insa-check-core 0.1.0

package/dist/code/python/ast.js

@@ -0,0 +1,193 @@
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+const HELPER = String.raw `
+import ast, json, os, sys, warnings
+warnings.simplefilter("ignore")
+sys.setrecursionlimit(20000)
+def conv(n):
+    if isinstance(n, ast.AST):
+        d = {"_t": type(n).__name__}
+        if hasattr(n, "lineno"):
+            d["_l"] = n.lineno; d["_c"] = n.col_offset
+            d["_el"] = getattr(n, "end_lineno", None); d["_ec"] = getattr(n, "end_col_offset", None)
+        for f, v in ast.iter_fields(n):
+            if f in ("ctx", "type_comment"): continue
+            if isinstance(n, ast.Constant) and f == "value":
+                if isinstance(v, bytes): d["value"] = v.decode("latin-1"); d["_bytes"] = True; continue
+                if isinstance(v, (complex,)) or v is Ellipsis: d["value"] = repr(v); continue
+                if isinstance(v, int) and not isinstance(v, bool) and abs(v) > 2**53: d["value"] = float(v); continue
+            d[f] = conv(v)
+        return d
+    if isinstance(n, list): return [conv(x) for x in n]
+    if n is None or isinstance(n, (str, int, float, bool)): return n
+    return repr(n)
+req = json.load(sys.stdin)
+for rel in req["files"]:
+    try:
+        with open(os.path.join(req["root"], rel), "rb") as fh: src = fh.read()
+        out = {"file": rel, "ast": conv(ast.parse(src, filename=rel))}
+    except SyntaxError as e:
+        out = {"file": rel, "error": "%s (line %s)" % (e.msg, e.lineno)}
+    except (RecursionError, MemoryError, ValueError) as e:
+        out = {"file": rel, "error": type(e).__name__}
+    sys.stdout.write(json.dumps(out) + "\n"); sys.stdout.flush()
+`;
+export class PythonUnavailableError extends Error {
+    code = "ENOPYTHON";
+    constructor(detail) {
+        super(`python3 is required to analyse Python code but could not be run (${detail}). Install Python 3 or set INSA_CHECK_PYTHON.`);
+    }
+}
+export function pythonExecutable() {
+    return process.env["INSA_CHECK_PYTHON"] ?? "python3";
+}
+/** Parses project files (relative paths) with the local Python interpreter. */
+export function parsePythonFiles(root, files, timeoutMs = 120_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(pythonExecutable(), ["-I", "-c", HELPER], { stdio: ["pipe", "pipe", "pipe"] });
+        const modules = new Map();
+        const errors = [];
+        let stderr = "";
+        const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            reject(new PythonUnavailableError(err.code ?? err.message));
+        });
+        child.stderr.on("data", (d) => (stderr = (stderr + d.toString()).slice(-2000)));
+        createInterface({ input: child.stdout }).on("line", (line) => {
+            const msg = JSON.parse(line);
+            if (msg.ast)
+                modules.set(msg.file, msg.ast);
+            else
+                errors.push({ file: msg.file, error: msg.error ?? "unknown error" });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve({ modules, errors });
+            else
+                reject(new Error(`Python parser exited with code ${code}: ${stderr.trim().split("\n").pop() ?? ""}`));
+        });
+        child.stdin.end(JSON.stringify({ root, files }));
+    });
+}
+// --- Tree helpers ------------------------------------------------------------
+export function isNode(x) {
+    return typeof x === "object" && x !== null && typeof x._t === "string";
+}
+export function childNodes(node) {
+    const out = [];
+    for (const [k, v] of Object.entries(node)) {
+        if (k.startsWith("_"))
+            continue;
+        if (isNode(v))
+            out.push(v);
+        else if (Array.isArray(v))
+            for (const x of v)
+                if (isNode(x))
+                    out.push(x);
+    }
+    return out;
+}
+/** Depth-first, source order. `skip` prunes a subtree (e.g. nested functions). */
+export function* walk(root, skip) {
+    const stack = [root];
+    while (stack.length) {
+        const node = stack.pop();
+        yield node;
+        const kids = childNodes(node);
+        for (let i = kids.length - 1; i >= 0; i--)
+            if (!skip?.(kids[i]))
+                stack.push(kids[i]);
