts.isIdentifier(object) || !REQUEST_NAMES.has(object.text)) return;\n\n  const method = memberName(callee);\n\n  if (!method || !UNFILTERED_METHODS.has(method)) return;\n\n  const target = receivingCall(node);\n\n  if (!target) return;\n\n  findings.push({\n    code: \"WL9005\",\n    node,\n    message: `\\`${object.text}.${method}()\\` passes every client-sent field to \\`${target}\\`. Use \\`${object.text}.validated()\\` so only the fields the validation schema accepted reach it.`,\n  });\n}\n\n// ── WL9006: a mutating route with no auth guard and no public: true ─────────\n\nconst ROUTER_NAMES: ReadonlySet<string> = new Set([\"router\"]);\n\n/** Wrappers whose callback routes are guarded, e.g. `guarded(() => …)`. */\nconst GUARD_FUNCTIONS: ReadonlySet<string> = new Set([\"guarded\"]);\n\n/** `router.post(…)` and friends. */\nconst MUTATING_ROUTER_METHODS: ReadonlySet<string> = new Set([\"post\", \"put\", \"patch\", \"delete\"]);\n\n/** Route builder methods (`router.route(path).create(…)`) that register a mutating route. */\nconst MUTATING_BUILDER_METHODS: ReadonlySet<string> = new Set([\n  \"post\",\n  \"postOne\",\n  \"put\",\n  \"updateOne\",\n  \"patch\",\n  \"patchOne\",\n  \"delete\",\n  \"deleteOne\",\n  \"create\",\n  \"update\",\n  \"destroy\",\n]);\n\nconst READ_ONLY_RESOURCE_METHODS: ReadonlySet<string> = new Set([\"list\", \"get\", \"show\"]);\n\nfunction isRouter(node: ts.Node): boolean {\n  const target = unwrap(node);\n\n  return ts.isIdentifier(target) && ROUTER_NAMES.has(target.text);\n}\n\nfunction isGuardName(name: string | undefined): boolean {\n  return name !== undefined && isAuthGuardName(name);\n}\n\n/** Whether a constant is initialised with `markAuthGuard(fn)` (not `markAuthGuard(fn, false)`). */\nfunction isMarkedGuard(identifier: ts.Identifier): boolean {\n  const initializer = resolveInitializer(identifier);\n  const value = initializer ? unwrap(initializer) : undefined;\n\n  return (\n    value !== undefined &&\n    ts.isCallExpression(value) &&\n    calleeName(value) === \"markAuthGuard\" &&\n    value.arguments[1]?.kind !== ts.SyntaxKind.FalseKeyword\n  );\n}\n\nfunction middlewareHasGuard(node: ts.Node): boolean {\n  const value = unwrap(node);\n\n  // A variable or a call: the check cannot see into it, so it trusts it.\n  if (!ts.isArrayLiteralExpression(value)) return true;\n\n  return value.elements.some((element) => {\n    if (ts.isSpreadElement(element)) return true;\n\n    const item = unwrap(element);\n\n    if (ts.isIdentifier(item)) return isGuardName(item.text) || isMarkedGuard(item);\n    if (ts.isCallExpression(item)) return isGuardName(calleeName(item));\n    if (isMemberAccess(item)) return isGuardName(memberName(item));\n\n    return false;\n  });\n}\n\n/** `public: true`, a guard in `middleware`, or an options value the check cannot see into. */\nfunction optionsGuard(node: ts.Node | undefined): \"guarded\" | \"unguarded\" | \"none\" {\n  if (!node) return \"none\";\n\n  const value = unwrap(node);\n\n  if (!ts.isObjectLiteralExpression(value)) return \"guarded\";\n\n  let verdict: \"guarded\" | \"unguarded\" = \"unguarded\";\n\n  for (const property of value.properties) {\n    if (ts.isSpreadAssignment(property)) {\n      verdict = \"guarded\";\n      continue;\n    }\n\n    let key: string | undefined;\n    let propertyValue: ts.Node | undefined;\n\n    if (ts.isPropertyAssignment(property)) {\n      key = keyName(property.name);\n      propertyValue = unwrap(property.initializer);\n    } else if (ts.isShorthandPropertyAssignment(property)) {\n      key = property.name.text;\n      propertyValue = property.name;\n    }\n\n    if (!propertyValue) continue;\n    if (key === \"public\" && propertyValue.kind === ts.SyntaxKind.TrueKeyword) return \"guarded\";\n    if (key === \"middleware\" && middlewareHasGuard(propertyValue)) return \"guarded\";\n  }\n\n  return verdict;\n}\n\n/** Whether an enclosing function is a guarded (or public) group callback. */\nfunction insideGuardedGroup(node: ts.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    if (!ts.isArrowFunction(ancestor) && !ts.isFunctionExpression(ancestor)) continue;\n\n    const parent = ancestor.parent;\n\n    if (!parent || !ts.isCallExpression(parent)) continue;\n    if (!parent.arguments.some((argument) => argument === ancestor)) continue;\n\n    const name = calleeName(parent);\n\n    if (name !== undefined && GUARD_FUNCTIONS.has(name)) return true;\n\n    const callee = unwrap(parent.expression);\n\n    if (\n      isMemberAccess(callee) &&\n      memberName(callee) === \"group\" &&\n      isRouter(callee.expression) &&\n      optionsGuard(parent.arguments[0]) === \"guarded\"\n    ) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nfunction pathText(node: ts.Node | undefined): string {\n  return literalString(node) ?? \"(dynamic path)\";\n}\n\n/**\n * Walk a builder chain back to `router.route(path, options)`, collecting every\n * options object passed along the way (`route()`, `nest()`).\n */\nfunction builderChain(node: ts.Node): { path: string; optionNodes: ts.Node[] } | undefined {\n  const optionNodes: ts.Node[] = [];\n  let current = unwrap(node);\n\n  while (ts.isCallExpression(current)) {\n    const callee = unwrap(current.expression);\n\n    if (!isMemberAccess(callee)) return undefined;\n\n    const name = memberName(callee);\n\n    if (name === \"route\" && isRouter(callee.expression)) {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n\n      return { path: pathText(current.arguments[0]), optionNodes };\n    }\n\n    if (name === \"nest\") {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n    }\n\n    current = unwrap(callee.expression);\n  }\n\n  return undefined;\n}\n\nfunction resourceIsReadOnly(node: ts.Node | undefined): boolean {\n  if (!node) return false;\n\n  const value = unwrap(node);\n\n  if (!ts.isObjectLiteralExpression(value)) return false;\n\n  for (const property of value.properties) {\n    if (!ts.isPropertyAssignment(property) || keyName(property.name) !== \"only\") continue;\n\n    const only = unwrap(property.initializer);\n\n    if (!ts.isArrayLiteralExpression(only)) return false;\n\n    return only.elements.every((element) => {\n      const method = literalString(element);\n      return method !== undefined && READ_ONLY_RESOURCE_METHODS.has(method);\n    });\n  }\n\n  return false;\n}\n\nfunction unguardedRoute(node: ts.Node, route: string): SourceFinding {\n  return {\n    code: \"WL9006\",\n    node,\n    message: `Mutating route \\`${route}\\` has no auth middleware. Add an auth guard (\\`middleware: [authMiddleware()]\\`, or register it inside a guarded group) or mark it intentionally open with \\`public: true\\`.`,\n  };\n}\n\nfunction checkRouteGuard(node: ts.Node, findings: SourceFinding[]): void {\n  if (!ts.isCallExpression(node)) return;\n\n  const callee = unwrap(node.expression);\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const guarded = (options: ts.Node | undefined) =>\n    optionsGuard(options) === \"guarded\" || insideGuardedGroup(node);\n\n  if (isRouter(callee.expression)) {\n    // router.post(path, handler, options)\n    if (MUTATING_ROUTER_METHODS.has(method)) {\n      if (!guarded(node.arguments[2])) {\n        findings.push(\n          unguardedRoute(node, `${method.toUpperCase()} ${pathText(node.arguments[0])}`),\n        );\n      }\n\n      return;\n    }\n\n    // router.add(\"POST\", path, handler, options)\n    if (method === \"add\") {\n      const httpMethod = literalString(node.arguments[0])?.toUpperCase();\n\n      if (!httpMethod || !isMutatingHttpMethod(httpMethod)) return;\n\n      if (!guarded(node.arguments[3])) {\n        findings.push(unguardedRoute(node, `${httpMethod} ${pathText(node.arguments[1])}`));\n      }\n\n      return;\n    }\n\n    // router.restfulResource(path, resource, options)\n    if (method === \"restfulResource\") {\n      if (resourceIsReadOnly(node.arguments[2])) return;\n\n      if (!guarded(node.arguments[2])) {\n        findings.push(unguardedRoute(node, `resource ${pathText(node.arguments[0])}`));\n      }\n    }\n\n    return;\n  }\n\n  // router.route(path, options).create(handler, options)\n  if (!MUTATING_BUILDER_METHODS.has(method)) return;\n\n  const chain = builderChain(callee.expression);\n\n  if (!chain) return;\n  if (optionsGuard(node.arguments[1]) === \"guarded\") return;\n  if (chain.optionNodes.some((options) => optionsGuard(options) === \"guarded\")) return;\n  if (insideGuardedGroup(node)) return;\n\n  findings.push(unguardedRoute(node, `${method} ${chain.path}`));\n}\n\n// ── WL9007: a redirect or link target from request input ────────────────────\n\n/** Calls that turn their first argument into a redirect or a navigation. */\nconst REDIRECT_CALLS: ReadonlySet<string> = new Set([\n  \"redirect\",\n  \"permanentRedirect\",\n  \"navigateTo\",\n]);\n\n/** Components whose `to`/`href` prop navigates. */\nconst LINK_COMPONENTS: ReadonlySet<string> = new Set([\"Link\", \"NavLink\"]);\n\n/** Helpers that return an allowed target (or a fallback) for any input. */\nconst REDIRECT_SANITIZERS: ReadonlySet<string> = new Set([\"safeRedirect\", \"safeRedirectTarget\"]);\n\n/** Predicates that, used in an enclosing `if` or `? :`, prove the target was checked. */\nconst REDIRECT_VALIDATORS: ReadonlySet<string> = new Set([\"isSafeRedirect\", \"isSafeRedirectUrl\"]);\n\n/** Client-side input: query-string hooks. */\nconst CLIENT_INPUT_CALLS: ReadonlySet<string> = new Set([\n  \"useQueryString\",\n  \"useSearchParams\",\n  \"useParams\",\n]);\n\n/** Identifiers whose members are client-controlled (a loader's `query`, URLSearchParams). */\nconst CLIENT_INPUT_NAMES: ReadonlySet<string> = new Set([\"query\", \"searchParams\"]);\n\nfunction isClientSource(node: ts.Node): boolean {\n  if (ts.isCallExpression(node)) {\n    const name = calleeName(node);\n    if (name !== undefined && CLIENT_INPUT_CALLS.has(name)) return true;\n  }\n\n  if (isMemberAccess(node)) {\n    const root = rootIdentifier(node);\n\n    if (root && CLIENT_INPUT_NAMES.has(root.text)) return true;\n\n    // location.search / window.location.hash\n    const name = memberName(node);\n\n    if (name === \"search\" || name === \"hash\") {\n      const object = unwrap(node.expression);\n\n      if (ts.isIdentifier(object) && object.text === \"location\") return true;\n      if (isMemberAccess(object) && memberName(object) === \"location\") return true;\n    }\n  }\n\n  return false;\n}\n\nfunction isRedirectTainted(node: ts.Node): boolean {\n  return containsRequestInput(node, { sanitizers: REDIRECT_SANITIZERS, isSource: isClientSource });\n}\n\n/** An enclosing `if (isSafeRedirect(x))` or `isSafeRedirect(x) ? … : …` validated the target. */\nfunction checkedByValidator(node: ts.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    let test: ts.Node | undefined;\n\n    if (ts.isIfStatement(ancestor)) test = ancestor.expression;\n    else if (ts.isConditionalExpression(ancestor)) test = ancestor.condition;\n    else continue;\n\n    let validated = false;\n\n    walk(test, (child) => {\n      if (ts.isCallExpression(child)) {\n        const name = calleeName(child);\n        if (name !== undefined && REDIRECT_VALIDATORS.has(name)) validated = true;\n      }\n\n      return undefined;\n    });\n\n    if (validated) return true;\n  }\n\n  return false;\n}\n\nfunction unsafeRedirect(node: ts.Node, what: string, helper: string, from: string): SourceFinding {\n  return {\n    code: \"WL9007\",\n    node,\n    message: `This ${what} target comes from request input. Pass it through \\`${helper}()\\` from \\`${from}\\` so only same-origin paths and allow-listed origins are followed (open redirects and \\`javascript:\\` URLs otherwise).`,\n  };\n}\n\nfunction checkRedirect(node: ts.Node, findings: SourceFinding[]): void {\n  if (ts.isCallExpression(node)) {\n    const name = calleeName(node);\n\n    if (name === undefined || !REDIRECT_CALLS.has(name)) return;\n\n    // `router.redirect(from, to)` registers a static redirect, not a request-time one.\n    const callee = unwrap(node.expression);\n\n    if (isMemberAccess(callee)) {\n      const owner = unwrap(callee.expression);\n      if (ts.isIdentifier(owner) && owner.text === \"router\") return;\n    }\n\n    const target = node.arguments[0];\n\n    if (!target || ts.isSpreadElement(target)) return;\n    if (!isRedirectTainted(target) || checkedByValidator(node)) return;\n\n    findings.push(\n      name === \"navigateTo\"\n        ? unsafeRedirect(target, \"navigation\", \"safeRedirectTarget\", \"@warlock.js/web\")\n        : unsafeRedirect(target, \"redirect\", \"safeRedirect\", \"@warlock.js/core\"),\n    );\n\n    return;\n  }\n\n  if (!ts.isJsxAttribute(node) || !ts.isIdentifier(node.name)) return;\n  if (node.name.text !== \"to\" && node.name.text !== \"href\") return;\n\n  const element = node.parent.parent;\n\n  if (!ts.isJsxOpeningElement(element) && !ts.isJsxSelfClosingElement(element)) return;\n  if (!ts.isIdentifier(element.tagName) || !LINK_COMPONENTS.has(element.tagName.text)) return;\n\n  const initializer = node.initializer;\n\n  if (!initializer || !ts.isJsxExpression(initializer) || !initializer.expression) return;\n\n  const expression = initializer.expression;\n\n  if (!isRedirectTainted(expression) || checkedByValidator(expression)) return;\n\n  findings.push(unsafeRedirect(expression, \"link\", \"safeRedirectTarget\", \"@warlock.js/web\"));\n}\n\n// ── WL9008: raw emails, credentials and request bodies in logs ──────────────\n\nconst LOGGER_NAMES: ReadonlySet<string> = new Set([\"log\", \"logger\", \"console\"]);\n\nconst LOG_METHODS: ReadonlySet<string> = new Set([\n  \"info\",\n  \"warn\",\n  \"error\",\n  \"debug\",\n  \"success\",\n  \"fatal\",\n  \"log\",\n  \"assert\",\n  \"trace\",\n]);\n\n/** Helpers that make a value safe to log; their arguments are not inspected. */\nconst REDACTORS: ReadonlySet<string> = new Set([\n  \"maskEmail\",\n  \"maskEmailsInText\",\n  \"redact\",\n  \"redactHeaders\",\n  \"redactError\",\n  \"redactUrlCredentials\",\n  \"redactQueryCredentials\",\n  \"escapeLogValue\",\n  \"toLogSnapshot\",\n]);\n\n/** Name endings that mark a value as a credential. */\nconst SECRET_SUFFIXES = [\n  \"token\",\n  \"password\",\n  \"passwd\",\n  \"secret\",\n  \"apikey\",\n  \"authorization\",\n  \"cookie\",\n  \"cookies\",\n  \"otp\",\n  \"jwt\",\n  \"privatekey\",\n];\n\n/**\n * Whether the logger censors this key by default (`DEFAULT_REDACT_KEYS` from\n * `@warlock.js/logger`). A secret logged under one of them never reaches a\n * channel. Emails are not on that list: they are not censored by default.\n */\nfunction isCensoredKey(key: string): boolean {\n  return DEFAULT_REDACT_KEY_SET.has(normalizeRedactKey(key));\n}\n\n/** `email` for addresses, `secret` for credentials, otherwise `undefined`. */\nfunction sensitiveCategory(name: string): \"email\" | \"secret\" | undefined {\n  const normalized = normalizeRedactKey(name);\n\n  if (normalized.endsWith(\"email\") || normalized.endsWith(\"emailaddress\")) return \"email\";\n  if (DEFAULT_REDACT_KEY_SET.has(normalized)) return \"secret\";\n  if (SECRET_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return \"secret\";\n\n  return undefined;\n}\n\nfunction describeCategory(category: \"email\" | \"secret\", name: string | undefined): string {\n  if (category === \"email\") return \"a raw email address\";\n\n  return name ? `the credential \\`${name}\\`` : \"a credential\";\n}\n\nfunction describeMember(member: string): string {\n  if (member === \"headers\" || member === \"cookies\") return member;\n\n  return `body (\\`${member}\\`)`;\n}\n\n/** `request.all()` / `request.body` itself, not `request.body.title`. */\nfunction isWholeAccess(node: ts.Node, member: string): boolean {\n  if (ts.isCallExpression(node)) {\n    const callee = unwrap(node.expression);\n    return isMemberAccess(callee) && memberName(callee) === member;\n  }\n\n  return isMemberAccess(node) && memberName(node) === member;\n}\n\ntype LogFinding = { node: ts.Node; what: string };\n\nfunction inspectLogged(node: ts.Node, censoredKey: boolean, found: LogFinding[]): void {\n  const value = unwrap(node);\n\n  if (isFunctionLike(value)) return;\n\n  if (ts.isCallExpression(value)) {\n    const name = calleeName(value);\n    if (name !