insa-check-core 0.1.0

package/dist/code/checks/treesitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"treesitter.js","sourceRoot":"","sources":["../../../src/code/checks/treesitter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,EAA0E,MAAM,wBAAwB,CAAC;AAEvH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExE,mFAAmF;AAEnF,MAAM,KAAK,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAGlE,SAAS,OAAO,CAAC,MAAgB,EAAE,IAAY,EAAE,IAAY,EAAE,UAAsB,EAAE,GAAW;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,IAAuC;IACjF,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,aAAa,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,4EAA4E,CAAC,CAAC;IAC5K,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,4GAA4G;AAC5G,SAAS,IAAI,CAAC,IAAgB,EAAE,GAAuB,EAAE,IAAI,GAAgB,EAAE;IAC7E,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5H,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC7B,OAAO,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,6GAA6G;AAC7G,SAAS,KAAK,CACZ,KAAc,EACd,QAAyB,EACzB,IAAY,EACZ,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,IAAI,GAAiD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;IAElE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY,EAAE,KAAe,EAAE,OAAe,EAAE,IAAY,EAAE,UAAsB,EAAE,GAAW;IAChI,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7E,8FAA8F;AAC9F,MAAM,UAAU,GAAG,6HAA6H,CAAC;AACjJ,MAAM,UAAU,GAAsB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;IACpG,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC5H,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;gBAAE,SAAS;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACpF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC9J,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACzJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,eAAe,GAAG,sDAAsD,CAAC;AAC/E,MAAM,aAAa,GAAG,4EAA4E,CAAC;AACnG,MAAM,cAAc,GAAoB;IACtC,MAAM,EAAE,kGAAkG;IAC1G,IAAI,EAAE,qFAAqF;IAC3F,EAAE,EAAE,yBAAyB;CAC9B,CAAC;AACF,MAAM,gBAAgB,GAAoB;IACxC,MAAM,EAAE,mFAAmF;IAC3F,EAAE,EAAE,2DAA2D;CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;IAC/F,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EACjG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uFAAuF,CAAC,CAAC,CAAC;QACvH,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,uEAAuE,CAAC,CAAC,CAAC;QAChK,IAAI,IAAI,KAAK,MAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,QAAQ,EAAE,CAAC;aAC5G,IAAI,IAAI,KAAK,MAAM,IAAI,4DAA4D,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,UAAU,EAAE,CAAC;aAC9I,IAAI,IAAI,KAAK,MAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,UAAU,EAAE,CAAC;aACrH,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,QAAQ,EAAE,CAAC;aACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,OAAO,GAAG,sEAAsE,CAAC;AACvF,MAAM,eAAe,GAAoB;IACvC,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,oCAAoC;IAC1C,EAAE,EAAE,kDAAkD;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,4EAA4E,EAAE,CAAC,KAAK,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4FAA4F,CAAC,CAAC,CAAC;QAC3J,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,0EAA0E;YAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,0GAA0G,CAAC,CAAC,CAAC;QAClL,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CACN,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,EAAE,2EAA2E,CAAC,EAClL,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,sDAAsD,EAAE,mBAAmB,EAAE,QAAQ,EAAE,0GAA0G,CAAC,EACzP,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EACrG,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,CACjH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,uGAAuG;AACvG,MAAM,GAAG,GAAoB;IAC3B,IAAI,EAAE,kKAAkK;IACxK,MAAM,EAAE,gJAAgJ;IACxJ,IAAI,EAAE,+GAA+G;IACrH,EAAE,EAAE,0FAA0F;CAC/F,CAAC;AACF,MAAM,OAAO,GAAG,0GAA0G,CAAC;AAE3H,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,oDAAoD,EAAE,CAAC,KAAK,EAAE,EAAE;IACxH,yFAAyF;IACzF,kIAAkI;IAClI,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpJ,sCAAsC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnE,MAAM,IAAI,GAAe,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,0GAA0G;AAC1G,MAAM,OAAO,GAAoB;IAC/B,IAAI,EAAE,kDAAkD;IACxD,MAAM,EAAE,8CAA8C;IACtD,IAAI,EAAE,gHAAgH;IACtH,EAAE,EAAE,kCAAkC;CACvC,CAAC;AACF,MAAM,WAAW,GAAG,gIAAgI,CAAC;AAErJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,EAAE,0CAA0C,EAAE,CAAC,KAAK,EAAE,EAAE;IACtH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3E,oHAAoH;QACpH,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9H,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,SAAS,GAAoB;IACjC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,6EAA6E;CACpF