+    }
+}
+const FUNCTION_TYPES = new Set(["FunctionDef", "AsyncFunctionDef", "Lambda"]);
+export const isFunction = (n) => FUNCTION_TYPES.has(n._t);
+/** "a.b.c" for Name/Attribute chains; calls and subscripts in the chain become "()" and "[]". */
+export function dotted(node) {
+    if (!isNode(node))
+        return undefined;
+    switch (node._t) {
+        case "Name":
+            return node["id"];
+        case "Attribute": {
+            const base = dotted(node["value"]);
+            return base === undefined ? undefined : `${base}.${node["attr"]}`;
+        }
+        case "Call": {
+            const base = dotted(node["func"]);
+            return base === undefined ? undefined : `${base}()`;
+        }
+        case "Subscript": {
+            const base = dotted(node["value"]);
+            return base === undefined ? undefined : `${base}[]`;
+        }
+        default:
+            return undefined;
+    }
+}
+export function strConst(node) {
+    return isNode(node) && node._t === "Constant" && typeof node["value"] === "string" && !node["_bytes"]
+        ? node["value"]
+        : undefined;
+}
+export function isConstant(node) {
+    return isNode(node) && node._t === "Constant";
+}
+export function callArgs(call) {
+    return call["args"] ?? [];
+}
+export function kwarg(call, name) {
+    const kw = (call["keywords"] ?? []).find((k) => k["arg"] === name);
+    return kw?.["value"];
+}
+/** `**something` arguments of a call. */
+export function starKwargs(call) {
+    return (call["keywords"] ?? []).filter((k) => k["arg"] === null).map((k) => k["value"]);
+}
+export function isTrue(node) {
+    return isNode(node) && node._t === "Constant" && node["value"] === true;
+}
+/** f-string with placeholders, "%" formatting, "+" concatenation with a string, or "...".format(...). */
+export function isDynamicString(node) {
+    if (!isNode(node))
+        return false;
+    if (node._t === "JoinedStr")
+        return (node["values"] ?? []).some((v) => v._t === "FormattedValue");
+    if (node._t === "BinOp") {
+        const op = node["op"]._t;
+        const left = node["left"];
+        const right = node["right"];
+        if (op === "Mod")
+            return strConst(left) !== undefined || isDynamicString(left);
+        if (op === "Add") {
+            const stringy = (n) => strConst(n) !== undefined || isDynamicString(n);
+            return (stringy(left) || stringy(right)) && !(strConst(left) !== undefined && strConst(right) !== undefined);
+        }
+        return false;
+    }
+    if (node._t === "Call") {
+        const func = node["func"];
+        return isNode(func) && func._t === "Attribute" && func["attr"] === "format" && strConst(func["value"]) !== undefined;
+    }
+    return false;
+}
+/** Identifiers used in an expression (Name ids, attribute names, constant subscript keys). */
+export function identifiers(node) {
+    const out = [];
+    for (const n of walk(node)) {
+        if (n._t === "Name")
+            out.push(n["id"]);
+        else if (n._t === "Attribute")
+            out.push(n["attr"]);
+        else if (n._t === "Subscript") {
+            const key = strConst(n["slice"]);
+            if (key)
+                out.push(key);
+        }
+        else if (n._t === "keyword" && typeof n["arg"] === "string")
+            out.push(n["arg"]);
+    }
+    return out;
+}
+//# sourceMappingURL=ast.js.map

package/dist/code/python/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../../src/code/python/ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAkBhD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BxB,CAAC;AAEF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,GAAG,WAAW,CAAC;IAC5B,YAAY,MAAc;QACxB,KAAK,CAAC,oEAAoE,MAAM,+CAA+C,CAAC,CAAC;IACnI,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;AACvD,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAe,EAAE,SAAS,GAAG,OAAO;IACjF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,MAAM,MAAM,GAAsC,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,sBAAsB,CAAE,GAA6B,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmD,CAAC;YAC/E,IAAI,GAAG,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;;gBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;;gBACxC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,MAAM,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAY,CAAC,EAAE,KAAK,QAAQ,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,MAAM,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAY,EAAE,IAA6B;IAC/D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1B,MAAM,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAElE,iGAAiG;AACjG,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,CAAW,CAAC;QAC9B,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAW,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;QACtD,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;QACtD,CAAC;QACD;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnG,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAQ,IAAI,CAAC,MAAM,CAAc,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,IAAY;IAC9C,MAAM,EAAE,GAAG,CAAE,IAAI,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjF,OAAO,EAAE,EAAE,CAAC,OAAO,CAAuB,CAAC;AAC7C,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,CAAE,IAAI,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC1E,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,CAAE,IAAI,CAAC,QAAQ,CAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC;IAChH,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,EAAE,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;IACvH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAW,CAAC,CAAC;aAC5C,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC;aACxD,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/code/python/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./ast.js";
+export * from "./module.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/code/python/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/code/python/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/code/python/index.js

@@ -0,0 +1,3 @@
+export * from "./ast.js";
+export * from "./module.js";
+//# sourceMappingURL=index.js.map

package/dist/code/python/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/code/python/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/code/python/module.d.ts

@@ -0,0 +1,55 @@
+import { type PyNode } from "./ast.js";
+export interface FunctionScope {
+    /** Names holding client-controlled data (request data, URL parameters of views, and values derived from them). */
+    tainted: Set<string>;
+    /** Names assigned a dynamically built string (f-string, %, +, .format). */
+    dynamicStrings: Set<string>;
+    /** Qualified names of every call made in the function. */
+    calls: Set<string>;
+}
+export interface CallSite {
+    module: PyModule;
+    node: PyNode;
+    /** Qualified dotted name with imports resolved, e.g. "subprocess.run", "hashlib.md5", "cursor.execute". */
+    name: string | undefined;
+    /** Last segment: method or function name ("execute", "md5"). */
+    method: string | undefined;
+    /** Innermost enclosing function, if any. */
+    fn: PyNode | undefined;
+}
+export declare class PyModule {
+    readonly path: string;
+    readonly tree: PyNode;
+    readonly lines: string[];
+    /** Local alias -> fully qualified module/name, from every import statement in the file. */
+    readonly imports: Map<string, string>;
+    private readonly scopes;
+    constructor(path: string, tree: PyNode, source: string);
+    /** Resolves the first segment of a dotted name through this file's imports. */
+    qualify(name: string | undefined): string | undefined;
+    line(n: number | undefined): string;
+    /** Exact source text of a node (columns are UTF-8 byte offsets). */
+    text(node: PyNode): string;
+    /** True when the expression contains client-controlled data, given the scope's tainted names. */
+    isRequestDerived(node: unknown, scope?: FunctionScope): boolean;
+    /** Lightweight intra-procedural taint: request data, view URL params, and names assigned from them. */
+    scope(fn: PyNode | undefined): FunctionScope | undefined;
+}
+export declare class PythonIndex {
+    readonly modules: PyModule[];
+    readonly parseErrors: {
+        file: string;
+        error: string;
+    }[];
+    readonly byPath: Map<string, PyModule>;
