codeslick-cli 1.0.0

package/dist/src/lib/analyzers/typescript/security-checks/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/access-control.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAcH,gDAuQC;AAlRD,sEAAqF;AAErF;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,yCAAyC;QACzC,2CAA2C;QAC3C,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,kBAAkB,GAAG,2IAA2I,CAAC;QAEvK,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,+CAA+C;YAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAEzE,mCAAmC;YACnC,2DAA2D;YAC3D,gCAAgC;YAChC,2BAA2B;YAC3B,2EAA2E;YAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACtC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;gBACL,iBAAiB;gBACjB,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACjC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC9B,uBAAuB;oBACvB,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;oBACnC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC;oBAC/C,yBAAyB;oBACzB,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAClC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC/B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC1B,mDAAmD;oBACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACzB,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAChC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,uBAAuB,EACvB,kGAAkG,EAClG,uHAAuH,EACvH,UAAU,EACV,0MAA0M,EAC1M,sIAAsI,EACtI;oBACE,gFAAgF;oBAChF,qCAAqC;oBACrC,2CAA2C;oBAC3C,qEAAqE;oBACrE,8CAA8C;iBAC/C,EACD,2KAA2K,EAC3K,wQAAwQ,EACxQ,kKAAkK,CACnK,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,iDAAiD;QACjD,0DAA0D;QAC1D,uDAAuD;QACvD,uFAAuF;QAEvF,oEAAoE;QACpE,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;QACvE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAElD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAEhC,gDAAgD;YAChD,MAAM,mBAAmB,GAAG,kFAAkF,CAAC;YAE/G,IAAI,YAAY,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC5C,IAAI,QAAQ,GAAG,EAAE,CAAC;gBAClB,IAAI,UAAU,GAAG,EAAE,CAAC;gBAEpB,2EAA2E;gBAC3E,oEAAoE;gBACpE,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAEzD,IAAI,eAAe,EAAE,CAAC;oBACpB,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACrC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,sDAAsD;oBACtD,0DAA0D;oBAC1D,MAAM,aAAa,GAAG,uBAAuB,CAAC;oBAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBACjD,IAAI,WAAW,EAAE,CAAC;wBAChB,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACrD,CAAC;oBAED,kCAAkC;oBAClC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC5E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;wBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACpC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;4BACnC,MAAM,eAAe,GAAG,aAAa,CAAC;4BACtC,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACzD,IAAI,aAAa,EAAE,CAAC;gCAClB,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACzD,CAAC;4BACD,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,mDAAmD;gBACnD,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBACtD,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,0BAA0B,EAC1B,sHAAsH,EACtH,2LAA2L,EAC3L,UAAU,EACV,4OAA4O,EAC5O,mJAAmJ,EACnJ;wBACE,gCAAgC;wBAChC,4CAA4C;wBAC5C,+CAA+C;wBAC/C,sBAAsB;wBACtB,wCAAwC;wBACxC,2DAA2D;wBAC3D,qDAAqD;qBACtD,EACD,mLAAmL,EACnL,4MAA4M,EAC5M,6KAA6K,CAC9K,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,sDAAsD;QACtD,uEAAuE;QACvE,MAAM,YAAY,GAAG,gEAAgE,CAAC;QACtF,MAAM,cAAc,GAAG,0DAA0D,CAAC;QAElF,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,+CAA+C;YAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAEnD,sDAAsD;YACtD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;gBACL,4DAA4D;gBAC5D,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;oBACvE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;oBACnE,sCAAsC;oBACtC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC;oBAC/C,6BAA6B;oBAC7B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,qDAAqD;oBACrD,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CACpG,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,mCAAmC,EACnC,yFAAyF,EACzF,