,CAAC;AACF,MAAM,WAAW,GAAoB;IACnC,IAAI,EAAE,gCAAgC;IACtC,MAAM,EAAE,4IAA4I;IACpJ,IAAI,EAAE,4DAA4D;CACnE,CAAC;AACF,MAAM,UAAU,GAAoB,EAAE,IAAI,EAAE,wDAAwD,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAE5J,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,mFAAmF,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1J,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oDAAoD,EAAE,EAAE,EAAE,QAAQ,CAAC;IACzG,GAAG,KAAK,CAAC,KAAK,EAAE;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/I,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAC3J,iIAAiI,CAAC,CAAC;IACvI,GAAG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,oFAAoF,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACtK,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;CACH,CAAC,CAAC;AAEH,gHAAgH;AAChH,MAAM,KAAK,GAAoB;IAC7B,IAAI,EAAE,mNAAmN;IACzN,MAAM,EAAE,6MAA6M;IACrN,IAAI,EAAE,iHAAiH;IACvH,EAAE,EAAE,iIAAiI;CACtI,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1G,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,8GAA8G,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACnL,CAAC;AAEF,iHAAiH;AACjH,MAAM,cAAc,GAAoB;IACtC,IAAI,EAAE,kFAAkF;IACxF,MAAM,EAAE,gCAAgC;IACxC,EAAE,EAAE,oDAAoD;CACzD,CAAC;AACF,MAAM,QAAQ,GAAoB,EAAE,MAAM,EAAE,mDAAmD,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,2BAA2B,EAAE,CAAC;AAElJ,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,EAAE;IACnF,MAAM,GAAG,GAAG;QACV,GAAG,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,8EAA8E,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC3J,GAAG,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,sGAAsG,EAAE,EAAE,EAAE,QAAQ,CAAC;KAC/J,CAAC;IACF,mDAAmD;IACnD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,mFAAmF,CAAC,CAAC,CAAC;IACpK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,sHAAsH;AACtH,MAAM,QAAQ,GAAoB;IAChC,IAAI,EAAE,mDAAmD;IACzD,MAAM,EAAE,mEAAmE;IAC3E,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,8BAA8B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,sCAAsC,EAAE,CAAC,KAAK,EAAE,EAAE;IAC1G,MAAM,GAAG,GAAG,qIAAqI,CAAC;IAClJ,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,0CAA0C;IAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACrG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,wHAAwH;AACxH,MAAM,QAAQ,GACZ,wXAAwX,CAAC;AAE3X,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,oBAAoB,EAAE,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE;IACvG,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxJ,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,uBAAuB,MAAM,wCAAwC,CAAC,CAAC,CAAC;IACvJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,2HAA2H;AAC3H,MAAM,gBAAgB,GAAG,6IAA6I,CAAC;AACvK,MAAM,iBAAiB,GAAG,qJAAqJ,CAAC;AAEhL,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,wDAAwD,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9G,GAAG,KAAK,CAAC,KAAK,EAAE;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACtH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAC7E,4JAA4J,CAAC,CAAC;IAClK,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,EAAE,+DAA+D,CAAC;IACrL,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,4BAA4B,CAAC,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,EAAE,oEAAoE,CAAC;IAC7L,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,yCAAyC,EAAE,gBAAgB,EAAE,MAAM,EAAE,gFAAgF,CAAC;CAC7N,CAAC,CAAC;AAEH,4HAA4H;AAC5H,kHAAkH;AAClH,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAyB,EAAE;IACrF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,GAAG,GAAkB;QACzB,GAAG,KAAK,CAAC,KAAK,EAAE;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC7I,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,oGAAoG,CAAC,CAAC;QAChL,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,EAAE,oFAAoF,CAAC;QAC/L,GAAG,KAAK,CAAC,KAAK,EAAE;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACnL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,sGAAsG,CAAC,CAAC;KAC9K,CAAC;IACF,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG;QAClB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,oEAAoE,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE;QAC1I,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,sEAAsE,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE;QACzI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE;QACvG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,8CAA8C,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE;KACnG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,WAAW,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACxI,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,8IAA8I,EAAE,CAAC;AACtL,CAAC,CAAC,CAAC"}