+    private callSites?;
+    constructor(modules: PyModule[], parseErrors: {
+        file: string;
+        error: string;
+    }[]);
+    /** Every call in the project with its resolved name and enclosing function. Computed once. */
+    calls(): CallSite[];
+    /** Whether any module imports something under the given dotted prefix (e.g. "defusedxml"). */
+    imports(prefix: string): boolean;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/code/python/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/code/python/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqD,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AA6B1F,MAAM,WAAW,aAAa;IAC5B,kHAAkH;IAClH,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,2EAA2E;IAC3E,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,2GAA2G;IAC3G,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4CAA4C;IAC5C,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;CACxB;AAED,qBAAa,QAAQ;IAOjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAPvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,sBAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YACW,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAmBf;IAED,+EAA+E;IAC/E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKpD;IAED,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAElC;IAED,oEAAoE;IACpE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzB;IAED,iGAAiG;IACjG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,aAAa,GAAG,OAAO,CAO9D;IAED,uGAAuG;IACvG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAkDvD;CACF;AAED,qBAAa,WAAW;IAKpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE;IAC5B,QAAQ,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE;IALzD,QAAQ,CAAC,MAAM,wBAA+B;IAC9C,OAAO,CAAC,SAAS,CAAC,CAAa;IAE/B,YACW,OAAO,EAAE,QAAQ,EAAE,EACnB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EAGxD;IAED,8FAA8F;IAC9F,KAAK,IAAI,QAAQ,EAAE,CA2BlB;IAED,8FAA8F;IAC9F,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/code/python/module.js

@@ -0,0 +1,215 @@
+import { dotted, isDynamicString, isFunction, isNode, walk } from "./ast.js";
+/** Attributes of a Django/DRF request that carry client-controlled data. */
+/** Client-controlled request attributes: Django/DRF (GET, POST, FILES...) and Flask/Starlette (args, form, json...). */
+const REQUEST_DATA = /^(self\.)?request\.(GET|POST|FILES|data|query_params|body|COOKIES|META|headers|content_params|path_info|path|args|form|values|json|files|cookies|get_json|get_data|view_args|stream|path_params)$/;
+/** Flask / FastAPI route decorators: @app.route(...), @bp.get(...), @router.post(...). */
+const ROUTE_DECORATOR = /\.(route|get|post|put|patch|delete|websocket)$/;
+/**
+ * Nodes whose value can flow into the expression's result. Skips parts that only produce booleans or
+ * pick between branches: comparisons, `not`, and the test of a conditional expression.
+ */
+function* valueNodes(root) {
+    const stack = [root];
+    while (stack.length) {
+        const n = stack.pop();
+        if (n._t === "Compare")
+            continue;
+        if (n._t === "UnaryOp" && n["op"]._t === "Not")
+            continue;
+        yield n;
+        for (const [k, v] of Object.entries(n)) {
+            if (k.startsWith("_") || (n._t === "IfExp" && k === "test"))
+                continue;
+            if (isNode(v))
+                stack.push(v);
+            else if (Array.isArray(v))
+                for (const x of v)
+                    if (isNode(x))
+                        stack.push(x);
+        }
+    }
+}
+export class PyModule {
+    path;
+    tree;
+    lines;
+    /** Local alias -> fully qualified module/name, from every import statement in the file. */
+    imports = new Map();
+    scopes = new WeakMap();
+    constructor(path, tree, source) {
+        this.path = path;
+        this.tree = tree;
+        this.lines = source.split(/\r?\n/);
+        for (const n of walk(tree)) {
+            if (n._t === "Import") {
+                for (const a of n["names"]) {
+                    const name = a["name"];
+                    const asname = a["asname"];
+                    if (asname)
+                        this.imports.set(asname, name);
