api-tests-coverage 1.0.20 → 1.0.22

package/dist/src/languages/javascript/hapiDetector.js

@@ -30,7 +30,7 @@ const BOOM_STATUS_MAP = {
  * Detect HapiJS route definitions from source text.
  */
 function detectHapiRoutes(sourceText, filePath) {
-    var _a, _b, _c, _d;
+    var _a, _b;
     const routes = [];
     const lines = sourceText.split('\n');
     for (let i = 0; i < lines.length; i++) {
@@ -55,7 +55,7 @@ function detectHapiRoutes(sourceText, filePath) {
             if (authSimple) {
                 auth = { strategy: authSimple[1], mode: 'required' };
             }
-            // auth: { mode: 'try' } or auth: { mode: 'optional' } — single-line case
+            // auth: { mode: 'try' } or auth: { mode: 'optional' }
             const authMode = nearLine.match(/(?:auth|mode)\s*:\s*[{]?\s*mode\s*:\s*['"](\w+)['"]/);
             if (authMode) {
                 auth = {
@@ -63,19 +63,6 @@ function detectHapiRoutes(sourceText, filePath) {
                     mode: authMode[1] === 'try' || authMode[1] === 'optional' ? 'optional' : 'required',
                 };
             }
-            else if (/auth\s*:\s*\{/.test(nearLine) || /auth\s*\{/.test(nearLine)) {
-                // Multi-line auth object: scan the next 5 lines for mode: 'try' / 'optional'
-                for (let m = j + 1; m < Math.min(j + 6, lines.length); m++) {
-                    const modeMatch = lines[m].match(/mode\s*:\s*['"](\w+)['"]/);
-                    if (modeMatch) {
-                        auth = {
-                            strategy: auth === null || auth === void 0 ? void 0 : auth.strategy,
-                            mode: modeMatch[1] === 'try' || modeMatch[1] === 'optional' ? 'optional' : 'required',
-                        };
-                        break;
-                    }
-                }
-            }
             // auth: false
             if (/auth\s*:\s*false/.test(nearLine)) {
                 auth = undefined; // Public route
@@ -87,9 +74,8 @@ function detectHapiRoutes(sourceText, filePath) {
                 // Scan validation block
                 for (let k = j; k < Math.min(j + 15, lines.length); k++) {
                     const valLine = lines[k];
-                    // query: { ... } — extract Joi fields from same line and subsequent lines
+                    // query: { ... }
                     if (/query\s*:/.test(valLine)) {
-                        // Same-line extraction
                         const paramMatch = valLine.match(/(\w+)\s*:\s*Joi\./g);
                         if (paramMatch) {
                             for (const pm of paramMatch) {
@@ -98,46 +84,17 @@ function detectHapiRoutes(sourceText, filePath) {
                                     queryParams.push(name);
                             }
                         }
-                        // Multi-line extraction: scan subsequent lines for fieldName: Joi. patterns
-                        for (let q = k + 1; q < Math.min(k + 16, lines.length); q++) {
-                            const subLine = lines[q];
-                            if (/}\s*[),]/.test(subLine) || /]\s*,/.test(subLine))
-                                break;
-                            const fieldMatch = subLine.match(/(\w+)\s*:\s*Joi\./g);
-                            if (fieldMatch) {
-                                for (const fm of fieldMatch) {
-                                    const name = (_b = fm.match(/(\w+)\s*:/)) === null || _b === void 0 ? void 0 : _b[1];
-                                    if (name && !queryParams.includes(name))
-                                        queryParams.push(name);
-                                }
-                            }
-                        }
                     }
-                    // payload: { ... } — extract Joi fields from same line and subsequent lines
+                    // payload: { ... }
                     if (/payload\s*:/.test(valLine)) {
-                        // Same-line extraction
                         const paramMatch = valLine.match(/(\w+)\s*:\s*Joi\./g);
                         if (paramMatch) {
                             for (const pm of paramMatch) {
-                                const name = (_c = pm.match(/(\w+)\s*:/)) === null || _c === void 0 ? void 0 : _c[1];
+                                const name = (_b = pm.match(/(\w+)\s*:/)) === null || _b === void 0 ? void 0 : _b[1];
                                 if (name)
                                     payloadParams.push(name);
                             }
                         }
-                        // Multi-line extraction: scan subsequent lines for fieldName: Joi. patterns
-                        for (let q = k + 1; q < Math.min(k + 16, lines.length); q++) {
-                            const subLine = lines[q];
-                            if (/}\s*[),]/.test(subLine) || /]\s*,/.test(subLine))
-                                break;
-                            const fieldMatch = subLine.match(/(\w+)\s*:\s*Joi\./g);
-                            if (fieldMatch) {
-                                for (const fm of fieldMatch) {
-                                    const name = (_d = fm.match(/(\w+)\s*:/)) === null || _d === void 0 ? void 0 : _d[1];
-                                    if (name && !payloadParams.includes(name))
-                                        payloadParams.push(name);
-                                }
-                            }
-                        }
                     }
                 }
                 if (queryParams.length > 0 || payloadParams.length > 0) {

