sourceverity 1.0.0

package/dist/analysis/frameworks.js

@@ -0,0 +1,189 @@
+import { unwrapExpression, resolveConstantValue } from "./values.js";
+/**
+ * Checks if a property access or call argument contains `{ throwOnError: true }`.
+ */
+function hasThrowOnErrorOption(args, ts, checker) {
+    for (const arg of args) {
+        const unwrapped = unwrapExpression(arg, ts);
+        if (ts.isObjectLiteralExpression(unwrapped)) {
+            for (const prop of unwrapped.properties) {
+                if (ts.isPropertyAssignment(prop)) {
+                    const propName = prop.name.getText();
+                    if (propName === "throwOnError") {
+                        const val = resolveConstantValue(prop.initializer, ts, checker);
+                        if (val.isStatic && val.kind === "boolean" && val.value === true) {
+                            return true;
+                        }
+                        if (prop.initializer.kind === ts.SyntaxKind.TrueKeyword) {
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Checks if an argument expression represents a callable function or callback.
+ */
+function isCallableArgument(arg, ts, checker) {
+    const unwrapped = unwrapExpression(arg, ts);
+    if (ts.isArrowFunction(unwrapped) || ts.isFunctionExpression(unwrapped)) {
+        return true;
+    }
+    if (checker) {
+        try {
+            const type = checker.getTypeAtLocation(unwrapped);
+            if (type.getCallSignatures().length > 0) {
+                return true;
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    return false;
+}
+/**
+ * Evaluates whether a CallExpression represents a verified, handled framework API call.
+ */
+export function evaluateFrameworkPromiseCall(callExpr, ts, checker) {
+    if (!checker)
+        return { isHandled: false };
+    const callee = unwrapExpression(callExpr.expression, ts);
+    let targetIdentifier;
+    let methodName = "";
+    if (ts.isPropertyAccessExpression(callee)) {
+        targetIdentifier = callee.name;
+        methodName = callee.name.text;
+    }
+    else if (ts.isIdentifier(callee)) {
+        targetIdentifier = callee;
+        methodName = callee.text;
+    }
+    if (!targetIdentifier)
+        return { isHandled: false };
+    const symbol = checker.getSymbolAtLocation(targetIdentifier);
+    if (!symbol)
+        return { isHandled: false };
+    let targetSymbol = symbol;
+    if (targetSymbol.flags & ts.SymbolFlags.Alias) {
+        try {
+            targetSymbol = checker.getAliasedSymbol(targetSymbol);
+        }
+        catch {
+            // ignore
+        }
+    }
+    const declarations = [...(targetSymbol?.getDeclarations() ?? [])];
+    // Also collect declarations from the type of the callee/target (e.g. NavigateFunction)
+    try {
+        const typeAtLoc = checker.getTypeAtLocation(targetIdentifier);
+        const typeSymbol = typeAtLoc.getSymbol() ?? typeAtLoc.aliasSymbol;
+        if (typeSymbol) {
+            let resolvedTypeSymbol = typeSymbol;
+            if (resolvedTypeSymbol.flags & ts.SymbolFlags.Alias) {
+                try {
+                    resolvedTypeSymbol = checker.getAliasedSymbol(resolvedTypeSymbol);
+                }
+                catch {
+                    // ignore
+                }
+            }
+            if (resolvedTypeSymbol?.name === "NavigateFunction") {
+                return {
+                    isHandled: true,
+                    reason: "React Router NavigateFunction optional navigation contract.",
+                };
+            }
+            const typeDecls = resolvedTypeSymbol?.getDeclarations();
+            if (typeDecls) {
+                declarations.push(...typeDecls);
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    if (declarations.length === 0)
+        return { isHandled: false };
+    for (const decl of declarations) {
+        const fileName = decl.getSourceFile().fileName.replace(/\\/g, "/");
+        // 1. TanStack Query / React Query: invalidateQueries, resetQueries, cancelQueries, removeQueries, refetchQueries
+        if (fileName.includes("@tanstack/query-core") ||
+            fileName.includes("@tanstack/react-query") ||
+            fileName.includes("react-query/")) {
+            if (methodName === "invalidateQueries" ||
+                methodName === "resetQueries" ||
+                methodName === "cancelQueries" ||
+                methodName === "removeQueries" ||
+                methodName === "refetchQueries" ||
+                methodName === "setQueryData") {
+                // If throwOnError: true is explicitly specified, the returned Promise will reject on query failure!
+                if (hasThrowOnErrorOption(callExpr.arguments, ts, checker)) {
+                    return {
+                        isHandled: false,
+                        reason: "QueryClient method configured with throwOnError: true may reject unhandled.",
+                    };
+                }
+                return {
+                    isHandled: true,
+                    reason: "TanStack Query default query management handles failures internally without unhandled rejection.",
+                };
+            }
+        }
+        // 2. i18next: i18n.init(...)
+        const isI18next = fileName.includes("i18next/") ||
+            fileName.includes("i18next") ||
+            (decl.parent &&
+                (ts.isInterfaceDeclaration(decl.parent) || ts.isTypeAliasDeclaration(decl.parent)) &&
+                /^(i18n|i18next|I18n|I18nInstance)$/i.test(decl.parent.name.text));
+        if (isI18next) {
+            if (methodName === "init") {
+                // i18next init has two callback signatures:
+                // 1. i18n.init(callback) -> 1 argument where arg[0] is callable
+                // 2. i18n.init(options, callback) -> 2 arguments where arg[1] is callable
+                const args = callExpr.arguments;
+                const hasCallback = (args.length === 1 && args[0] !== undefined && isCallableArgument(args[0], ts, checker)) ||
+                    (args.length >= 2 && args[1] !== undefined && isCallableArgument(args[1], ts, checker));
+                if (hasCallback) {
+                    return {
+                        isHandled: true,
+                        reason: "i18next init called with error/completion callback handler.",
+                    };
+                }
+                // Bare i18n.init(options) returns a Promise that can reject on init failure; must not be blanket-suppressed
+                return {
+                    isHandled: false,
+                    isKnownRejecting: true,
+                    reason: "i18next 'init' returns a Promise that rejects on initialization failure, which will escape unhandled if not caught.",
+                };
+            }
+        }
+        // 3. React Hook Form: UseFormRegisterReturn.onChange / onBlur or ChangeHandler
+        if (fileName.includes("react-hook-form/")) {
+            if (methodName === "onChange" ||
+                methodName === "onBlur" ||
+                targetSymbol.name === "ChangeHandler") {
+                return {
+                    isHandled: true,
+                    reason: "React Hook Form synthetic change handler handles internal async validation safely.",
+                };
+            }
+        }
+        // 4. React Router / Remix: NavigateFunction
+        if (fileName.includes("react-router/") ||
+            fileName.includes("react-router-dom/") ||
+            fileName.includes("@remix-run/router/")) {
+            if (methodName === "navigate" || targetSymbol.name === "NavigateFunction") {
+                return {
+                    isHandled: true,
+                    reason: "React Router NavigateFunction optional navigation contract.",
+                };
+            }
+        }
+    }
+    return { isHandled: false };
+}
+//# sourceMappingURL=frameworks.js.map

