code-auditor-mcp 3.10.0 → 4.0.1

package/dist/languages/typescript/TreeSitterTypeScriptAdapter.js

@@ -13,8 +13,9 @@
  * co-located in TsSafetyAnalysis (TypeScript forbids a base class calling a
  * subclass method, so those must live in one class).
  */
-import { getParser, parseWithRecovery } from '../tree-sitter/parser.js';
+import { parseWithRecovery } from '../tree-sitter/parser.js';
 import { toASTNode, toSourceLocation } from '../tree-sitter/converter.js';
+import { getRawNode } from '../tree-sitter/rawNode.js';
 // ---------------------------------------------------------------------------
 // Source code storage
 // ---------------------------------------------------------------------------
@@ -34,12 +35,6 @@ const SAFE_STRING_NODE = {
     type: 'string',
     range: [-1, -1],
     location: { start: { line: 0, column: 0 }, end: { line: 0, column: 0 } },
-    raw: {
-        type: 'string',
-        text: "''",
-        startIndex: -1,
-        endIndex: -1,
-    },
 };
 // ---------------------------------------------------------------------------
 // Traversal + primitive helpers
@@ -74,14 +69,6 @@ class TsTraversalHelpers {
             this.collectErrors(child, errors);
         }
     }
-    /** Find first child of node matching one of the given types. */
-    getChildByType(node, type) {
-        for (const child of node.children) {
-            if (child.type === type)
-                return child;
-        }
-        return null;
-    }
     /** Find the first named child matching one of the given types. */
     findFirstNamedChild(node, types) {
         const typeSet = Array.isArray(types) ? new Set(types) : new Set([types]);
@@ -171,7 +158,7 @@ class TsTraversalHelpers {
     }
     /** Extract ordered parameter names from a function node. */
     getParamNames(fnNode) {
-        const raw = fnNode.raw;
+        const raw = getRawNode(fnNode);
         const paramsNode = raw.childForFieldName?.('parameters');
         if (!paramsNode)
             return [];
@@ -203,7 +190,7 @@ class TsTraversalHelpers {
     }
     /** Return the ASTNodes for a call expression's arguments. */
     getCallArgASTNodes(callNode) {
-        const raw = callNode.raw;
+        const raw = getRawNode(callNode);
         const argsNode = raw.childForFieldName?.('arguments');
         if (!argsNode)
             return [];
@@ -422,7 +409,7 @@ class TsNameDocumentation extends TsTraversalHelpers {
     }
     /** Match an ASTNode against a NodePattern. */
     matchesPattern(node, pattern) {
-        const syntaxNode = node.raw;
+        const syntaxNode = getRawNode(node);
         // type matching
         if (pattern.type !== undefined) {
             const types = Array.isArray(pattern.type) ? pattern.type : [pattern.type];
@@ -756,81 +743,6 @@ class TsExtraction extends TsNameDocumentation {
         }
         return undefined;
     }
-    /** Collect static imports, dynamic `import()`, and `require()` calls. */
-    collectRawImport(node, results) {
-        if (node.type === 'import_statement') {
-            const source = this.getChildByType(node, 'string');
-            if (source) {
-                results.push({
-                    moduleSpecifier: source.text.slice(1, -1), // strip quotes
-                    isStatic: true,
-                    isDynamic: false,
-                    isRequire: false,
-                    line: source.startPosition.row,
-                });
-            }
-        }
-        if (node.type === 'call_expression') {
-            const fn = node.firstChild;
-            if (fn?.type === 'import') {
-                this.pushCallImport(node, results, /* isRequire */ false);
-            }
-            else if (fn?.type === 'identifier' && fn.text === 'require') {
-                this.pushCallImport(node, results, /* isRequire */ true);
-            }
-        }
-    }
-    /** Push a `import('...')` or `require('...')` record for a call expression. */
-    pushCallImport(node, results, isRequire) {
-        const args = this.getChildByType(node, 'arguments');
-        const strNode = args ? this.findFirstNamedChild(args, 'string') : null;
-        if (!strNode)
-            return;
-        results.push({
-            moduleSpecifier: strNode.text.slice(1, -1),
-            isStatic: false,
-            isDynamic: !isRequire,