package/dist/src/languages/javascript/vueDetector.d.ts

@@ -9,8 +9,6 @@
  */
 export interface VueApiCall {
     actionName?: string;
-    /** Resolved string value when actionName is a constant (e.g., FETCH_ARTICLES → 'fetchArticles') */
-    resolvedName?: string;
     method: string;
     urlPattern: string;
     baseUrl?: string;

package/dist/src/languages/javascript/vueDetector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vueDetector.d.ts","sourceRoot":"","sources":["../../../../src/languages/javascript/vueDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAO/F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAoEpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAkBzF"}
+{"version":3,"file":"vueDetector.d.ts","sourceRoot":"","sources":["../../../../src/languages/javascript/vueDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAO/F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CA4CpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAkBzF"}

package/dist/src/languages/javascript/vueDetector.js

@@ -29,20 +29,7 @@ function detectAxiosBaseUrl(sourceText, filePath) {
 function detectVuexActions(sourceText, filePath) {
     const calls = [];
     const lines = sourceText.split('\n');
-    // Pass 1: Build a map of constant name → string value.
-    // Matches patterns like:
-    //   const FETCH_ARTICLES = 'fetchArticles'
-    //   export const FETCH_ARTICLES = "fetchArticles"
-    const constantMap = new Map();
-    for (const line of lines) {
-        const constMatch = line.match(/(?:export\s+)?const\s+([A-Z_][A-Z0-9_]*)\s*=\s*['"]([^'"]+)['"]/);
-        if (constMatch) {
-            constantMap.set(constMatch[1], constMatch[2]);
-        }
-    }
-    // Pass 2: Detect action definitions and their API calls.
     let currentAction = '';
-    let currentResolvedName;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         // Vuex action definition: [ACTION_NAME]({ commit }, payload) {
@@ -50,13 +37,6 @@ function detectVuexActions(sourceText, filePath) {
         const actionMatch = line.match(/(?:\[(\w+)\]|(\w+))\s*\(\s*\{\s*(?:commit|dispatch|state|getters|rootState)/);
         if (actionMatch) {
             currentAction = actionMatch[1] || actionMatch[2] || '';
-            // If using bracket syntax with a constant, resolve to its string value
-            if (actionMatch[1] && constantMap.has(actionMatch[1])) {
-                currentResolvedName = constantMap.get(actionMatch[1]);
-            }
-            else {
-                currentResolvedName = undefined;
-            }
             continue;
         }
         // ApiService.get/post/put/delete('resource')
@@ -64,7 +44,6 @@ function detectVuexActions(sourceText, filePath) {
         if (apiServiceMatch) {
             calls.push({
                 actionName: currentAction || undefined,
-                resolvedName: currentResolvedName,
                 method: apiServiceMatch[1].toUpperCase(),
                 urlPattern: apiServiceMatch[2],
                 sourceFile: filePath,
@@ -77,7 +56,6 @@ function detectVuexActions(sourceText, filePath) {
         if (axiosMatch) {
             calls.push({
                 actionName: currentAction || undefined,
-                resolvedName: currentResolvedName,
                 method: axiosMatch[1].toUpperCase(),
                 urlPattern: axiosMatch[2],
                 sourceFile: filePath,

package/dist/src/languages/python/index.d.ts

@@ -10,7 +10,7 @@ export declare class PythonAnalyzer implements LanguageAnalyzer {
     extractHttpInteractions(model: SemanticModel, _ctx: AnalysisContext): ResolvedHttpInteraction[];
     extractAssertions(model: SemanticModel): SemanticAssertion[];
     extractBusinessRuleRefs(model: SemanticModel): BusinessRuleRef[];
-    extractFlowRefs(model: SemanticModel): FlowRef[];
+    extractFlowRefs(_model: SemanticModel): FlowRef[];
 }
 /**
  * Classify JWT/auth security from decorator information.