package/dist/analysis/frameworks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frameworks.js","sourceRoot":"","sources":["../../src/analysis/frameworks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAQrE;;GAEG;AACH,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,EAAiB,EACjB,OAA2B;IAE3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBACxC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;wBAChC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;wBAChE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;4BACjE,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;4BACxD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,GAAsB,EACtB,EAAiB,EACjB,OAAwC;IAExC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA+B,EAC/B,EAAiB,EACjB,OAAwC;IAExC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,gBAAyC,CAAC;IAC9C,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/B,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,CAAC;SAAM,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,gBAAgB,GAAG,MAAM,CAAC;QAC1B,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEzC,IAAI,YAAY,GAA8B,MAAM,CAAC;IACrD,IAAI,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAElE,uFAAuF;IACvF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,SAAS,CAAC,WAAW,CAAC;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,kBAAkB,GAA8B,UAAU,CAAC;YAC/D,IAAI,kBAAkB,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACpD,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,6DAA6D;iBACtE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,kBAAkB,EAAE,eAAe,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAE3D,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEnE,iHAAiH;QACjH,IACE,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACzC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC1C,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;YACD,IACE,UAAU,KAAK,mBAAmB;gBAClC,UAAU,KAAK,cAAc;gBAC7B,UAAU,KAAK,eAAe;gBAC9B,UAAU,KAAK,eAAe;gBAC9B,UAAU,KAAK,gBAAgB;gBAC/B,UAAU,KAAK,cAAc,EAC7B,CAAC;gBACD,oGAAoG;gBACpG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC3D,OAAO;wBACL,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,6EAA6E;qBACtF,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,kGAAkG;iBAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GACb,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC5B,CAAC,IAAI,CAAC,MAAM;gBACV,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClF,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,4CAA4C;gBAC5C,gEAAgE;gBAChE,0EAA0E;gBAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAChC,MAAM,WAAW,GACf,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;oBACxF,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;gBAE1F,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO;wBACL,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,6DAA6D;qBACtE,CAAC;gBACJ,CAAC;gBACD,4GAA4G;gBAC5G,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,qHAAqH;iBAC9H,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1C,IACE,UAAU,KAAK,UAAU;gBACzB,UAAU,KAAK,QAAQ;gBACvB,YAAY,CAAC,IAAI,KAAK,eAAe,EACrC,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,oFAAoF;iBAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IACE,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAClC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACtC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACvC,CAAC;YACD,IAAI,UAAU,KAAK,UAAU,IAAI,YAAY,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC1E,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,6DAA6D;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/analysis/functions.d.ts