0GAA0G,EAC1G,UAAU,EACV,qJAAqJ,EACrJ,yGAAyG,EACzG;oBACE,uCAAuC;oBACvC,6CAA6C;oBAC7C,gDAAgD;oBAChD,uBAAuB;oBACvB,gDAAgD;iBACjD,EACD,2EAA2E,EAC3E,2FAA2F,EAC3F,qGAAqG,CACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,mDAAmD;QACnD,yEAAyE;QACzE,MAAM,qBAAqB,GAAG,oFAAoF,CAAC;QACnH,MAAM,eAAe,GAAG,qEAAqE,CAAC;QAE9F,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACzC,4EAA4E;YAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACxE,MAAM,qBAAqB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAC5B,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC5B,CAAC;YAEF,wEAAwE;YACxE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACtC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC1B,CAAC;YAEF,IAAI,qBAAqB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3C,eAAe,CAAC,IAAI,CAAC,IAAA,2DAAqC,EACxD,2BAA2B,EAC3B,yFAAyF,EACzF,kGAAkG,EAClG,UAAU,EACV,0LAA0L,EAC1L,uHAAuH,EACvH;oBACE,yDAAyD;oBACzD,qCAAqC;oBACrC,uCAAuC;oBACvC,gCAAgC;oBAChC,uBAAuB;oBACvB,2DAA2D;iBAC5D,EACD,mFAAmF,EACnF,kPAAkP,EAClP,4IAA4I,CAC7I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/ai-generated-code.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TypeScript AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 17 hallucination patterns (15 JavaScript + 2 TypeScript-specific)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Detect AI-generated code in TypeScript
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+export declare function checkAIGeneratedCode(lines: string[], filename?: string): SecurityVulnerability[];
+//# sourceMappingURL=ai-generated-code.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/ai-generated-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/ai-generated-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAqHpD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,qBAAqB,EAAE,CAuJzB"}

package/dist/src/lib/analyzers/typescript/security-checks/ai-generated-code.js

@@ -0,0 +1,242 @@
+"use strict";
+/**
+ * TypeScript AI-Generated Code Detection Module
+ *
+ * Detects AI-generated code patterns as SECURITY RISKS:
+ * - 17 hallucination patterns (15 JavaScript + 2 TypeScript-specific)
+ * - 8 code smell heuristics (over-engineering, inconsistency)
+ * - Confidence scoring (HIGH/MEDIUM/LOW)
+ *
+ * OWASP A04:2025 - Insecure Design
+ * CWE-1120 - Excessive Code Complexity
+ * CWE-758 - Reliance on Undefined Behavior
+ *
+ * Phase 1.5, Week 5-7 (AI-Generated Code Detection)
+ * Created: January 8, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAIGeneratedCode = checkAIGeneratedCode;
+const createVulnerability_1 = require("../utils/createVulnerability");
+const ai_code_detection_utils_1 = require("../../helpers/ai-code-detection-utils");
+/**
+ * TypeScript hallucination patterns (17 patterns)
+ *
+ * Includes all JavaScript patterns (15) + TypeScript-specific (2):
+ * - Python influence: .append(), .strip(), .len()
+ * - Case sensitivity errors: .toUppercase(), .toLowercase()
+ * - Non-existent methods: .contains(), .remove(), .split_by()
+ * - TypeScript-specific: .as_type(), .typeof()
+ */
+const HALLUCINATION_PATTERNS = new Map([
+    // Python-style methods in TypeScript
+    ['append', {
+            correct: '.push()',
+            description: 'TypeScript arrays use .push(), not .append(). This is a Python method.'
+        }],
+    ['strip', {
+            correct: '.trim()',
+            description: 'TypeScript strings use .trim(), not .strip(). This is a Python method.'
+        }],
+    ['len', {
+            correct: '.length',
+            description: 'TypeScript uses .length property, not .len() method. This is Python/Rust syntax.'
+        }],
+    ['split_by', {
+            correct: '.split()',
+            description: 'Non-existent method. TypeScript uses .split() with camelCase naming.'
+        }],
+    // Case sensitivity errors (common AI typos)
+    ['toUppercase', {
+            correct: '.toUpperCase()',
+            description: 'Case sensitivity error. Correct method is .toUpperCase() with capital C.'