package/dist/code/checks/xml.d.ts

@@ -0,0 +1,9 @@
+/** #86 XML external entity expansion. */
+export declare const xxe: import("../types.js").CodeCheck;
+/** #87 External DTD parsing. */
+export declare const externalDtd: import("../types.js").CodeCheck;
+/** #88 Extraneous or dangerous XML extensions (XInclude, XSLT). */
+export declare const xmlExtensions: import("../types.js").CodeCheck;
+/** #89 Recursive entity expansion ("billion laughs"). */
+export declare const entityExpansion: import("../types.js").CodeCheck;
+//# sourceMappingURL=xml.d.ts.map

package/dist/code/checks/xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.d.ts","sourceRoot":"","sources":["../../../src/code/checks/xml.ts"],"names":[],"mappings":"AAsCA,yCAAyC;AACzC,eAAO,MAAM,GAAG,iCAoBf,CAAC;AAEF,gCAAgC;AAChC,eAAO,MAAM,WAAW,iCAiBvB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,aAAa,iCASzB,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,eAAe,iCAkB3B,CAAC"}

package/dist/code/checks/xml.js

@@ -0,0 +1,78 @@
+import { pyFinding } from "../findings.js";
+import { callArgs, isTrue, kwarg } from "../python/index.js";
+import { patternCheck } from "./shared.js";
+const STDLIB_PARSE = /^xml\.(etree\.(c?ElementTree)\.(parse|fromstring|XML|iterparse|XMLParser)|dom\.(minidom|pulldom|expatbuilder)\.(parse|parseString)|sax\.(parse|parseString|make_parser))$/;
+const LXML_PARSE = /^lxml\.etree\.(parse|fromstring|XML|iterparse|XMLParser)$/;
+const cache = new WeakMap();
+function xmlUsage(index) {
+    let usage = cache.get(index);
+    if (!usage) {
+        const calls = index.calls();
+        usage = {
+            stdlib: calls.filter((s) => STDLIB_PARSE.test(s.name ?? "")),
+            lxml: calls.filter((s) => LXML_PARSE.test(s.name ?? "")),
+            defused: index.imports("defusedxml"),
+        };
+        cache.set(index, usage);
+    }
+    return usage;
+}
+const passDetail = (index, what) => {
+    const u = xmlUsage(index);
+    const total = u.stdlib.length + u.lxml.length;
+    return total === 0
+        ? `No XML parsing found in ${index.modules.length} Python file(s)${u.defused ? " (defusedxml is used)" : ""}.`
+        : `${total} XML parse call(s) found; none ${what}.`;
+};
+/** #86 XML external entity expansion. */
+export const xxe = patternCheck("py-xml-xxe", ["python"], (index) => {
+    const out = [];
+    for (const s of xmlUsage(index).lxml) {
+        if (s.method === "XMLParser" && isTrue(kwarg(s.node, "resolve_entities"))) {
+            out.push(pyFinding(s.module, s.node, "lxml-resolve-entities", "high", "resolve_entities=True expands external entities (XXE): file disclosure and SSRF."));
+        }
+        else if (s.method !== "XMLParser" && !kwarg(s.node, "parser") && !callArgs(s.node)[1] && s.module.isRequestDerived(s.node, s.module.scope(s.fn))) {
+            out.push(pyFinding(s.module, s.node, "lxml-default-parser-untrusted", "medium", "lxml's default parser resolves entities in older versions; parse untrusted XML with defusedxml or XMLParser(resolve_entities=False)."));
+        }
+    }
+    for (const s of index.calls()) {
+        if (s.method === "setFeature" && /feature_external_(ges|pes)/.test(s.module.line(s.node._l)) && /True|1/.test(s.module.line(s.node._l))) {
+            out.push(pyFinding(s.module, s.node, "sax-external-entities", "high", "Enabling external entities on a SAX parser allows XXE."));
+        }
+    }
+    return out;
+}, (_, index) => passDetail(index, "enables external entity resolution"));
+/** #87 External DTD parsing. */
+export const externalDtd = patternCheck("py-xml-dtd", ["python"], (index) => xmlUsage(index)
+    .lxml.filter((s) => s.method === "XMLParser")
+    .flatMap((s) => {
+    const out = [];
+    if (isTrue(kwarg(s.node, "load_dtd")) || isTrue(kwarg(s.node, "dtd_validation"))) {
+        out.push(pyFinding(s.module, s.node, "lxml-load-dtd", "high", "Loading DTDs lets documents pull external definitions."));
+    }
+    if (kwarg(s.node, "no_network")?.["value"] === false) {
+        out.push(pyFinding(s.module, s.node, "lxml-network", "high", "no_network=False lets the parser fetch external DTDs/entities over the network (SSRF)."));
+    }
+    return out;
+}), (_, index) => passDetail(index, "loads external DTDs or allows network access"));
+/** #88 Extraneous or dangerous XML extensions (XInclude, XSLT). */
+export const xmlExtensions = patternCheck("py-xml-extensions", ["python"], (index) => index
+    .calls()
+    .filter((s) => s.method === "xinclude" || /^lxml\.etree\.(XInclude|XSLT)$/.test(s.name ?? ""))
+    .map((s) => pyFinding(s.module, s.node, "lxml-xinclude-xslt", "medium", "XInclude/XSLT processing can read local files or run extension functions; disable unless required.")), (_, index) => passDetail(index, "uses XInclude/XSLT"));
+/** #89 Recursive entity expansion ("billion laughs"). */
+export const entityExpansion = patternCheck("py-xml-entity-expansion", ["python"], (index) => {
+    const u = xmlUsage(index);
+    const out = [];
+    for (const s of u.lxml) {
+        if (isTrue(kwarg(s.node, "huge_tree"))) {
+            out.push(pyFinding(s.module, s.node, "lxml-huge-tree", "medium", "huge_tree=True removes lxml's limits on entity expansion and depth."));
+        }
+    }
+    // Modern CPython bundles expat >= 2.4.1 with expansion limits, so stdlib use is only a review item.
+    for (const s of u.stdlib) {
+        out.push(pyFinding(s.module, s.node, "stdlib-xml-parser", "low", "Standard-library XML parsers are only protected against entity expansion with expat >= 2.4.1; prefer defusedxml for untrusted XML."));
+    }
+    return out;
+}, (_, index) => passDetail(index, "disables entity-expansion limits"));
+//# sourceMappingURL=xml.js.map