+                    else
+                        this.imports.set(name.split(".")[0], name.split(".")[0]);
+                }
+            }
+            else if (n._t === "ImportFrom") {
+                const mod = `${".".repeat(n["level"] ?? 0)}${n["module"] ?? ""}`;
+                for (const a of n["names"]) {
+                    const name = a["name"];
+                    this.imports.set(a["asname"] ?? name, mod ? `${mod}.${name}` : name);
+                }
+            }
+        }
+    }
+    /** Resolves the first segment of a dotted name through this file's imports. */
+    qualify(name) {
+        if (!name)
+            return undefined;
+        const [head, ...rest] = name.split(".");
+        const resolved = this.imports.get(head);
+        return resolved ? [resolved, ...rest].join(".") : name;
+    }
+    line(n) {
+        return n ? (this.lines[n - 1] ?? "") : "";
+    }
+    /** Exact source text of a node (columns are UTF-8 byte offsets). */
+    text(node) {
+        const { _l: l, _c: c, _el: el, _ec: ec } = node;
+        if (!l || c === undefined || !el || ec === undefined)
+            return "";
+        if (l === el)
+            return Buffer.from(this.line(l)).subarray(c, ec).toString();
+        const parts = [Buffer.from(this.line(l)).subarray(c).toString()];
+        for (let i = l + 1; i < el; i++)
+            parts.push(this.line(i));
+        parts.push(Buffer.from(this.line(el)).subarray(0, ec).toString());
+        return parts.join("\n");
+    }
+    /** True when the expression contains client-controlled data, given the scope's tainted names. */
+    isRequestDerived(node, scope) {
+        if (!isNode(node))
+            return false;
+        for (const n of valueNodes(node)) {
+            if (n._t === "Name" && scope?.tainted.has(n["id"]))
+                return true;
+            if (n._t === "Attribute" && REQUEST_DATA.test(dotted(n) ?? ""))
+                return true;
+        }
+        return false;
+    }
+    /** Lightweight intra-procedural taint: request data, view URL params, and names assigned from them. */
+    scope(fn) {
+        if (!fn)
+            return undefined;
+        let scope = this.scopes.get(fn);
+        if (scope)
+            return scope;
+        scope = { tainted: new Set(), dynamicStrings: new Set(), calls: new Set() };
+        this.scopes.set(fn, scope);
+        // URL parameters of Django views (def view(request, slug) / def get(self, request, pk)) are client-controlled.
+        const args = (fn["args"]?.["args"] ?? []).map((a) => a["arg"]);
+        const reqIndex = args.indexOf("request");
+        const isRoute = (fn["decorator_list"] ?? []).some((d) => ROUTE_DECORATOR.test(dotted(d._t === "Call" ? d["func"] : d) ?? ""));
+        if (isRoute) {
+            // Flask / FastAPI route handlers: parameters come from the URL, query string or body.
+            // Parameters whose default is Depends(...) are injected dependencies, not client input.
+            const argNodes = fn["args"]?.["args"] ?? [];
+            const defaults = fn["args"]?.["defaults"] ?? [];
+            const firstDefault = argNodes.length - defaults.length;
+            argNodes.forEach((a, i) => {
+                const def = i >= firstDefault ? defaults[i - firstDefault] : undefined;
+                const injected = def?._t === "Call" && /(^|\.)Depends$/.test(dotted(def["func"]) ?? "");
+                const name = a["arg"];
+                if (!injected && !["self", "cls", "request", "response", "db", "session", "background_tasks"].includes(name))
+                    scope.tainted.add(name);
+            });
+        }
+        if (reqIndex === 0 || (reqIndex === 1 && (args[0] === "self" || args[0] === "cls"))) {
+            for (const a of args.slice(reqIndex + 1))
+                scope.tainted.add(a);
+            const kw = fn["args"]?.["kwarg"];
+            if (kw)
+                scope.tainted.add(kw["arg"]);
+        }
+        const body = fn["body"] ?? [];
+        const roots = Array.isArray(body) ? body : [body];
+        const nodes = roots.flatMap((r) => [...walk(r, isFunction)]);
+        // Two passes so that assignments inside loops propagate.