+        }],
+    ['toLowercase', {
+            correct: '.toLowerCase()',
+            description: 'Case sensitivity error. Correct method is .toLowerCase() with capital C.'
+        }],
+    // Non-existent methods (hallucinations)
+    ['contains', {
+            correct: '.includes()',
+            description: 'TypeScript arrays/strings use .includes(), not .contains(). This is Java syntax.'
+        }],
+    ['remove', {
+            correct: '.splice() or .filter()',
+            description: 'Arrays do not have .remove() method. Use .splice() or .filter().'
+        }],
+    ['replace_all', {
+            correct: '.replaceAll()',
+            description: 'Incorrect method name. TypeScript uses camelCase: .replaceAll().'
+        }],
+    ['substring_of', {
+            correct: '.includes()',
+            description: 'Non-existent method. Use .includes() to check if string contains substring.'
+        }],
+    ['to_string', {
+            correct: '.toString()',
+            description: 'TypeScript uses camelCase: .toString(), not snake_case to_string().'
+        }],
+    ['is_empty', {
+            correct: '.length === 0',
+            description: 'No .is_empty() method. Check .length property instead. This is Rust/Python syntax.'
+        }],
+    // Rust/Python influence
+    ['size', {
+            correct: '.length or .size',
+            description: 'Arrays use .length property. Maps/Sets use .size property (not method).'
+        }],
+    // Java influence
+    ['indexOf', {
+            correct: '.indexOf() or .findIndex()',
+            description: 'Method exists but often misused. Consider .findIndex() for complex searches.'
+        }],
+    // String method confusion
+    ['charAt', {
+            correct: '[index]',
+            description: 'Modern TypeScript prefers bracket notation [index] over .charAt().'
+        }],
+    // TypeScript-specific hallucinations
+    ['as_type', {
+            correct: 'as Type',
+            description: 'No .as_type() method. Use type assertions with "as" keyword: value as Type.'
+        }],
+    ['typeof', {
+            correct: 'typeof operator',
+            description: 'No .typeof() method. Use typeof operator: typeof variable === "string".'
+        }],
+]);
+/**
+ * Detect AI-generated code in TypeScript
+ *
+ * @param lines - Array of code lines
+ * @param filename - Optional filename (to skip test files)
+ * @returns Array of security vulnerabilities (0-1 aggregated vulnerability)
+ */
+function checkAIGeneratedCode(lines, filename) {
+    // Skip test files to reduce false positives
+    if ((0, ai_code_detection_utils_1.isTestFile)(filename)) {
+        return [];
+    }
+    let hallucinationCount = 0;
+    const hallucinationLines = new Set();
+    const detectedPatterns = [];
+    // Combined regex for all 17 hallucination patterns (optimized)
+    const combinedPattern = new RegExp('\\.' +
+        '(append|strip|len|split_by|toUppercase|toLowercase|contains|remove|' +
+        'replace_all|substring_of|to_string|is_empty|size|indexOf|charAt|as_type|typeof)' +
+        '\\s*\\(', 'g');
+    let inMultiLineComment = false;
+    // 1. Detect hallucination patterns
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comments (/* ... */)
+        if (trimmed.includes('/*'))
+            inMultiLineComment = true;
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//'))
+            return;
+        // Remove string literals and template literals to avoid false positives
+        const cleanedLine = (0, ai_code_detection_utils_1.removeCommentsAndStrings)(line, 'typescript');
+        // Match hallucination patterns
+        const matches = Array.from(cleanedLine.matchAll(combinedPattern));
+        for (const match of matches) {
+            const method = match[1];
+            const details = HALLUCINATION_PATTERNS.get(method);
+            if (details) {
+                hallucinationCount++;
+                hallucinationLines.add(lineNumber);