package/dist/src/languages/python/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/languages/python/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EAIb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,eAAe,EAEf,aAAa,EAEb,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAmC5B,qBAAa,cAAe,YAAW,gBAAgB;IACrD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAY;IAEhD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAc1D,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,GAAG,aAAa;IA4CtF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,GAAG,uBAAuB,EAAE;IAwB/F,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAG5D,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,EAAE;IAGhE,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE;CAqBjD;AA2WD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,sBAAsB,GAAG,SAAS,CAarG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/languages/python/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EAIb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,eAAe,EAEf,aAAa,EAEb,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAkC5B,qBAAa,cAAe,YAAW,gBAAgB;IACrD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAY;IAEhD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAc1D,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,GAAG,aAAa;IA6BtF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,GAAG,uBAAuB,EAAE;IAwB/F,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAG5D,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,EAAE;IAGhE,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,EAAE;CAGlD;AA2WD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,sBAAsB,GAAG,SAAS,CAarG"}

package/dist/src/languages/python/index.js

@@ -8,7 +8,6 @@ exports.classifyFlaskSecurity = classifyFlaskSecurity;
 const parserRegistry_1 = require("../../ast/parserRegistry");
 const treeSitterUtils_1 = require("../shared/treeSitterUtils");
 const resolvePaths_1 = require("../../coverage/deep-analysis/resolvePaths");
-const testPatternDetector_1 = require("./testPatternDetector");
 // ─── Parser ───────────────────────────────────────────────────────────────────
 let cachedParser = undefined;
 let parserLoaded = false;
@@ -46,7 +45,7 @@ class PythonAnalyzer {
         }
     }
     buildSemanticModel(parsed, _context) {
-        var _a, _b, _c, _d;
+        var _a, _b;
         const root = (_b = (_a = parsed.ast) === null || _a === void 0 ? void 0 : _a.rootNode) !== null && _b !== void 0 ? _b : parsed.ast;
         if (!root)
             return emptyModel(parsed.filePath);
@@ -57,20 +56,6 @@ class PythonAnalyzer {
         // Feature 27: Flask/FastAPI pattern detection
         const decoratorStacks = extractFlaskDecoratorStacks(root, parsed.filePath);
         const routeRegistrations = extractFlaskRouteRegistrations(root, parsed.filePath);
-        // Feature 27: webtest API call detection
-        const sourceText = (_d = (_c = root.text) !== null && _c !== void 0 ? _c : parsed.content) !== null && _d !== void 0 ? _d : '';
-        const webtestCalls = (0, testPatternDetector_1.detectWebtestCalls)(sourceText, parsed.filePath);
-        if (webtestCalls.length > 0) {
-            const httpCalls = (0, testPatternDetector_1.webtestCallsToHttpCalls)(webtestCalls);
-            // Merge webtest HTTP calls into the functions map under a synthetic entry
-            const webtestFunc = {
-                name: '__webtest_calls__',
-                parameters: [],
-                bodyHttpCalls: httpCalls,
-                calledFunctions: [],
-            };
-            functions.set('__webtest_calls__', webtestFunc);
-        }
         return {
             filePath: parsed.filePath,
             language: 'python',
@@ -118,23 +103,8 @@ class PythonAnalyzer {
     extractBusinessRuleRefs(model) {
         return model.businessRuleRefs;
     }
-    extractFlowRefs(model) {
-        // Feature 27: Resolve pytest fixture chains
-        const refs = [...model.flowRefs];
-        // Use function parameter names to discover fixture dependencies
-        // In pytest, function parameters that aren't built-in fixtures are fixture references
-        const builtinFixtures = new Set([
-            'request', 'tmp_path', 'tmpdir', 'capsys', 'capfd', 'monkeypatch',
-            'pytestconfig', 'recwarn', 'caplog', 'cache', 'self',
-        ]);
-        for (const [funcName, func] of model.functions) {
-            for (const param of func.parameters) {
-                if (param && !builtinFixtures.has(param)) {
-                    refs.push({ flowId: `fixture:${param}`, source: 'tag' });
-                }
-            }
-        }
-        return refs;
+    extractFlowRefs(_model) {
+        return [];
     }
 }
 exports.PythonAnalyzer = PythonAnalyzer;