package/dist/code/checks/xml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.js","sourceRoot":"","sources":["../../../src/code/checks/xml.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAmC,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,YAAY,GAAG,2KAA2K,CAAC;AACjM,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAQ/E,MAAM,KAAK,GAAG,IAAI,OAAO,EAAyB,CAAC;AAEnD,SAAS,QAAQ,CAAC,KAAkB;IAClC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,GAAG;YACN,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;SACrC,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAE,IAAY,EAAE,EAAE;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9C,OAAO,KAAK,KAAK,CAAC;QAChB,CAAC,CAAC,2BAA2B,KAAK,CAAC,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC9G,CAAC,CAAC,GAAG,KAAK,kCAAkC,IAAI,GAAG,CAAC;AACxD,CAAC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,GAAG,GAAG,YAAY,CAC7B,YAAY,EACZ,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,kFAAkF,CAAC,CAAC,CAAC;QAC7J,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACnJ,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,sIAAsI,CAAC,CAAC,CAAC;QAC3N,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACxI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,wDAAwD,CAAC,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,oCAAoC,CAAC,CACtE,CAAC;AAEF,gCAAgC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CACrC,YAAY,EACZ,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,QAAQ,CAAC,KAAK,CAAC;KACZ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;KAC5C,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;IACb,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,wDAAwD,CAAC,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wFAAwF,CAAC,CAAC,CAAC;IAC1J,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EACN,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAChF,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CACvC,mBAAmB,EACnB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,KAAK,EAAE;KACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;KAC7F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oGAAoG,CAAC,CAAC,EAClL,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,oBAAoB,CAAC,CACtD,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CACzC,yBAAyB,EACzB,CAAC,QAAQ,CAAC,EACV,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,qEAAqE,CAAC,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,oGAAoG;IACpG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,oIAAoI,CAAC,CAAC,CAAC;IAC1M,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,kCAAkC,CAAC,CACpE,CAAC"}

package/dist/code/context.d.ts

@@ -0,0 +1,6 @@
+import type { CodeContext, ProjectInfo, SourceFile } from "./types.js";
+/** JavaScript/TypeScript source files worth analysing (no type declarations or minified bundles). */
+export declare const isJsSource: (p: string) => boolean;
+/** Filesystem-backed CodeContext. Files are read from disk only; nothing leaves the machine. */
+export declare function createCodeContext(root: string, files: SourceFile[], project: ProjectInfo): CodeContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/code/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/code/context.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEvE,qGAAqG;AACrG,eAAO,MAAM,UAAU,MAAO,MAAM,YAAwG,CAAC;AAE7I,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,CA6EtG"}

package/dist/code/context.js

@@ -0,0 +1,92 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { JsIndex, JsModule, parseJs } from "./javascript/index.js";
+import { parsePhp, PhpIndex, PhpModule } from "./php/index.js";
+import { parsePythonFiles, PyModule, PythonIndex } from "./python/index.js";
+import { langOfFile, parseTs, TsIndex } from "./treesitter/index.js";
+/** JavaScript/TypeScript source files worth analysing (no type declarations or minified bundles). */
+export const isJsSource = (p) => /\.(js|mjs|cjs|jsx|ts|mts|cts|tsx)$/.test(p) && !/\.d\.[cm]?ts$|\.min\.js$|[.-]bundle\.js$/.test(p);
+/** Filesystem-backed CodeContext. Files are read from disk only; nothing leaves the machine. */
+export function createCodeContext(root, files, project) {
+    const cache = new Map();
+    let python;
+    let javascript;
+    let php;
+    let treeSitter;
+    const read = (rel) => {
+        let pending = cache.get(rel);
+        if (!pending) {
+            pending = readFile(path.join(root, rel), "utf8");
+            cache.set(rel, pending);
+        }
+        return pending;
+    };
+    return {
+        name: path.basename(root),
+        project,
+        files,
+        read,
+        python() {
+            python ??= (async () => {
+                const pyFiles = files.filter((f) => f.path.endsWith(".py")).map((f) => f.path);
+                const { modules, errors } = await parsePythonFiles(root, pyFiles);
+                const parsed = await Promise.all([...modules.entries()].map(async ([rel, tree]) => new PyModule(rel, tree, await read(rel))));
+                parsed.sort((a, b) => a.path.localeCompare(b.path));
+                return new PythonIndex(parsed, errors);
+            })();
+            return python;
+        },
+        javascript() {
+            javascript ??= (async () => {
+                const modules = [];
+                const errors = [];
+                for (const f of files.filter((x) => isJsSource(x.path))) {
+                    const source = await read(f.path);
+                    const { ast, error } = parseJs(source, f.path);
+                    if (ast)
+                        modules.push(new JsModule(f.path, ast, source));
+                    else
+                        errors.push({ file: f.path, error: error ?? "parse error" });
+                }
+                return new JsIndex(modules, errors);
+            })();
+            return javascript;
+        },
+        php() {
+            php ??= (async () => {
+                const modules = [];
+                const errors = [];
+                for (const f of files.filter((x) => x.path.endsWith(".php"))) {
+                    const source = await read(f.path);
+                    const { ast, error } = parsePhp(source, f.path);
+                    if (ast)
+                        modules.push(new PhpModule(f.path, ast, source));
+                    else
+                        errors.push({ file: f.path, error: error ?? "parse error" });
+                }
+                return new PhpIndex(modules, errors);
+            })();
+            return php;
+        },
+        treeSitter() {
+            treeSitter ??= (async () => {
+                const modules = [];
+                const errors = [];
+                for (const f of files) {
+                    const lang = langOfFile(f.path);
+                    if (!lang)
+                        continue;
+                    try {
+                        modules.push(await parseTs(lang, f.path, await read(f.path)));
+                    }
+                    catch (err) {
+                        errors.push({ file: f.path, error: err.message });
+                    }
+                }
+                return new TsIndex(modules, errors);
+            })();
+            return treeSitter;
+        },
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/code/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/code/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAiB,MAAM,uBAAuB,CAAC;AAGpF,qGAAqG;AACrG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE7I,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAmB,EAAE,OAAoB;IACvF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,MAAwC,CAAC;IAC7C,IAAI,UAAwC,CAAC;IAC7C,IAAI,GAAkC,CAAC;IACvC,IAAI,UAAwC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,OAAO;QACP,KAAK;QACL,IAAI;QACJ,MAAM;YACJ,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAC5F,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpD,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,UAAU;YACR,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,OAAO,GAAe,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAsC,EAAE,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAClC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC/C,IAAI,GAAG;wBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;;wBACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,GAAG;YACD,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE;gBAClB,MAAM,OAAO,GAAgB,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAsC,EAAE,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAClC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBAChD,IAAI,GAAG;wBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;;wBACrD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,GAAG,CAAC;QACb,CAAC;QACD,UAAU;YACR,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,OAAO,GAAe,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAsC,EAAE,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAChC,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChE,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/code/detect.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectInfo, SourceFile } from "./types.js";
+export declare function detectProject(files: readonly SourceFile[], read: (p: string) => Promise<string>): Promise<ProjectInfo>;
+//# sourceMappingURL=detect.d.ts.map