+                detectedPatterns.push(method);
+            }
+        }
+    });
+    // 2. Run heuristic detectors
+    const heuristicScores = {
+        overEngineeredErrors: (0, ai_code_detection_utils_1.detectOverEngineeredErrorHandling)(lines),
+        unnecessaryWrappers: (0, ai_code_detection_utils_1.detectUnnecessaryWrappers)(lines),
+        verboseComments: (0, ai_code_detection_utils_1.detectVerboseComments)(lines),
+        mixedNaming: (0, ai_code_detection_utils_1.detectMixedNamingConventions)(lines),
+        redundantNullChecks: (0, ai_code_detection_utils_1.detectRedundantNullChecks)(lines),
+        unnecessaryAsync: (0, ai_code_detection_utils_1.detectUnnecessaryAsync)(lines),
+        genericVariables: (0, ai_code_detection_utils_1.detectGenericVariableOveruse)(lines),
+        inconsistentStrings: (0, ai_code_detection_utils_1.detectInconsistentStringConcatenation)(lines),
+    };
+    // 3. Calculate confidence and severity
+    const detection = (0, ai_code_detection_utils_1.calculateAICodeConfidence)(hallucinationCount, heuristicScores);
+    if (!detection) {
+        return []; // No AI-generated code detected
+    }
+    // 4. Create aggregated vulnerability
+    const categoryId = detection.severity === 'CRITICAL' ? 'ai-generated-code-high' :
+        detection.severity === 'HIGH' ? 'ai-generated-code-medium' :
+            'ai-generated-code-low';
+    // Build message based on detection type
+    let message = `AI-generated code detected (${detection.confidence} confidence): `;
+    if (hallucinationCount > 0) {
+        message += `${hallucinationCount} hallucinated method(s) found`;
+        if (detectedPatterns.length > 0) {
+            const uniquePatterns = Array.from(new Set(detectedPatterns)).slice(0, 3);
+            message += ` (.${uniquePatterns.join(', .')})`;
+        }
+    }
+    else {
+        message += 'Multiple code smell patterns detected (over-engineering, inconsistent naming, etc.)';
+    }
+    // Build suggestion
+    const suggestion = hallucinationCount > 0
+        ? `Replace hallucinated methods with correct TypeScript equivalents. Found: ${Array.from(new Set(detectedPatterns)).map(p => `.${p}()`).join(', ')}. Review and rewrite AI-generated code sections.`
+        : 'Simplify code structure, use consistent naming conventions (camelCase), and follow TypeScript idioms. Remove unnecessary async functions, redundant null checks, and over-engineered error handling.';
+    // Find first occurrence line for reporting
+    const reportLine = hallucinationLines.size > 0
+        ? Math.min(...hallucinationLines)
+        : 1; // Use first line if only heuristics detected
+    // Get first detected pattern details for remediation example
+    const firstPattern = detectedPatterns[0];
+    const firstPatternDetails = firstPattern ? HALLUCINATION_PATTERNS.get(firstPattern) : null;
+    return [
+        (0, createVulnerability_1.createTypeScriptSecurityVulnerability)({
+            category: categoryId,
+            severity: detection.severity.toLowerCase(),
+            confidence: detection.confidence,
+            message,
+            line: reportLine,
+            suggestion,
+            owasp: 'A04:2025 - Insecure Design',
+            cwe: 'CWE-1120, CWE-758',
+            pciDss: '6.5',
+            remediation: {
+                explanation: 'AI code generators (like GitHub Copilot, ChatGPT, Claude) can hallucinate non-existent methods or generate over-engineered patterns. ' +
+                    'This creates reliability issues and potential security vulnerabilities. Hallucinated methods cause runtime errors that expose stack traces with ' +
+                    'sensitive information. Over-engineered code patterns make security audits difficult, hiding real vulnerabilities. ' +
+                    'Always verify AI-generated code matches TypeScript specifications and follows security best practices.',
+                before: firstPatternDetails
+                    ? `array.${firstPattern}(item)  // Hallucinated method`