package/dist/src/pipeline/confidence.d.ts

@@ -65,11 +65,6 @@ export declare function hasPartialResolution(graph: CoverageKnowledgeGraph, path
 /**
  * Build a ConfidenceEvidence object from a coverage path in the graph.
  * Inspects the nodes and their source stages to determine what evidence exists.
- *
- * Optional `iastConfirmed` and `dastConfirmed` flags allow the caller to
- * inject runtime confirmation state that may not be discoverable by walking
- * `pathNodeIds` alone (e.g. when IAST/DAST nodes are not directly on the
- * endpoint→test path in the graph).
  */
-export declare function buildConfidenceEvidence(graph: CoverageKnowledgeGraph, pathNodeIds: string[], isStaticOnlyMode: boolean, iastConfirmed?: boolean, dastConfirmed?: boolean): ConfidenceEvidence;
+export declare function buildConfidenceEvidence(graph: CoverageKnowledgeGraph, pathNodeIds: string[], isStaticOnlyMode: boolean): ConfidenceEvidence;
 //# sourceMappingURL=confidence.d.ts.map

package/dist/src/pipeline/confidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confidence.d.ts","sourceRoot":"","sources":["../../../src/pipeline/confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAa,MAAM,SAAS,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,kBAAkB,CAwBtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,kBAAkB,CAoBpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,kBAAkB,CAGlF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,kBAAkB,GAC3B,kBAAkB,CAIpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAS9E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAMT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAMT;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,EACrB,gBAAgB,EAAE,OAAO,EACzB,aAAa,CAAC,EAAE,OAAO,EACvB,aAAa,CAAC,EAAE,OAAO,GACtB,kBAAkB,CA6CpB"}
+{"version":3,"file":"confidence.d.ts","sourceRoot":"","sources":["../../../src/pipeline/confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAa,MAAM,SAAS,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAYtD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,kBAAkB,CAwBtF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,kBAAkB,CAoBpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,kBAAkB,CAGlF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,kBAAkB,GAC3B,kBAAkB,CAIpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAS9E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAMT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,WAAW,EAAE,MAAM,EAAE,EACrB,gBAAgB,EAAE,OAAO,GACxB,kBAAkB,CA6CpB"}

package/dist/src/pipeline/confidence.js

@@ -151,13 +151,8 @@ function hasPartialResolution(graph, pathNodeIds) {
 /**
  * Build a ConfidenceEvidence object from a coverage path in the graph.
  * Inspects the nodes and their source stages to determine what evidence exists.
- *
- * Optional `iastConfirmed` and `dastConfirmed` flags allow the caller to
- * inject runtime confirmation state that may not be discoverable by walking
- * `pathNodeIds` alone (e.g. when IAST/DAST nodes are not directly on the
- * endpoint→test path in the graph).
  */
-function buildConfidenceEvidence(graph, pathNodeIds, isStaticOnlyMode, iastConfirmed, dastConfirmed) {
+function buildConfidenceEvidence(graph, pathNodeIds, isStaticOnlyMode) {
     var _a, _b;
     const sourceStages = new Set();
     let hasIastConfirmation = false;
@@ -192,8 +187,8 @@ function buildConfidenceEvidence(graph, pathNodeIds, isStaticOnlyMode, iastConfi
     }
     return {
         sourceStages: Array.from(sourceStages),
-        hasIastConfirmation: hasIastConfirmation || (iastConfirmed !== null && iastConfirmed !== void 0 ? iastConfirmed : false),
-        hasDastConfirmation: hasDastConfirmation || (dastConfirmed !== null && dastConfirmed !== void 0 ? dastConfirmed : false),
+        hasIastConfirmation,
+        hasDastConfirmation,
         hasAssertionConfirmation,
         hasMockBoundary,
         hasPartialResolution: hasPartial,