== undefined && REDACTORS.has(name)) return;\n  }\n\n  // request.all() / request.body / request.headers / request.input(\"email\")\n  if (ts.isCallExpression(value) || isMemberAccess(value)) {\n    const member = requestMemberAccess(value);\n\n    if (member !== undefined && isWholeAccess(value, member)) {\n      if (REQUEST_BODY_MEMBERS.has(member)) {\n        found.push({ node: value, what: `the request ${describeMember(member)}` });\n        return;\n      }\n\n      if (member === \"email\") {\n        found.push({ node: value, what: \"a raw email address\" });\n        return;\n      }\n    }\n\n    if (ts.isCallExpression(value) && member !== undefined) {\n      const key = literalString(value.arguments[0]);\n      const category = key ? sensitiveCategory(key) : undefined;\n\n      if (category && !(censoredKey && category === \"secret\")) {\n        found.push({ node: value, what: describeCategory(category, key) });\n        return;\n      }\n    }\n  }\n\n  if (ts.isIdentifier(value) || isMemberAccess(value)) {\n    const name = ts.isIdentifier(value) ? value.text : memberName(value);\n    const category = name ? sensitiveCategory(name) : undefined;\n\n    if (category && !(censoredKey && category === \"secret\")) {\n      found.push({ node: value, what: describeCategory(category, name) });\n      return;\n    }\n\n    // `request.body.title` reads one field; only the whole body is reported.\n    if (isMemberAccess(value) && requestMemberAccess(value) === undefined) {\n      inspectLogged(value.expression, false, found);\n\n      if (ts.isElementAccessExpression(value))\n        inspectLogged(value.argumentExpression, false, found);\n    }\n\n    return;\n  }\n\n  if (ts.isObjectLiteralExpression(value)) {\n    for (const property of value.properties) {\n      if (ts.isSpreadAssignment(property)) {\n        inspectLogged(property.expression, false, found);\n      } else if (ts.isPropertyAssignment(property)) {\n        const key = keyName(property.name);\n        inspectLogged(property.initializer, key !== undefined && isCensoredKey(key), found);\n      } else if (ts.isShorthandPropertyAssignment(property)) {\n        inspectLogged(property.name, isCensoredKey(property.name.text), found);\n      }\n    }\n\n    return;\n  }\n\n  if (ts.isTemplateExpression(value)) {\n    for (const span of value.templateSpans) inspectLogged(span.expression, false, found);\n    return;\n  }\n\n  if (ts.isBinaryExpression(value)) {\n    inspectLogged(value.left, false, found);\n    inspectLogged(value.right, false, found);\n    return;\n  }\n\n  if (ts.isConditionalExpression(value)) {\n    inspectLogged(value.whenTrue, censoredKey, found);\n    inspectLogged(value.whenFalse, censoredKey, found);\n    return;\n  }\n\n  if (ts.isArrayLiteralExpression(value)) {\n    for (const element of value.elements) {\n      if (ts.isOmittedExpression(element)) continue;\n      inspectLogged(ts.isSpreadElement(element) ? element.expression : element, false, found);\n    }\n\n    return;\n  }\n\n  if (ts.isCallExpression(value)) {\n    // JSON.stringify(request.all()), String(user.email), user.email.trim()\n    const callee = unwrap(value.expression);\n\n    if (isMemberAccess(callee)) inspectLogged(callee.expression, false, found);\n\n    for (const argument of value.arguments) {\n      inspectLogged(ts.isSpreadElement(argument) ? argument.expression : argument, false, found);\n    }\n\n    return;\n  }\n\n  if (ts.isAwaitExpression(value)) inspectLogged(value.expression, censoredKey, found);\n}\n\nfunction checkSensitiveLog(node: ts.Node, findings: SourceFinding[]): void {\n  if (!ts.isCallExpression(node)) return;\n\n  const callee = unwrap(node.expression);\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method || !LOG_METHODS.has(method)) return;\n\n  const owner = unwrap(callee.expression);\n\n  if (!ts.isIdentifier(owner)) return;\n\n  // log.info(…), console.log(…), and request.log(…)\n  const isLogger =\n    LOGGER_NAMES.has(owner.text) || (REQUEST_NAMES.has(owner.text) && method === \"log\");\n\n  if (!isLogger) return;\n\n  const found: LogFinding[] = [];\n\n  for (const argument of node.arguments) {\n    inspectLogged(ts.isSpreadElement(argument) ? argument.expression : argument, false, found);\n  }\n\n  for (const finding of found) {\n    findings.push({\n      code: \"WL9008\",\n      node: finding.node,\n      message: `Do not log ${finding.what} as-is. Pass it through a redaction helper (\\`maskEmail()\\`, \\`redact()\\`, \\`request.toLogSnapshot()\\`), or log it under a key the logger censors.`,\n    });\n  }\n}\n\n// ── WL9009: unbounded regex quantifiers on request input ────────────────────\n\n/** `regex.test(input)` / `regex.exec(input)`. */\nconst REGEX_METHODS: ReadonlySet<string> = new Set([\"test\", \"exec\"]);\n\n/** `input.match(regex)` and friends: the regex is the first argument. */\nconst STRING_METHODS: ReadonlySet<string> = new Set([\n  \"match\",\n  \"matchAll\",\n  \"replace\",\n  \"replaceAll\",\n  \"search\",\n  \"split\",\n]);\n\n/**\n * The first unbounded quantifier in a regex source (`*`, `+`, `{n,}`), skipping\n * escapes and character classes, or `undefined` when every repetition is\n * bounded.\n */\nexport function findUnboundedQuantifier(source: string): string | undefined {\n  let inClass = false;\n\n  for (let index = 0; index < source.length; index++) {\n    const char = source[index];\n\n    if (char === \"\\\\\") {\n      index++;\n      continue;\n    }\n\n    if (inClass) {\n      if (char === \"]\") inClass = false;\n      continue;\n    }\n\n    if (char === \"[\") {\n      inClass = true;\n      continue;\n    }\n\n    if (char === \"*\" || char === \"+\") {\n      return `${char}${source[index + 1] === \"?\" ? \"?\" : \"\"}`;\n    }\n\n    if (char === \"{\") {\n      const match = /^\\{(\\d+),\\}/.exec(source.slice(index));\n      if (match) return match[0];\n    }\n  }\n\n  return undefined;\n}\n\n/** The pattern of a regex literal, `new RegExp(\"…\")`, or a constant holding either. */\nfunction regexSource(node: ts.Node | undefined, depth = 0): string | undefined {\n  if (!node || depth > 8) return undefined;\n\n  const value = unwrap(node);\n\n  if (ts.isRegularExpressionLiteral(value)) {\n    return value.text.slice(1, value.text.lastIndexOf(\"/\"));\n  }\n\n  if (\n    (ts.isNewExpression(value) || ts.isCallExpression(value)) &&\n    ts.isIdentifier(value.expression) &&\n    value.expression.text === \"RegExp\"\n  ) {\n    return literalString(value.arguments?.[0]);\n  }\n\n  if (ts.isIdentifier(value)) {\n    const initializer = resolveInitializer(value);\n    return initializer ? regexSource(initializer, depth + 1) : undefined;\n  }\n\n  return undefined;\n}\n\nfunction checkUnboundedRegex(node: ts.Node, findings: SourceFinding[]): void {\n  if (!ts.isCallExpression(node)) return;\n\n  const callee = unwrap(node.expression);\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const first = node.arguments[0];\n  const firstArgument = first && !ts.isSpreadElement(first) ? first : undefined;\n  let regex: ts.Node | undefined;\n  let input: ts.Node | undefined;\n\n  if (REGEX_METHODS.has(method)) {\n    regex = callee.expression;\n    input = firstArgument;\n  } else if (STRING_METHODS.has(method)) {\n    regex = firstArgument;\n    input = callee.expression;\n  } else {\n    return;\n  }\n\n  if (!input) return;\n\n  const source = regexSource(regex);\n\n  if (source === undefined) return;\n\n  const quantifier = findUnboundedQuantifier(source);\n\n  if (!quantifier || !containsRequestInput(input)) return;\n\n  findings.push({\n    code: \"WL9009\",\n    node,\n    message: `This regex has an unbounded quantifier (\\`${quantifier}\\`) and runs on request input, so a crafted input can make it backtrack for a long time (ReDoS). Bound the repetition, e.g. \\`{1,256}\\`, or cap the input length before matching.`,\n  });\n}\n\n/**\n * The security conventions in one parsed file:\n *\n * - `WL9005` `request.all()` (or `heavy()`, `allExceptParams()`) passed to a\n *   query, a service or `inApp()`;\n * - `WL9006` a POST/PUT/PATCH/DELETE route with no auth middleware and no\n *   `public: true`;\n * - `WL9007` a `redirect()` / `navigateTo()` / `<Link to|href>` target taken\n *   from request input without `safeRedirect()` / `safeRedirectTarget()` or an\n *   `isSafeRedirect()` check;\n * - `WL9008` a raw email, credential or request body passed to a logger;\n * - `WL9009` a regex with an unbounded quantifier run on request input.\n */\nexport function securityFindings(sourceFile: ts.SourceFile): SourceFinding[] {\n  const findings: SourceFinding[] = [];\n\n  walk(\n    sourceFile,\n    (node) => {\n      checkRequestAll(node, findings);\n      checkRouteGuard(node, findings);\n      checkRedirect(node, findings);\n      checkSensitiveLog(node, findings);\n      checkUnboundedRegex(node, findings);\n\n      return undefined;\n    },\n    true,\n  );\n\n  return findings;\n}\n"],"mappings":";;;;;;;;AA4BA,MAAM,qBAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,MAAM,oBAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,cAAc,QAAyB;CAC9C,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,GAAG,aAAa,MAAM,GAAG,OAAO,GAAG,OAAO,KAAK;CAEnD,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,MAAM,SAAS,OAAO,OAAO,UAAU;EACvC,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK;EAE5D,OAAO,OAAO,GAAG,QAAQ,KAAK,MAAM;CACtC;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,QAA0B;CACnD,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;CAEpC,MAAM,SAAS,OAAO,OAAO,UAAU;CAEvC,OAAO,GAAG,aAAa,MAAM,KAAK,kBAAkB,IAAI,OAAO,IAAI;AACrE;;AAGA,SAAS,cAAc,MAAmC;CACxD,IAAI,UAAU;CAEd,SAAS;EACP,MAAM,SAAS,QAAQ;EAEvB,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,GAAG,iBAAiB,MAAM,KAAK,GAAG,gBAAgB,MAAM,GAAG;GAC7D,IAAI,EAAE,OAAO,aAAa,CAAC,EAAC,CAAE,MAAM,aAAa,aAAa,OAAO,GAAG,OAAO;GAC/E,IAAI,kBAAkB,OAAO,UAAU,GAAG,OAAO;GAEjD,OAAO,cAAc,OAAO,UAAU;EACxC;EAEA,IACE,GAAG,gBAAgB,MAAM,KACzB,GAAG,mBAAmB,MAAM,KAC5B,GAAG,0BAA0B,MAAM,KACnC,GAAG,yBAAyB,MAAM,KACjC,GAAG,qBAAqB,MAAM,KAAK,OAAO,gBAAgB,WAC3D,GAAG,8BAA8B,MAAM,KACvC,GAAG,eAAe,MAAM,KACxB,GAAG,oBAAoB,MAAM,KAC7B,GAAG,sBAAsB,MAAM,KAC/B,GAAG,0BAA0B,MAAM,KACnC,GAAG,0BAA0B,MAAM,KACnC,GAAG,kBAAkB,MAAM,GAC3B;GACA,UAAU;GACV;EACF;EAEA;CACF;AACF;;;;;;AAOA,SAAS,cAAc,MAAmC;CACxD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,QAAQ,OAAO;CAGnB,MAAM,SAAS,KAAK;CAEpB,IACE,UACA,GAAG,sBAAsB,MAAM,KAC/B,OAAO,gBAAgB,QACvB,GAAG,aAAa,OAAO,IAAI,GAE3B,KAAK,MAAM,aAAa,aAAa,MAAM,GAAG;EAC5C,MAAM,OAAO,cAAc,SAAS;EACpC,IAAI,MAAM,OAAO;CACnB;AAIJ;AAEA,SAAS,gBAAgB,MAAe,UAAiC;CACvE,IAAI,CAAC,GAAG,iBAAiB,IAAI,GAAG;CAEhC,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,OAAO,OAAO,UAAU;CAEvC,IAAI,CAAC,GAAG,aAAa,MAAM,KAAK,CAAC,cAAc,IAAI,OAAO,IAAI,GAAG;CAEjE,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,mBAAmB,IAAI,MAAM,GAAG;CAEhD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,CAAC,QAAQ;CAEb,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,KAAK,OAAO,KAAK,GAAG,OAAO,2CAA2C,OAAO,YAAY,OAAO,KAAK;CAChH,CAAC;AACH;AAIA,MAAM,eAAoC,IAAI,IAAI,CAAC,QAAQ,CAAC;;AAG5D,MAAM,kBAAuC,IAAI,IAAI,CAAC,SAAS,CAAC;;AAGhE,MAAM,0BAA+C,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAG/F,MAAM,2BAAgD,IAAI,IAAI;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,6BAAkD,IAAI,IAAI;CAAC;CAAQ;CAAO;AAAM,CAAC;AAEvF,SAAS,SAAS,MAAwB;CACxC,MAAM,SAAS,OAAO,IAAI;CAE1B,OAAO,GAAG,aAAa,MAAM,KAAK,aAAa,IAAI,OAAO,IAAI;AAChE;AAEA,SAAS,YAAY,MAAmC;CACtD,OAAO,SAAS,UAAa,gBAAgB,IAAI;AACnD;;AAGA,SAAS,cAAc,YAAoC;CACzD,MAAM,cAAc,mBAAmB,UAAU;CACjD,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;CAElD,OACE,UAAU,UACV,GAAG,iBAAiB,KAAK,KACzB,WAAW,KAAK,MAAM,mBACtB,MAAM,UAAU,EAAE,EAAE,SAAS,GAAG,WAAW;AAE/C;AAEA,SAAS,mBAAmB,MAAwB;CAClD,MAAM,QAAQ,OAAO,IAAI;CAGzB,IAAI,CAAC,GAAG,yBAAyB,KAAK,GAAG,OAAO;CAEhD,OAAO,MAAM,SAAS,MAAM,YAAY;EACtC,IAAI,GAAG,gBAAgB,OAAO,GAAG,OAAO;EAExC,MAAM,OAAO,OAAO,OAAO;EAE3B,IAAI,GAAG,aAAa,IAAI,GAAG,OAAO,YAAY,KAAK,IAAI,KAAK,cAAc,IAAI;EAC9E,IAAI,GAAG,iBAAiB,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EAClE,IAAI,eAAe,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EAE7D,OAAO;CACT,CAAC;AACH;;AAGA,SAAS,aAAa,MAA6D;CACjF,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAAC,GAAG,0BAA0B,KAAK,GAAG,OAAO;CAEjD,IAAI,UAAmC;CAEvC,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAI,GAAG,mBAAmB,QAAQ,GAAG;GACnC,UAAU;GACV;EACF;EAEA,IAAI;EACJ,IAAI;EAEJ,IAAI,GAAG,qBAAqB,QAAQ,GAAG;GACrC,MAAM,QAAQ,SAAS,IAAI;GAC3B,gBAAgB,OAAO,SAAS,WAAW;EAC7C,OAAO,IAAI,GAAG,8BAA8B,QAAQ,GAAG;GACrD,MAAM,SAAS,KAAK;GACpB,gBAAgB,SAAS;EAC3B;EAEA,IAAI,CAAC,eAAe;EACpB,IAAI,QAAQ,YAAY,cAAc,SAAS,GAAG,WAAW,aAAa,OAAO;EACjF,IAAI,QAAQ,gBAAgB,mBAAmB,aAAa,GAAG,OAAO;CACxE;CAEA,OAAO;AACT;;AAGA,SAAS,mBAAmB,MAAwB;CAClD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI,CAAC,GAAG,gBAAgB,QAAQ,KAAK,CAAC,GAAG,qBAAqB,QAAQ,GAAG;EAEzE,MAAM,SAAS,SAAS;EAExB,IAAI,CAAC,UAAU,CAAC,GAAG,iBAAiB,MAAM,GAAG;EAC7C,IAAI,CAAC,OAAO,UAAU,MAAM,aAAa,aAAa,QAAQ,GAAG;EAEjE,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,UAAa,gBAAgB,IAAI,IAAI,GAAG,OAAO;EAE5D,MAAM,SAAS,OAAO,OAAO,UAAU;EAEvC,IACE,eAAe,MAAM,KACrB,WAAW,MAAM,MAAM,WACvB,SAAS,OAAO,UAAU,KAC1B,aAAa,OAAO,UAAU,EAAE,MAAM,WAEtC,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAS,SAAS,MAAmC;CACnD,OAAO,cAAc,IAAI,KAAK;AAChC;;;;;AAMA,SAAS,aAAa,MAAqE;CACzF,MAAM,cAAyB,CAAC;CAChC,IAAI,UAAU,OAAO,IAAI;CAEzB,OAAO,GAAG,iBAAiB,OAAO,GAAG;EACnC,MAAM,SAAS,OAAO,QAAQ,UAAU;EAExC,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;EAEpC,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,WAAW,SAAS,OAAO,UAAU,GAAG;GACnD,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;GAErC,OAAO;IAAE,MAAM,SAAS,QAAQ,UAAU,EAAE;IAAG;GAAY;EAC7D;EAEA,IAAI,SAAS,QAAQ;GACnB,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;EACvC;EAEA,UAAU,OAAO,OAAO,UAAU;CACpC;AAGF;AAEA,SAAS,mBAAmB,MAAoC;CAC9D,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAAC,GAAG,0BAA0B,KAAK,GAAG,OAAO;CAEjD,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAI,CAAC,GAAG,qBAAqB,QAAQ,KAAK,QAAQ,SAAS,IAAI,MAAM,QAAQ;EAE7E,MAAM,OAAO,OAAO,SAAS,WAAW;EAExC,IAAI,CAAC,GAAG,yBAAyB,IAAI,GAAG,OAAO;EAE/C,OAAO,KAAK,SAAS,OAAO,YAAY;GACtC,MAAM,SAAS,cAAc,OAAO;GACpC,OAAO,WAAW,UAAa,2BAA2B,IAAI,MAAM;EACtE,CAAC;CACH;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAe,OAA8B;CACnE,OAAO;EACL,MAAM;EACN;EACA,SAAS,oBAAoB,MAAM;CACrC;AACF;AAEA,SAAS,gBAAgB,MAAe,UAAiC;CACvE,IAAI,CAAC,GAAG,iBAAiB,IAAI,GAAG;CAEhC,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,WAAW,YACf,aAAa,OAAO,MAAM,aAAa,mBAAmB,IAAI;CAEhE,IAAI,SAAS,OAAO,UAAU,GAAG;EAE/B,IAAI,wBAAwB,IAAI,MAAM,GAAG;GACvC,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KACP,eAAe,MAAM,GAAG,OAAO,YAAY,EAAE,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAC/E;GAGF;EACF;EAGA,IAAI,WAAW,OAAO;GACpB,MAAM,aAAa,cAAc,KAAK,UAAU,EAAE,CAAC,EAAE,YAAY;GAEjE,IAAI,CAAC,cAAc,CAAC,qBAAqB,UAAU,GAAG;GAEtD,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,GAAG,WAAW,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;GAGpF;EACF;EAGA,IAAI,WAAW,mBAAmB;GAChC,IAAI,mBAAmB,KAAK,UAAU,EAAE,GAAG;GAE3C,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,YAAY,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;EAEjF;EAEA;CACF;CAGA,IAAI,CAAC,yBAAyB,IAAI,MAAM,GAAG;CAE3C,MAAM,QAAQ,aAAa,OAAO,UAAU;CAE5C,IAAI,CAAC,OAAO;CACZ,IAAI,aAAa,KAAK,UAAU,EAAE,MAAM,WAAW;CACnD,IAAI,MAAM,YAAY,MAAM,YAAY,aAAa,OAAO,MAAM,SAAS,GAAG;CAC9E,IAAI,mBAAmB,IAAI,GAAG;CAE9B,SAAS,KAAK,eAAe,MAAM,GAAG,OAAO,GAAG,MAAM,MAAM,CAAC;AAC/D;;AAKA,MAAM,iBAAsC,IAAI,IAAI;CAClD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kBAAuC,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;;AAGxE,MAAM,sBAA2C,IAAI,IAAI,CAAC,gBAAgB,oBAAoB,CAAC;;AAG/F,MAAM,sBAA2C,IAAI,IAAI,CAAC,kBAAkB,mBAAmB,CAAC;;AAGhG,MAAM,qBAA0C,IAAI,IAAI;CACtD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,qBAA0C,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAEjF,SAAS,eAAe,MAAwB;CAC9C,IAAI,GAAG,iBAAiB,IAAI,GAAG;EAC7B,MAAM,OAAO,WAAW,IAAI;EAC5B,IAAI,SAAS,UAAa,mBAAmB,IAAI,IAAI,GAAG,OAAO;CACjE;CAEA,IAAI,eAAe,IAAI,GAAG;EACxB,MAAM,OAAO,eAAe,IAAI;EAEhC,IAAI,QAAQ,mBAAmB,IAAI,KAAK,IAAI,GAAG,OAAO;EAGtD,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,YAAY,SAAS,QAAQ;GACxC,MAAM,SAAS,OAAO,KAAK,UAAU;GAErC,IAAI,GAAG,aAAa,MAAM,KAAK,OAAO,SAAS,YAAY,OAAO;GAClE,IAAI,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM,YAAY,OAAO;EAC1E;CACF;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,MAAwB;CACjD,OAAO,qBAAqB,MAAM;EAAE,YAAY;EAAqB,UAAU;CAAe,CAAC;AACjG;;AAGA,SAAS,mBAAmB,MAAwB;CAClD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI;EAEJ,IAAI,GAAG,cAAc,QAAQ,GAAG,OAAO,SAAS;OAC3C,IAAI,GAAG,wBAAwB,QAAQ,GAAG,OAAO,SAAS;OAC1D;EAEL,IAAI,YAAY;EAEhB,KAAK,OAAO,UAAU;GACpB,IAAI,GAAG,iBAAiB,KAAK,GAAG;IAC9B,MAAM,OAAO,WAAW,KAAK;IAC7B,IAAI,SAAS,UAAa,oBAAoB,IAAI,IAAI,GAAG,YAAY;GACvE;EAGF,CAAC;EAED,IAAI,WAAW,OAAO;CACxB;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAe,MAAc,QAAgB,MAA6B;CAChG,OAAO;EACL,MAAM;EACN;EACA,SAAS,QAAQ,KAAK,sDAAsD,OAAO,cAAc,KAAK;CACxG;AACF;AAEA,SAAS,cAAc,MAAe,UAAiC;CACrE,IAAI,GAAG,iBAAiB,IAAI,GAAG;EAC7B,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,UAAa,CAAC,eAAe,IAAI,IAAI,GAAG;EAGrD,MAAM,SAAS,OAAO,KAAK,UAAU;EAErC,IAAI,eAAe,MAAM,GAAG;GAC1B,MAAM,QAAQ,OAAO,OAAO,UAAU;GACtC,IAAI,GAAG,aAAa,KAAK,KAAK,MAAM,SAAS,UAAU;EACzD;EAEA,MAAM,SAAS,KAAK,UAAU;EAE9B,IAAI,CAAC,UAAU,GAAG,gBAAgB,MAAM,GAAG;EAC3C,IAAI,CAAC,kBAAkB,MAAM,KAAK,mBAAmB,IAAI,GAAG;EAE5D,SAAS,KACP,SAAS,eACL,eAAe,QAAQ,cAAc,sBAAsB,iBAAiB,IAC5E,eAAe,QAAQ,YAAY,gBAAgB,kBAAkB,CAC3E;EAEA;CACF;CAEA,IAAI,CAAC,GAAG,eAAe,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,IAAI,GAAG;CAC7D,IAAI,KAAK,KAAK,SAAS,QAAQ,KAAK,KAAK,SAAS,QAAQ;CAE1D,MAAM,UAAU,KAAK,OAAO;CAE5B,IAAI,CAAC,GAAG,oBAAoB,OAAO,KAAK,CAAC,GAAG,wBAAwB,OAAO,GAAG;CAC9E,IAAI,CAAC,GAAG,aAAa,QAAQ,OAAO,KAAK,CAAC,gBAAgB,IAAI,QAAQ,QAAQ,IAAI,GAAG;CAErF,MAAM,cAAc,KAAK;CAEzB,IAAI,CAAC,eAAe,CAAC,GAAG,gBAAgB,WAAW,KAAK,CAAC,YAAY,YAAY;CAEjF,MAAM,aAAa,YAAY;CAE/B,IAAI,CAAC,kBAAkB,UAAU,KAAK,mBAAmB,UAAU,GAAG;CAEtE,SAAS,KAAK,eAAe,YAAY,QAAQ,sBAAsB,iBAAiB,CAAC;AAC3F;AAIA,MAAM,eAAoC,IAAI,IAAI;CAAC;CAAO;CAAU;AAAS,CAAC;AAE9E,MAAM,cAAmC,IAAI,IAAI;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,YAAiC,IAAI,IAAI;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;AAOA,SAAS,cAAc,KAAsB;CAC3C,OAAO,uBAAuB,IAAI,mBAAmB,GAAG,CAAC;AAC3D;;AAGA,SAAS,kBAAkB,MAA8C;CACvE,MAAM,aAAa,mBAAmB,IAAI;CAE1C,IAAI,WAAW,SAAS,OAAO,KAAK,WAAW,SAAS,cAAc,GAAG,OAAO;CAChF,IAAI,uBAAuB,IAAI,UAAU,GAAG,OAAO;CACnD,IAAI,gBAAgB,MAAM,WAAW,WAAW,SAAS,MAAM,CAAC,GAAG,OAAO;AAG5E;AAEA,SAAS,iBAAiB,UAA8B,MAAkC;CACxF,IAAI,aAAa,SAAS,OAAO;CAEjC,OAAO,OAAO,oBAAoB,KAAK,MAAM;AAC/C;AAEA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,aAAa,WAAW,WAAW,OAAO;CAEzD,OAAO,WAAW,OAAO;AAC3B;;AAGA,SAAS,cAAc,MAAe,QAAyB;CAC7D,IAAI,GAAG,iBAAiB,IAAI,GAAG;EAC7B,MAAM,SAAS,OAAO,KAAK,UAAU;EACrC,OAAO,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM;CAC1D;CAEA,OAAO,eAAe,IAAI,KAAK,WAAW,IAAI,MAAM;AACtD;AAIA,SAAS,cAAc,MAAe,aAAsB,OAA2B;CACrF,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,eAAe,KAAK,GAAG;CAE3B,IAAI,GAAG,iBAAiB,KAAK,GAAG;EAC9B,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,UAAa,UAAU,IAAI,IAAI,GAAG;CACjD;CAGA,IAAI,GAAG,iBAAiB,KAAK,KAAK,eAAe,KAAK,GAAG;EACvD,MAAM,SAAS,oBAAoB,KAAK;EAExC,IAAI,WAAW,UAAa,cAAc,OAAO,MAAM,GAAG;GACxD,IAAI,qBAAqB,IAAI,MAAM,GAAG;IACpC,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,eAAe,eAAe,MAAM;IAAI,CAAC;IACzE;GACF;GAEA,IAAI,WAAW,SAAS;IACtB,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM;IAAsB,CAAC;IACvD;GACF;EACF;EAEA,IAAI,GAAG,iBAAiB,KAAK,KAAK,WAAW,QAAW;GACtD,MAAM,MAAM,cAAc,MAAM,UAAU,EAAE;GAC5C,MAAM,WAAW,MAAM,kBAAkB,GAAG,IAAI;GAEhD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;IACvD,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,iBAAiB,UAAU,GAAG;IAAE,CAAC;IACjE;GACF;EACF;CACF;CAEA,IAAI,GAAG,aAAa,KAAK,KAAK,eAAe,KAAK,GAAG;EACnD,MAAM,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,OAAO,WAAW,KAAK;EACnE,MAAM,WAAW,OAAO,kBAAkB,IAAI,IAAI;EAElD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;GACvD,MAAM,KAAK;IAAE,MAAM;IAAO,MAAM,iBAAiB,UAAU,IAAI;GAAE,CAAC;GAClE;EACF;EAGA,IAAI,eAAe,KAAK,KAAK,oBAAoB,KAAK,MAAM,QAAW;GACrE,cAAc,MAAM,YAAY,OAAO,KAAK;GAE5C,IAAI,GAAG,0BAA0B,KAAK,GACpC,cAAc,MAAM,oBAAoB,OAAO,KAAK;EACxD;EAEA;CACF;CAEA,IAAI,GAAG,0BAA0B,KAAK,GAAG;EACvC,KAAK,MAAM,YAAY,MAAM,YAC3B,IAAI,GAAG,mBAAmB,QAAQ,GAChC,cAAc,SAAS,YAAY,OAAO,KAAK;OAC1C,IAAI,GAAG,qBAAqB,QAAQ,GAAG;GAC5C,MAAM,MAAM,QAAQ,SAAS,IAAI;GACjC,cAAc,SAAS,aAAa,QAAQ,UAAa,cAAc,GAAG,GAAG,KAAK;EACpF,OAAO,IAAI,GAAG,8BAA8B,QAAQ,GAClD,cAAc,SAAS,MAAM,cAAc,SAAS,KAAK,IAAI,GAAG,KAAK;EAIzE;CACF;CAEA,IAAI,GAAG,qBAAqB,KAAK,GAAG;EAClC,KAAK,MAAM,QAAQ,MAAM,eAAe,cAAc,KAAK,YAAY,OAAO,KAAK;EACnF;CACF;CAEA,IAAI,GAAG,mBAAmB,KAAK,GAAG;EAChC,cAAc,MAAM,MAAM,OAAO,KAAK;EACtC,cAAc,MAAM,OAAO,OAAO,KAAK;EACvC;CACF;CAEA,IAAI,GAAG,wBAAwB,KAAK,GAAG;EACrC,cAAc,MAAM,UAAU,aAAa,KAAK;EAChD,cAAc,MAAM,WAAW,aAAa,KAAK;EACjD;CACF;CAEA,IAAI,GAAG,yBAAyB,KAAK,GAAG;EACtC,KAAK,MAAM,WAAW,MAAM,UAAU;GACpC,IAAI,GAAG,oBAAoB,OAAO,GAAG;GACrC,cAAc,GAAG,gBAAgB,OAAO,IAAI,QAAQ,aAAa,SAAS,OAAO,KAAK;EACxF;EAEA;CACF;CAEA,IAAI,GAAG,iBAAiB,KAAK,GAAG;EAE9B,MAAM,SAAS,OAAO,MAAM,UAAU;EAEtC,IAAI,eAAe,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,KAAK;EAEzE,KAAK,MAAM,YAAY,MAAM,WAC3B,cAAc,GAAG,gBAAgB,QAAQ,IAAI,SAAS,aAAa,UAAU,OAAO,KAAK;EAG3F;CACF;CAEA,IAAI,GAAG,kBAAkB,KAAK,GAAG,cAAc,MAAM,YAAY,aAAa,KAAK;AACrF;AAEA,SAAS,kBAAkB,MAAe,UAAiC;CACzE,IAAI,CAAC,GAAG,iBAAiB,IAAI,GAAG;CAEhC,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,GAAG;CAEzC,MAAM,QAAQ,OAAO,OAAO,UAAU;CAEtC,IAAI,CAAC,GAAG,aAAa,KAAK,GAAG;CAM7B,IAAI,EAFF,aAAa,IAAI,MAAM,IAAI,KAAM,cAAc,IAAI,MAAM,IAAI,KAAK,WAAW,QAEhE;CAEf,MAAM,QAAsB,CAAC;CAE7B,KAAK,MAAM,YAAY,KAAK,WAC1B,cAAc,GAAG,gBAAgB,QAAQ,IAAI,SAAS,aAAa,UAAU,OAAO,KAAK;CAG3F,KAAK,MAAM,WAAW,OACpB,SAAS,KAAK;EACZ,MAAM;EACN,MAAM,QAAQ;EACd,SAAS,cAAc,QAAQ,KAAK;CACtC,CAAC;AAEL;;AAKA,MAAM,gBAAqC,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC;;AAGnE,MAAM,iBAAsC,IAAI,IAAI;CAClD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,wBAAwB,QAAoC;CAC1E,IAAI,UAAU;CAEd,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,OAAO,OAAO;EAEpB,IAAI,SAAS,MAAM;GACjB;GACA;EACF;EAEA,IAAI,SAAS;GACX,IAAI,SAAS,KAAK,UAAU;GAC5B;EACF;EAEA,IAAI,SAAS,KAAK;GAChB,UAAU;GACV;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,KAC3B,OAAO,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;EAGrD,IAAI,SAAS,KAAK;GAChB,MAAM,QAAQ,cAAc,KAAK,OAAO,MAAM,KAAK,CAAC;GACpD,IAAI,OAAO,OAAO,MAAM;EAC1B;CACF;AAGF;;AAGA,SAAS,YAAY,MAA2B,QAAQ,GAAuB;CAC7E,IAAI,CAAC,QAAQ,QAAQ,GAAG,OAAO;CAE/B,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,GAAG,2BAA2B,KAAK,GACrC,OAAO,MAAM,KAAK,MAAM,GAAG,MAAM,KAAK,YAAY,GAAG,CAAC;CAGxD,KACG,GAAG,gBAAgB,KAAK,KAAK,GAAG,iBAAiB,KAAK,MACvD,GAAG,aAAa,MAAM,UAAU,KAChC,MAAM,WAAW,SAAS,UAE1B,OAAO,cAAc,MAAM,YAAY,EAAE;CAG3C,IAAI,GAAG,aAAa,KAAK,GAAG;EAC1B,MAAM,cAAc,mBAAmB,KAAK;EAC5C,OAAO,cAAc,YAAY,aAAa,QAAQ,CAAC,IAAI;CAC7D;AAGF;AAEA,SAAS,oBAAoB,MAAe,UAAiC;CAC3E,IAAI,CAAC,GAAG,iBAAiB,IAAI,GAAG;CAEhC,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,QAAQ,KAAK,UAAU;CAC7B,MAAM,gBAAgB,SAAS,CAAC,GAAG,gBAAgB,KAAK,IAAI,QAAQ;CACpE,IAAI;CACJ,IAAI;CAEJ,IAAI,cAAc,IAAI,MAAM,GAAG;EAC7B,QAAQ,OAAO;EACf,QAAQ;CACV,OAAO,IAAI,eAAe,IAAI,MAAM,GAAG;EACrC,QAAQ;EACR,QAAQ,OAAO;CACjB,OACE;CAGF,IAAI,CAAC,OAAO;CAEZ,MAAM,SAAS,YAAY,KAAK;CAEhC,IAAI,WAAW,QAAW;CAE1B,MAAM,aAAa,wBAAwB,MAAM;CAEjD,IAAI,CAAC,cAAc,CAAC,qBAAqB,KAAK,GAAG;CAEjD,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,6CAA6C,WAAW;CACnE,CAAC;AACH;;;;;;;;;;;;;;AAeA,SAAgB,iBAAiB,YAA4C;CAC3E,MAAM,WAA4B,CAAC;CAEnC,KACE,aACC,SAAS;EACR,gBAAgB,MAAM,QAAQ;EAC9B,gBAAgB,MAAM,QAAQ;EAC9B,cAAc,MAAM,QAAQ;EAC5B,kBAAkB,MAAM,QAAQ;EAChC,oBAAoB,MAAM,QAAQ;CAGpC,GACA,IACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"security-conventions.mjs","names":["ast.isIdentifier","ast.valueText","ast.expressionOf","ast.parentOf","ast.isCallExpression","ast.isNewExpression","ast.isSpreadElement","ast.isSpreadAssignment","ast.isObjectLiteralExpression","ast.isArrayLiteralExpression","ast.isPropertyAssignment","ast.isShorthandPropertyAssignment","ast.isAsExpression","ast.isNonNullExpression","ast.isSatisfiesExpression","ast.isTypeAssertionExpression","ast.isParenthesizedExpression","ast.isAwaitExpression","ast.isVariableDeclaration","ast.isArrowFunction","ast.isFunctionExpression","ast.isIfStatement","ast.isConditionalExpression","ast.isJsxAttribute","ast.nameNode","ast.isJsxOpeningElement","ast.isJsxSelfClosingElement","ast.isJsxExpression","ast.isElementAccessExpression","ast.isTemplateExpression","ast.isBinaryExpression","ast.isOmittedExpression","ast.isRegularExpressionLiteral"],"sources":["../../../../../../../../../packages/core/src/tooling/check/security-conventions.ts"],"sourcesContent":["import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from \"@warlock.js/logger\";\nimport * as ast from \"../syntax/ast\";\nimport { isAuthGuardName, isMutatingHttpMethod } from \"../../router/route-guard-names\";\nimport {\n  containsRequestInput,\n  REQUEST_BODY_MEMBERS,\n  REQUEST_NAMES,\n  requestMemberAccess,\n} from \"./request-input\";\nimport {\n  ancestors,\n  calleeName,\n  isFunctionLike,\n  isMemberAccess,\n  keyName,\n  literalString,\n  memberName,\n  referencesOf,\n  resolveInitializer,\n  rootIdentifier,\n  type SourceFinding,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n// ── WL9005: request.all() into a query, a service or inApp() ────────────────\n\n/** Request methods that return every input the client sent, validated or not. */\nconst UNFILTERED_METHODS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n]);\n\n/**\n * Responses and loggers are not the data sinks `WL9005` guards: echoing input\n * back is not mass assignment, and logging it is `WL9008`'s concern.\n */\nconst IGNORED_RECEIVERS: ReadonlySet<string> = new Set([\n  \"response\",\n  \"reply\",\n  \"res\",\n  \"console\",\n  \"log\",\n  \"logger\",\n]);\n\nfunction displayCallee(callee: ast.Node): string {\n  const target = unwrap(callee);\n\n  if (ast.isIdentifier(target)) return `${ast.valueText(target)}()`;\n\n  if (isMemberAccess(target)) {\n    const name = memberName(target);\n    const object = unwrap(ast.expressionOf(target));\n    const owner = ast.isIdentifier(object) ? `${ast.valueText(object)}.` : \"\";\n\n    return name ? `${owner}${name}()` : \"a call\";\n  }\n\n  return \"a call\";\n}\n\nfunction isIgnoredReceiver(callee: ast.Node): boolean {\n  const target = unwrap(callee);\n\n  if (!isMemberAccess(target)) return false;\n\n  const object = unwrap(ast.expressionOf(target));\n\n  return ast.isIdentifier(object) && IGNORED_RECEIVERS.has(ast.valueText(object));\n}\n\n/** When `node` flows into a call's arguments, the callee's display name. */\nfunction callReceiving(node: ast.Node): string | undefined {\n  let current = node;\n\n  for (;;) {\n    const parent = ast.parentOf(current);\n\n    if (!parent) return undefined;\n\n    if (ast.isCallExpression(parent) || ast.isNewExpression(parent)) {\n      if (!(parent.arguments ?? []).some((argument) => argument === current)) return undefined;\n      if (isIgnoredReceiver(ast.expressionOf(parent))) return undefined;\n\n      return displayCallee(ast.expressionOf(parent));\n    }\n\n    if (\n      ast.isSpreadElement(parent) ||\n      ast.isSpreadAssignment(parent) ||\n      ast.isObjectLiteralExpression(parent) ||\n      ast.isArrayLiteralExpression(parent) ||\n      (ast.isPropertyAssignment(parent) && parent.value === current) ||\n      ast.isShorthandPropertyAssignment(parent) ||\n      ast.isAsExpression(parent) ||\n      ast.isNonNullExpression(parent) ||\n      ast.isSatisfiesExpression(parent) ||\n      ast.isTypeAssertionExpression(parent) ||\n      ast.isParenthesizedExpression(parent) ||\n      ast.isAwaitExpression(parent)\n    ) {\n      current = parent;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/**\n * The call that ends up receiving this value: directly as an argument, spread\n * into an object/array argument, or through a local constant later passed to\n * a call.\n */\nfunction receivingCall(node: ast.Node): string | undefined {\n  const direct = callReceiving(node);\n\n  if (direct) return direct;\n\n  // `const data = request.all(); await Model.create(data);`\n  const parent = ast.parentOf(node);\n\n  if (\n    parent &&\n    ast.isVariableDeclaration(parent) &&\n    parent.init === node &&\n    ast.isIdentifier(parent.id)\n  ) {\n    for (const reference of referencesOf(parent)) {\n      const name = callReceiving(reference);\n      if (name) return name;\n    }\n  }\n\n  return undefined;\n}\n\nfunction checkRequestAll(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const object = unwrap(ast.expressionOf(callee));\n\n  if (!ast.isIdentifier(object) || !REQUEST_NAMES.has(ast.valueText(object))) return;\n\n  const method = memberName(callee);\n\n  if (!method || !UNFILTERED_METHODS.has(method)) return;\n\n  const target = receivingCall(node);\n\n  if (!target) return;\n\n  findings.push({\n    code: \"WL9005\",\n    node,\n    message: `\\`${ast.valueText(object)}.${method}()\\` passes every client-sent field to \\`${target}\\`. Use \\`${ast.valueText(object)}.validated()\\` so only the fields the validation schema accepted reach it.`,\n  });\n}\n\n// ── WL9006: a mutating route with no auth guard and no public: true ─────────\n\nconst ROUTER_NAMES: ReadonlySet<string> = new Set([\"router\"]);\n\n/** Wrappers whose callback routes are guarded, e.g. `guarded(() => …)`. */\nconst GUARD_FUNCTIONS: ReadonlySet<string> = new Set([\"guarded\"]);\n\n/** `router.post(…)` and friends. */\nconst MUTATING_ROUTER_METHODS: ReadonlySet<string> = new Set([\"post\", \"put\", \"patch\", \"delete\"]);\n\n/** Route builder methods (`router.route(path).create(…)`) that register a mutating route. */\nconst MUTATING_BUILDER_METHODS: ReadonlySet<string> = new Set([\n  \"post\",\n  \"postOne\",\n  \"put\",\n  \"updateOne\",\n  \"patch\",\n  \"patchOne\",\n  \"delete\",\n  \"deleteOne\",\n  \"create\",\n  \"update\",\n  \"destroy\",\n]);\n\nconst READ_ONLY_RESOURCE_METHODS: ReadonlySet<string> = new Set([\"list\", \"get\", \"show\"]);\n\nfunction isRouter(node: ast.Node): boolean {\n  const target = unwrap(node);\n\n  return ast.isIdentifier(target) && ROUTER_NAMES.has(ast.valueText(target));\n}\n\nfunction isGuardName(name: string | undefined): boolean {\n  return name !== undefined && isAuthGuardName(name);\n}\n\n/** Whether a constant is initialised with `markAuthGuard(fn)` (not `markAuthGuard(fn, false)`). */\nfunction isMarkedGuard(identifier: ast.Identifier): boolean {\n  const initializer = resolveInitializer(identifier);\n  const value = initializer ? unwrap(initializer) : undefined;\n\n  return (\n    value !== undefined &&\n    ast.isCallExpression(value) &&\n    calleeName(value) === \"markAuthGuard\" &&\n    !(value.arguments[1]?.type === \"Literal\" && value.arguments[1].value === false)\n  );\n}\n\nfunction middlewareHasGuard(node: ast.Node): boolean {\n  const value = unwrap(node);\n\n  // A variable or a call: the check cannot see into it, so it trusts it.\n  if (!ast.isArrayLiteralExpression(value)) return true;\n\n  return value.elements.some((element) => {\n    if (!element) return false;\n    if (ast.isSpreadElement(element)) return true;\n\n    const item = unwrap(element);\n\n    if (ast.isIdentifier(item)) return isGuardName(ast.valueText(item)) || isMarkedGuard(item);\n    if (ast.isCallExpression(item)) return isGuardName(calleeName(item));\n    if (isMemberAccess(item)) return isGuardName(memberName(item));\n\n    return false;\n  });\n}\n\n/** `public: true`, a guard in `middleware`, or an options value the check cannot see into. */\nfunction optionsGuard(node: ast.Node | undefined): \"guarded\" | \"unguarded\" | \"none\" {\n  if (!node) return \"none\";\n\n  const value = unwrap(node);\n\n  if (!ast.isObjectLiteralExpression(value)) return \"guarded\";\n\n  let verdict: \"guarded\" | \"unguarded\" = \"unguarded\";\n\n  for (const property of value.properties) {\n    if (ast.isSpreadAssignment(property)) {\n      verdict = \"guarded\";\n      continue;\n    }\n\n    let key: string | undefined;\n    let propertyValue: ast.Node | undefined;\n\n    if (ast.isPropertyAssignment(property)) {\n      key = keyName(property.key);\n      propertyValue = unwrap(property.value);\n    } else if (ast.isShorthandPropertyAssignment(property)) {\n      key = ast.valueText(property.key);\n      propertyValue = property.key;\n    }\n\n    if (!propertyValue) continue;\n    if (key === \"public\" && propertyValue.type === \"Literal\" && propertyValue.value === true)\n      return \"guarded\";\n    if (key === \"middleware\" && middlewareHasGuard(propertyValue)) return \"guarded\";\n  }\n\n  return verdict;\n}\n\n/** Whether an enclosing function is a guarded (or public) group callback. */\nfunction insideGuardedGroup(node: ast.