-            isRequire,
-            line: strNode.startPosition.row,
-        });
-    }
-    /** Collect the exported symbol(s) declared by a single `export_statement`. */
-    collectExportedSymbol(node, symbols) {
-        // export function foo / export class Foo / export const x
-        const declaration = this.findFirstNamedChild(node, [
-            'function_declaration',
-            'class_declaration',
-            'abstract_class_declaration',
-            'lexical_declaration',
-            'variable_declaration',
-            'interface_declaration',
-            'type_alias_declaration',
-            'enum_declaration',
-        ]);
-        if (declaration) {
-            const name = this.extractName(declaration);
-            if (name) {
-                symbols.push({ name, line: declaration.startPosition.row });
-                return;
-            }
-        }
-        // export { foo, bar } or export { default }
-        const clause = this.getChildByType(node, 'export_clause');
-        if (clause) {
-            for (const child of clause.namedChildren) {
-                if (child.type === 'export_specifier') {
-                    const nameNode = this.getChildByType(child, 'identifier');
-                    if (nameNode) {
-                        symbols.push({ name: nameNode.text, line: nameNode.startPosition.row });
-                    }
-                }
-            }
-        }
-        // export default <expression>
-        if (node.childForFieldName?.('value')) {
-            symbols.push({ name: 'default', line: node.startPosition.row });
-        }
-    }
 }
 // ---------------------------------------------------------------------------
 // Public LanguageAdapter surface: parsing, navigation, extraction
@@ -876,11 +788,6 @@ class TsPublicApi extends TsExtraction {
     getChildren(node) {
         return node.children ?? [];
     }
-    getSiblings(node) {
-        if (!node.parent?.children)
-            return [];
-        return node.parent.children.filter((c) => c !== node);
-    }
     getNodeType(node) {
         return node.type;
     }
@@ -888,17 +795,14 @@ class TsPublicApi extends TsExtraction {
         return sourceCode.slice(node.range[0], node.range[1]);
     }
     getNodeName(node) {
-        const syntaxNode = node.raw;
+        const syntaxNode = getRawNode(node);
         return this.extractName(syntaxNode);
     }
-    getNodeLocation(node) {
-        return node.location;
-    }
     extractFunctions(ast) {
         const sourceCode = sourceCodeMap.get(ast) ?? '';
         const functions = [];
         this.walk(ast.root, (node) => {
-            const syntaxNode = node.raw;
+            const syntaxNode = getRawNode(node);
             const type = syntaxNode.type;
             if (type === 'function_declaration' ||
                 type === 'generator_function_declaration' ||
@@ -916,7 +820,7 @@ class TsPublicApi extends TsExtraction {
         const sourceCode = sourceCodeMap.get(ast) ?? '';
         const classes = [];
         this.walk(ast.root, (node) => {
-            const syntaxNode = node.raw;
+            const syntaxNode = getRawNode(node);
             if (syntaxNode.type === 'class_declaration' || syntaxNode.type === 'abstract_class_declaration') {
                 const cls = this.buildClassInfo(syntaxNode, sourceCode);
                 if (cls)
@@ -929,7 +833,7 @@ class TsPublicApi extends TsExtraction {
         const sourceCode = sourceCodeMap.get(ast) ?? '';
         const imports = [];
         this.walk(ast.root, (node) => {
-            const syntaxNode = node.raw;
+            const syntaxNode = getRawNode(node);
             if (syntaxNode.type === 'import_statement') {
                 const imp = this.buildImportInfo(syntaxNode, sourceCode);
                 if (imp)
@@ -942,7 +846,7 @@ class TsPublicApi extends TsExtraction {
         const sourceCode = sourceCodeMap.get(ast) ?? '';
         const exports = [];
         this.walk(ast.root, (node) => {
-            const syntaxNode = node.raw;
+            const syntaxNode = getRawNode(node);
             if (syntaxNode.type === 'export_statement') {
                 const ex = this.buildExportInfo(syntaxNode, sourceCode);
                 if (ex)
@@ -957,11 +861,11 @@ class TsPublicApi extends TsExtraction {