@@ -0,0 +1,27 @@
+import type * as tsType from "typescript";
+export type PromiseBehavior = "handles-known-rejections" | "propagates" | "may-reject" | "unknown";
+export interface FunctionSummary {
+    readonly symbol?: tsType.Symbol | undefined;
+    readonly isAsync: boolean;
+    readonly returnsPromiseLike: boolean;
+    readonly returnsOptionalPromiseUnion: boolean;
+    readonly promiseBehavior: PromiseBehavior;
+    readonly returnsCreatedPromise: boolean;
+}
+/**
+ * Context for managing function summary analysis, caching, and recursion cycle detection.
+ */
+export declare class FunctionSummaryContext {
+    readonly ts: typeof tsType;
+    readonly checker?: tsType.TypeChecker | undefined;
+    private readonly cache;
+    private readonly inProgress;
+    constructor(ts: typeof tsType, checker?: tsType.TypeChecker | undefined);
+    getSummary(funcNode: tsType.Node): FunctionSummary;
+}
+/**
+ * Public helper to obtain a function summary (creates or reuses a context).
+ */
+export declare function getFunctionSummary(funcNode: tsType.Node, ts: typeof tsType, checker?: tsType.TypeChecker | undefined, context?: FunctionSummaryContext | undefined): FunctionSummary;
+export declare function resolveLocalOrProjectFunctionDeclaration(callExpr: tsType.CallExpression, ts: typeof tsType, checker?: tsType.TypeChecker | undefined): tsType.Node | undefined;
+//# sourceMappingURL=functions.d.ts.map

package/dist/analysis/functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/analysis/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,MAAM,YAAY,CAAC;AAI1C,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,YAAY,GACZ,YAAY,GACZ,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,qBAAa,sBAAsB;IAK/B,QAAQ,CAAC,EAAE,EAAE,OAAO,MAAM;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS;IALnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2C;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;gBAG1C,EAAE,EAAE,OAAO,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS;IAGnD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,GAAG,eAAe;CAwBnD;AAwfD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,EACrB,EAAE,EAAE,OAAO,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,GAC3C,eAAe,CAgBjB;AAwCD,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,MAAM,CAAC,cAAc,EAC/B,EAAE,EAAE,OAAO,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS,GACvC,MAAM,CAAC,IAAI,GAAG,SAAS,CAgBzB"}