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    if (!ast.isArrowFunction(ancestor) && !ast.isFunctionExpression(ancestor)) continue;\n\n    const parent = ast.parentOf(ancestor);\n\n    if (!parent || !ast.isCallExpression(parent)) continue;\n    if (!parent.arguments.some((argument) => argument === ancestor)) continue;\n\n    const name = calleeName(parent);\n\n    if (name !== undefined && GUARD_FUNCTIONS.has(name)) return true;\n\n    const callee = unwrap(ast.expressionOf(parent));\n\n    if (\n      isMemberAccess(callee) &&\n      memberName(callee) === \"group\" &&\n      isRouter(ast.expressionOf(callee)) &&\n      optionsGuard(parent.arguments[0]) === \"guarded\"\n    ) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nfunction pathText(node: ast.Node | undefined): string {\n  return literalString(node) ?? \"(dynamic path)\";\n}\n\n/**\n * Walk a builder chain back to `router.route(path, options)`, collecting every\n * options object passed along the way (`route()`, `nest()`).\n */\nfunction builderChain(node: ast.Node): { path: string; optionNodes: ast.Node[] } | undefined {\n  const optionNodes: ast.Node[] = [];\n  let current = unwrap(node);\n\n  while (ast.isCallExpression(current)) {\n    const callee = unwrap(ast.expressionOf(current));\n\n    if (!isMemberAccess(callee)) return undefined;\n\n    const name = memberName(callee);\n\n    if (name === \"route\" && isRouter(ast.expressionOf(callee))) {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n\n      return { path: pathText(current.arguments[0]), optionNodes };\n    }\n\n    if (name === \"nest\") {\n      const options = current.arguments[1];\n      if (options) optionNodes.push(options);\n    }\n\n    current = unwrap(ast.expressionOf(callee));\n  }\n\n  return undefined;\n}\n\nfunction resourceIsReadOnly(node: ast.Node | undefined): boolean {\n  if (!node) return false;\n\n  const value = unwrap(node);\n\n  if (!ast.isObjectLiteralExpression(value)) return false;\n\n  for (const property of value.properties) {\n    if (!ast.isPropertyAssignment(property) || keyName(property.key) !== \"only\") continue;\n\n    const only = unwrap(property.value);\n\n    if (!ast.isArrayLiteralExpression(only)) return false;\n\n    return only.elements.every((element) => {\n      if (!element) return false;\n      const method = literalString(element);\n      return method !== undefined && READ_ONLY_RESOURCE_METHODS.has(method);\n    });\n  }\n\n  return false;\n}\n\nfunction unguardedRoute(node: ast.Node, route: string): SourceFinding {\n  return {\n    code: \"WL9006\",\n    node,\n    message: `Mutating route \\`${route}\\` has no auth middleware. Add an auth guard (\\`middleware: [authMiddleware()]\\`, or register it inside a guarded group) or mark it intentionally open with \\`public: true\\`.`,\n  };\n}\n\nfunction checkRouteGuard(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const guarded = (options: ast.Node | undefined) =>\n    optionsGuard(options) === \"guarded\" || insideGuardedGroup(node);\n\n  if (isRouter(ast.expressionOf(callee))) {\n    // router.post(path, handler, options)\n    if (MUTATING_ROUTER_METHODS.has(method)) {\n      if (!guarded(node.arguments[2])) {\n        findings.push(\n          unguardedRoute(node, `${method.toUpperCase()} ${pathText(node.arguments[0])}`),\n        );\n      }\n\n      return;\n    }\n\n    // router.add(\"POST\", path, handler, options)\n    if (method === \"add\") {\n      const httpMethod = literalString(node.arguments[0])?.toUpperCase();\n\n      if (!httpMethod || !isMutatingHttpMethod(httpMethod)) return;\n\n      if (!guarded(node.arguments[3])) {\n        findings.push(unguardedRoute(node, `${httpMethod} ${pathText(node.arguments[1])}`));\n      }\n\n      return;\n    }\n\n    // router.restfulResource(path, resource, options)\n    if (method === \"restfulResource\") {\n      if (resourceIsReadOnly(node.arguments[2])) return;\n\n      if (!guarded(node.arguments[2])) {\n        findings.push(unguardedRoute(node, `resource ${pathText(node.arguments[0])}`));\n      }\n    }\n\n    return;\n  }\n\n  // router.route(path, options).create(handler, options)\n  if (!MUTATING_BUILDER_METHODS.has(method)) return;\n\n  const chain = builderChain(ast.expressionOf(callee));\n\n  if (!chain) return;\n  if (optionsGuard(node.arguments[1]) === \"guarded\") return;\n  if (chain.optionNodes.some((options) => optionsGuard(options) === \"guarded\")) return;\n  if (insideGuardedGroup(node)) return;\n\n  findings.push(unguardedRoute(node, `${method} ${chain.path}`));\n}\n\n// ── WL9007: a redirect or link target from request input ────────────────────\n\n/** Calls that turn their first argument into a redirect or a navigation. */\nconst REDIRECT_CALLS: ReadonlySet<string> = new Set([\n  \"redirect\",\n  \"permanentRedirect\",\n  \"navigateTo\",\n]);\n\n/** Components whose `to`/`href` prop navigates. */\nconst LINK_COMPONENTS: ReadonlySet<string> = new Set([\"Link\", \"NavLink\"]);\n\n/** Helpers that return an allowed target (or a fallback) for any input. */\nconst REDIRECT_SANITIZERS: ReadonlySet<string> = new Set([\"safeRedirect\", \"safeRedirectTarget\"]);\n\n/** Predicates that, used in an enclosing `if` or `? :`, prove the target was checked. */\nconst REDIRECT_VALIDATORS: ReadonlySet<string> = new Set([\"isSafeRedirect\", \"isSafeRedirectUrl\"]);\n\n/** Client-side input: query-string hooks. */\nconst CLIENT_INPUT_CALLS: ReadonlySet<string> = new Set([\n  \"useQueryString\",\n  \"useSearchParams\",\n  \"useParams\",\n]);\n\n/** Identifiers whose members are client-controlled (a loader's `query`, URLSearchParams). */\nconst CLIENT_INPUT_NAMES: ReadonlySet<string> = new Set([\"query\", \"searchParams\"]);\n\nfunction isClientSource(node: ast.Node): boolean {\n  if (ast.isCallExpression(node)) {\n    const name = calleeName(node);\n    if (name !== undefined && CLIENT_INPUT_CALLS.has(name)) return true;\n  }\n\n  if (isMemberAccess(node)) {\n    const root = rootIdentifier(node);\n\n    if (root && CLIENT_INPUT_NAMES.has(ast.valueText(root))) return true;\n\n    // location.search / window.location.hash\n    const name = memberName(node);\n\n    if (name === \"search\" || name === \"hash\") {\n      const object = unwrap(ast.expressionOf(node));\n\n      if (ast.isIdentifier(object) && ast.valueText(object) === \"location\") return true;\n      if (isMemberAccess(object) && memberName(object) === \"location\") return true;\n    }\n  }\n\n  return false;\n}\n\nfunction isRedirectTainted(node: ast.Node): boolean {\n  return containsRequestInput(node, { sanitizers: REDIRECT_SANITIZERS, isSource: isClientSource });\n}\n\n/** An enclosing `if (isSafeRedirect(x))` or `isSafeRedirect(x) ? … : …` validated the target. */\nfunction checkedByValidator(node: ast.Node): boolean {\n  for (const ancestor of ancestors(node)) {\n    let test: ast.Node | undefined;\n\n    if (ast.isIfStatement(ancestor)) test = ast.expressionOf(ancestor);\n    else if (ast.isConditionalExpression(ancestor)) test = ancestor.test;\n    else continue;\n\n    let validated = false;\n\n    walk(test, (child) => {\n      if (ast.isCallExpression(child)) {\n        const name = calleeName(child);\n        if (name !== undefined && REDIRECT_VALIDATORS.has(name)) validated = true;\n      }\n\n      return undefined;\n    });\n\n    if (validated) return true;\n  }\n\n  return false;\n}\n\nfunction unsafeRedirect(node: ast.Node, what: string, helper: string, from: string): SourceFinding {\n  return {\n    code: \"WL9007\",\n    node,\n    message: `This ${what} target comes from request input. Pass it through \\`${helper}()\\` from \\`${from}\\` so only same-origin paths and allow-listed origins are followed (open redirects and \\`javascript:\\` URLs otherwise).`,\n  };\n}\n\nfunction checkRedirect(node: ast.Node, findings: SourceFinding[]): void {\n  if (ast.isCallExpression(node)) {\n    const name = calleeName(node);\n\n    if (name === undefined || !REDIRECT_CALLS.has(name)) return;\n\n    // `router.redirect(from, to)` registers a static redirect, not a request-time one.\n    const callee = unwrap(ast.expressionOf(node));\n\n    if (isMemberAccess(callee)) {\n      const owner = unwrap(ast.expressionOf(callee));\n      if (ast.isIdentifier(owner) && ast.valueText(owner) === \"router\") return;\n    }\n\n    const target = node.arguments[0];\n\n    if (!target || ast.isSpreadElement(target)) return;\n    if (!isRedirectTainted(target) || checkedByValidator(node)) return;\n\n    findings.push(\n      name === \"navigateTo\"\n        ? unsafeRedirect(target, \"navigation\", \"safeRedirectTarget\", \"@warlock.js/web\")\n        : unsafeRedirect(target, \"redirect\", \"safeRedirect\", \"@warlock.js/core\"),\n    );\n\n    return;\n  }\n\n  if (!ast.isJsxAttribute(node) || ast.nameNode(node).type !== \"JSXIdentifier\") return;\n  if (ast.valueText(ast.nameNode(node)) !== \"to\" && ast.valueText(ast.nameNode(node)) !== \"href\")\n    return;\n\n  const element = ast.parentOf(node);\n\n  if (!element || (!ast.isJsxOpeningElement(element) && !ast.isJsxSelfClosingElement(element)))\n    return;\n  if (element.name.type !== \"JSXIdentifier\" || !LINK_COMPONENTS.has(element.name.name)) return;\n\n  const initializer = node.value;\n\n  if (!initializer || !ast.isJsxExpression(initializer) || !initializer.expression) return;\n\n  const expression = initializer.expression;\n\n  if (!isRedirectTainted(expression) || checkedByValidator(expression)) return;\n\n  findings.push(unsafeRedirect(expression, \"link\", \"safeRedirectTarget\", \"@warlock.js/web\"));\n}\n\n// ── WL9008: raw emails, credentials and request bodies in logs ──────────────\n\nconst LOGGER_NAMES: ReadonlySet<string> = new Set([\"log\", \"logger\", \"console\"]);\n\nconst LOG_METHODS: ReadonlySet<string> = new Set([\n  \"info\",\n  \"warn\",\n  \"error\",\n  \"debug\",\n  \"success\",\n  \"fatal\",\n  \"log\",\n  \"assert\",\n  \"trace\",\n]);\n\n/** Helpers that make a value safe to log; their arguments are not inspected. */\nconst REDACTORS: ReadonlySet<string> = new Set([\n  \"maskEmail\",\n  \"maskEmailsInText\",\n  \"redact\",\n  \"redactHeaders\",\n  \"redactError\",\n  \"redactUrlCredentials\",\n  \"redactQueryCredentials\",\n  \"escapeLogValue\",\n  \"toLogSnapshot\",\n]);\n\n/** Name endings that mark a value as a credential. */\nconst SECRET_SUFFIXES = [\n  \"token\",\n  \"password\",\n  \"passwd\",\n  \"secret\",\n  \"apikey\",\n  \"authorization\",\n  \"cookie\",\n  \"cookies\",\n  \"otp\",\n  \"jwt\",\n  \"privatekey\",\n];\n\n/**\n * Whether the logger censors this key by default (`DEFAULT_REDACT_KEYS` from\n * `@warlock.js/logger`). A secret logged under one of them never reaches a\n * channel. Emails are not on that list: they are not censored by default.\n */\nfunction isCensoredKey(key: string): boolean {\n  return DEFAULT_REDACT_KEY_SET.has(normalizeRedactKey(key));\n}\n\n/** `email` for addresses, `secret` for credentials, otherwise `undefined`. */\nfunction sensitiveCategory(name: string): \"email\" | \"secret\" | undefined {\n  const normalized = normalizeRedactKey(name);\n\n  if (normalized.endsWith(\"email\") || normalized.endsWith(\"emailaddress\")) return \"email\";\n  if (DEFAULT_REDACT_KEY_SET.has(normalized)) return \"secret\";\n  if (SECRET_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return \"secret\";\n\n  return undefined;\n}\n\nfunction describeCategory(category: \"email\" | \"secret\", name: string | undefined): string {\n  if (category === \"email\") return \"a raw email address\";\n\n  return name ? `the credential \\`${name}\\`` : \"a credential\";\n}\n\nfunction describeMember(member: string): string {\n  if (member === \"headers\" || member === \"cookies\") return member;\n\n  return `body (\\`${member}\\`)`;\n}\n\n/** `request.all()` / `request.body` itself, not `request.body.title`. */\nfunction isWholeAccess(node: ast.Node, member: string): boolean {\n  if (ast.isCallExpression(node)) {\n    const callee = unwrap(ast.expressionOf(node));\n    return isMemberAccess(callee) && memberName(callee) === member;\n  }\n\n  return isMemberAccess(node) && memberName(node) === member;\n}\n\ntype LogFinding = { node: ast.Node; what: string };\n\nfunction inspectLogged(node: ast.Node, censoredKey: boolean, found: LogFinding[]): void {\n  const value = unwrap(node);\n\n  if (isFunctionLike(value)) return;\n\n  if (ast.isCallExpression(value)) {\n    const name = calleeName(value);\n    if (name !== undefined && REDACTORS.has(name)) return;\n  }\n\n  // request.all() / request.body / request.headers / request.input(\"email\")\n  if (ast.isCallExpression(value) || isMemberAccess(value)) {\n    const member = requestMemberAccess(value);\n\n    if (member !== undefined && isWholeAccess(value, member)) {\n      if (REQUEST_BODY_MEMBERS.has(member)) {\n        found.push({ node: value, what: `the request ${describeMember(member)}` });\n        return;\n      }\n\n      if (member === \"email\") {\n        found.push({ node: value, what: \"a raw email address\" });\n        return;\n      }\n    }\n\n    if (ast.isCallExpression(value) && member !== undefined) {\n      const key = literalString(value.arguments[0]);\n      const category = key ? sensitiveCategory(key) : undefined;\n\n      if (category && !(censoredKey && category === \"secret\")) {\n        found.push({ node: value, what: describeCategory(category, key) });\n        return;\n      }\n    }\n  }\n\n  if (ast.isIdentifier(value) || isMemberAccess(value)) {\n    const name = ast.isIdentifier(value) ? ast.valueText(value) : memberName(value);\n    const category = name ? sensitiveCategory(name) : undefined;\n\n    if (category && !(censoredKey && category === \"secret\")) {\n      found.push({ node: value, what: describeCategory(category, name) });\n      return;\n    }\n\n    // `request.body.title` reads one field; only the whole body is reported.\n    if (isMemberAccess(value) && requestMemberAccess(value) === undefined) {\n      inspectLogged(ast.expressionOf(value), false, found);\n\n      if (ast.isElementAccessExpression(value)) inspectLogged(value.property, false, found);\n    }\n\n    return;\n  }\n\n  if (ast.isObjectLiteralExpression(value)) {\n    for (const property of value.properties) {\n      if (ast.isSpreadAssignment(property)) {\n        inspectLogged(ast.expressionOf(property), false, found);\n      } else if (ast.isPropertyAssignment(property)) {\n        const key = keyName(property.key);\n        inspectLogged(property.value, key !== undefined && isCensoredKey(key), found);\n      } else if (ast.isShorthandPropertyAssignment(property)) {\n        inspectLogged(property.key, isCensoredKey(ast.valueText(property.key)), found);\n      }\n    }\n\n    return;\n  }\n\n  if (ast.isTemplateExpression(value)) {\n    for (const expression of value.expressions) inspectLogged(expression, false, found);\n    return;\n  }\n\n  if (ast.isBinaryExpression(value)) {\n    inspectLogged(value.left, false, found);\n    inspectLogged(value.right, false, found);\n    return;\n  }\n\n  if (ast.isConditionalExpression(value)) {\n    inspectLogged(value.consequent, censoredKey, found);\n    inspectLogged(value.alternate, censoredKey, found);\n    return;\n  }\n\n  if (ast.isArrayLiteralExpression(value)) {\n    for (const element of value.elements) {\n      if (ast.isOmittedExpression(element)) continue;\n      inspectLogged(\n        ast.isSpreadElement(element) ? ast.expressionOf(element) : element,\n        false,\n        found,\n      );\n    }\n\n    return;\n  }\n\n  if (ast.isCallExpression(value)) {\n    // JSON.stringify(request.all()), String(user.email), user.email.trim()\n    const callee = unwrap(ast.expressionOf(value));\n\n    if (isMemberAccess(callee)) inspectLogged(ast.expressionOf(callee), false, found);\n\n    for (const argument of value.arguments) {\n      inspectLogged(\n        ast.isSpreadElement(argument) ? ast.expressionOf(argument) : argument,\n        false,\n        found,\n      );\n    }\n\n    return;\n  }\n\n  if (ast.isAwaitExpression(value)) inspectLogged(ast.expressionOf(value), censoredKey, found);\n}\n\nfunction checkSensitiveLog(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method || !LOG_METHODS.has(method)) return;\n\n  const owner = unwrap(ast.expressionOf(callee));\n\n  if (!ast.isIdentifier(owner)) return;\n\n  // log.info(…), console.log(…), and request.log(…)\n  const isLogger =\n    LOGGER_NAMES.has(ast.valueText(owner)) ||\n    (REQUEST_NAMES.has(ast.valueText(owner)) && method === \"log\");\n\n  if (!isLogger) return;\n\n  const found: LogFinding[] = [];\n\n  for (const argument of node.arguments) {\n    inspectLogged(\n      ast.isSpreadElement(argument) ? ast.expressionOf(argument) : argument,\n      false,\n      found,\n    );\n  }\n\n  for (const finding of found) {\n    findings.push({\n      code: \"WL9008\",\n      node: finding.node,\n      message: `Do not log ${finding.what} as-is. Pass it through a redaction helper (\\`maskEmail()\\`, \\`redact()\\`, \\`request.toLogSnapshot()\\`), or log it under a key the logger censors.