+                    : '// Over-engineered or inconsistent code patterns\n// Example: try { ... } catch (e) { if (...) { if (...) { if (...) { } } } }',
+                after: firstPatternDetails
+                    ? `array${firstPatternDetails.correct}  // Correct TypeScript`
+                    : '// Simplified, idiomatic code following TypeScript conventions\n// Example: try { ... } catch (e) { logError(e); throw e; }',
+            },
+            attackVector: {
+                description: 'AI-generated code with hallucinated methods creates runtime TypeError exceptions exposing system internals through stack traces. ' +
+                    'Attackers can trigger these errors repeatedly to map application structure and identify vulnerable endpoints. ' +
+                    'Inconsistent code patterns make security reviews difficult, allowing real vulnerabilities to hide among AI-generated noise. ' +
+                    'Over-engineered error handling may leak sensitive information in catch blocks.',
+                exploitExample: "User triggers: array.append(item)\n" +
+                    "Result: TypeError: array.append is not a function\n" +
+                    "Stack trace reveals: Internal file paths, function names, database schema hints\n" +
+                    "Attacker uses this to map application architecture and plan targeted attacks.",
+                realWorldImpact: [
+                    'Runtime errors revealing sensitive stack traces with internal paths',
+                    'Logic bugs in access control or validation code (AI-generated if statements)',
+                    'Performance degradation from inefficient AI-generated loops and algorithms',
+                    'Maintenance burden: Developers spend hours debugging AI hallucinations',
+                    'Hidden security vulnerabilities masked by over-engineered code patterns',
+                ],
+            },
+        })
+    ];
+}
+//# sourceMappingURL=ai-generated-code.js.map

package/dist/src/lib/analyzers/typescript/security-checks/ai-generated-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-generated-code.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/ai-generated-code.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA8HH,oDA0JC;AArRD,sEAAqF;AACrF,mFAY+C;AAU/C;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAA+B;IACnE,qCAAqC;IACrC,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,wEAAwE;SACtF,CAAC;IACF,CAAC,OAAO,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,wEAAwE;SACtF,CAAC;IACF,CAAC,KAAK,EAAE;YACN,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,sEAAsE;SACpF,CAAC;IAEF,4CAA4C;IAC5C,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,0EAA0E;SACxF,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,0EAA0E;SACxF,CAAC;IAEF,wCAAwC;IACxC,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,kFAAkF;SAChG,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE,kEAAkE;SAChF,CAAC;IACF,CAAC,aAAa,EAAE;YACd,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,kEAAkE;SAChF,CAAC;IACF,CAAC,cAAc,EAAE;YACf,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,WAAW,EAAE;YACZ,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,qEAAqE;SACnF,CAAC;IACF,CAAC,UAAU,EAAE;YACX,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,oFAAoF;SAClG,CAAC;IAEF,wBAAwB;IACxB,CAAC,MAAM,EAAE;YACP,OAAO,EAAE,kBAAkB;YAC3B,WAAW,EAAE,yEAAyE;SACvF,CAAC;IAEF,iBAAiB;IACjB,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,4BAA4B;YACrC,WAAW,EAAE,8EAA8E;SAC5F,CAAC;IAEF,0BAA0B;IAC1B,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,oEAAoE;SAClF,CAAC;IAEF,qCAAqC;IACrC,CAAC,SAAS,EAAE;YACV,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,6EAA6E;SAC3F,CAAC;IACF,CAAC,QAAQ,EAAE;YACT,OAAO,EAAE,iBAAiB;YAC1B,WAAW,EAAE,yEAAyE;SACvF,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,KAAe,EACf,QAAiB;IAEjB,4CAA4C;IAC5C,IAAI,IAAA,oCAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,KAAK;QACL,qEAAqE;QACrE,iFAAiF;QACjF,SAAS,EACT,GAAG,CACJ,CAAC;IAEF,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,mCAAmC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,wCAAwC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,kBAAkB,GAAG,IAAI,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAEvE,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAA,kDAAwB,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAEjE,+BAA+B;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEnD,IAAI,OAAO,EAAE,CAAC;gBACZ,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACnC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,eAAe,GAAG;QACtB,oBAAoB,EAAE,IAAA,2DAAiC,EAAC,KAAK,CAAC;QAC9D,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,eAAe,EAAE,IAAA,+CAAqB,EAAC,KAAK,CAAC;QAC7C,WAAW,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QAChD,mBAAmB,EAAE,IAAA,mDAAyB,EAAC,KAAK,CAAC;QACrD,gBAAgB,EAAE,IAAA,gDAAsB,EAAC,KAAK,CAAC;QAC/C,gBAAgB,EAAE,IAAA,sDAA4B,EAAC,KAAK,CAAC;QACrD,mBAAmB,EAAE,IAAA,+DAAqC,EAAC,KAAK,CAAC;KAClE,CAAC;IAEF,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAA,mDAAyB,EAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,gCAAgC;IAC7C,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GACd,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9D,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;YAC5D,uBAAuB,CAAC;IAE1B,wCAAwC;IACxC,IAAI,OAAO,GAAG,+BAA+B,SAAS,CAAC,UAAU,gBAAgB,CAAC;IAElF,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,GAAG,kBAAkB,+BAA+B,CAAC;QAChE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,qFAAqF,CAAC;IACnG,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,kBAAkB,GAAG,CAAC;QACvC,CAAC,CAAC,4EAA4E,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;QACpM,CAAC,CAAC,sMAAsM,CAAC;IAE3M,2CAA2C;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,CAAC,6CAA6C;IAEpD,6DAA6D;IAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,OAAO;QACL,IAAA,2DAAqC,EAAC;YACpC,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAoC;YAC5E,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,UAAU;YACV,KAAK,EAAE,4BAA4B;YACnC,GAAG,EAAE,mBAAmB;YACxB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE;gBACX,WAAW,EACT,uIAAuI;oBACvI,kJAAkJ;oBAClJ,oHAAoH;oBACpH,wGAAwG;gBAC1G,MAAM,EAAE,mBAAmB;oBACzB,CAAC,CAAC,SAAS,YAAY,gCAAgC;oBACvD,CAAC,CAAC,gIAAgI;gBACpI,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,QAAQ,mBAAmB,CAAC,OAAO,yBAAyB;oBAC9D,CAAC,CAAC,6HAA6H;aAClI;YACD,YAAY,EAAE;gBACZ,WAAW,EACT,mIAAmI;oBACnI,gHAAgH;oBAChH,8HAA8H;oBAC9H,gFAAgF;gBAClF,cAAc,EACZ,qCAAqC;oBACrC,qDAAqD;oBACrD,mFAAmF;oBACnF,+EAA+E;gBACjF,eAAe,EAAE;oBACf,qEAAqE;oBACrE,8EAA8E;oBAC9E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;iBAC1E;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/lib/analyzers/typescript/security-checks/authentication.d.ts

@@ -0,0 +1,28 @@
+/**
+ * TypeScript Authentication Security Checks
+ * OWASP A07:2021 - Identification and Authentication Failures
+ * OWASP A02:2021 - Cryptographic Failures
+ *
+ * Detects critical authentication vulnerabilities:
+ * - Check #3: JWT None Algorithm bypass
+ * - Check #4: JWT Weak Secret
+ * - Check #88: Plaintext password comparison
+ * - Check #89: Weak/predictable token generation
+ * - Check #90: Master password backdoors
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for authentication vulnerabilities in TypeScript code
+ *
+ * Covers:
+ * - Check #3: JWT None Algorithm bypass (CRITICAL) - Phase A P0
+ * - Check #4: JWT Weak Secret (CRITICAL) - Phase A P0
+ * - Check #88: Plaintext password comparison (CRITICAL)
+ * - Check #89: Weak token generation (HIGH)
+ * - Check #90: Master password backdoor (HIGH)
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkAuthentication(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=authentication.d.ts.map

package/dist/src/lib/analyzers/typescript/security-checks/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/typescript/security-checks/authentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAYpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAyezB"}