+        for (let pass = 0; pass < 2; pass++) {
+            for (const n of nodes) {
+                let targets = [];
+                let value;
+                if (n._t === "Assign")
+                    [targets, value] = [n["targets"], n["value"]];
+                else if (n._t === "AnnAssign" || n._t === "AugAssign" || n._t === "NamedExpr")
+                    [targets, value] = [[n["target"]], n["value"]];
+                else if (n._t === "For" || n._t === "AsyncFor" || n._t === "comprehension")
+                    [targets, value] = [[n["target"]], n["iter"]];
+                else if (n._t === "withitem" && n["optional_vars"])
+                    [targets, value] = [[n["optional_vars"]], n["context_expr"]];
+                else
+                    continue;
+                const names = targets.flatMap((t) => [...walk(t)].filter((x) => x._t === "Name").map((x) => x["id"]));
+                if (this.isRequestDerived(value, scope))
+                    names.forEach((x) => scope.tainted.add(x));
+                if (isDynamicString(value))
+                    names.forEach((x) => scope.dynamicStrings.add(x));
+            }
+        }
+        for (const n of nodes)
+            if (n._t === "Call")
+                scope.calls.add(this.qualify(dotted(n["func"])) ?? "");
+        return scope;
+    }
+}
+export class PythonIndex {
+    modules;
+    parseErrors;
+    byPath = new Map();
+    callSites;
+    constructor(modules, parseErrors) {
+        this.modules = modules;
+        this.parseErrors = parseErrors;
+        for (const m of modules)
+            this.byPath.set(m.path, m);
+    }
+    /** Every call in the project with its resolved name and enclosing function. Computed once. */
+    calls() {
+        if (this.callSites)
+            return this.callSites;
+        const sites = [];
+        for (const module of this.modules) {
+            const visit = (node, fn) => {
+                const stack = [[node, fn]];
+                while (stack.length) {
+                    const [n, f] = stack.pop();
+                    if (n._t === "Call") {
+                        const name = module.qualify(dotted(n["func"]));
+                        const func = n["func"];
+                        const method = func._t === "Attribute" ? func["attr"] : func._t === "Name" ? func["id"] : undefined;
+                        sites.push({ module, node: n, name, method, fn: f });
+                    }
+                    const inner = isFunction(n) ? n : f;
+                    for (const [k, v] of Object.entries(n)) {
+                        if (k.startsWith("_"))
+                            continue;
+                        if (isNode(v))
+                            stack.push([v, inner]);
+                        else if (Array.isArray(v))
+                            for (const x of v)
+                                if (isNode(x))
+                                    stack.push([x, inner]);
+                    }
+                }
+            };
+            visit(module.tree, undefined);
+        }
+        sites.sort((a, b) => a.module.path.localeCompare(b.module.path) || (a.node._l ?? 0) - (b.node._l ?? 0));
+        this.callSites = sites;
+        return sites;
+    }
+    /** Whether any module imports something under the given dotted prefix (e.g. "defusedxml"). */
+    imports(prefix) {
+        return this.modules.some((m) => [...m.imports.values()].some((v) => v === prefix || v.startsWith(`${prefix}.`)));
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/code/python/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/code/python/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AAE1F,4EAA4E;AAC5E,wHAAwH;AACxH,MAAM,YAAY,GAChB,mMAAmM,CAAC;AAEtM,0FAA0F;AAC1F,MAAM,eAAe,GAAG,gDAAgD,CAAC;AAEzE;;;GAGG;AACH,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAK,CAAC,CAAC,IAAI,CAAY,CAAC,EAAE,KAAK,KAAK;YAAE,SAAS;QACrE,MAAM,CAAC,CAAC;QACR,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,CAAC;gBAAE,SAAS;YACtE,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBACxB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,IAAI,MAAM,CAAC,CAAC,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAsBD,MAAM,OAAO,QAAQ;IAOR,IAAI;IACJ,IAAI;IAPN,KAAK,CAAW;IACzB,2FAA2F;IAClF,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5B,MAAM,GAAG,IAAI,OAAO,EAAyB,CAAC;IAE/D,YACW,IAAY,EACZ,IAAY,EACrB,MAAc;oBAFL,IAAI;oBACJ,IAAI;QAGb,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAa,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAW,CAAC;oBACjC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAkB,CAAC;oBAC5C,IAAI,MAAM;wBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;;wBACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,OAAO,CAAY,IAAI,CAAC,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAmB,IAAI,EAAE,EAAE,CAAC;gBAChG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAa,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAW,CAAC;oBACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,CAAC,QAAQ,CAAmB,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,IAAwB;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,CAAqB;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,IAAY;QACf,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QAChD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iGAAiG;IACjG,gBAAgB,CAAC,IAAa,EAAE,KAAqB;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,EAAsB;QAC1B,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE3B,+GAA+G;QAC/G,MAAM,IAAI,GAAG,CAAG,EAAE,CAAC,MAAM,CAAY,EAAE,CAAC,MAAM,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAW,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAE,EAAE,CAAC,gBAAgB,CAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5I,IAAI,OAAO,EAAE,CAAC;YACZ,sFAAsF;YACtF,wFAAwF;YACxF,MAAM,QAAQ,GAAK,EAAE,CAAC,MAAM,CAAY,EAAE,CAAC,MAAM,CAAc,IAAI,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAK,EAAE,CAAC,MAAM,CAAY,EAAE,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACxB,MAAM,GAAG,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvE,MAAM,QAAQ,GAAG,GAAG,EAAE,EAAE,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAW,CAAC;gBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzI,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACpF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE,GAAI,EAAE,CAAC,MAAM,CAAY,EAAE,CAAC,OAAO,CAAkB,CAAC;YAC9D,IAAI,EAAE;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAW,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAuB,IAAI,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7D,yDAAyD;QACzD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,OAAO,GAAa,EAAE,CAAC;gBAC3B,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;oBAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;qBAC5E,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;oBAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;qBACnI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,eAAe;oBAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;qBAC/H,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,eAAe,CAAC;oBAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAW,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;;oBACtH,SAAS;gBACd,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAW,CAAC,CAAC,CAAC;gBAChH,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrF,IAAI,eAAe,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAKX,OAAO;IACP,WAAW;IALb,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,SAAS,CAAc;IAE/B,YACW,OAAmB,EACnB,WAA8C;uBAD9C,OAAO;2BACP,WAAW;QAEpB,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,8FAA8F;IAC9F,KAAK;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAsB,EAAE,EAAE;gBACrD,MAAM,KAAK,GAAmC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;oBAC5B,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;wBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAW,CAAC;wBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC5H,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;oBACvD,CAAC;oBACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACpC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;4BAAE,SAAS;wBAChC,IAAI,MAAM,CAAC,CAAC,CAAC;4BAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;6BACjC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;4BAAE,KAAK,MAAM,CAAC,IAAI,CAAC;gCAAE,IAAI,MAAM,CAAC,CAAC,CAAC;oCAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8FAA8F;IAC9F,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;CACF"}

package/dist/code/scan.d.ts

@@ -0,0 +1,24 @@
+import type { AnnexItem, CheckResult, Report } from "../types.js";
+import type { CodeCheck, FrameworkId } from "./types.js";
+export interface CodeScanOptions {
+    /** Force a framework instead of auto-detecting it. */
+    framework?: FrameworkId;
+    /** Per-check time budget. Default 60 s. */
+    checkTimeoutMs?: number;
+    /** Default 20 000. */
+    maxFiles?: number;
+    /** Files larger than this are skipped. Default 1 MB. */
+    maxFileBytes?: number;
+    registry?: readonly AnnexItem[];
+    checks?: ReadonlyMap<string, CodeCheck>;
+    onResult?: (result: CheckResult) => void;
+}
+export declare class CodeScanError extends Error {
+    name: string;
+}
+/**
+ * Tier 2: statically analyse a local project directory. Source code is read from disk
+ * and parsed locally; nothing is sent anywhere. Returns the same 102-row Report as runScan().
+ */
+export declare function runCodeScan(dir: string, options?: CodeScanOptions): Promise<Report>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/code/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/code/scan.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAgB,WAAW,EAAE,MAAM,EAAU,MAAM,aAAa,CAAC;AAMxF,OAAO,KAAK,EAAE,SAAS,EAAe,WAAW,EAAY,MAAM,YAAY,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;CAC1C;AAED,qBAAa,aAAc,SAAQ,KAAK;IAC7B,IAAI,SAAmB;CACjC;AA8BD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0G7F"}