 // ---------------------------------------------------------------------------
 class TsPredicatesOptional extends TsPublicApi {
     isClass(node) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         return type === 'class_declaration' || type === 'abstract_class_declaration' || type === 'class_expression';
     }
     isFunction(node) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         return (type === 'function_declaration' ||
             type === 'function_expression' ||
             type === 'arrow_function' ||
@@ -969,54 +873,34 @@ class TsPredicatesOptional extends TsPublicApi {
             type === 'generator_function_expression');
     }
     isMethod(node) {
-        return node.raw.type === 'method_definition';
-    }
-    isInterface(node) {
-        return node.raw.type === 'interface_declaration';
-    }
-    isImport(node) {
-        return node.raw.type === 'import_statement';
-    }
-    isExport(node) {
-        return node.raw.type === 'export_statement';
+        return (getRawNode(node)).type === 'method_definition';
     }
     isLoop(node) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         return (type === 'for_statement' ||
             type === 'for_in_statement' ||
             type === 'while_statement' ||
             type === 'do_statement');
     }
-    isConditional(node) {
-        const type = node.raw.type;
-        return (type === 'if_statement' ||
-            type === 'switch_statement' ||
-            type === 'ternary_expression' ||
-            type === 'switch_case');
-    }
     isVariableDeclaration(node) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         return (type === 'variable_declaration' ||
             type === 'lexical_declaration' ||
             type === 'variable_declarator');
     }
-    getTypeInfo(node) {
-        const syntaxNode = node.raw;
-        return this.extractTypeAnnotation(syntaxNode);
-    }
     getDocumentation(node) {
-        const syntaxNode = node.raw;
+        const syntaxNode = getRawNode(node);
         return this.extractDocumentation(syntaxNode);
     }
     getComplexity(node) {
-        const syntaxNode = node.raw;
+        const syntaxNode = getRawNode(node);
         return this.calculateCyclomaticComplexity(syntaxNode);
     }
     extractInterfaces(ast) {
         const sourceCode = sourceCodeMap.get(ast) ?? '';
         const interfaces = [];
         this.walk(ast.root, (node) => {
-            const syntaxNode = node.raw;
+            const syntaxNode = getRawNode(node);
             if (syntaxNode.type === 'interface_declaration') {
                 const iface = this.buildInterfaceInfo(syntaxNode, sourceCode);
                 if (iface)
@@ -1025,24 +909,6 @@ class TsPredicatesOptional extends TsPublicApi {
         });
         return interfaces;
     }
-    extractRawImports(_filePath, content) {
-        const results = [];
-        const parser = getParser('typescript');
-        const tree = parser.parse(content);
-        if (!tree)
-            return results;
-        this.walkRaw(tree.rootNode, (node) => this.collectRawImport(node, results));
-        return results;
-    }
-    extractExportedSymbols(ast) {
-        const symbols = [];
-        this.walk(ast.root, (astNode) => {
-            const node = astNode.raw;
-            if (node.type === 'export_statement')
-                this.collectExportedSymbol(node, symbols);
-        });
-        return symbols;
-    }
 }
 // ---------------------------------------------------------------------------
 // Scope + static-value resolution
@@ -1099,7 +965,7 @@ class TsScopeStatic extends TsPredicatesOptional {
     findEnclosingScope(node, ast) {
         let current = node;
         while (current) {
-            const type = current.raw.type;
+            const type = (getRawNode(current)).type;
             if (type === 'function_declaration' ||
                 type === 'arrow_function' ||
                 type === 'function_expression' ||
@@ -1119,14 +985,14 @@ class TsScopeStatic extends TsPredicatesOptional {
         const parent = declNode.parent;
         if (!parent)
             return null;
-        const pType = parent.raw.type;
+        const pType = (getRawNode(parent)).type;
         // The declarator's parent is lexical_declaration; the for-statement
         // is the parent of that.