`,\n    });\n  }\n}\n\n// ── WL9009: unbounded regex quantifiers on request input ────────────────────\n\n/** `regex.test(input)` / `regex.exec(input)`. */\nconst REGEX_METHODS: ReadonlySet<string> = new Set([\"test\", \"exec\"]);\n\n/** `input.match(regex)` and friends: the regex is the first argument. */\nconst STRING_METHODS: ReadonlySet<string> = new Set([\n  \"match\",\n  \"matchAll\",\n  \"replace\",\n  \"replaceAll\",\n  \"search\",\n  \"split\",\n]);\n\n/**\n * The first unbounded quantifier in a regex source (`*`, `+`, `{n,}`), skipping\n * escapes and character classes, or `undefined` when every repetition is\n * bounded.\n */\nexport function findUnboundedQuantifier(source: string): string | undefined {\n  let inClass = false;\n\n  for (let index = 0; index < source.length; index++) {\n    const char = source[index];\n\n    if (char === \"\\\\\") {\n      index++;\n      continue;\n    }\n\n    if (inClass) {\n      if (char === \"]\") inClass = false;\n      continue;\n    }\n\n    if (char === \"[\") {\n      inClass = true;\n      continue;\n    }\n\n    if (char === \"*\" || char === \"+\") {\n      return `${char}${source[index + 1] === \"?\" ? \"?\" : \"\"}`;\n    }\n\n    if (char === \"{\") {\n      const match = /^\\{(\\d+),\\}/.exec(source.slice(index));\n      if (match) return match[0];\n    }\n  }\n\n  return undefined;\n}\n\n/** The pattern of a regex literal, `new RegExp(\"…\")`, or a constant holding either. */\nfunction regexSource(node: ast.Node | undefined, depth = 0): string | undefined {\n  if (!node || depth > 8) return undefined;\n\n  const value = unwrap(node);\n\n  if (ast.isRegularExpressionLiteral(value)) {\n    return ast.valueText(value).slice(1, ast.valueText(value).lastIndexOf(\"/\"));\n  }\n\n  if (\n    (ast.isNewExpression(value) || ast.isCallExpression(value)) &&\n    ast.isIdentifier(ast.expressionOf(value)) &&\n    ast.valueText(ast.expressionOf(value)) === \"RegExp\"\n  ) {\n    return literalString(value.arguments?.[0]);\n  }\n\n  if (ast.isIdentifier(value)) {\n    const initializer = resolveInitializer(value);\n    return initializer ? regexSource(initializer, depth + 1) : undefined;\n  }\n\n  return undefined;\n}\n\nfunction checkUnboundedRegex(node: ast.Node, findings: SourceFinding[]): void {\n  if (!ast.isCallExpression(node)) return;\n\n  const callee = unwrap(ast.expressionOf(node));\n\n  if (!isMemberAccess(callee)) return;\n\n  const method = memberName(callee);\n\n  if (!method) return;\n\n  const first = node.arguments[0];\n  const firstArgument = first && !ast.isSpreadElement(first) ? first : undefined;\n  let regex: ast.Node | undefined;\n  let input: ast.Node | undefined;\n\n  if (REGEX_METHODS.has(method)) {\n    regex = ast.expressionOf(callee);\n    input = firstArgument;\n  } else if (STRING_METHODS.has(method)) {\n    regex = firstArgument;\n    input = ast.expressionOf(callee);\n  } else {\n    return;\n  }\n\n  if (!input) return;\n\n  const source = regexSource(regex);\n\n  if (source === undefined) return;\n\n  const quantifier = findUnboundedQuantifier(source);\n\n  if (!quantifier || !containsRequestInput(input)) return;\n\n  findings.push({\n    code: \"WL9009\",\n    node,\n    message: `This regex has an unbounded quantifier (\\`${quantifier}\\`) and runs on request input, so a crafted input can make it backtrack for a long time (ReDoS). Bound the repetition, e.g. \\`{1,256}\\`, or cap the input length before matching.`,\n  });\n}\n\n/**\n * The security conventions in one parsed file:\n *\n * - `WL9005` `request.all()` (or `heavy()`, `allExceptParams()`) passed to a\n *   query, a service or `inApp()`;\n * - `WL9006` a POST/PUT/PATCH/DELETE route with no auth middleware and no\n *   `public: true`;\n * - `WL9007` a `redirect()` / `navigateTo()` / `<Link to|href>` target taken\n *   from request input without `safeRedirect()` / `safeRedirectTarget()` or an\n *   `isSafeRedirect()` check;\n * - `WL9008` a raw email, credential or request body passed to a logger;\n * - `WL9009` a regex with an unbounded quantifier run on request input.\n */\nexport function securityFindings(sourceFile: ast.SourceFile): SourceFinding[] {\n  const findings: SourceFinding[] = [];\n\n  walk(\n    sourceFile,\n    (node) => {\n      checkRequestAll(node, findings);\n      checkRouteGuard(node, findings);\n      checkRedirect(node, findings);\n      checkSensitiveLog(node, findings);\n      checkUnboundedRegex(node, findings);\n\n      return undefined;\n    },\n    true,\n  );\n\n  return findings;\n}\n"],"mappings":";;;;;;;;AA4BA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,MAAM,oCAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,cAAc,QAA0B;CAC/C,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAIA,aAAiB,MAAM,GAAG,OAAO,GAAGC,UAAc,MAAM,EAAE;CAE9D,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;EAC9C,MAAM,QAAQF,aAAiB,MAAM,IAAI,GAAGC,UAAc,MAAM,EAAE,KAAK;EAEvE,OAAO,OAAO,GAAG,QAAQ,KAAK,MAAM;CACtC;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,QAA2B;CACpD,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;CAEpC,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;CAE9C,OAAOF,aAAiB,MAAM,KAAK,kBAAkB,IAAIC,UAAc,MAAM,CAAC;AAChF;;AAGA,SAAS,cAAc,MAAoC;CACzD,IAAI,UAAU;CAEd,SAAS;EACP,MAAM,SAASE,SAAa,OAAO;EAEnC,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAIC,iBAAqB,MAAM,KAAKC,gBAAoB,MAAM,GAAG;GAC/D,IAAI,EAAE,OAAO,aAAa,CAAC,EAAC,CAAE,MAAM,aAAa,aAAa,OAAO,GAAG,OAAO;GAC/E,IAAI,kBAAkBH,aAAiB,MAAM,CAAC,GAAG,OAAO;GAExD,OAAO,cAAcA,aAAiB,MAAM,CAAC;EAC/C;EAEA,IACEI,gBAAoB,MAAM,KAC1BC,mBAAuB,MAAM,KAC7BC,0BAA8B,MAAM,KACpCC,yBAA6B,MAAM,KAClCC,qBAAyB,MAAM,KAAK,OAAO,UAAU,WACtDC,8BAAkC,MAAM,KACxCC,eAAmB,MAAM,KACzBC,oBAAwB,MAAM,KAC9BC,sBAA0B,MAAM,KAChCC,0BAA8B,MAAM,KACpCC,0BAA8B,MAAM,KACpCC,kBAAsB,MAAM,GAC5B;GACA,UAAU;GACV;EACF;EAEA;CACF;AACF;;;;;;AAOA,SAAS,cAAc,MAAoC;CACzD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,QAAQ,OAAO;CAGnB,MAAM,SAASd,SAAa,IAAI;CAEhC,IACE,UACAe,sBAA0B,MAAM,KAChC,OAAO,SAAS,QAChBlB,aAAiB,OAAO,EAAE,GAE1B,KAAK,MAAM,aAAa,aAAa,MAAM,GAAG;EAC5C,MAAM,OAAO,cAAc,SAAS;EACpC,IAAI,MAAM,OAAO;CACnB;AAIJ;AAEA,SAAS,gBAAgB,MAAgB,UAAiC;CACxE,IAAI,CAACI,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,OAAOA,aAAiB,MAAM,CAAC;CAE9C,IAAI,CAACF,aAAiB,MAAM,KAAK,CAAC,cAAc,IAAIC,UAAc,MAAM,CAAC,GAAG;CAE5E,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,mBAAmB,IAAI,MAAM,GAAG;CAEhD,MAAM,SAAS,cAAc,IAAI;CAEjC,IAAI,CAAC,QAAQ;CAEb,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,KAAKA,UAAc,MAAM,EAAE,GAAG,OAAO,2CAA2C,OAAO,YAAYA,UAAc,MAAM,EAAE;CACpI,CAAC;AACH;AAIA,MAAM,+BAAoC,IAAI,IAAI,CAAC,QAAQ,CAAC;;AAG5D,MAAM,kCAAuC,IAAI,IAAI,CAAC,SAAS,CAAC;;AAGhE,MAAM,0CAA+C,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAG/F,MAAM,2CAAgD,IAAI,IAAI;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,6CAAkD,IAAI,IAAI;CAAC;CAAQ;CAAO;AAAM,CAAC;AAEvF,SAAS,SAAS,MAAyB;CACzC,MAAM,SAAS,OAAO,IAAI;CAE1B,OAAOD,aAAiB,MAAM,KAAK,aAAa,IAAIC,UAAc,MAAM,CAAC;AAC3E;AAEA,SAAS,YAAY,MAAmC;CACtD,OAAO,SAAS,UAAa,gBAAgB,IAAI;AACnD;;AAGA,SAAS,cAAc,YAAqC;CAC1D,MAAM,cAAc,mBAAmB,UAAU;CACjD,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;CAElD,OACE,UAAU,UACVG,iBAAqB,KAAK,KAC1B,WAAW,KAAK,MAAM,mBACtB,EAAE,MAAM,UAAU,EAAE,EAAE,SAAS,aAAa,MAAM,UAAU,EAAE,CAAC,UAAU;AAE7E;AAEA,SAAS,mBAAmB,MAAyB;CACnD,MAAM,QAAQ,OAAO,IAAI;CAGzB,IAAI,CAACK,yBAA6B,KAAK,GAAG,OAAO;CAEjD,OAAO,MAAM,SAAS,MAAM,YAAY;EACtC,IAAI,CAAC,SAAS,OAAO;EACrB,IAAIH,gBAAoB,OAAO,GAAG,OAAO;EAEzC,MAAM,OAAO,OAAO,OAAO;EAE3B,IAAIN,aAAiB,IAAI,GAAG,OAAO,YAAYC,UAAc,IAAI,CAAC,KAAK,cAAc,IAAI;EACzF,IAAIG,iBAAqB,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EACnE,IAAI,eAAe,IAAI,GAAG,OAAO,YAAY,WAAW,IAAI,CAAC;EAE7D,OAAO;CACT,CAAC;AACH;;AAGA,SAAS,aAAa,MAA8D;CAClF,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAACI,0BAA8B,KAAK,GAAG,OAAO;CAElD,IAAI,UAAmC;CAEvC,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAID,mBAAuB,QAAQ,GAAG;GACpC,UAAU;GACV;EACF;EAEA,IAAI;EACJ,IAAI;EAEJ,IAAIG,qBAAyB,QAAQ,GAAG;GACtC,MAAM,QAAQ,SAAS,GAAG;GAC1B,gBAAgB,OAAO,SAAS,KAAK;EACvC,OAAO,IAAIC,8BAAkC,QAAQ,GAAG;GACtD,MAAMV,UAAc,SAAS,GAAG;GAChC,gBAAgB,SAAS;EAC3B;EAEA,IAAI,CAAC,eAAe;EACpB,IAAI,QAAQ,YAAY,cAAc,SAAS,aAAa,cAAc,UAAU,MAClF,OAAO;EACT,IAAI,QAAQ,gBAAgB,mBAAmB,aAAa,GAAG,OAAO;CACxE;CAEA,OAAO;AACT;;AAGA,SAAS,mBAAmB,MAAyB;CACnD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI,CAACkB,gBAAoB,QAAQ,KAAK,CAACC,qBAAyB,QAAQ,GAAG;EAE3E,MAAM,SAASjB,SAAa,QAAQ;EAEpC,IAAI,CAAC,UAAU,CAACC,iBAAqB,MAAM,GAAG;EAC9C,IAAI,CAAC,OAAO,UAAU,MAAM,aAAa,aAAa,QAAQ,GAAG;EAEjE,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,UAAa,gBAAgB,IAAI,IAAI,GAAG,OAAO;EAE5D,MAAM,SAAS,OAAOF,aAAiB,MAAM,CAAC;EAE9C,IACE,eAAe,MAAM,KACrB,WAAW,MAAM,MAAM,WACvB,SAASA,aAAiB,MAAM,CAAC,KACjC,aAAa,OAAO,UAAU,EAAE,MAAM,WAEtC,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAS,SAAS,MAAoC;CACpD,OAAO,cAAc,IAAI,KAAK;AAChC;;;;;AAMA,SAAS,aAAa,MAAuE;CAC3F,MAAM,cAA0B,CAAC;CACjC,IAAI,UAAU,OAAO,IAAI;CAEzB,OAAOE,iBAAqB,OAAO,GAAG;EACpC,MAAM,SAAS,OAAOF,aAAiB,OAAO,CAAC;EAE/C,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;EAEpC,MAAM,OAAO,WAAW,MAAM;EAE9B,IAAI,SAAS,WAAW,SAASA,aAAiB,MAAM,CAAC,GAAG;GAC1D,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;GAErC,OAAO;IAAE,MAAM,SAAS,QAAQ,UAAU,EAAE;IAAG;GAAY;EAC7D;EAEA,IAAI,SAAS,QAAQ;GACnB,MAAM,UAAU,QAAQ,UAAU;GAClC,IAAI,SAAS,YAAY,KAAK,OAAO;EACvC;EAEA,UAAU,OAAOA,aAAiB,MAAM,CAAC;CAC3C;AAGF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,CAACM,0BAA8B,KAAK,GAAG,OAAO;CAElD,KAAK,MAAM,YAAY,MAAM,YAAY;EACvC,IAAI,CAACE,qBAAyB,QAAQ,KAAK,QAAQ,SAAS,GAAG,MAAM,QAAQ;EAE7E,MAAM,OAAO,OAAO,SAAS,KAAK;EAElC,IAAI,CAACD,yBAA6B,IAAI,GAAG,OAAO;EAEhD,OAAO,KAAK,SAAS,OAAO,YAAY;GACtC,IAAI,CAAC,SAAS,OAAO;GACrB,MAAM,SAAS,cAAc,OAAO;GACpC,OAAO,WAAW,UAAa,2BAA2B,IAAI,MAAM;EACtE,CAAC;CACH;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAgB,OAA8B;CACpE,OAAO;EACL,MAAM;EACN;EACA,SAAS,oBAAoB,MAAM;CACrC;AACF;AAEA,SAAS,gBAAgB,MAAgB,UAAiC;CACxE,IAAI,CAACL,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,WAAW,YACf,aAAa,OAAO,MAAM,aAAa,mBAAmB,IAAI;CAEhE,IAAI,SAASA,aAAiB,MAAM,CAAC,GAAG;EAEtC,IAAI,wBAAwB,IAAI,MAAM,GAAG;GACvC,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KACP,eAAe,MAAM,GAAG,OAAO,YAAY,EAAE,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAC/E;GAGF;EACF;EAGA,IAAI,WAAW,OAAO;GACpB,MAAM,aAAa,cAAc,KAAK,UAAU,EAAE,CAAC,EAAE,YAAY;GAEjE,IAAI,CAAC,cAAc,CAAC,qBAAqB,UAAU,GAAG;GAEtD,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,GAAG,WAAW,GAAG,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;GAGpF;EACF;EAGA,IAAI,WAAW,mBAAmB;GAChC,IAAI,mBAAmB,KAAK,UAAU,EAAE,GAAG;GAE3C,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,GAC5B,SAAS,KAAK,eAAe,MAAM,YAAY,SAAS,KAAK,UAAU,EAAE,GAAG,CAAC;EAEjF;EAEA;CACF;CAGA,IAAI,CAAC,yBAAyB,IAAI,MAAM,GAAG;CAE3C,MAAM,QAAQ,aAAaA,aAAiB,MAAM,CAAC;CAEnD,IAAI,CAAC,OAAO;CACZ,IAAI,aAAa,KAAK,UAAU,EAAE,MAAM,WAAW;CACnD,IAAI,MAAM,YAAY,MAAM,YAAY,aAAa,OAAO,MAAM,SAAS,GAAG;CAC9E,IAAI,mBAAmB,IAAI,GAAG;CAE9B,SAAS,KAAK,eAAe,MAAM,GAAG,OAAO,GAAG,MAAM,MAAM,CAAC;AAC/D;;AAKA,MAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kCAAuC,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC;;AAGxE,MAAM,sCAA2C,IAAI,IAAI,CAAC,gBAAgB,oBAAoB,CAAC;;AAG/F,MAAM,sCAA2C,IAAI,IAAI,CAAC,kBAAkB,mBAAmB,CAAC;;AAGhG,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;AACF,CAAC;;AAGD,MAAM,qCAA0C,IAAI,IAAI,CAAC,SAAS,cAAc,CAAC;AAEjF,SAAS,eAAe,MAAyB;CAC/C,IAAIE,iBAAqB,IAAI,GAAG;EAC9B,MAAM,OAAO,WAAW,IAAI;EAC5B,IAAI,SAAS,UAAa,mBAAmB,IAAI,IAAI,GAAG,OAAO;CACjE;CAEA,IAAI,eAAe,IAAI,GAAG;EACxB,MAAM,OAAO,eAAe,IAAI;EAEhC,IAAI,QAAQ,mBAAmB,IAAIH,UAAc,IAAI,CAAC,GAAG,OAAO;EAGhE,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,YAAY,SAAS,QAAQ;GACxC,MAAM,SAAS,OAAOC,aAAiB,IAAI,CAAC;GAE5C,IAAIF,aAAiB,MAAM,KAAKC,UAAc,MAAM,MAAM,YAAY,OAAO;GAC7E,IAAI,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM,YAAY,OAAO;EAC1E;CACF;CAEA,OAAO;AACT;AAEA,SAAS,kBAAkB,MAAyB;CAClD,OAAO,qBAAqB,MAAM;EAAE,YAAY;EAAqB,UAAU;CAAe,CAAC;AACjG;;AAGA,SAAS,mBAAmB,MAAyB;CACnD,KAAK,MAAM,YAAY,UAAU,IAAI,GAAG;EACtC,IAAI;EAEJ,IAAIoB,cAAkB,QAAQ,GAAG,OAAOnB,aAAiB,QAAQ;OAC5D,IAAIoB,wBAA4B,QAAQ,GAAG,OAAO,SAAS;OAC3D;EAEL,IAAI,YAAY;EAEhB,KAAK,OAAO,UAAU;GACpB,IAAIlB,iBAAqB,KAAK,GAAG;IAC/B,MAAM,OAAO,WAAW,KAAK;IAC7B,IAAI,SAAS,UAAa,oBAAoB,IAAI,IAAI,GAAG,YAAY;GACvE;EAGF,CAAC;EAED,IAAI,WAAW,OAAO;CACxB;CAEA,OAAO;AACT;AAEA,SAAS,eAAe,MAAgB,MAAc,QAAgB,MAA6B;CACjG,OAAO;EACL,MAAM;EACN;EACA,SAAS,QAAQ,KAAK,sDAAsD,OAAO,cAAc,KAAK;CACxG;AACF;AAEA,SAAS,cAAc,MAAgB,UAAiC;CACtE,IAAIA,iBAAqB,IAAI,GAAG;EAC9B,MAAM,OAAO,WAAW,IAAI;EAE5B,IAAI,SAAS,UAAa,CAAC,eAAe,IAAI,IAAI,GAAG;EAGrD,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;EAE5C,IAAI,eAAe,MAAM,GAAG;GAC1B,MAAM,QAAQ,OAAOA,aAAiB,MAAM,CAAC;GAC7C,IAAIF,aAAiB,KAAK,KAAKC,UAAc,KAAK,MAAM,UAAU;EACpE;EAEA,MAAM,SAAS,KAAK,UAAU;EAE9B,IAAI,CAAC,UAAUK,gBAAoB,MAAM,GAAG;EAC5C,IAAI,CAAC,kBAAkB,MAAM,KAAK,mBAAmB,IAAI,GAAG;EAE5D,SAAS,KACP,SAAS,eACL,eAAe,QAAQ,cAAc,sBAAsB,iBAAiB,IAC5E,eAAe,QAAQ,YAAY,gBAAgB,kBAAkB,CAC3E;EAEA;CACF;CAEA,IAAI,CAACiB,eAAmB,IAAI,KAAKC,SAAa,IAAI,CAAC,CAAC,SAAS,iBAAiB;CAC9E,IAAIvB,UAAcuB,SAAa,IAAI,CAAC,MAAM,QAAQvB,UAAcuB,SAAa,IAAI,CAAC,MAAM,QACtF;CAEF,MAAM,UAAUrB,SAAa,IAAI;CAEjC,IAAI,CAAC,WAAY,CAACsB,oBAAwB,OAAO,KAAK,CAACC,wBAA4B,OAAO,GACxF;CACF,IAAI,QAAQ,KAAK,SAAS,mBAAmB,CAAC,gBAAgB,IAAI,QAAQ,KAAK,IAAI,GAAG;CAEtF,MAAM,cAAc,KAAK;CAEzB,IAAI,CAAC,eAAe,CAACC,gBAAoB,WAAW,KAAK,CAAC,YAAY,YAAY;CAElF,MAAM,aAAa,YAAY;CAE/B,IAAI,CAAC,kBAAkB,UAAU,KAAK,mBAAmB,UAAU,GAAG;CAEtE,SAAS,KAAK,eAAe,YAAY,QAAQ,sBAAsB,iBAAiB,CAAC;AAC3F;AAIA,MAAM,+BAAoC,IAAI,IAAI;CAAC;CAAO;CAAU;AAAS,CAAC;AAE9E,MAAM,8BAAmC,IAAI,IAAI;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,4BAAiC,IAAI,IAAI;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;AAOA,SAAS,cAAc,KAAsB;CAC3C,OAAO,uBAAuB,IAAI,mBAAmB,GAAG,CAAC;AAC3D;;AAGA,SAAS,kBAAkB,MAA8C;CACvE,MAAM,aAAa,mBAAmB,IAAI;CAE1C,IAAI,WAAW,SAAS,OAAO,KAAK,WAAW,SAAS,cAAc,GAAG,OAAO;CAChF,IAAI,uBAAuB,IAAI,UAAU,GAAG,OAAO;CACnD,IAAI,gBAAgB,MAAM,WAAW,WAAW,SAAS,MAAM,CAAC,GAAG,OAAO;AAG5E;AAEA,SAAS,iBAAiB,UAA8B,MAAkC;CACxF,IAAI,aAAa,SAAS,OAAO;CAEjC,OAAO,OAAO,oBAAoB,KAAK,MAAM;AAC/C;AAEA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,aAAa,WAAW,WAAW,OAAO;CAEzD,OAAO,WAAW,OAAO;AAC3B;;AAGA,SAAS,cAAc,MAAgB,QAAyB;CAC9D,IAAIvB,iBAAqB,IAAI,GAAG;EAC9B,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;EAC5C,OAAO,eAAe,MAAM,KAAK,WAAW,MAAM,MAAM;CAC1D;CAEA,OAAO,eAAe,IAAI,KAAK,WAAW,IAAI,MAAM;AACtD;AAIA,SAAS,cAAc,MAAgB,aAAsB,OAA2B;CACtF,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI,eAAe,KAAK,GAAG;CAE3B,IAAIE,iBAAqB,KAAK,GAAG;EAC/B,MAAM,OAAO,WAAW,KAAK;EAC7B,IAAI,SAAS,UAAa,UAAU,IAAI,IAAI,GAAG;CACjD;CAGA,IAAIA,iBAAqB,KAAK,KAAK,eAAe,KAAK,GAAG;EACxD,MAAM,SAAS,oBAAoB,KAAK;EAExC,IAAI,WAAW,UAAa,cAAc,OAAO,MAAM,GAAG;GACxD,IAAI,qBAAqB,IAAI,MAAM,GAAG;IACpC,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,eAAe,eAAe,MAAM;IAAI,CAAC;IACzE;GACF;GAEA,IAAI,WAAW,SAAS;IACtB,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM;IAAsB,CAAC;IACvD;GACF;EACF;EAEA,IAAIA,iBAAqB,KAAK,KAAK,WAAW,QAAW;GACvD,MAAM,MAAM,cAAc,MAAM,UAAU,EAAE;GAC5C,MAAM,WAAW,MAAM,kBAAkB,GAAG,IAAI;GAEhD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;IACvD,MAAM,KAAK;KAAE,MAAM;KAAO,MAAM,iBAAiB,UAAU,GAAG;IAAE,CAAC;IACjE;GACF;EACF;CACF;CAEA,IAAIJ,aAAiB,KAAK,KAAK,eAAe,KAAK,GAAG;EACpD,MAAM,OAAOA,aAAiB,KAAK,IAAIC,UAAc,KAAK,IAAI,WAAW,KAAK;EAC9E,MAAM,WAAW,OAAO,kBAAkB,IAAI,IAAI;EAElD,IAAI,YAAY,EAAE,eAAe,aAAa,WAAW;GACvD,MAAM,KAAK;IAAE,MAAM;IAAO,MAAM,iBAAiB,UAAU,IAAI;GAAE,CAAC;GAClE;EACF;EAGA,IAAI,eAAe,KAAK,KAAK,oBAAoB,KAAK,MAAM,QAAW;GACrE,cAAcC,aAAiB,KAAK,GAAG,OAAO,KAAK;GAEnD,IAAI0B,0BAA8B,KAAK,GAAG,cAAc,MAAM,UAAU,OAAO,KAAK;EACtF;EAEA;CACF;CAEA,IAAIpB,0BAA8B,KAAK,GAAG;EACxC,KAAK,MAAM,YAAY,MAAM,YAC3B,IAAID,mBAAuB,QAAQ,GACjC,cAAcL,aAAiB,QAAQ,GAAG,OAAO,KAAK;OACjD,IAAIQ,qBAAyB,QAAQ,GAAG;GAC7C,MAAM,MAAM,QAAQ,SAAS,GAAG;GAChC,cAAc,SAAS,OAAO,QAAQ,UAAa,cAAc,GAAG,GAAG,KAAK;EAC9E,OAAO,IAAIC,8BAAkC,QAAQ,GACnD,cAAc,SAAS,KAAK,cAAcV,UAAc,SAAS,GAAG,CAAC,GAAG,KAAK;EAIjF;CACF;CAEA,IAAI4B,qBAAyB,KAAK,GAAG;EACnC,KAAK,MAAM,cAAc,MAAM,aAAa,cAAc,YAAY,OAAO,KAAK;EAClF;CACF;CAEA,IAAIC,mBAAuB,KAAK,GAAG;EACjC,cAAc,MAAM,MAAM,OAAO,KAAK;EACtC,cAAc,MAAM,OAAO,OAAO,KAAK;EACvC;CACF;CAEA,IAAIR,wBAA4B,KAAK,GAAG;EACtC,cAAc,MAAM,YAAY,aAAa,KAAK;EAClD,cAAc,MAAM,WAAW,aAAa,KAAK;EACjD;CACF;CAEA,IAAIb,yBAA6B,KAAK,GAAG;EACvC,KAAK,MAAM,WAAW,MAAM,UAAU;GACpC,IAAIsB,oBAAwB,OAAO,GAAG;GACtC,cACEzB,gBAAoB,OAAO,IAAIJ,aAAiB,OAAO,IAAI,SAC3D,OACA,KACF;EACF;EAEA;CACF;CAEA,IAAIE,iBAAqB,KAAK,GAAG;EAE/B,MAAM,SAAS,OAAOF,aAAiB,KAAK,CAAC;EAE7C,IAAI,eAAe,MAAM,GAAG,cAAcA,aAAiB,MAAM,GAAG,OAAO,KAAK;EAEhF,KAAK,MAAM,YAAY,MAAM,WAC3B,cACEI,gBAAoB,QAAQ,IAAIJ,aAAiB,QAAQ,IAAI,UAC7D,OACA,KACF;EAGF;CACF;CAEA,IAAIe,kBAAsB,KAAK,GAAG,cAAcf,aAAiB,KAAK,GAAG,aAAa,KAAK;AAC7F;AAEA,SAAS,kBAAkB,MAAgB,UAAiC;CAC1E,IAAI,CAACE,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,GAAG;CAEzC,MAAM,QAAQ,OAAOA,aAAiB,MAAM,CAAC;CAE7C,IAAI,CAACF,aAAiB,KAAK,GAAG;CAO9B,IAAI,EAHF,aAAa,IAAIC,UAAc,KAAK,CAAC,KACpC,cAAc,IAAIA,UAAc,KAAK,CAAC,KAAK,WAAW,QAE1C;CAEf,MAAM,QAAsB,CAAC;CAE7B,KAAK,MAAM,YAAY,KAAK,WAC1B,cACEK,gBAAoB,QAAQ,IAAIJ,aAAiB,QAAQ,IAAI,UAC7D,OACA,KACF;CAGF,KAAK,MAAM,WAAW,OACpB,SAAS,KAAK;EACZ,MAAM;EACN,MAAM,QAAQ;EACd,SAAS,cAAc,QAAQ,KAAK;CACtC,CAAC;AAEL;;AAKA,MAAM,gCAAqC,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC;;AAGnE,MAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,wBAAwB,QAAoC;CAC1E,IAAI,UAAU;CAEd,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,OAAO,OAAO;EAEpB,IAAI,SAAS,MAAM;GACjB;GACA;EACF;EAEA,IAAI,SAAS;GACX,IAAI,SAAS,KAAK,UAAU;GAC5B;EACF;EAEA,IAAI,SAAS,KAAK;GAChB,UAAU;GACV;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,KAC3B,OAAO,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;EAGrD,IAAI,SAAS,KAAK;GAChB,MAAM,QAAQ,cAAc,KAAK,OAAO,MAAM,KAAK,CAAC;GACpD,IAAI,OAAO,OAAO,MAAM;EAC1B;CACF;AAGF;;AAGA,SAAS,YAAY,MAA4B,QAAQ,GAAuB;CAC9E,IAAI,CAAC,QAAQ,QAAQ,GAAG,OAAO;CAE/B,MAAM,QAAQ,OAAO,IAAI;CAEzB,IAAI8B,2BAA+B,KAAK,GACtC,OAAO/B,UAAc,KAAK,CAAC,CAAC,MAAM,GAAGA,UAAc,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC;CAG5E,KACGI,gBAAoB,KAAK,KAAKD,iBAAqB,KAAK,MACzDJ,aAAiBE,aAAiB,KAAK,CAAC,KACxCD,UAAcC,aAAiB,KAAK,CAAC,MAAM,UAE3C,OAAO,cAAc,MAAM,YAAY,EAAE;CAG3C,IAAIF,aAAiB,KAAK,GAAG;EAC3B,MAAM,cAAc,mBAAmB,KAAK;EAC5C,OAAO,cAAc,YAAY,aAAa,QAAQ,CAAC,IAAI;CAC7D;AAGF;AAEA,SAAS,oBAAoB,MAAgB,UAAiC;CAC5E,IAAI,CAACI,iBAAqB,IAAI,GAAG;CAEjC,MAAM,SAAS,OAAOF,aAAiB,IAAI,CAAC;CAE5C,IAAI,CAAC,eAAe,MAAM,GAAG;CAE7B,MAAM,SAAS,WAAW,MAAM;CAEhC,IAAI,CAAC,QAAQ;CAEb,MAAM,QAAQ,KAAK,UAAU;CAC7B,MAAM,gBAAgB,SAAS,CAACI,gBAAoB,KAAK,IAAI,QAAQ;CACrE,IAAI;CACJ,IAAI;CAEJ,IAAI,cAAc,IAAI,MAAM,GAAG;EAC7B,QAAQJ,aAAiB,MAAM;EAC/B,QAAQ;CACV,OAAO,IAAI,eAAe,IAAI,MAAM,GAAG;EACrC,QAAQ;EACR,QAAQA,aAAiB,MAAM;CACjC,OACE;CAGF,IAAI,CAAC,OAAO;CAEZ,MAAM,SAAS,YAAY,KAAK;CAEhC,IAAI,WAAW,QAAW;CAE1B,MAAM,aAAa,wBAAwB,MAAM;CAEjD,IAAI,CAAC,cAAc,CAAC,qBAAqB,KAAK,GAAG;CAEjD,SAAS,KAAK;EACZ,MAAM;EACN;EACA,SAAS,6CAA6C,WAAW;CACnE,CAAC;AACH;;;;;;;;;;;;;;AAeA,SAAgB,iBAAiB,YAA6C;CAC5E,MAAM,WAA4B,CAAC;CAEnC,KACE,aACC,SAAS;EACR,gBAAgB,MAAM,QAAQ;EAC9B,gBAAgB,MAAM,QAAQ;EAC9B,cAAc,MAAM,QAAQ;EAC5B,kBAAkB,MAAM,QAAQ;EAChC,oBAAoB,MAAM,QAAQ;CAGpC,GACA,IACF;CAEA,OAAO;AACT"}

package/esm/tooling/check/source-ast.mjs

@@ -1,195 +1,155 @@
-import ts from "typescript";
+import { declarationName, expressionOf, forEachChild, isNoSubstitutionTemplateLiteral, isStringLiteral, keyName as keyName$1, parentOf, positionOf as positionOf$1, sourceOf } from "../syntax/ast.mjs";
 
 //#region ../../packages/core/src/tooling/check/source-ast.ts
-/** Whether a node is `a.b` or `a[b]`. */
-function isMemberAccess(node) {
-	return ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node);
-}
-/** Strip parentheses and type-only wrappers (`x as T`, `x!`, `<T>x`, `x satisfies T`). */
+const isMemberAccess = (node) => node.type === "MemberExpression";
+const keyName = keyName$1;
+const positionOf = positionOf$1;
 function unwrap(node) {
 	let current = node;
-	while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isNonNullExpression(current) || ts.isTypeAssertionExpression(current) || ts.isSatisfiesExpression(current)) current = current.expression;
+	while ([
+		"ParenthesizedExpression",
+		"TSAsExpression",
+		"TSNonNullExpression",
+		"TSTypeAssertion",
+		"TSSatisfiesExpression",
+		"ChainExpression"
+	].includes(current.type)) current = expressionOf(current);
 	return current;
 }
-/** The text of a string literal or a template without substitutions. */
 function literalString(node) {
 	if (!node) return void 0;
 	const value = unwrap(node);
-	return ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value) ? value.text : void 0;
+	if (isStringLiteral(value)) return value.value;
+	if (isNoSubstitutionTemplateLiteral(value)) return value.quasis[0]?.value.cooked ?? void 0;
 }
-/** The static name of a member (`a.b` → `b`, `a["b"]` → `b`). */
 function memberName(node) {
-	if (ts.isPropertyAccessExpression(node)) return node.name.text;
-	return literalString(node.argumentExpression);
-}
-/** The static name of an object-literal or type-member key (`{ a: 1 }`, `{ "a": 1 }`). */
-function keyName(name) {
-	if (!name) return void 0;
-	if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isPrivateIdentifier(name)) return name.text;
-}
-/**
-* The name a call is made through: `foo()` → `foo`, `a.b.foo()` → `foo`.
-* Used to recognise helpers by name wherever they are imported from.
-*/
+	return node.computed ? literalString(node.property) : keyName$1(node.property);
+}
 function calleeName(call) {
-	const callee = unwrap(call.expression);
-	if (ts.isIdentifier(callee)) return callee.text;
-	if (isMemberAccess(callee)) return memberName(callee);
+	const callee = unwrap(call.callee);
+	return callee.type === "Identifier" ? callee.name : isMemberAccess(callee) ? memberName(callee) : void 0;
 }
-/** The root identifier of a member chain: `a.b.c()` → `a`. */
 function rootIdentifier(node) {
 	let current = unwrap(node);
 	for (;;) {
-		if (ts.isIdentifier(current)) return current;
-		if (isMemberAccess(current) || ts.isCallExpression(current)) {
-			current = unwrap(current.expression);
-			continue;
-		}
-		return;
+		if (current.type === "Identifier") return current;
+		if (isMemberAccess(current) || current.type === "CallExpression") current = unwrap(expressionOf(current));
+		else return void 0;
 	}
 }
-/** Whether a node is a function body owner (declaration, expression, arrow, method, accessor). */
 function isFunctionLike(node) {
-	return ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node) || ts.isGetAccessorDeclaration(node) || ts.isSetAccessorDeclaration(node) || ts.isConstructorDeclaration(node);
+	return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
 }
-/**
-* Walk a node depth-first, skipping type annotations. The visitor returns
-* `false` to skip a node's children. Nested functions are not entered unless
-* `enterFunctions`.
-*/
 function walk(node, visit, enterFunctions = false) {
-	if (visit(node) === false) return;
-	if (!enterFunctions && isFunctionLike(node)) return;
-	ts.forEachChild(node, (child) => {
-		if (!ts.isTypeNode(child)) walk(child, visit, enterFunctions);
+	if (visit(node) === false || !enterFunctions && isFunctionLike(node)) return;
+	forEachChild(node, (child) => {
+		if (!child.type.startsWith("TS") || "expression" in child && typeof child.expression === "object") walk(child, visit, enterFunctions);
 	});
 }
-/** Every ancestor of a node, nearest first. */
 function ancestors(node) {
 	const list = [];
-	let current = node.parent;
+	let current = parentOf(node);
 	while (current) {
 		list.push(current);
-		current = current.parent;
+		current = parentOf(current);
 	}
 	return list;
 }
-/**
-* Whether an identifier is a value reference: not the `b` of `a.b`, an object
-* key, or the name a declaration introduces.
-*/
 function isValueReference(identifier) {
-	const parent = identifier.parent;
+	const parent = parentOf(identifier);
 	if (!parent) return true;
-	if (ts.isPropertyAccessExpression(parent)) return parent.expression === identifier;
-	if (ts.isShorthandPropertyAssignment(parent)) return true;
-	if (ts.isPropertyAssignment(parent) || ts.isMethodDeclaration(parent) || ts.isPropertyDeclaration(parent) || ts.isGetAccessorDeclaration(parent) || ts.isSetAccessorDeclaration(parent) || ts.isPropertySignature(parent) || ts.isVariableDeclaration(parent) || ts.isParameter(parent) || ts.isFunctionDeclaration(parent) || ts.isFunctionExpression(parent) || ts.isClassDeclaration(parent) || ts.isClassExpression(parent) || ts.isEnumMember(parent)) return parent.name !== identifier;
-	if (ts.isBindingElement(parent)) return parent.name !== identifier && parent.propertyName !== identifier;
-	return !(ts.isJsxAttribute(parent) || ts.isImportSpecifier(parent) || ts.isExportSpecifier(parent) || ts.isImportClause(parent) || ts.isNamespaceImport(parent) || ts.isLabeledStatement(parent) || ts.isBreakOrContinueStatement(parent));
-}
-function declarationListDeclares(list, name) {
-	for (const declaration of list.declarations) if (ts.isIdentifier(declaration.name)) {
-		if (declaration.name.text === name) return declaration;
-	} else if (bindingDeclares(declaration.name, name)) return "other";
+	if (parent.type === "MemberExpression") return parent.object === identifier || parent.computed;
+	if (parent.type === "Property") return parent.value === identifier || parent.computed;
+	if (parent.type === "VariableDeclarator") return parent.id !== identifier;
+	if ((isFunctionLike(parent) || parent.type === "ClassDeclaration" || parent.type === "ClassExpression") && parent.id === identifier) return false;
+	return ![
+		"ImportSpecifier",
+		"ImportDefaultSpecifier",
+		"ImportNamespaceSpecifier",
+		"ExportSpecifier",
+		"JSXAttribute",
+		"LabeledStatement",
+		"BreakStatement",
+		"ContinueStatement",
+		"TSPropertySignature",
+		"PropertyDefinition",
+		"MethodDefinition",
+		"RestElement",
+		"ArrayPattern",
+		"ObjectPattern"
+	].includes(parent.type);
 }
 function bindingDeclares(binding, name) {
-	if (ts.isIdentifier(binding)) return binding.text === name;
-	return binding.elements.some((element) => !ts.isOmittedExpression(element) && bindingDeclares(element.name, name));
+	if (binding.type === "Identifier") return binding.name === name;
+	if (binding.type === "RestElement") return bindingDeclares(binding.argument, name);
+	if (binding.type === "AssignmentPattern") return bindingDeclares(binding.left, name);
+	if (binding.type === "ObjectPattern") return binding.properties.some((property) => bindingDeclares(property.type === "RestElement" ? property.argument : property.value, name));
+	if (binding.type === "ArrayPattern") return binding.elements.some((element) => element !== null && bindingDeclares(element, name));
+	return false;
+}
+function declarationsDeclare(list, name) {
+	for (const declaration of list.declarations) if (bindingDeclares(declaration.id, name)) return declaration.id.type === "Identifier" ? declaration : "other";
 }
 function statementsDeclare(statements, name) {
-	for (const statement of statements) if (ts.isVariableStatement(statement)) {
-		const found = declarationListDeclares(statement.declarationList, name);
-		if (found) return found;
-	} else if ((ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isEnumDeclaration(statement)) && statement.name?.text === name) return "other";
-	else if (ts.isImportDeclaration(statement) && importDeclares(statement, name)) return "other";
-}
-function importDeclares(statement, name) {
-	const clause = statement.importClause;
-	if (!clause) return false;
-	if (clause.name?.text === name) return true;
-	const bindings = clause.namedBindings;
-	if (!bindings) return false;
-	if (ts.isNamespaceImport(bindings)) return bindings.name.text === name;
-	return bindings.elements.some((element) => element.name.text === name);
-}
-/** The declaration a scope node introduces for `name`, if it introduces one. */
-function scopeDeclares(scope, name) {
-	if (ts.isSourceFile(scope) || ts.isBlock(scope) || ts.isModuleBlock(scope)) return statementsDeclare(scope.statements, name);
-	if (ts.isCaseBlock(scope)) {
-		for (const clause of scope.clauses) {
-			const found = statementsDeclare(clause.statements, name);
+	for (let statement of statements) {
+		if (statement.type === "ExportNamedDeclaration" && statement.declaration) statement = statement.declaration;
+		if (statement.type === "VariableDeclaration") {
+			const found = declarationsDeclare(statement, name);
 			if (found) return found;
-		}
-		return;
+		} else if (declarationName(statement) === name) return "other";
+		else if (statement.type === "ImportDeclaration" && statement.specifiers.some((specifier) => specifier.local.name === name)) return "other";
+	}
+}
+function scopeDeclares(scope, name) {
+	if (scope.type === "Program" || scope.type === "BlockStatement" || scope.type === "TSModuleBlock") return statementsDeclare(scope.body, name);
+	if (scope.type === "SwitchStatement") for (const clause of scope.cases) {
+		const found = statementsDeclare(clause.consequent, name);
+		if (found) return found;
 	}
 	if (isFunctionLike(scope)) {
-		if (scope.parameters.some((parameter) => bindingDeclares(parameter.name, name))) return "other";
-		return ts.isFunctionExpression(scope) && scope.name?.text === name ? "other" : void 0;
+		if (scope.params.some((parameter) => bindingDeclares(parameter, name))) return "other";
+		if (scope.type === "FunctionExpression" && scope.id?.name === name) return "other";
+	}
+	if (scope.type === "ForStatement" || scope.type === "ForInStatement" || scope.type === "ForOfStatement") {
+		const initializer = scope.type === "ForStatement" ? scope.init : scope.left;
+		if (initializer?.type === "VariableDeclaration" && declarationsDeclare(initializer, name)) return "other";
 	}
-	if ((ts.isForStatement(scope) || ts.isForInStatement(scope) || ts.isForOfStatement(scope)) && scope.initializer && ts.isVariableDeclarationList(scope.initializer)) return declarationListDeclares(scope.initializer, name) ? "other" : void 0;
-	if (ts.isCatchClause(scope) && scope.variableDeclaration) return bindingDeclares(scope.variableDeclaration.name, name) ? "other" : void 0;
+	if (scope.type === "CatchClause" && scope.param && bindingDeclares(scope.param, name)) return "other";
 }
-/** The nearest declaration of an identifier's name, searching outward from it. */
 function findDeclaration(identifier) {
 	for (const scope of ancestors(identifier)) {
-		const found = scopeDeclares(scope, identifier.text);
+		const found = scopeDeclares(scope, identifier.name);
 		if (found) return found;
 	}
 }
-const ASSIGNMENT_OPERATORS = new Set([
-	ts.SyntaxKind.EqualsToken,
-	ts.SyntaxKind.PlusEqualsToken,
-	ts.SyntaxKind.MinusEqualsToken,
-	ts.SyntaxKind.AsteriskEqualsToken,
-	ts.SyntaxKind.SlashEqualsToken,
-	ts.SyntaxKind.BarBarEqualsToken,
-	ts.SyntaxKind.AmpersandAmpersandEqualsToken,
-	ts.SyntaxKind.QuestionQuestionEqualsToken
-]);
-/** Whether a `let`/`var` is assigned again anywhere it is visible. */
 function isReassigned(declaration) {
-	const name = declaration.name;
-	if (!ts.isIdentifier(name)) return true;
+	const name = declaration.id;
+	if (name.type !== "Identifier") return true;
 	let reassigned = false;
-	walk(declaration.getSourceFile(), (node) => {
+	walk(sourceOf(declaration), (node) => {
 		if (reassigned) return false;
-		let target;
-		if (ts.isBinaryExpression(node) && ASSIGNMENT_OPERATORS.has(node.operatorToken.kind)) target = unwrap(node.left);
-		else if ((ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) && (node.operator === ts.SyntaxKind.PlusPlusToken || node.operator === ts.SyntaxKind.MinusMinusToken)) target = unwrap(node.operand);
-		if (target && ts.isIdentifier(target) && target.text === name.text && findDeclaration(target) === declaration) reassigned = true;
+		const target = node.type === "AssignmentExpression" ? unwrap(node.left) : node.type === "UpdateExpression" ? unwrap(node.argument) : void 0;
+		if (target?.type === "Identifier" && target.name === name.name && findDeclaration(target) === declaration) reassigned = true;
 	}, true);
 	return reassigned;
 }
-/**
-* The expression an identifier was initialised with, when it names a
-* `const` (or a `let`/`var` never assigned again) declared once.