package/dist/code/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/code/detect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAsGjF,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,CAiCtB"}

package/dist/code/detect.js

@@ -0,0 +1,118 @@
+import { isJsSource } from "./context.js";
+import { langOfFile } from "./treesitter/index.js";
+const has = (files, re) => files.filter((f) => re.test(f.path));
+async function manifestMentions(files, read, manifest, pkg, label) {
+    const evidence = [];
+    for (const f of has(files, manifest)) {
+        if (pkg.test(await read(f.path)))
+            evidence.push(`${f.path} lists ${label}`);
+    }
+    return evidence;
+}
+const PACKAGE_JSON = /(^|\/)package\.json$/;
+const PY_MANIFEST = /(^|\/)(requirements[^/]*\.(txt|in)|pyproject\.toml|Pipfile|setup\.py|setup\.cfg)$/;
+const DETECTORS = [
+    {
+        framework: "django",
+        language: "python",
+        async detect(files, read) {
+            const evidence = await manifestMentions(files, read, PY_MANIFEST, /\bdjango\b/i, "Django");
+            for (const f of has(files, /(^|\/)manage\.py$/)) {
+                if (/DJANGO_SETTINGS_MODULE/.test(await read(f.path)))
+                    evidence.push(`${f.path} sets DJANGO_SETTINGS_MODULE`);
+            }
+            for (const f of has(files, /(^|\/)settings(\/[^/]+)?\.py$/)) {
+                if (/^\s*INSTALLED_APPS\s*=/m.test(await read(f.path)))
+                    evidence.push(`${f.path} defines INSTALLED_APPS`);
+            }
+            return evidence;
+        },
+    },
+    {
+        framework: "flask",
+        language: "python",
+        detect: (files, read) => manifestMentions(files, read, PY_MANIFEST, /\bflask\b/i, "Flask"),
+    },
+    {
+        framework: "fastapi",
+        language: "python",
+        detect: (files, read) => manifestMentions(files, read, PY_MANIFEST, /\bfastapi\b/i, "FastAPI"),
+    },
+    ...[
+        ["express", /"express"\s*:/, "express"],
+        ["koa", /"koa"\s*:/, "koa"],
+        ["fastify", /"fastify"\s*:/, "fastify"],
+        ["next", /"next"\s*:/, "next"],
+        ["nestjs", /"@nestjs\/core"\s*:/, "@nestjs/core"],
+    ].map(([framework, pkg, label]) => ({
+        framework,
+        language: "javascript",
+        detect: (files, read) => manifestMentions(files, read, PACKAGE_JSON, pkg, label),
+    })),
+    {
+        framework: "spring",
+        language: "java",
+        detect: (files, read) => manifestMentions(files, read, /(^|\/)(pom\.xml|build\.gradle(\.kts)?)$/, /spring-boot|springframework/, "Spring"),
+    },
+    {
+        framework: "aspnet",
+        language: "csharp",
+        detect: (files, read) => manifestMentions(files, read, /\.csproj$/, /Microsoft\.NET\.Sdk\.Web|Microsoft\.AspNetCore/, "ASP.NET Core"),
+    },
+    {
+        framework: "rails",
+        language: "ruby",
+        detect: (files, read) => manifestMentions(files, read, /(^|\/)Gemfile$/, /^\s*gem\s+["']rails["']/m, "Rails"),
+    },
+    {
+        framework: "gin",
+        language: "go",
+        detect: (files, read) => manifestMentions(files, read, /(^|\/)go\.mod$/, /gin-gonic\/gin|labstack\/echo|gofiber\/fiber|go-chi\/chi|gorilla\/mux/, "a Go web framework"),
+    },
+    {
+        framework: "laravel",
+        language: "php",
+        async detect(files, read) {
+            const evidence = await manifestMentions(files, read, /(^|\/)composer\.json$/, /"laravel\/framework"\s*:/, "laravel/framework");
+            if (has(files, /^artisan$/).length)
+                evidence.push("artisan present");
+            return evidence;
+        },
+    },
+];
+export async function detectProject(files, read) {
+    const frameworks = [];
+    const evidence = [];
+    const languages = new Map();
+    for (const d of DETECTORS) {
+        const found = await d.detect(files, read);
+        if (found.length) {
+            frameworks.push(d.framework);
+            evidence.push(...found);
+            languages.set(d.language, (languages.get(d.language) ?? 0) + 100);
+        }
+    }
+    // Count source files per language; every language present is analysed.
+    const present = new Set();
+    for (const f of files) {
+        const lang = f.path.endsWith(".py")
+            ? "python"
+            : isJsSource(f.path)
+                ? "javascript"
+                : f.path.endsWith(".php")
+                    ? "php"
+                    : langOfFile(f.path);
+        if (!lang)
+            continue;
+        present.add(lang);
+        languages.set(lang, (languages.get(lang) ?? 0) + 1);
+    }
+    const ordered = [...languages.entries()].sort((a, b) => b[1] - a[1]).map(([l]) => l);
+    return {
+        language: ordered[0] ?? null,
+        languages: ordered.filter((l) => present.has(l)),
+        frameworks,
+        evidence,
+    };
+}
+//# sourceMappingURL=detect.js.map