         if (pType === 'lexical_declaration' || pType === 'variable_declaration') {
             const grandparent = parent.parent;
             if (!grandparent)
                 return null;
-            const gpType = grandparent.raw.type;
+            const gpType = (getRawNode(grandparent)).type;
             if (gpType === 'for_of_statement' || gpType === 'for_in_statement') {
                 return grandparent;
             }
@@ -1137,14 +1003,14 @@ class TsScopeStatic extends TsPredicatesOptional {
     findDeclarationInScope(scopeRoot, targetName) {
         const results = [];
         this.walk(scopeRoot, (astNode) => {
-            const t = astNode.raw.type;
+            const t = (getRawNode(astNode)).type;
             if (t === 'variable_declarator') {
-                const raw = astNode.raw;
+                const raw = getRawNode(astNode);
                 const nameNode = raw.childForFieldName?.('name') ?? null;
                 const name = nameNode ? nameNode.text : '?';
                 const parent = astNode.parent;
                 if (parent) {
-                    const pType = parent.raw.type;
+                    const pType = (getRawNode(parent)).type;
                     if (pType === 'lexical_declaration' || pType === 'variable_declaration') {
                         if (name === targetName) {
                             results.push(astNode);
@@ -1166,7 +1032,7 @@ class TsScopeStatic extends TsPredicatesOptional {
             // Early exit — first match wins.
             if (results.length > 0)
                 return;
-            const raw = astNode.raw;
+            const raw = getRawNode(astNode);
             const type = raw.type;
             if (type === 'import_specifier') {
                 // named import: import { X } from …  or  import { X as Y } from …
@@ -1177,7 +1043,7 @@ class TsScopeStatic extends TsPredicatesOptional {
                     results.push({ isStatic: true, declLine: astNode.location.start.line });
                 }
             }
-            else if (type === 'import' && astNode.parent?.raw?.type === 'import_clause') {
+            else if (type === 'import' && astNode.parent?.type === 'import_clause') {
                 // default import: import X from … — the 'import' node is a child of
                 // 'import_clause', and its text is the local binding name.
                 if (raw.text === name) {
@@ -1204,11 +1070,11 @@ class TsScopeStatic extends TsPredicatesOptional {
         this.walk(scopeRoot, (astNode) => {
             if (found)
                 return;
-            const t = astNode.raw.type;
+            const t = (getRawNode(astNode)).type;
             if (t === 'assignment_expression' || t === 'augmented_assignment_expression') {
                 if (astNode.location.start.line < declLine)
                     return;
-                const raw = astNode.raw;
+                const raw = getRawNode(astNode);
                 const left = raw.childForFieldName?.('left');
                 if (left && left.type === 'identifier' && left.text === targetName) {
                     found = true;
@@ -1223,7 +1089,7 @@ class TsScopeStatic extends TsPredicatesOptional {
         this.walk(ast.root, (node) => {
             if (result)
                 return;
-            const raw = node.raw;
+            const raw = getRawNode(node);
             const t = raw.type;
             if (t === 'function_declaration' || t === 'generator_function_declaration') {
                 const nameNode = raw.childForFieldName?.('name');
@@ -1243,7 +1109,7 @@ class TsScopeStatic extends TsPredicatesOptional {
     }
     /** Extract a function's name (named functions and arrow-function assignments). */
     getFunctionName(node) {
-        const raw = node.raw;
+        const raw = getRawNode(node);
         const t = raw.type;
         if (t === 'function_declaration' || t === 'generator_function_declaration'
             || t === 'function_expression' || t === 'method_definition') {
@@ -1254,7 +1120,7 @@ class TsScopeStatic extends TsPredicatesOptional {
         if (t === 'arrow_function') {
             const parent = node.parent;
             if (parent) {
-                const pRaw = parent.raw;
+                const pRaw = getRawNode(parent);
                 if (pRaw.type === 'variable_declarator') {
                     const nameNode = pRaw.childForFieldName?.('name');
                     if (nameNode && nameNode.type === 'identifier')
@@ -1268,7 +1134,7 @@ class TsScopeStatic extends TsPredicatesOptional {
     findCallSites(fnName, ast) {
         const sites = [];
         this.walk(ast.root, (node) => {
-            const raw = node.raw;
+            const raw = getRawNode(node);
             if (raw.type !== 'call_expression')
                 return;
             const fn = raw.childForFieldName?.('function');
@@ -1290,11 +1156,11 @@ class TsDynamicStringConstruction extends TsScopeStatic {
      *   String-like identifiers and plain string literals are never dynamic.