-*/
 function resolveInitializer(identifier) {
 	const declaration = findDeclaration(identifier);
-	if (!declaration || declaration === "other" || !declaration.initializer) return void 0;
-	const list = declaration.parent;
-	if (!(ts.isVariableDeclarationList(list) && (list.flags & ts.NodeFlags.Const) !== 0) && isReassigned(declaration)) return void 0;
-	return declaration.initializer;
+	if (!declaration || declaration === "other" || !declaration.init) return void 0;
+	const list = parentOf(declaration);
+	if (!(list?.type === "VariableDeclaration" && list.kind === "const") && isReassigned(declaration)) return void 0;
+	return declaration.init;
 }
-/** Every value reference to a variable declaration in its file (not the declaration itself). */
 function referencesOf(declaration) {
-	const name = declaration.name;
-	if (!ts.isIdentifier(name)) return [];
+	const name = declaration.id;
+	if (name.type !== "Identifier") return [];
 	const found = [];
-	walk(declaration.getSourceFile(), (node) => {
-		if (ts.isIdentifier(node) && node !== name && node.text === name.text && isValueReference(node) && findDeclaration(node) === declaration) found.push(node);
+	walk(sourceOf(declaration), (node) => {
+		if (node.type === "Identifier" && node !== name && node.name === name.name && isValueReference(node) && findDeclaration(node) === declaration) found.push(node);
 	}, true);
 	return found;
 }
-/** 1-based line and column of a node's first character. */
-function positionOf(sourceFile, node) {
-	const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-	return {
-		line: position.line + 1,
-		column: position.character + 1
-	};
-}
 
 //#endregion
-export { ancestors, calleeName, isFunctionLike, isMemberAccess, isValueReference, keyName, literalString, memberName, positionOf, referencesOf, resolveInitializer, rootIdentifier, unwrap, walk };
+export { ancestors, calleeName, findDeclaration, isFunctionLike, isMemberAccess, isValueReference, keyName, literalString, memberName, positionOf, referencesOf, resolveInitializer, rootIdentifier, unwrap, walk };
 //# sourceMappingURL=source-ast.mjs.map

package/esm/tooling/check/source-ast.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"source-ast.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/source-ast.ts"],"sourcesContent":["import ts from \"typescript\";\nimport type { WarlockErrorCode } from \"../../errors/error-codes\";\n\n/**\n * Syntax helpers for the source convention checks (`WL9005`–`WL9012`).\n *\n * The checks read one file at a time with `ts.createSourceFile` — no program,\n * no type checker — so they stay as fast as a parse and run the same whatever\n * linter the app uses. Identifiers are resolved to their declarations by\n * walking the enclosing scopes of the syntax tree.\n */\n\n/** One problem a source check found, before it is placed and turned into a problem. */\nexport type SourceFinding = {\n  code: WarlockErrorCode;\n  /** The node the problem is reported at. */\n  node: ts.Node;\n  message: string;\n  /** Default `error`. */\n  severity?: \"error\" | \"warning\";\n};\n\n/** `a.b` or `a[\"b\"]`. */\nexport type MemberAccess = ts.PropertyAccessExpression | ts.ElementAccessExpression;\n\n/** Whether a node is `a.b` or `a[b]`. */\nexport function isMemberAccess(node: ts.Node): node is MemberAccess {\n  return ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node);\n}\n\n/** Strip parentheses and type-only wrappers (`x as T`, `x!`, `<T>x`, `x satisfies T`). */\nexport function unwrap(node: ts.Node): ts.Node {\n  let current = node;\n\n  while (\n    ts.isParenthesizedExpression(current) ||\n    ts.isAsExpression(current) ||\n    ts.isNonNullExpression(current) ||\n    ts.isTypeAssertionExpression(current) ||\n    ts.isSatisfiesExpression(current)\n  ) {\n    current = current.expression;\n  }\n\n  return current;\n}\n\n/** The text of a string literal or a template without substitutions. */\nexport function literalString(node: ts.Node | undefined): string | undefined {\n  if (!node) return undefined;\n\n  const value = unwrap(node);\n\n  return ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value)\n    ? value.text\n    : undefined;\n}\n\n/** The static name of a member (`a.b` → `b`, `a[\"b\"]` → `b`). */\nexport function memberName(node: MemberAccess): string | undefined {\n  if (ts.isPropertyAccessExpression(node)) return node.name.text;\n\n  return literalString(node.argumentExpression);\n}\n\n/** The static name of an object-literal or type-member key (`{ a: 1 }`, `{ \"a\": 1 }`). */\nexport function keyName(name: ts.PropertyName | undefined): string | undefined {\n  if (!name) return undefined;\n  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isPrivateIdentifier(name)) {\n    return name.text;\n  }\n\n  return undefined;\n}\n\n/**\n * The name a call is made through: `foo()` → `foo`, `a.b.foo()` → `foo`.\n * Used to recognise helpers by name wherever they are imported from.\n */\nexport function calleeName(call: ts.CallExpression | ts.NewExpression): string | undefined {\n  const callee = unwrap(call.expression);\n\n  if (ts.isIdentifier(callee)) return callee.text;\n  if (isMemberAccess(callee)) return memberName(callee);\n\n  return undefined;\n}\n\n/** The root identifier of a member chain: `a.b.c()` → `a`. */\nexport function rootIdentifier(node: ts.Node): ts.Identifier | undefined {\n  let current = unwrap(node);\n\n  for (;;) {\n    if (ts.isIdentifier(current)) return current;\n\n    if (isMemberAccess(current) || ts.isCallExpression(current)) {\n      current = unwrap(current.expression);\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/** Whether a node is a function body owner (declaration, expression, arrow, method, accessor). */\nexport function isFunctionLike(node: ts.Node): node is ts.FunctionLikeDeclaration {\n  return (\n    ts.isFunctionDeclaration(node) ||\n    ts.isFunctionExpression(node) ||\n    ts.isArrowFunction(node) ||\n    ts.isMethodDeclaration(node) ||\n    ts.isGetAccessorDeclaration(node) ||\n    ts.isSetAccessorDeclaration(node) ||\n    ts.isConstructorDeclaration(node)\n  );\n}\n\n/**\n * Walk a node depth-first, skipping type annotations. The visitor returns\n * `false` to skip a node's children. Nested functions are not entered unless\n * `enterFunctions`.\n */\nexport function walk(\n  node: ts.Node,\n  visit: (node: ts.Node) => boolean | void,\n  enterFunctions = false,\n): void {\n  if (visit(node) === false) return;\n  if (!enterFunctions && isFunctionLike(node)) return;\n\n  ts.forEachChild(node, (child) => {\n    if (!ts.isTypeNode(child)) walk(child, visit, enterFunctions);\n\n    return undefined;\n  });\n}\n\n/** Every ancestor of a node, nearest first. */\nexport function ancestors(node: ts.Node): ts.Node[] {\n  const list: ts.Node[] = [];\n  let current = node.parent;\n\n  while (current) {\n    list.push(current);\n    current = current.parent;\n  }\n\n  return list;\n}\n\n/**\n * Whether an identifier is a value reference: not the `b` of `a.b`, an object\n * key, or the name a declaration introduces.\n */\nexport function isValueReference(identifier: ts.Identifier): boolean {\n  const parent = identifier.parent;\n\n  if (!parent) return true;\n  if (ts.isPropertyAccessExpression(parent)) return parent.expression === identifier;\n  if (ts.isShorthandPropertyAssignment(parent)) return true;\n\n  if (\n    ts.isPropertyAssignment(parent) ||\n    ts.isMethodDeclaration(parent) ||\n    ts.isPropertyDeclaration(parent) ||\n    ts.isGetAccessorDeclaration(parent) ||\n    ts.isSetAccessorDeclaration(parent) ||\n    ts.isPropertySignature(parent) ||\n    ts.isVariableDeclaration(parent) ||\n    ts.isParameter(parent) ||\n    ts.isFunctionDeclaration(parent) ||\n    ts.isFunctionExpression(parent) ||\n    ts.isClassDeclaration(parent) ||\n    ts.isClassExpression(parent) ||\n    ts.isEnumMember(parent)\n  ) {\n    return parent.name !== identifier;\n  }\n\n  if (ts.isBindingElement(parent)) {\n    return parent.name !== identifier && parent.propertyName !== identifier;\n  }\n\n  return !(\n    ts.isJsxAttribute(parent) ||\n    ts.isImportSpecifier(parent) ||\n    ts.isExportSpecifier(parent) ||\n    ts.isImportClause(parent) ||\n    ts.isNamespaceImport(parent) ||\n    ts.isLabeledStatement(parent) ||\n    ts.isBreakOrContinueStatement(parent)\n  );\n}\n\n/** What declares a name: a single `const`/`let`/`var` declarator, or something else. */\ntype Declaration = ts.VariableDeclaration | \"other\";\n\nfunction declarationListDeclares(\n  list: ts.VariableDeclarationList,\n  name: string,\n): Declaration | undefined {\n  for (const declaration of list.declarations) {\n    if (ts.isIdentifier(declaration.name)) {\n      if (declaration.name.text === name) return declaration;\n    } else if (bindingDeclares(declaration.name, name)) {\n      return \"other\";\n    }\n  }\n\n  return undefined;\n}\n\nfunction bindingDeclares(binding: ts.BindingName, name: string): boolean {\n  if (ts.isIdentifier(binding)) return binding.text === name;\n\n  return binding.elements.some(\n    (element) => !ts.isOmittedExpression(element) && bindingDeclares(element.name, name),\n  );\n}\n\nfunction statementsDeclare(\n  statements: readonly ts.Statement[],\n  name: string,\n): Declaration | undefined {\n  for (const statement of statements) {\n    if (ts.isVariableStatement(statement)) {\n      const found = declarationListDeclares(statement.declarationList, name);\n      if (found) return found;\n    } else if (\n      (ts.isFunctionDeclaration(statement) ||\n        ts.isClassDeclaration(statement) ||\n        ts.isEnumDeclaration(statement)) &&\n      statement.name?.text === name\n    ) {\n      return \"other\";\n    } else if (ts.isImportDeclaration(statement) && importDeclares(statement, name)) {\n      return \"other\";\n    }\n  }\n\n  return undefined;\n}\n\nfunction importDeclares(statement: ts.ImportDeclaration, name: string): boolean {\n  const clause = statement.importClause;\n\n  if (!clause) return false;\n  if (clause.name?.text === name) return true;\n\n  const bindings = clause.namedBindings;\n\n  if (!bindings) return false;\n  if (ts.isNamespaceImport(bindings)) return bindings.name.text === name;\n\n  return bindings.elements.some((element) => element.name.text === name);\n}\n\n/** The declaration a scope node introduces for `name`, if it introduces one. */\nfunction scopeDeclares(scope: ts.Node, name: string): Declaration | undefined {\n  if (ts.isSourceFile(scope) || ts.isBlock(scope) || ts.isModuleBlock(scope)) {\n    return statementsDeclare(scope.statements, name);\n  }\n\n  if (ts.isCaseBlock(scope)) {\n    for (const clause of scope.clauses) {\n      const found = statementsDeclare(clause.statements, name);\n      if (found) return found;\n    }\n\n    return undefined;\n  }\n\n  if (isFunctionLike(scope)) {\n    if (scope.parameters.some((parameter) => bindingDeclares(parameter.name, name))) {\n      return \"other\";\n    }\n\n    return ts.isFunctionExpression(scope) && scope.name?.text === name ? \"other\" : undefined;\n  }\n\n  if (\n    (ts.isForStatement(scope) || ts.isForInStatement(scope) || ts.isForOfStatement(scope)) &&\n    scope.initializer &&\n    ts.isVariableDeclarationList(scope.initializer)\n  ) {\n    return declarationListDeclares(scope.initializer, name) ? \"other\" : undefined;\n  }\n\n  if (ts.isCatchClause(scope) && scope.variableDeclaration) {\n    return bindingDeclares(scope.variableDeclaration.name, name) ? \"other\" : undefined;\n  }\n\n  return undefined;\n}\n\n/** The nearest declaration of an identifier's name, searching outward from it. */\nexport function findDeclaration(identifier: ts.Identifier): Declaration | undefined {\n  for (const scope of ancestors(identifier)) {\n    const found = scopeDeclares(scope, identifier.text);\n    if (found) return found;\n  }\n\n  return undefined;\n}\n\nconst ASSIGNMENT_OPERATORS: ReadonlySet<ts.SyntaxKind> = new Set([\n  ts.SyntaxKind.EqualsToken,\n  ts.SyntaxKind.PlusEqualsToken,\n  ts.SyntaxKind.MinusEqualsToken,\n  ts.SyntaxKind.AsteriskEqualsToken,\n  ts.SyntaxKind.SlashEqualsToken,\n  ts.SyntaxKind.BarBarEqualsToken,\n  ts.SyntaxKind.AmpersandAmpersandEqualsToken,\n  ts.SyntaxKind.QuestionQuestionEqualsToken,\n]);\n\n/** Whether a `let`/`var` is assigned again anywhere it is visible. */\nfunction isReassigned(declaration: ts.VariableDeclaration): boolean {\n  const name = declaration.name;\n\n  if (!ts.isIdentifier(name)) return true;\n\n  let reassigned = false;\n\n  walk(\n    declaration.getSourceFile(),\n    (node) => {\n      if (reassigned) return false;\n\n      let target: ts.Node | undefined;\n\n      if (ts.isBinaryExpression(node) && ASSIGNMENT_OPERATORS.has(node.operatorToken.kind)) {\n        target = unwrap(node.left);\n      } else if (\n        (ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) &&\n        (node.operator === ts.SyntaxKind.PlusPlusToken ||\n          node.operator === ts.SyntaxKind.MinusMinusToken)\n      ) {\n        target = unwrap(node.operand);\n      }\n\n      if (\n        target &&\n        ts.isIdentifier(target) &&\n        target.text === name.text &&\n        findDeclaration(target) === declaration\n      ) {\n        reassigned = true;\n      }\n\n      return undefined;\n    },\n    true,\n  );\n\n  return reassigned;\n}\n\n/**\n * The expression an identifier was initialised with, when it names a\n * `const` (or a `let`/`var` never assigned again) declared once.\n */\nexport function resolveInitializer(identifier: ts.Identifier): ts.Expression | undefined {\n  const declaration = findDeclaration(identifier);\n\n  if (!declaration || declaration === \"other\" || !declaration.initializer) return undefined;\n\n  const list = declaration.parent;\n  const isConst = ts.isVariableDeclarationList(list) && (list.flags & ts.NodeFlags.Const) !== 0;\n\n  if (!isConst && isReassigned(declaration)) return undefined;\n\n  return declaration.initializer;\n}\n\n/** Every value reference to a variable declaration in its file (not the declaration itself). */\nexport function referencesOf(declaration: ts.VariableDeclaration): ts.Identifier[] {\n  const name = declaration.name;\n\n  if (!ts.isIdentifier(name)) return [];\n\n  const found: ts.Identifier[] = [];\n\n  walk(\n    declaration.getSourceFile(),\n    (node) => {\n      if (\n        ts.isIdentifier(node) &&\n        node !