srclawyer 0.4.0

package/dist/llm/resolveAmbiguousFindings.js

@@ -0,0 +1,103 @@
+import { DATA_CATEGORY_LABELS } from "../policy/dataCategoryLabels.js";
+import { buildRequestItem } from "./buildRequestItem.js";
+const KNOWN_CATEGORIES = new Set(Object.keys(DATA_CATEGORY_LABELS));
+const DEFAULT_BATCH_SIZE = 15;
+const DEFAULT_BATCH_CHAR_BUDGET = 6000;
+export async function resolveAmbiguousFindings(findings, provider, options) {
+    const batches = chunkFindings(findings, options.batchSize ?? DEFAULT_BATCH_SIZE);
+    const resolvedById = new Map();
+    for (const batch of batches) {
+        const items = batch.map((finding) => buildRequestItem(finding, options.collectsChildrensData));
+        const isHighStakesById = new Map(items.map((item) => [item.findingId, item.isHighStakes]));
+        let responses;
+        try {
+            responses = await provider.resolveBatch({ items });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            for (const finding of batch) {
+                resolvedById.set(finding.id, {
+                    outcome: "unresolved",
+                    reason: `API request failed: ${message}`,
+                    provider: provider.name,
+                    model: provider.model,
+                });
+            }
+            continue;
+        }
+        const responseById = new Map(responses.map((response) => [response.findingId, response]));
+        for (const finding of batch) {
+            const response = responseById.get(finding.id);
+            const isHighStakes = isHighStakesById.get(finding.id) ?? false;
+            resolvedById.set(finding.id, toResolution(response, isHighStakes, provider));
+        }
+    }
+    return findings.map((finding) => {
+        const resolution = resolvedById.get(finding.id);
+        return resolution ? { ...finding, llmResolution: resolution } : finding;
+    });
+}
+function toResolution(response, isHighStakes, provider) {
+    if (!response) {
+        return {
+            outcome: "unresolved",
+            reason: "Response missing or malformed for this item",
+            provider: provider.name,
+            model: provider.model,
+        };
+    }
+    // Hard code-level override: a high-stakes item can never come back "resolved",
+    // regardless of what the model claims. This is enforced here, not just in the
+    // prompt, since model output text is never trusted as sole enforcement.
+    if (isHighStakes && response.outcome === "resolved") {
+        return {
+            outcome: "declined",
+            reason: "High-stakes category (children's data) — always requires manual/legal review, never auto-resolved.",
+            provider: provider.name,
+            model: provider.model,
+        };
+    }
+    if (response.outcome === "declined") {
+        return {
+            outcome: "declined",
+            reason: response.reason ?? "The model declined to classify this item without giving a reason.",
+            provider: provider.name,
+            model: provider.model,
+        };
+    }
+    const validCategories = (response.resolvedDataCategories ?? []).filter((category) => KNOWN_CATEGORIES.has(category));
+    if (validCategories.length === 0 || !response.resolvedDescription) {
+        return {
+            outcome: "unresolved",
+            reason: "Model reported a resolution but did not provide a recognized data category and description",
+            provider: provider.name,
+            model: provider.model,
+        };
+    }
+    return {
+        outcome: "resolved",
+        reason: null,
+        provider: provider.name,
+        model: provider.model,
+        resolvedDataCategories: validCategories,
+        resolvedDescription: response.resolvedDescription,
+    };
+}
+function chunkFindings(findings, batchSize) {
+    const batches = [];
+    let current = [];
+    let currentChars = 0;
+    for (const finding of findings) {
+        const approxSize = finding.evidence.length + finding.description.length;
+        if (current.length > 0 && (current.length >= batchSize || currentChars + approxSize > DEFAULT_BATCH_CHAR_BUDGET)) {
+            batches.push(current);
+            current = [];
+            currentChars = 0;
+        }
+        current.push(finding);
+        currentChars += approxSize;
+    }
+    if (current.length > 0)
+        batches.push(current);
+    return batches;
+}

package/dist/llm/resolveProviderForTier.d.ts

@@ -0,0 +1,3 @@
+import type { SrcLawyerConfig } from "../config/config.js";
+import type { ProviderResolution } from "./types.js";
+export declare function resolveProviderForTier(config: SrcLawyerConfig): ProviderResolution;