      */
     isDynamicStringConstruction(node) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         if (type === 'template_string') {
             // template_string is dynamic only if it has template_substitution children
             for (const child of node.children ?? []) {
-                if (child.raw.type === 'template_substitution') {
+                if ((getRawNode(child)).type === 'template_substitution') {
                     return true;
                 }
             }
@@ -1303,20 +1169,20 @@ class TsDynamicStringConstruction extends TsScopeStatic {
         if (type === 'binary_expression') {
             // Check for string concatenation: operands include a string literal
             const children = node.children ?? [];
-            const hasStringLiteral = children.some(c => c.raw.type === 'string');
+            const hasStringLiteral = children.some(c => (getRawNode(c)).type === 'string');
             return hasStringLiteral;
         }
         if (type === 'call_expression') {
             // Check for .concat() calls
-            const text = node.raw.text;
+            const text = (getRawNode(node)).text;
             if (text.includes('.concat(') || text.includes('?.concat('))
                 return true;
             // Recurse into arguments: query(binaryExpression) where the argument
             // itself is a dynamic string construction.
             for (const child of node.children ?? []) {
-                if (child.raw.type === 'arguments') {
+                if ((getRawNode(child)).type === 'arguments') {
                     for (const arg of child.children ?? []) {
-                        const argType = arg.raw.type;
+                        const argType = (getRawNode(arg)).type;
                         if (argType === '(' || argType === ')' || argType === ',')
                             continue;
                         if (this.isDynamicStringConstruction(arg))
@@ -1335,7 +1201,7 @@ class TsDynamicStringConstruction extends TsScopeStatic {
      * and non-literal arguments for concat calls.
      */
     getDynamicParts(node, sourceCode) {
-        const type = node.raw.type;
+        const type = (getRawNode(node)).type;
         if (type === 'call_expression') {
             const nested = this.getNestedDynamicCallParts(node, sourceCode);
             if (nested)
@@ -1351,14 +1217,14 @@ class TsDynamicStringConstruction extends TsScopeStatic {
     /** For a non-`.concat()` call, recurse into the first argument that is itself
      *  a dynamic string construction; null when there is none (or it's .concat). */
     getNestedDynamicCallParts(node, sourceCode) {
-        const text = node.raw.text;
+        const text = (getRawNode(node)).text;
         if (text.includes('.concat(') || text.includes('?.concat('))
             return null;
         for (const child of node.children ?? []) {
-            if (child.raw.type !== 'arguments')
+            if ((getRawNode(child)).type !== 'arguments')
                 continue;
             for (const arg of child.children ?? []) {
-                const argType = arg.raw.type;
+                const argType = (getRawNode(arg)).type;
                 if (argType === '(' || argType === ')' || argType === ',')
                     continue;
                 if (this.isDynamicStringConstruction(arg)) {
@@ -1372,13 +1238,13 @@ class TsDynamicStringConstruction extends TsScopeStatic {
     getCallArgParts(node) {
         const parts = [];
         for (const child of node.children ?? []) {
-            if (child.raw.type !== 'arguments')
+            if ((getRawNode(child)).type !== 'arguments')
                 continue;
             for (const arg of child.children ?? []) {
-                const argType = arg.raw.type;
+                const argType = (getRawNode(arg)).type;
                 if (argType === '(' || argType === ')' || argType === ',')
                     continue;
-                const text = arg.raw.text.trim();
+                const text = (getRawNode(arg)).text.trim();
                 const isId = /^[$\p{L}_][\p{L}\p{N}_$]*$/u.test(text);
                 parts.push({ text, isIdentifier: isId, node: arg });
             }
@@ -1389,7 +1255,7 @@ class TsDynamicStringConstruction extends TsScopeStatic {
     getTemplateStringParts(node, sourceCode) {
         const parts = [];
         for (const child of node.children ?? []) {
-            if (child.raw.type !== 'template_substitution')
+            if ((getRawNode(child)).type !== 'template_substitution')
                 continue;
             const text = sourceCode.slice(child.range[0], child.range[1]);
             // Strip the ${ } wrapper to get the inner identifier/expression.