package/dist/code/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/code/detect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAanD,MAAM,GAAG,GAAG,CAAC,KAA4B,EAAE,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/F,KAAK,UAAU,gBAAgB,CAC7B,KAA4B,EAC5B,IAAoC,EACpC,QAAgB,EAChB,GAAW,EACX,KAAa;IAEb,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,WAAW,GAAG,mFAAmF,CAAC;AAExG,MAAM,SAAS,GAAe;IAC5B;QACE,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI;YACtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAChD,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC;YAChH,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,+BAA+B,CAAC,EAAE,CAAC;gBAC5D,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;IACD;QACE,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC;KAC3F;IACD;QACE,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,CAAC;KAC/F;IACD,GACE;QACE,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC;QACvC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC;QAC3B,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC;QACvC,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC;QAC9B,CAAC,QAAQ,EAAE,qBAAqB,EAAE,cAAc,CAAC;KAEpD,CAAC,GAAG,CACH,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,EAAY,EAAE,CAAC,CAAC;QACtC,SAAS;QACT,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC;KACjF,CAAC,CACH;IACD;QACE,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,yCAAyC,EAAE,6BAA6B,EAAE,QAAQ,CAAC;KAC3I;IACD;QACE,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,gDAAgD,EAAE,cAAc,CAAC;KACtI;IACD;QACE,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,OAAO,CAAC;KAC9G;IACD;QACE,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,uEAAuE,EAAE,oBAAoB,CAAC;KACxK;IACD;QACE,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,KAAK;QACf,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI;YACtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;YAC/H,IAAI,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAA4B,EAC5B,IAAoC;IAEpC,MAAM,UAAU,GAAkB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACxB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAY,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAyB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACvB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC5B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/code/django/settings.d.ts

@@ -0,0 +1,46 @@
+import type { CodeFinding } from "../../types.js";
+import { type PyModule, type PyNode, type PythonIndex } from "../python/index.js";
+/** Marker for values that are computed at runtime (environment variables, function calls...). */
+export declare const DYNAMIC: unique symbol;
+export type Literal = string | number | boolean | null | Literal[] | {
+    [k: string]: Literal;
+};
+export type SettingsFileKind = "base" | "prod" | "dev";
+export interface SettingAssignment {
+    name: string;
+    module: PyModule;
+    node: PyNode;
+    line: number;
+    op: "=" | "+=";
+    value: Literal | typeof DYNAMIC;
+    kind: SettingsFileKind;
+}
+export interface EffectiveSetting {
+    /** DYNAMIC when computed at runtime; cannot be decided statically. */
+    value: Literal | typeof DYNAMIC;
+    /** The assignment that determined the value. */
+    at: SettingAssignment;
+    /** Only development/test settings define it. */
+    devOnly: boolean;
+}
+/** Evaluates literal Python expressions; anything else is DYNAMIC. */
+export declare function evalLiteral(node: unknown): Literal | typeof DYNAMIC;
+export declare class DjangoSettings {
+    readonly modules: PyModule[];
+    private readonly byName;
+    constructor(modules: PyModule[]);
+    get found(): boolean;
+    /** The settings file to cite for settings that are absent (Django defaults apply). */
+    get primary(): PyModule | undefined;
+    all(name: string): SettingAssignment[];
+    /** Production-relevant value: base settings overridden by production settings; dev/test files ignored unless nothing else defines it. */
+    get(name: string): EffectiveSetting | undefined;
+    /** A finding located at a setting's assignment. */
+    findingAt(s: SettingAssignment, rule: string, confidence: CodeFinding["confidence"], why: string): CodeFinding;
+    /** A finding for a setting that is not set at all (Django's default applies). */
+    findingAbsent(name: string, defaultDesc: string, rule: string, confidence: CodeFinding["confidence"], why: string): CodeFinding;
+}
+/** Settings modules: files defining Django marker settings, or named settings.py / settings/*.py. */
+export declare function djangoSettings(index: PythonIndex): DjangoSettings;
+export declare function describe(value: Literal | typeof DYNAMIC): string;
+//# sourceMappingURL=settings.d.ts.map