package/dist/src/pipeline/detectors/expressMiddlewareDetector.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Express middleware-as-auth detector (Feature 27)
+ *
+ * Detects from raw JavaScript/TypeScript file content:
+ * 1. router.use(path, [auth.required | auth.optional], subRouter) →
+ *    router-mount nodes with middleware classification
+ * 2. jwt({ credentialsRequired: false }) → security: { optional: true }
+ * 3. jwt({ secret, ... }) (no credentialsRequired: false) → security: { required: true }
+ * 4. 4-argument Express error handlers (err, req, res, next) → error-handler nodes
+ * 5. if (err.name === '...') branches inside error handlers → exception-branch nodes
+ *
+ * Auth middleware inheritance rule: when auth.required / auth.optional appears in
+ * router.use(), ALL routes in the mounted sub-router inherit that security classification.
+ * This is flagged in the node metadata so the cross-file resolver can propagate it.
+ */
+import type { DetectedNode, Detector } from './types';
+export declare class ExpressMiddlewareDetector implements Detector {
+    readonly name = "express-middleware";
+    detect(fileContent: string, filePath: string): DetectedNode[];
+}
+//# sourceMappingURL=expressMiddlewareDetector.d.ts.map

package/dist/src/pipeline/detectors/expressMiddlewareDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expressMiddlewareDetector.d.ts","sourceRoot":"","sources":["../../../../src/pipeline/detectors/expressMiddlewareDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAItD,qBAAa,yBAA0B,YAAW,QAAQ;IACxD,QAAQ,CAAC,IAAI,wBAAwB;IAErC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;CAyL9D"}