@@ -1399,7 +1265,7 @@ class TsDynamicStringConstruction extends TsScopeStatic {
             // isSafeInterpolation() cross-function safety checks.
             let exprNode;
             for (const subChild of child.children ?? []) {
-                if (subChild.raw.type !== 'template_substitution') {
+                if ((getRawNode(subChild)).type !== 'template_substitution') {
                     exprNode = subChild;
                     break;
                 }
@@ -1412,7 +1278,7 @@ class TsDynamicStringConstruction extends TsScopeStatic {
     getBinaryExpressionParts(node, sourceCode) {
         const parts = [];
         for (const child of node.children ?? []) {
-            const childType = child.raw.type;
+            const childType = (getRawNode(child)).type;
             if (childType === 'string' || childType === '+' || childType === 'template_string')
                 continue;
             const text = sourceCode.slice(child.range[0], child.range[1]);
@@ -1457,7 +1323,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
      *  declarations survive (`.` doesn't match `\n`). */
     resolveFromDeclaration(declNode, idName, sourceCode, scope) {
         const { scopeRoot, enclosing, ast } = scope;
-        const raw = declNode.raw;
+        const raw = getRawNode(declNode);
         const valueNode = raw.childForFieldName?.('value');
         const declLine = declNode.location.start.line;
         const reassigned = this.hasReassignment(scopeRoot, idName, declLine);
@@ -1524,7 +1390,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
      */
     traceForInLoopVariable(identifierNode, idName, sourceCode, scope) {
         const { scopeRoot, enclosing, ast } = scope;
-        const idRaw = identifierNode.raw;
+        const idRaw = getRawNode(identifierNode);
         let tsCurrent = idRaw.parent;
         while (tsCurrent) {
             if (tsCurrent.type === 'for_in_statement') {
@@ -1535,7 +1401,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
                         const iterName = right.text;
                         let iterDecl = this.resolveDeclaration(scopeRoot, enclosing, ast, iterName);
                         if (iterDecl) {
-                            const iterRaw = iterDecl.raw;
+                            const iterRaw = getRawNode(iterDecl);
                             const iterValue = iterRaw.childForFieldName?.('value');
                             const iterLine = iterDecl.location.start.line;
                             const iterReassigned = this.hasReassignment(scopeRoot, iterName, iterLine)
@@ -1560,7 +1426,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
         const forParent = this.findEnclosingForStatement(declNode);
         if (!forParent)
             return false;
-        const forRaw = forParent.raw;
+        const forRaw = getRawNode(forParent);
         const iterable = forRaw.childForFieldName?.('right');
         if (!iterable || iterable.type !== 'identifier')
             return false;
@@ -1568,7 +1434,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
         let iterDecl = this.resolveDeclaration(scopeRoot, enclosing, ast, iterName);
         if (!iterDecl)
             return false;
-        const iterRaw = iterDecl.raw;
+        const iterRaw = getRawNode(iterDecl);
         const iterValue = iterRaw.childForFieldName?.('value');
         const iterLine = iterDecl.location.start.line;
         const iterReassigned = this.hasReassignment(scopeRoot, iterName, iterLine)
@@ -1589,7 +1455,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
         }
         if (!linkedDecl)
             return false;
-        const linkedRaw = linkedDecl.raw;
+        const linkedRaw = getRawNode(linkedDecl);
         const linkedValue = linkedRaw.childForFieldName?.('value');
         const linkedLine = linkedDecl.location.start.line;
         const linkedReassigned = this.hasReassignment(scopeRoot, linkedName, linkedLine)
@@ -1614,7 +1480,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
      *  before its use.  Guards throw on invalid input, so a parameter that has
      *  passed one cannot carry unvalidated attacker data past the check. */
     isGuardValidatedParameter(identifierNode, ast) {
-        const idRaw = identifierNode.raw;
+        const idRaw = getRawNode(identifierNode);
         const paramName = idRaw.text;
         const enclosing = this.findEnclosingScope(identifierNode, ast);
         if (!enclosing || enclosing === ast.root)
@@ -1625,7 +1491,7 @@ class TsConstantResolution extends TsDynamicStringConstruction {
         this.walk(enclosing, (node) => {
             if (guarded)
                 return;
-            const raw = node.raw;
+            const raw = getRawNode(node);
             if (raw.type !== 'call_expression')
                 return;
             const fn = raw.childForFieldName?.('function');
@@ -1662,13 +1528,47 @@ class TsSafetyAnalysis extends TsConstantResolution {
             paramMap: new Map(),
         });
     }
+    /**
+     * Public entry point (LanguageAdapter.isEscapedInterpolation).  True when the
+     * expression applies manual quote-doubling — `.replace(/'/g, "''")`,
+     * `.replace(/"/g, '""')`, `.replaceAll("'", "''")`, or
+     * `.split("'").join("''")` (and the double-quote variants).  Such input is
+     * defended but NOT provably safe: single-quote doubling handles only the
+     * single-quote vector, not backslash escapes, unicode quote variants, or
+     * numeric/identifier positions.  The caller downgrades these from `critical`
+     * to `advisory` rather than certifying them safe.