package/dist/code/django/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/code/django/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAU,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE1F,iGAAiG;AACjG,eAAO,MAAM,OAAO,eAAoB,CAAC;AACzC,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE9F,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,EAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAChC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,KAAK,EAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAChC,gDAAgD;IAChD,EAAE,EAAE,iBAAiB,CAAC;IACtB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,OAAO,CA6CnE;AAED,qBAAa,cAAc;IAGb,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE;IAFxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YAAqB,OAAO,EAAE,QAAQ,EAAE,EAiBvC;IAED,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,sFAAsF;IACtF,IAAI,OAAO,IAAI,QAAQ,GAAG,SAAS,CAElC;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAErC;IAED,yIAAyI;IACzI,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAc9C;IAED,mDAAmD;IACnD,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAE7G;IAED,iFAAiF;IACjF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAU9H;CACF;AAID,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAajE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,OAAO,GAAG,MAAM,CAEhE"}

package/dist/code/django/settings.js

@@ -0,0 +1,154 @@
+import { snippetOf } from "../findings.js";
+import { isNode } from "../python/index.js";
+/** Marker for values that are computed at runtime (environment variables, function calls...). */
+export const DYNAMIC = Symbol("dynamic");
+const MARKERS = new Set(["INSTALLED_APPS", "MIDDLEWARE", "MIDDLEWARE_CLASSES", "ROOT_URLCONF", "SECRET_KEY"]);
+const DEV_FILE = /(^|[\/_.-])(dev|devel|develop|development|local|test|tests|testing|ci)([\/_.-]|$)/i;
+const PROD_FILE = /(^|[\/_.-])(prod|production|live|deploy|staging)([\/_.-]|$)/i;
+/** Evaluates literal Python expressions; anything else is DYNAMIC. */
+export function evalLiteral(node) {
+    if (!isNode(node))
+        return DYNAMIC;
+    switch (node._t) {
+        case "Constant":
+            return node["_bytes"] ? DYNAMIC : node["value"];
+        case "List":
+        case "Tuple":
+        case "Set": {
+            const items = node["elts"].map(evalLiteral);
+            return items.includes(DYNAMIC) ? DYNAMIC : items;
+        }
+        case "Dict": {
+            const out = {};
+            const keys = node["keys"];
+            const values = node["values"];
+            for (let i = 0; i < keys.length; i++) {
+                const k = evalLiteral(keys[i]);
+                const v = evalLiteral(values[i]);
+                if (typeof k !== "string" || v === DYNAMIC)
+                    return DYNAMIC;
+                out[k] = v;
+            }
+            return out;
+        }
+        case "UnaryOp": {
+            const v = evalLiteral(node["operand"]);
+            const op = node["op"]._t;
+            if (op === "USub" && typeof v === "number")
+                return -v;
+            if (op === "Not" && v !== DYNAMIC)
+                return !v;
+            return DYNAMIC;
+        }
+        case "BinOp": {
+            const l = evalLiteral(node["left"]);
+            const r = evalLiteral(node["right"]);
+            const op = node["op"]._t;
+            if (typeof l === "number" && typeof r === "number") {
+                if (op === "Mult")
+                    return l * r;
+                if (op === "Add")
+                    return l + r;
+                if (op === "Sub")
+                    return l - r;
+            }
+            if (op === "Add" && Array.isArray(l) && Array.isArray(r))
+                return [...l, ...r];
+            return DYNAMIC;
+        }
+        default:
+            return DYNAMIC;
+    }
+}
+export class DjangoSettings {
+    modules;
+    byName = new Map();
+    constructor(modules) {
+        this.modules = modules;
+        for (const module of modules) {
+            const kind = DEV_FILE.test(module.path) ? "dev" : PROD_FILE.test(module.path) ? "prod" : "base";
+            for (const stmt of module.tree["body"]) {
+                let target;
+                let op = "=";
+                if (stmt._t === "Assign" && stmt["targets"].length === 1)
+                    target = stmt["targets"][0];
+                else if (stmt._t === "AnnAssign")
+                    target = stmt["target"];
+                else if (stmt._t === "AugAssign" && stmt["op"]._t === "Add")
+                    [target, op] = [stmt["target"], "+="];
+                if (target?._t !== "Name")
+                    continue;
+                const name = target["id"];
+                if (name !== name.toUpperCase())
+                    continue;
+                const list = this.byName.get(name) ?? [];
+                list.push({ name, module, node: stmt, line: stmt._l ?? 1, op, value: evalLiteral(stmt["value"]), kind });
+                this.byName.set(name, list);
+            }
+        }
+    }
+    get found() {
+        return this.modules.length > 0;
+    }
+    /** The settings file to cite for settings that are absent (Django defaults apply). */
+    get primary() {
+        return this.modules.find((m) => !DEV_FILE.test(m.path) && /settings\.py$|base\.py$/.test(m.path)) ?? this.modules[0];
+    }
+    all(name) {
+        return this.byName.get(name) ?? [];
+    }
+    /** Production-relevant value: base settings overridden by production settings; dev/test files ignored unless nothing else defines it. */
+    get(name) {
+        const all = this.all(name);
+        if (all.length === 0)
+            return undefined;
+        const relevant = all.filter((a) => a.kind !== "dev");
+        const devOnly = relevant.length === 0;
+        const ordered = devOnly ? all : [...relevant.filter((a) => a.kind === "base"), ...relevant.filter((a) => a.kind === "prod")];
+        let value = DYNAMIC;
+        let at = ordered[0];
+        for (const a of ordered) {
+            if (a.op === "=")
+                value = a.value;
+            else
+                value = Array.isArray(value) && Array.isArray(a.value) ? [...value, ...a.value] : DYNAMIC;
+            at = a;
+        }
+        return { value, at, devOnly };
+    }
+    /** A finding located at a setting's assignment. */
+    findingAt(s, rule, confidence, why) {
+        return { file: s.module.path, line: s.line, snippet: snippetOf(s.module.line(s.line)), why, confidence, method: "ast", rule };
+    }
+    /** A finding for a setting that is not set at all (Django's default applies). */
+    findingAbsent(name, defaultDesc, rule, confidence, why) {
+        return {
+            file: this.primary?.path ?? "(settings)",
+            line: 1,
+            snippet: `${name} not set (Django default: ${defaultDesc})`,
+            why,
+            confidence,
+            method: "ast",
+            rule,
+        };
+    }
+}
+const cache = new WeakMap();
+/** Settings modules: files defining Django marker settings, or named settings.py / settings/*.py. */
+export function djangoSettings(index) {
+    let settings = cache.get(index);
+    if (!settings) {
+        const modules = index.modules.filter((m) => {
+            if (/(^|\/)settings(\.py$|\/)/.test(m.path))
+                return true;
+            return m.tree["body"].some((s) => s._t === "Assign" && s["targets"].some((t) => t._t === "Name" && MARKERS.has(t["id"])));
+        });
+        settings = new DjangoSettings(modules);
+        cache.set(index, settings);
+    }
+    return settings;
+}
+export function describe(value) {
+    return value === DYNAMIC ? "computed at runtime" : JSON.stringify(value);
+}
+//# sourceMappingURL=settings.js.map