package/dist/src/pipeline/detectors/expressMiddlewareDetector.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * Express middleware-as-auth detector (Feature 27)
+ *
+ * Detects from raw JavaScript/TypeScript file content:
+ * 1. router.use(path, [auth.required | auth.optional], subRouter) →
+ *    router-mount nodes with middleware classification
+ * 2. jwt({ credentialsRequired: false }) → security: { optional: true }
+ * 3. jwt({ secret, ... }) (no credentialsRequired: false) → security: { required: true }
+ * 4. 4-argument Express error handlers (err, req, res, next) → error-handler nodes
+ * 5. if (err.name === '...') branches inside error handlers → exception-branch nodes
+ *
+ * Auth middleware inheritance rule: when auth.required / auth.optional appears in
+ * router.use(), ALL routes in the mounted sub-router inherit that security classification.
+ * This is flagged in the node metadata so the cross-file resolver can propagate it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressMiddlewareDetector = void 0;
+const types_1 = require("./types");
+class ExpressMiddlewareDetector {
+    constructor() {
+        this.name = 'express-middleware';
+    }
+    detect(fileContent, filePath) {
+        var _a, _b, _c;
+        if (!filePath.endsWith('.js') && !filePath.endsWith('.ts') &&
+            !filePath.endsWith('.mjs') && !filePath.endsWith('.cjs')) {
+            return [];
+        }
+        // Quick bail: skip files with no router/app patterns
+        if (!fileContent.includes('router') &&
+            !fileContent.includes('app.use') &&
+            !fileContent.includes('express')) {
+            return [];
+        }
+        const nodes = [];
+        const lines = fileContent.split('\n');
+        // ── Detect jwt middleware definitions ─────────────────────────────────
+        // const auth = { required: jwt({...}), optional: jwt({ credentialsRequired: false, ...}) }
+        const authVarPattern = /const\s+auth\s*=\s*\{([^}]+)\}/s;
+        const authVarMatch = fileContent.match(authVarPattern);
+        const authObjectDefs = new Map();
+        if (authVarMatch) {
+            const body = authVarMatch[1];
+            // required: jwt({...}) without credentialsRequired: false
+            if (/required\s*:.*?jwt\s*\(/.test(body) && !/credentialsRequired\s*:\s*false/.test((_a = body.split('optional')[0]) !== null && _a !== void 0 ? _a : '')) {
+                authObjectDefs.set('auth.required', { type: 'jwt', required: true, optional: false, sourcePattern: 'auth.required' });
+            }
+            // optional: jwt({ credentialsRequired: false, ...})
+            if (/optional\s*:.*?credentialsRequired\s*:\s*false/.test(body)) {
+                authObjectDefs.set('auth.optional', { type: 'jwt', required: false, optional: true, sourcePattern: 'auth.optional' });
+            }
+        }
+        // Also detect standalone: jwt({ credentialsRequired: false })
+        const jwtOptionalPattern = /jwt\s*\(\s*\{[^}]*credentialsRequired\s*:\s*false[^}]*\}\s*\)/;
+        const jwtRequiredPattern = /jwt\s*\(\s*\{[^}]*secret[^}]*\}\s*\)/;
+        // ── Detect router.use(path, [middleware], subRouter) ─────────────────
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // router.use('/path', middleware, require('./sub'))
+            // router.use('/path', require('./sub'))
+            const routerUsePattern = /(?:router|app)\s*\.\s*use\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*(.*?)\)/;
+            const routerUseMatch = line.match(routerUsePattern);
+            if (routerUseMatch) {
+                const mountPath = routerUseMatch[1];
+                const rest = routerUseMatch[2];
+                // Determine security from middleware args
+                let security;
+                if (/auth\.required/.test(rest)) {
+                    security = (_b = authObjectDefs.get('auth.required')) !== null && _b !== void 0 ? _b : { type: 'jwt', required: true, optional: false, sourcePattern: 'auth.required' };
+                }
+                else if (/auth\.optional/.test(rest)) {
+                    security = (_c = authObjectDefs.get('auth.optional')) !== null && _c !== void 0 ? _c : { type: 'jwt', required: false, optional: true, sourcePattern: 'auth.optional' };
+                }
+                else if (jwtOptionalPattern.test(rest)) {
+                    security = { type: 'jwt', required: false, optional: true, sourcePattern: 'jwt(credentialsRequired:false)' };
+                }
+                else if (jwtRequiredPattern.test(rest)) {
+                    security = { type: 'jwt', required: true, optional: false, sourcePattern: 'jwt(secret)' };
+                }
+                // Determine target module (require('./x') or just the last identifier)
+                const requireMatch = rest.match(/require\s*\(['"`]([^'"`]+)['"`]\)/);
+                const targetModule = requireMatch ? requireMatch[1] : extractLastIdentifier(rest);
+                nodes.push({
+                    id: (0, types_1.makeNodeId)(filePath, 'router-mount', mountPath, i + 1),
+                    kind: 'router-mount',
+                    name: mountPath,
+                    filePath,
+                    line: i + 1,
+                    httpPath: mountPath,
+                    urlPrefix: mountPath,
+                    targetModule,
+                    security,
+                    resolution: targetModule ? 'cross-file-unresolved' : 'resolved',
+                    diagnosticMessage: targetModule
+                        ? `Sub-router '${targetModule}' defined in another file`
+                        : undefined,
+                });
+            }
+            // router.use('/path', router) — no middleware between path and router
+            const simpleMountPattern = /(?:router|app)\s*\.\s*use\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*(require\s*\([^)]+\)|\w+)\s*\)/;
+            const simpleMountMatch = line.match(simpleMountPattern);
+            if (simpleMountMatch && !routerUseMatch) {
+                const mountPath = simpleMountMatch[1];
+                const targetExpr = simpleMountMatch[2];
+                const requireMatch2 = targetExpr.match(/require\s*\(['"`]([^'"`]+)['"`]\)/);
+                const targetModule = requireMatch2 ? requireMatch2[1] : targetExpr;
+                nodes.push({
+                    id: (0, types_1.makeNodeId)(filePath, 'router-mount', mountPath, i + 1),
+                    kind: 'router-mount',
+                    name: mountPath,
+                    filePath,
+                    line: i + 1,
+                    httpPath: mountPath,
+                    urlPrefix: mountPath,
+                    targetModule,
+                    resolution: 'cross-file-unresolved',
+                    diagnosticMessage: `Sub-router '${targetModule}' defined in another file`,
+                });
+            }
+        }
+        // ── Detect 4-argument error handlers ─────────────────────────────────
+        // function(err, req, res, next) { ... }
+        // (err, req, res, next) => { ... }
+        const errorHandlerPattern = /(?:function\s*\w*\s*\(|(?:\w+\s*,\s*){0,1}\()\s*err\s*,\s*\w+\s*,\s*\w+\s*,\s*next\s*[)]/;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (!errorHandlerPattern.test(line))
+                continue;
+            // Find the end of this error handler block
+            const handlerStart = i;
+            const braceIdx = fileContent.indexOf('{', fileContent.split('\n').slice(0, i + 1).join('\n').length);
+            let handlerBody = '';
+            if (braceIdx >= 0) {
+                handlerBody = extractBraceBody(fileContent, braceIdx);
+            }
+            nodes.push({
+                id: (0, types_1.makeNodeId)(filePath, 'error-handler', `errorHandler:${i + 1}`, i + 1),
+                kind: 'error-handler',
+                name: `errorHandler:${i + 1}`,
+                filePath,
+                line: i + 1,
+                resolution: 'resolved',
+            });
+            // Extract if (err.name === 'SomeName') branches
+            const errNamePattern = /err\.name\s*===?\s*['"`](\w+)['"`]/g;
+            let errMatch;
+            let bodyOffset = 0;
+            while ((errMatch = errNamePattern.exec(handlerBody)) !== null) {
+                const bodyLines = handlerBody.substring(0, errMatch.index).split('\n');
+                const branchLine = handlerStart + bodyLines.length;
+                // Find status code in the branch
+                const branchContext = handlerBody.substring(errMatch.index, errMatch.index + 200);
+                const statusMatch = branchContext.match(/\.status\s*\(\s*(\d{3})\s*\)/);
+                const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : undefined;
+                nodes.push({
+                    id: (0, types_1.makeNodeId)(filePath, 'exception-branch', errMatch[1], branchLine),
+                    kind: 'exception-branch',
+                    name: errMatch[1],
+                    filePath,
+                    line: branchLine,
+                    errorName: errMatch[1],
+                    errorStatusCode: statusCode,
+                    resolution: 'resolved',
+                });
+            }
+        }
+        // ── Detect auth middleware object definitions ──────────────────────────
+        // Emit auth-middleware node for downstream use
+        if (authObjectDefs.size > 0) {
+            for (const [key, sec] of authObjectDefs) {
+                nodes.push({
+                    id: (0, types_1.makeNodeId)(filePath, 'auth-middleware', key, undefined),
+                    kind: 'auth-middleware',
+                    name: key,
+                    filePath,
+                    security: sec,
+                    resolution: 'resolved',
+                });
+            }
+        }
+        return nodes;
+    }
+}
+exports.ExpressMiddlewareDetector = ExpressMiddlewareDetector;
+function extractLastIdentifier(expr) {
+    const m = expr.match(/(\w+)\s*$/);
+    return m ? m[1] : undefined;
+}
+function extractBraceBody(source, openBrace) {
+    let depth = 1;
+    let i = openBrace + 1;
+    while (i < source.length && depth > 0) {
+        if (source[i] === '{')
+            depth++;
+        if (source[i] === '}')
+            depth--;
+        i++;
+    }
+    return source.substring(openBrace, i);
+}