+     */
+    isEscapedInterpolation(node, ast, sourceCode) {
+        // Source slice, not `raw.text` — web-tree-sitter's Node.text is unreliable
+        // without a text provider (the adapter reads text via sourceCode.slice).
+        const text = sourceCode.slice(node.range[0], node.range[1]).trim();
+        if (!text)
+            return false;
+        // Quote-doubling is the *specific* defense: the search argument must be a
+        // bare quote and the replacement that same quote doubled — `.replace(/'/g, "''")`
+        // / `.replaceAll("'", "''")` (single) or `.replace(/"/g, '""')` /
+        // `.replaceAll('"', '""')` (double). A generic `.replace()` whose replacement
+        // merely happens to be a doubled quote — `replace('x', "''")` or
+        // `replace(/x/g, "''")` — is NOT escaping and must not read as one. The
+        // search quote and the replacement quote must match in kind.
+        const singleReplace = /\.(?:replace|replaceAll)\s*\(\s*(?:\/'\/[a-z]*|"'")\s*,\s*"''"\s*\)/;
+        const doubleReplace = /\.(?:replace|replaceAll)\s*\(\s*(?:\/"\/[a-z]*|'"')\s*,\s*'""'\s*\)/;
+        if (singleReplace.test(text) || doubleReplace.test(text))
+            return true;
+        // `.split("'").join("''")` — split on a quote, rejoin on its doubled form.
+        const singleSplit = /\.split\(\s*"'"\s*\)\s*\.join\(\s*"''"\s*\)/;
+        const doubleSplit = /\.split\(\s*'"'\s*\)\s*\.join\(\s*'""'\s*\)/;
+        if (singleSplit.test(text) || doubleSplit.test(text))
+            return true;
+        return false;
+    }
     /** Recursive safety check against the traversal context in `ctx`. */
     isSafeExpression(node, ctx) {
         if (!node)
             return false;
         if (node === SAFE_STRING_NODE)
             return true;
-        const raw = node.raw;
+        const raw = getRawNode(node);
         // `seen` is path-based (added on entry, removed on exit) and keyed by the
         // node's unique `id` — NOT `startIndex`, which collides between an
         // expression and its leading operand (a `binary_expression` and its left
@@ -1719,7 +1619,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     evaluateStructuralExpression(node, raw, ctx) {
         switch (raw.type) {
             case 'parenthesized_expression': {
-                const inner = (node.children ?? []).find((c) => !['(', ')'].includes(c.raw.type));
+                const inner = (node.children ?? []).find((c) => !['(', ')'].includes((getRawNode(c)).type));
                 return this.isSafeExpression(inner ?? null, ctx);
             }
             case 'as_expression':
@@ -1748,7 +1648,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** Identifier safety: a bound parameter, compile-time constant, or validated
      *  parameter at all call sites. */
     isSafeIdentifier(node, ctx) {
-        const name = node.raw.text;
+        const name = (getRawNode(node)).text;
         // A parameter bound at the current call site — recurse into its value.