== name &&\n        node.text === name.text &&\n        isValueReference(node) &&\n        findDeclaration(node) === declaration\n      ) {\n        found.push(node);\n      }\n\n      return undefined;\n    },\n    true,\n  );\n\n  return found;\n}\n\n/** 1-based line and column of a node's first character. */\nexport function positionOf(\n  sourceFile: ts.SourceFile,\n  node: ts.Node,\n): { line: number; column: number } {\n  const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));\n\n  return { line: position.line + 1, column: position.character + 1 };\n}\n"],"mappings":";;;;AA0BA,SAAgB,eAAe,MAAqC;CAClE,OAAO,GAAG,2BAA2B,IAAI,KAAK,GAAG,0BAA0B,IAAI;AACjF;;AAGA,SAAgB,OAAO,MAAwB;CAC7C,IAAI,UAAU;CAEd,OACE,GAAG,0BAA0B,OAAO,KACpC,GAAG,eAAe,OAAO,KACzB,GAAG,oBAAoB,OAAO,KAC9B,GAAG,0BAA0B,OAAO,KACpC,GAAG,sBAAsB,OAAO,GAEhC,UAAU,QAAQ;CAGpB,OAAO;AACT;;AAGA,SAAgB,cAAc,MAA+C;CAC3E,IAAI,CAAC,MAAM,OAAO;CAElB,MAAM,QAAQ,OAAO,IAAI;CAEzB,OAAO,GAAG,gBAAgB,KAAK,KAAK,GAAG,gCAAgC,KAAK,IACxE,MAAM,OACN;AACN;;AAGA,SAAgB,WAAW,MAAwC;CACjE,IAAI,GAAG,2BAA2B,IAAI,GAAG,OAAO,KAAK,KAAK;CAE1D,OAAO,cAAc,KAAK,kBAAkB;AAC9C;;AAGA,SAAgB,QAAQ,MAAuD;CAC7E,IAAI,CAAC,MAAM,OAAO;CAClB,IAAI,GAAG,aAAa,IAAI,KAAK,GAAG,gBAAgB,IAAI,KAAK,GAAG,oBAAoB,IAAI,GAClF,OAAO,KAAK;AAIhB;;;;;AAMA,SAAgB,WAAW,MAAgE;CACzF,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,GAAG,aAAa,MAAM,GAAG,OAAO,OAAO;CAC3C,IAAI,eAAe,MAAM,GAAG,OAAO,WAAW,MAAM;AAGtD;;AAGA,SAAgB,eAAe,MAA0C;CACvE,IAAI,UAAU,OAAO,IAAI;CAEzB,SAAS;EACP,IAAI,GAAG,aAAa,OAAO,GAAG,OAAO;EAErC,IAAI,eAAe,OAAO,KAAK,GAAG,iBAAiB,OAAO,GAAG;GAC3D,UAAU,OAAO,QAAQ,UAAU;GACnC;EACF;EAEA;CACF;AACF;;AAGA,SAAgB,eAAe,MAAmD;CAChF,OACE,GAAG,sBAAsB,IAAI,KAC7B,GAAG,qBAAqB,IAAI,KAC5B,GAAG,gBAAgB,IAAI,KACvB,GAAG,oBAAoB,IAAI,KAC3B,GAAG,yBAAyB,IAAI,KAChC,GAAG,yBAAyB,IAAI,KAChC,GAAG,yBAAyB,IAAI;AAEpC;;;;;;AAOA,SAAgB,KACd,MACA,OACA,iBAAiB,OACX;CACN,IAAI,MAAM,IAAI,MAAM,OAAO;CAC3B,IAAI,CAAC,kBAAkB,eAAe,IAAI,GAAG;CAE7C,GAAG,aAAa,OAAO,UAAU;EAC/B,IAAI,CAAC,GAAG,WAAW,KAAK,GAAG,KAAK,OAAO,OAAO,cAAc;CAG9D,CAAC;AACH;;AAGA,SAAgB,UAAU,MAA0B;CAClD,MAAM,OAAkB,CAAC;CACzB,IAAI,UAAU,KAAK;CAEnB,OAAO,SAAS;EACd,KAAK,KAAK,OAAO;EACjB,UAAU,QAAQ;CACpB;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,iBAAiB,YAAoC;CACnE,MAAM,SAAS,WAAW;CAE1B,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,GAAG,2BAA2B,MAAM,GAAG,OAAO,OAAO,eAAe;CACxE,IAAI,GAAG,8BAA8B,MAAM,GAAG,OAAO;CAErD,IACE,GAAG,qBAAqB,MAAM,KAC9B,GAAG,oBAAoB,MAAM,KAC7B,GAAG,sBAAsB,MAAM,KAC/B,GAAG,yBAAyB,MAAM,KAClC,GAAG,yBAAyB,MAAM,KAClC,GAAG,oBAAoB,MAAM,KAC7B,GAAG,sBAAsB,MAAM,KAC/B,GAAG,YAAY,MAAM,KACrB,GAAG,sBAAsB,MAAM,KAC/B,GAAG,qBAAqB,MAAM,KAC9B,GAAG,mBAAmB,MAAM,KAC5B,GAAG,kBAAkB,MAAM,KAC3B,GAAG,aAAa,MAAM,GAEtB,OAAO,OAAO,SAAS;CAGzB,IAAI,GAAG,iBAAiB,MAAM,GAC5B,OAAO,OAAO,SAAS,cAAc,OAAO,iBAAiB;CAG/D,OAAO,EACL,GAAG,eAAe,MAAM,KACxB,GAAG,kBAAkB,MAAM,KAC3B,GAAG,kBAAkB,MAAM,KAC3B,GAAG,eAAe,MAAM,KACxB,GAAG,kBAAkB,MAAM,KAC3B,GAAG,mBAAmB,MAAM,KAC5B,GAAG,2BAA2B,MAAM;AAExC;AAKA,SAAS,wBACP,MACA,MACyB;CACzB,KAAK,MAAM,eAAe,KAAK,cAC7B,IAAI,GAAG,aAAa,YAAY,IAAI,GAClC;MAAI,YAAY,KAAK,SAAS,MAAM,OAAO;CAAW,OACjD,IAAI,gBAAgB,YAAY,MAAM,IAAI,GAC/C,OAAO;AAKb;AAEA,SAAS,gBAAgB,SAAyB,MAAuB;CACvE,IAAI,GAAG,aAAa,OAAO,GAAG,OAAO,QAAQ,SAAS;CAEtD,OAAO,QAAQ,SAAS,MACrB,YAAY,CAAC,GAAG,oBAAoB,OAAO,KAAK,gBAAgB,QAAQ,MAAM,IAAI,CACrF;AACF;AAEA,SAAS,kBACP,YACA,MACyB;CACzB,KAAK,MAAM,aAAa,YACtB,IAAI,GAAG,oBAAoB,SAAS,GAAG;EACrC,MAAM,QAAQ,wBAAwB,UAAU,iBAAiB,IAAI;EACrE,IAAI,OAAO,OAAO;CACpB,OAAO,KACJ,GAAG,sBAAsB,SAAS,KACjC,GAAG,mBAAmB,SAAS,KAC/B,GAAG,kBAAkB,SAAS,MAChC,UAAU,MAAM,SAAS,MAEzB,OAAO;MACF,IAAI,GAAG,oBAAoB,SAAS,KAAK,eAAe,WAAW,IAAI,GAC5E,OAAO;AAKb;AAEA,SAAS,eAAe,WAAiC,MAAuB;CAC9E,MAAM,SAAS,UAAU;CAEzB,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,OAAO,MAAM,SAAS,MAAM,OAAO;CAEvC,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI,GAAG,kBAAkB,QAAQ,GAAG,OAAO,SAAS,KAAK,SAAS;CAElE,OAAO,SAAS,SAAS,MAAM,YAAY,QAAQ,KAAK,SAAS,IAAI;AACvE;;AAGA,SAAS,cAAc,OAAgB,MAAuC;CAC5E,IAAI,GAAG,aAAa,KAAK,KAAK,GAAG,QAAQ,KAAK,KAAK,GAAG,cAAc,KAAK,GACvE,OAAO,kBAAkB,MAAM,YAAY,IAAI;CAGjD,IAAI,GAAG,YAAY,KAAK,GAAG;EACzB,KAAK,MAAM,UAAU,MAAM,SAAS;GAClC,MAAM,QAAQ,kBAAkB,OAAO,YAAY,IAAI;GACvD,IAAI,OAAO,OAAO;EACpB;EAEA;CACF;CAEA,IAAI,eAAe,KAAK,GAAG;EACzB,IAAI,MAAM,WAAW,MAAM,cAAc,gBAAgB,UAAU,MAAM,IAAI,CAAC,GAC5E,OAAO;EAGT,OAAO,GAAG,qBAAqB,KAAK,KAAK,MAAM,MAAM,SAAS,OAAO,UAAU;CACjF;CAEA,KACG,GAAG,eAAe,KAAK,KAAK,GAAG,iBAAiB,KAAK,KAAK,GAAG,iBAAiB,KAAK,MACpF,MAAM,eACN,GAAG,0BAA0B,MAAM,WAAW,GAE9C,OAAO,wBAAwB,MAAM,aAAa,IAAI,IAAI,UAAU;CAGtE,IAAI,GAAG,cAAc,KAAK,KAAK,MAAM,qBACnC,OAAO,gBAAgB,MAAM,oBAAoB,MAAM,IAAI,IAAI,UAAU;AAI7E;;AAGA,SAAgB,gBAAgB,YAAoD;CAClF,KAAK,MAAM,SAAS,UAAU,UAAU,GAAG;EACzC,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;EAClD,IAAI,OAAO,OAAO;CACpB;AAGF;AAEA,MAAM,uBAAmD,IAAI,IAAI;CAC/D,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;CACd,GAAG,WAAW;AAChB,CAAC;;AAGD,SAAS,aAAa,aAA8C;CAClE,MAAM,OAAO,YAAY;CAEzB,IAAI,CAAC,GAAG,aAAa,IAAI,GAAG,OAAO;CAEnC,IAAI,aAAa;CAEjB,KACE,YAAY,cAAc,IACzB,SAAS;EACR,IAAI,YAAY,OAAO;EAEvB,IAAI;EAEJ,IAAI,GAAG,mBAAmB,IAAI,KAAK,qBAAqB,IAAI,KAAK,cAAc,IAAI,GACjF,SAAS,OAAO,KAAK,IAAI;OACpB,KACJ,GAAG,wBAAwB,IAAI,KAAK,GAAG,yBAAyB,IAAI,OACpE,KAAK,aAAa,GAAG,WAAW,iBAC/B,KAAK,aAAa,GAAG,WAAW,kBAElC,SAAS,OAAO,KAAK,OAAO;EAG9B,IACE,UACA,GAAG,aAAa,MAAM,KACtB,OAAO,SAAS,KAAK,QACrB,gBAAgB,MAAM,MAAM,aAE5B,aAAa;CAIjB,GACA,IACF;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,mBAAmB,YAAsD;CACvF,MAAM,cAAc,gBAAgB,UAAU;CAE9C,IAAI,CAAC,eAAe,gBAAgB,WAAW,CAAC,YAAY,aAAa,OAAO;CAEhF,MAAM,OAAO,YAAY;CAGzB,IAAI,EAFY,GAAG,0BAA0B,IAAI,MAAM,KAAK,QAAQ,GAAG,UAAU,WAAW,MAE5E,aAAa,WAAW,GAAG,OAAO;CAElD,OAAO,YAAY;AACrB;;AAGA,SAAgB,aAAa,aAAsD;CACjF,MAAM,OAAO,YAAY;CAEzB,IAAI,CAAC,GAAG,aAAa,IAAI,GAAG,OAAO,CAAC;CAEpC,MAAM,QAAyB,CAAC;CAEhC,KACE,YAAY,cAAc,IACzB,SAAS;EACR,IACE,GAAG,aAAa,IAAI,KACpB,SAAS,QACT,KAAK,SAAS,KAAK,QACnB,iBAAiB,IAAI,KACrB,gBAAgB,IAAI,MAAM,aAE1B,MAAM,KAAK,IAAI;CAInB,GACA,IACF;CAEA,OAAO;AACT;;AAGA,SAAgB,WACd,YACA,MACkC;CAClC,MAAM,WAAW,WAAW,8BAA8B,KAAK,SAAS,UAAU,CAAC;CAEnF,OAAO;EAAE,MAAM,SAAS,OAAO;EAAG,QAAQ,SAAS,YAAY;CAAE;AACnE"}
+{"version":3,"file":"source-ast.mjs","names":["ast.keyName","ast.positionOf","ast.expressionOf","ast.isStringLiteral","ast.isNoSubstitutionTemplateLiteral","ast.parentOf","ast.declarationName","ast.sourceOf"],"sources":["../../../../../../../../../packages/core/src/tooling/check/source-ast.ts"],"sourcesContent":["import * as ast from \"../syntax/ast\";\nimport type { WarlockErrorCode } from \"../../errors/error-codes\";\n\nexport type SourceFinding = {\n  code: WarlockErrorCode;\n  node: ast.Node;\n  message: string;\n  severity?: \"error\" | \"warning\";\n};\nexport type MemberAccess = ast.MemberExpression;\nexport const isMemberAccess = (node: ast.Node): node is MemberAccess =>\n  node.type === \"MemberExpression\";\nexport const keyName = ast.keyName;\nexport const positionOf = ast.positionOf;\n\nexport function unwrap(node: ast.Node): ast.Node {\n  let current = node;\n  while (\n    [\n      \"ParenthesizedExpression\",\n      \"TSAsExpression\",\n      \"TSNonNullExpression\",\n      \"TSTypeAssertion\",\n      \"TSSatisfiesExpression\",\n      \"ChainExpression\",\n    ].includes(current.type)\n  )\n    current = ast.expressionOf(current);\n  return current;\n}\nexport function literalString(node: ast.Node | null | undefined): string | undefined {\n  if (!node) return undefined;\n  const value = unwrap(node);\n  if (ast.isStringLiteral(value)) return value.value;\n  if (ast.isNoSubstitutionTemplateLiteral(value)) return value.quasis[0]?.value.cooked ?? undefined;\n  return undefined;\n}\nexport function memberName(node: MemberAccess): string | undefined {\n  return node.computed ? literalString(node.property) : ast.keyName(node.property);\n}\nexport function calleeName(call: ast.CallExpression | ast.NewExpression): string | undefined {\n  const callee = unwrap(call.callee);\n  return callee.type === \"Identifier\"\n    ? callee.name\n    : isMemberAccess(callee)\n      ? memberName(callee)\n      : undefined;\n}\nexport function rootIdentifier(node: ast.Node): ast.Identifier | undefined {\n  let current = unwrap(node);\n  for (;;) {\n    if (current.type === \"Identifier\") return current;\n    if (isMemberAccess(current) || current.type === \"CallExpression\")\n      current = unwrap(ast.expressionOf(current));\n    else return undefined;\n  }\n}\nexport function isFunctionLike(\n  node: ast.Node,\n): node is ast.FunctionDeclaration | ast.FunctionExpression | ast.ArrowFunctionExpression {\n  return (\n    node.type === \"FunctionDeclaration\" ||\n    node.type === \"FunctionExpression\" ||\n    node.type === \"ArrowFunctionExpression\"\n  );\n}\nexport function walk(\n  node: ast.Node,\n  visit: (node: ast.Node) => boolean | void,\n  enterFunctions = false,\n): void {\n  if (visit(node) === false || (!enterFunctions && isFunctionLike(node))) return;\n  ast.forEachChild(node, (child) => {\n    if (\n      !child.type.startsWith(\"TS\") ||\n      (\"expression\" in child && typeof child.expression === \"object\")\n    )\n      walk(child, visit, enterFunctions);\n  });\n}\nexport function ancestors(node: ast.Node): ast.Node[] {\n  const list: ast.Node[] = [];\n  let current = ast.parentOf(node);\n  while (current) {\n    list.push(current);\n    current = ast.parentOf(current);\n  }\n  return list;\n}\nexport function isValueReference(identifier: ast.Identifier): boolean {\n  const parent = ast.parentOf(identifier);\n  if (!parent) return true;\n  if (parent.type === \"MemberExpression\") return parent.object === identifier || parent.computed;\n  if (parent.type === \"Property\") return parent.value === identifier || parent.computed;\n  if (parent.type === \"VariableDeclarator\") return parent.id !== identifier;\n  if (\n    (isFunctionLike(parent) ||\n      parent.type === \"ClassDeclaration\" ||\n      parent.type === \"ClassExpression\") &&\n    parent.id === identifier\n  )\n    return false;\n  return ![\n    \"ImportSpecifier\",\n    \"ImportDefaultSpecifier\",\n    \"ImportNamespaceSpecifier\",\n    \"ExportSpecifier\",\n    \"JSXAttribute\",\n    \"LabeledStatement\",\n    \"BreakStatement\",\n    \"ContinueStatement\",\n    \"TSPropertySignature\",\n    \"PropertyDefinition\",\n    \"MethodDefinition\",\n    \"RestElement\",\n    \"ArrayPattern\",\n    \"ObjectPattern\",\n  ].includes(parent.type);\n}\n\ntype Declaration = ast.VariableDeclarator | \"other\";\nfunction bindingDeclares(binding: ast.Node, name: string): boolean {\n  if (binding.type === \"Identifier\") return binding.name === name;\n  if (binding.type === \"RestElement\") return bindingDeclares(binding.argument, name);\n  if (binding.type === \"AssignmentPattern\") return bindingDeclares(binding.left, name);\n  if (binding.type === \"ObjectPattern\")\n    return binding.properties.some((property) =>\n      bindingDeclares(property.type === \"RestElement\" ? property.argument : property.value, name),\n    );\n  if (binding.type === \"ArrayPattern\")\n    return binding.elements.some((element) => element !== null && bindingDeclares(element, name));\n  return false;\n}\nfunction declarationsDeclare(list: ast.VariableDeclaration, name: string): Declaration | undefined {\n  for (const declaration of list.declarations) {\n    if (bindingDeclares(declaration.id, name))\n      return declaration.id.type === \"Identifier\" ? declaration : \"other\";\n  }\n  return undefined;\n}\nfunction statementsDeclare(\n  statements: readonly ast.Statement[],\n  name: string,\n): Declaration | undefined {\n  for (let statement of statements) {\n    if (statement.type === \"ExportNamedDeclaration\" && statement.declaration)\n      statement = statement.declaration;\n    if (statement.type === \"VariableDeclaration\") {\n      const found = declarationsDeclare(statement, name);\n      if (found) return found;\n    } else if (ast.declarationName(statement) === name) return \"other\";\n    else if (\n      statement.type === \"ImportDeclaration\" &&\n      statement.specifiers.some((specifier) => specifier.local.name === name)\n    )\n      return \"other\";\n  }\n  return undefined;\n}\nfunction scopeDeclares(scope: ast.Node, name: string): Declaration | undefined {\n  if (scope.type === \"Program\" || scope.type === \"BlockStatement\" || scope.type === \"TSModuleBlock\")\n    return statementsDeclare(scope.body, name);\n  if (scope.type === \"SwitchStatement\") {\n    for (const clause of scope.cases) {\n      const found = statementsDeclare(clause.consequent, name);\n      if (found) return found;\n    }\n  }\n  if (isFunctionLike(scope)) {\n    if (scope.params.some((parameter) => bindingDeclares(parameter, name))) return \"other\";\n    if (scope.type === \"FunctionExpression\" && scope.id?.name === name) return \"other\";\n  }\n  if (\n    scope.type === \"ForStatement\" ||\n    scope.type === \"ForInStatement\" ||\n    scope.type === \"ForOfStatement\"\n  ) {\n    const initializer = scope.type === \"ForStatement\" ? scope.init : scope.left;\n    if (initializer?.type === \"VariableDeclaration\" && declarationsDeclare(initializer, name))\n      return \"other\";\n  }\n  if (scope.type === \"CatchClause\" && scope.param && bindingDeclares(scope.param, name))\n    return \"other\";\n  return undefined;\n}\nexport function findDeclaration(identifier: ast.Identifier): Declaration | undefined {\n  for (const scope of ancestors(identifier)) {\n    const found = scopeDeclares(scope, identifier.name);\n    if (found) return found;\n  }\n  return undefined;\n}\nfunction isReassigned(declaration: ast.VariableDeclarator): boolean {\n  const name = declaration.id;\n  if (name.type !== \"Identifier\") return true;\n  let reassigned = false;\n  walk(\n    ast.sourceOf(declaration),\n    (node) => {\n      if (reassigned) return false;\n      const target =\n        node.type === \"AssignmentExpression\"\n          ? unwrap(node.left)\n          : node.type === \"UpdateExpression\"\n            ? unwrap(node.argument)\n            : undefined;\n      if (\n        target?.type === \"Identifier\" &&\n        target.name === name.name &&\n        findDeclaration(target) === declaration\n      )\n        reassigned = true;\n      return undefined;\n    },\n    true,\n  );\n  return reassigned;\n}\nexport function resolveInitializer(identifier: ast.Identifier): ast.Expression | undefined {\n  const declaration = findDeclaration(identifier);\n  if (!declaration || declaration === \"other\" || !declaration.init) return undefined;\n  const list = ast.parentOf(declaration);\n  if (!(list?.type === \"VariableDeclaration\" && list.kind === \"const\") && isReassigned(declaration))\n    return undefined;\n  return declaration.init;\n}\nexport function referencesOf(declaration: ast.VariableDeclarator): ast.Identifier[] {\n  const name = declaration.id;\n  if (name.type !== \"Identifier\") return [];\n  const found: ast.Identifier[] = [];\n  walk(\n    ast.sourceOf(declaration),\n    (node) => {\n      if (\n        node.type === \"Identifier\" &&\n        node !== name &&\n        node.name === name.name &&\n        isValueReference(node) &&\n        findDeclaration(node) === declaration\n      )\n        found.push(node);\n      return undefined;\n    },\n    true,\n  );\n  return found;\n}\n"],"mappings":";;;AAUA,MAAa,kBAAkB,SAC7B,KAAK,SAAS;AAChB,MAAa,UAAUA;AACvB,MAAa,aAAaC;AAE1B,SAAgB,OAAO,MAA0B;CAC/C,IAAI,UAAU;CACd,OACE;EACE;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,QAAQ,IAAI,GAEvB,UAAUC,aAAiB,OAAO;CACpC,OAAO;AACT;AACA,SAAgB,cAAc,MAAuD;CACnF,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAIC,gBAAoB,KAAK,GAAG,OAAO,MAAM;CAC7C,IAAIC,gCAAoC,KAAK,GAAG,OAAO,MAAM,OAAO,EAAE,EAAE,MAAM,UAAU;AAE1F;AACA,SAAgB,WAAW,MAAwC;CACjE,OAAO,KAAK,WAAW,cAAc,KAAK,QAAQ,IAAIJ,UAAY,KAAK,QAAQ;AACjF;AACA,SAAgB,WAAW,MAAkE;CAC3F,MAAM,SAAS,OAAO,KAAK,MAAM;CACjC,OAAO,OAAO,SAAS,eACnB,OAAO,OACP,eAAe,MAAM,IACnB,WAAW,MAAM,IACjB;AACR;AACA,SAAgB,eAAe,MAA4C;CACzE,IAAI,UAAU,OAAO,IAAI;CACzB,SAAS;EACP,IAAI,QAAQ,SAAS,cAAc,OAAO;EAC1C,IAAI,eAAe,OAAO,KAAK,QAAQ,SAAS,kBAC9C,UAAU,OAAOE,aAAiB,OAAO,CAAC;OACvC,OAAO;CACd;AACF;AACA,SAAgB,eACd,MACwF;CACxF,OACE,KAAK,SAAS,yBACd,KAAK,SAAS,wBACd,KAAK,SAAS;AAElB;AACA,SAAgB,KACd,MACA,OACA,iBAAiB,OACX;CACN,IAAI,MAAM,IAAI,MAAM,SAAU,CAAC,kBAAkB,eAAe,IAAI,GAAI;CACxE,aAAiB,OAAO,UAAU;EAChC,IACE,CAAC,MAAM,KAAK,WAAW,IAAI,KAC1B,gBAAgB,SAAS,OAAO,MAAM,eAAe,UAEtD,KAAK,OAAO,OAAO,cAAc;CACrC,CAAC;AACH;AACA,SAAgB,UAAU,MAA4B;CACpD,MAAM,OAAmB,CAAC;CAC1B,IAAI,UAAUG,SAAa,IAAI;CAC/B,OAAO,SAAS;EACd,KAAK,KAAK,OAAO;EACjB,UAAUA,SAAa,OAAO;CAChC;CACA,OAAO;AACT;AACA,SAAgB,iBAAiB,YAAqC;CACpE,MAAM,SAASA,SAAa,UAAU;CACtC,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,OAAO,SAAS,oBAAoB,OAAO,OAAO,WAAW,cAAc,OAAO;CACtF,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,UAAU,cAAc,OAAO;CAC7E,IAAI,OAAO,SAAS,sBAAsB,OAAO,OAAO,OAAO;CAC/D,KACG,eAAe,MAAM,KACpB,OAAO,SAAS,sBAChB,OAAO,SAAS,sBAClB,OAAO,OAAO,YAEd,OAAO;CACT,OAAO,CAAC;EACN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,OAAO,IAAI;AACxB;AAGA,SAAS,gBAAgB,SAAmB,MAAuB;CACjE,IAAI,QAAQ,SAAS,cAAc,OAAO,QAAQ,SAAS;CAC3D,IAAI,QAAQ,SAAS,eAAe,OAAO,gBAAgB,QAAQ,UAAU,IAAI;CACjF,IAAI,QAAQ,SAAS,qBAAqB,OAAO,gBAAgB,QAAQ,MAAM,IAAI;CACnF,IAAI,QAAQ,SAAS,iBACnB,OAAO,QAAQ,WAAW,MAAM,aAC9B,gBAAgB,SAAS,SAAS,gBAAgB,SAAS,WAAW,SAAS,OAAO,IAAI,CAC5F;CACF,IAAI,QAAQ,SAAS,gBACnB,OAAO,QAAQ,SAAS,MAAM,YAAY,YAAY,QAAQ,gBAAgB,SAAS,IAAI,CAAC;CAC9F,OAAO;AACT;AACA,SAAS,oBAAoB,MAA+B,MAAuC;CACjG,KAAK,MAAM,eAAe,KAAK,cAC7B,IAAI,gBAAgB,YAAY,IAAI,IAAI,GACtC,OAAO,YAAY,GAAG,SAAS,eAAe,cAAc;AAGlE;AACA,SAAS,kBACP,YACA,MACyB;CACzB,KAAK,IAAI,aAAa,YAAY;EAChC,IAAI,UAAU,SAAS,4BAA4B,UAAU,aAC3D,YAAY,UAAU;EACxB,IAAI,UAAU,SAAS,uBAAuB;GAC5C,MAAM,QAAQ,oBAAoB,WAAW,IAAI;GACjD,IAAI,OAAO,OAAO;EACpB,OAAO,IAAIC,gBAAoB,SAAS,MAAM,MAAM,OAAO;OACtD,IACH,UAAU,SAAS,uBACnB,UAAU,WAAW,MAAM,cAAc,UAAU,MAAM,SAAS,IAAI,GAEtE,OAAO;CACX;AAEF;AACA,SAAS,cAAc,OAAiB,MAAuC;CAC7E,IAAI,MAAM,SAAS,aAAa,MAAM,SAAS,oBAAoB,MAAM,SAAS,iBAChF,OAAO,kBAAkB,MAAM,MAAM,IAAI;CAC3C,IAAI,MAAM,SAAS,mBACjB,KAAK,MAAM,UAAU,MAAM,OAAO;EAChC,MAAM,QAAQ,kBAAkB,OAAO,YAAY,IAAI;EACvD,IAAI,OAAO,OAAO;CACpB;CAEF,IAAI,eAAe,KAAK,GAAG;EACzB,IAAI,MAAM,OAAO,MAAM,cAAc,gBAAgB,WAAW,IAAI,CAAC,GAAG,OAAO;EAC/E,IAAI,MAAM,SAAS,wBAAwB,MAAM,IAAI,SAAS,MAAM,OAAO;CAC7E;CACA,IACE,MAAM,SAAS,kBACf,MAAM,SAAS,oBACf,MAAM,SAAS,kBACf;EACA,MAAM,cAAc,MAAM,SAAS,iBAAiB,MAAM,OAAO,MAAM;EACvE,IAAI,aAAa,SAAS,yBAAyB,oBAAoB,aAAa,IAAI,GACtF,OAAO;CACX;CACA,IAAI,MAAM,SAAS,iBAAiB,MAAM,SAAS,gBAAgB,MAAM,OAAO,IAAI,GAClF,OAAO;AAEX;AACA,SAAgB,gBAAgB,YAAqD;CACnF,KAAK,MAAM,SAAS,UAAU,UAAU,GAAG;EACzC,MAAM,QAAQ,cAAc,OAAO,WAAW,IAAI;EAClD,IAAI,OAAO,OAAO;CACpB;AAEF;AACA,SAAS,aAAa,aAA8C;CAClE,MAAM,OAAO,YAAY;CACzB,IAAI,KAAK,SAAS,cAAc,OAAO;CACvC,IAAI,aAAa;CACjB,KACEC,SAAa,WAAW,IACvB,SAAS;EACR,IAAI,YAAY,OAAO;EACvB,MAAM,SACJ,KAAK,SAAS,yBACV,OAAO,KAAK,IAAI,IAChB,KAAK,SAAS,qBACZ,OAAO,KAAK,QAAQ,IACpB;EACR,IACE,QAAQ,SAAS,gBACjB,OAAO,SAAS,KAAK,QACrB,gBAAgB,MAAM,MAAM,aAE5B,aAAa;CAEjB,GACA,IACF;CACA,OAAO;AACT;AACA,SAAgB,mBAAmB,YAAwD;CACzF,MAAM,cAAc,gBAAgB,UAAU;CAC9C,IAAI,CAAC,eAAe,gBAAgB,WAAW,CAAC,YAAY,MAAM,OAAO;CACzE,MAAM,OAAOF,SAAa,WAAW;CACrC,IAAI,EAAE,MAAM,SAAS,yBAAyB,KAAK,SAAS,YAAY,aAAa,WAAW,GAC9F,OAAO;CACT,OAAO,YAAY;AACrB;AACA,SAAgB,aAAa,aAAuD;CAClF,MAAM,OAAO,YAAY;CACzB,IAAI,KAAK,SAAS,cAAc,OAAO,CAAC;CACxC,MAAM,QAA0B,CAAC;CACjC,KACEE,SAAa,WAAW,IACvB,SAAS;EACR,IACE,KAAK,SAAS,gBACd,SAAS,QACT,KAAK,SAAS,KAAK,QACnB,iBAAiB,IAAI,KACrB,gBAAgB,IAAI,MAAM,aAE1B,MAAM,KAAK,IAAI;CAEnB,GACA,IACF;CACA,OAAO;AACT"}