package/dist/src/pipeline/detectors/flaskBlueprintDetector.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Flask Blueprint detector (Feature 27)
+ *
+ * Detects from raw Python file content:
+ * 1. Blueprint() constructor calls → blueprint-definition nodes
+ * 2. @blueprint.route() decorators with HTTP methods → endpoint nodes (marked
+ *    cross-file-unresolved until url_prefix is resolved by FlaskBlueprintResolver)
+ * 3. app.register_blueprint() calls → blueprint-registration nodes
+ * 4. @use_kwargs({...}) decorator → parameter nodes with location inference
+ * 5. @marshal_with(schema, code=N) → response-schema nodes
+ * 6. @jwt_required / @jwt_optional / @jwt_required(optional=True) → security nodes
+ *
+ * RULE-SA01: never infers role from directory — only from code content
+ * RULE-SA02: endpoint nodes are emitted with resolution: 'cross-file-unresolved'
+ *            when url_prefix is not visible in the same file
+ * RULE-SA04: @jwt_optional → security.optional = true — NEVER classified as public
+ */
+import type { DetectedNode, Detector } from './types';
+export declare class FlaskBlueprintDetector implements Detector {
+    readonly name = "flask-blueprint";
+    detect(fileContent: string, filePath: string): DetectedNode[];
+}
+//# sourceMappingURL=flaskBlueprintDetector.d.ts.map

package/dist/src/pipeline/detectors/flaskBlueprintDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flaskBlueprintDetector.d.ts","sourceRoot":"","sources":["../../../../src/pipeline/detectors/flaskBlueprintDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGtD,qBAAa,sBAAuB,YAAW,QAAQ;IACrD,QAAQ,CAAC,IAAI,qBAAqB;IAElC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;CAyJ9D"}