         if (ctx.paramMap.has(name)) {
             return this.isSafeExpression(ctx.paramMap.get(name) ?? null, ctx);
@@ -1772,10 +1672,10 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** A template string is safe only if every `${…}` substitution is safe. */
     isSafeTemplateString(node, ctx) {
         for (const child of node.children ?? []) {
-            const ct = child.raw.type;
+            const ct = (getRawNode(child)).type;
             if (ct !== 'template_substitution')
                 continue;
-            const inner = (child.children ?? []).find((c) => c.raw.type !== 'template_substitution') ?? child;
+            const inner = (child.children ?? []).find((c) => (getRawNode(c)).type !== 'template_substitution') ?? child;
             if (!this.isSafeExpression(inner, ctx)) {
                 return false;
             }
@@ -1785,7 +1685,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** An array literal is safe only if every element is safe. */
     isSafeArray(node, ctx) {
         for (const child of node.children ?? []) {
-            const ct = child.raw.type;
+            const ct = (getRawNode(child)).type;
             if (ct === ',' || ct === '[' || ct === ']')
                 continue;
             if (!this.isSafeExpression(child, ctx)) {
@@ -1796,7 +1696,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     }
     /** Decide whether a call expression is provably safe to embed in SQL. */
     isSafeCallExpression(node, ctx) {
-        const raw = node.raw;
+        const raw = getRawNode(node);
         const fnNode = raw.childForFieldName?.('function');
         if (!fnNode)
             return false;
@@ -1815,7 +1715,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** True when the node is `.join(...)` over `.map(...)` of a static array whose
      *  callback body is safe for every element. */
     isSafeMapJoin(node, ctx) {
-        const raw = node.raw;
+        const raw = getRawNode(node);
         const fnNode = raw.childForFieldName?.('function');
         if (!fnNode || fnNode.type !== 'member_expression')
             return false;
@@ -1851,7 +1751,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** True when the node is a call to a local (in-file) function whose body is
      *  safe under the values passed at this call site. */
     isLocalFunctionCallSafe(node, ctx) {
-        const raw = node.raw;
+        const raw = getRawNode(node);
         const fnNode = raw.childForFieldName?.('function');
         if (!fnNode || fnNode.type !== 'identifier')
             return false;
@@ -1871,7 +1771,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** Check a function's body returns only safe values, under the `paramMap`
      *  already bound in `ctx` to the values passed at the call site. */
     isBodySafeUnderParams(fnNode, ctx) {
-        const raw = fnNode.raw;
+        const raw = getRawNode(fnNode);
         const body = raw.childForFieldName?.('body');
         if (!body)
             return false;
@@ -1902,7 +1802,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
      *  in-file call site of that function passes a provably-safe value for that
      *  parameter position. */
     isParamSafeAtAllCallSites(identifierNode, ctx) {
-        const idRaw = identifierNode.raw;
+        const idRaw = getRawNode(identifierNode);
         const paramName = idRaw.text;
         const enclosing = this.findEnclosingScope(identifierNode, ctx.ast);
         if (!enclosing || enclosing === ctx.ast.root)
@@ -1929,7 +1829,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
     /** True when the identifier names a local variable whose initializer is a
      *  provably-safe expression and which is never reassigned. */
     isDeclarationValueSafe(identifierNode, ctx) {
-        const idRaw = identifierNode.raw;
+        const idRaw = getRawNode(identifierNode);
         const name = idRaw.text;
         const enclosing = this.findEnclosingScope(identifierNode, ctx.ast);
         const scopeRoot = enclosing ?? ctx.ast.root;
@@ -1944,7 +1844,7 @@ class TsSafetyAnalysis extends TsConstantResolution {
             || (enclosing && enclosing !== ctx.ast.root ? this.hasReassignment(ctx.ast.root, name, declLine) : false);
         if (reassigned)
             return false;
-        const declRaw = declNode.raw;
+        const declRaw = getRawNode(declNode);
         const valueRaw = declRaw.childForFieldName?.('value');
         if (!valueRaw)
             return false;