package/dist/code/django/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/code/django/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAgD,MAAM,oBAAoB,CAAC;AAE1F,iGAAiG;AACjG,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAwBzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9G,MAAM,QAAQ,GAAG,oFAAoF,CAAC;AACtG,MAAM,SAAS,GAAG,8DAA8D,CAAC;AAEjF,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAClC,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAa,CAAC;QAC/D,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAI,IAAI,CAAC,MAAM,CAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,KAAmB,CAAC;QAClE,CAAC;QACD,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAsB,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAa,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC3D,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACb,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,CAAC;YACtD,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,MAAM,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,CAAC,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnD,IAAI,EAAE,KAAK,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,EAAE,KAAK,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,EAAE,KAAK,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QACD;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,cAAc;IAGJ,OAAO;IAFX,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEjE,YAAqB,OAAmB;uBAAnB,OAAO;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAqB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAClH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAa,EAAE,CAAC;gBACnD,IAAI,MAA0B,CAAC;gBAC/B,IAAI,EAAE,GAAe,GAAG,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAK,IAAI,CAAC,SAAS,CAAc,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,GAAI,IAAI,CAAC,SAAS,CAAc,CAAC,CAAC,CAAC,CAAC;qBAC7G,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW;oBAAE,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAW,CAAC;qBAC/D,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,IAAK,IAAI,CAAC,IAAI,CAAY,CAAC,EAAE,KAAK,KAAK;oBAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAW,EAAE,IAAI,CAAC,CAAC;gBACzH,IAAI,MAAM,EAAE,EAAE,KAAK,MAAM;oBAAE,SAAS;gBACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAW,CAAC;gBACpC,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,sFAAsF;IACtF,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvH,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,yIAAyI;IACzI,GAAG,CAAC,IAAY;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;QAC7H,IAAI,KAAK,GAA6B,OAAO,CAAC;QAC9C,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;;gBAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/F,EAAE,GAAG,CAAC,CAAC;QACT,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,mDAAmD;IACnD,SAAS,CAAC,CAAoB,EAAE,IAAY,EAAE,UAAqC,EAAE,GAAW;QAC9F,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAChI,CAAC;IAED,iFAAiF;IACjF,aAAa,CAAC,IAAY,EAAE,WAAmB,EAAE,IAAY,EAAE,UAAqC,EAAE,GAAW;QAC/G,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,YAAY;YACxC,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,IAAI,6BAA6B,WAAW,GAAG;YAC3D,GAAG;YACH,UAAU;YACV,MAAM,EAAE,KAAK;YACb,IAAI;SACL,CAAC;IACJ,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEzD,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzD,OAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAK,CAAC,CAAC,SAAS,CAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAW,CAAC,CAAC,CACtH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAA+B;IACtD,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC"}