package/dist/llm/resolveProviderForTier.js

@@ -0,0 +1,31 @@
+import { AnthropicProvider } from "./anthropicProvider.js";
+export function resolveProviderForTier(config) {
+    const tier = config.tier ?? "free";
+    if (tier === "free") {
+        return { provider: null, error: null };
+    }
+    if (tier === "byok") {
+        const envVar = config.llm?.apiKeyEnvVar;
+        if (!envVar) {
+            return {
+                provider: null,
+                error: 'Tier is "byok" but no API key environment variable is configured in .privacypolicy.yml. Run "srclawyer init" to set one.',
+            };
+        }
+        const apiKey = process.env[envVar];
+        if (!apiKey) {
+            return {
+                provider: null,
+                error: `Tier is "byok" but the environment variable ${envVar} is not set. Set it to your Anthropic API key and re-run.`,
+            };
+        }
+        return { provider: new AnthropicProvider(apiKey), error: null };
+    }
+    if (tier === "managed") {
+        return {
+            provider: null,
+            error: 'Tier is "managed" but SrcLawyer\'s managed backend is not available yet. Use "byok" with your own Anthropic API key, or "free".',
+        };
+    }
+    return { provider: null, error: `Unknown tier "${tier}" in .privacypolicy.yml.` };
+}

package/dist/llm/types.d.ts

@@ -0,0 +1,29 @@
+import type { DataCategory } from "../engine/types.js";
+export interface LlmRequestItem {
+    findingId: string;
+    redactedEvidence: string;
+    redactedDescription: string;
+    dataCategories: DataCategory[];
+    isHighStakes: boolean;
+}
+export interface LlmBatchRequest {
+    items: LlmRequestItem[];
+}
+export interface LlmResponseItem {
+    findingId: string;
+    outcome: "resolved" | "declined";
+    reason: string | null;
+    resolvedDataCategories?: DataCategory[];
+    resolvedDescription?: string;
+}
+export interface LlmProvider {
+    readonly name: string;
+    readonly model: string;
+    resolveBatch(request: LlmBatchRequest): Promise<LlmResponseItem[]>;
+}
+export interface ProviderResolution {
+    provider: LlmProvider | null;
+    /** Non-null means: do not run Layer 2, and this message must be surfaced
+     *  loudly — never swallowed. */
+    error: string | null;
+}

package/dist/llm/types.js

@@ -0,0 +1 @@
+export {};

package/dist/policy/dataCategoryLabels.d.ts

@@ -0,0 +1,2 @@
+import type { DataCategory } from "../engine/types.js";
+export declare const DATA_CATEGORY_LABELS: Record<DataCategory, string>;

package/dist/policy/dataCategoryLabels.js

@@ -0,0 +1,18 @@
+export const DATA_CATEGORY_LABELS = {
+    email: "Email addresses",
+    name: "Names",
+    phone: "Phone numbers",
+    physical_address: "Physical or mailing addresses",
+    payment_info: "Payment information",
+    government_id: "Government-issued identifiers",
+    device_id: "Device identifiers",
+    ip_address: "IP addresses",
+    location: "Location data",
+    analytics_usage: "Usage and analytics data",
+    authentication_credentials: "Authentication credentials",
+    childrens_data: "Children's data",
+    health_data: "Health data",
+    microphone_audio: "Microphone audio",
+    camera_video: "Camera video",
+    generic_pii: "Other personal data",
+};

package/dist/policy/disclaimer.d.ts

@@ -0,0 +1 @@
+export declare const MANDATORY_DISCLAIMER = "This document was generated based on automated code analysis and does not constitute legal advice; consult an attorney to verify applicability to your specific circumstances.";

package/dist/policy/disclaimer.js

@@ -0,0 +1 @@
+export const MANDATORY_DISCLAIMER = "This document was generated based on automated code analysis and does not constitute legal advice; consult an attorney to verify applicability to your specific circumstances.";

package/dist/policy/generatePolicy.d.ts

@@ -0,0 +1,3 @@
+import type { ScanResult } from "../engine/types.js";
+import type { SrcLawyerConfig } from "../config/config.js";
+export declare function generatePolicyMarkdown(result: ScanResult, config: SrcLawyerConfig | null, llmError?: string | null): string;

package/dist/policy/generatePolicy.js

@@ -0,0 +1,149 @@
+import { DATA_CATEGORY_LABELS } from "./dataCategoryLabels.js";
+import { MANDATORY_DISCLAIMER } from "./disclaimer.js";
+function locationRef(finding) {
+    return `${finding.location.file}:${finding.location.line}`;
+}
+function effectiveCategories(finding) {
+    return finding.llmResolution?.resolvedDataCategories ?? finding.dataCategories;
+}
+function effectiveDescription(finding) {
+    return finding.llmResolution?.resolvedDescription ?? finding.description;
+}
+function groupByCategory(findings) {
+    const byCategory = new Map();
+    for (const finding of findings) {
+        for (const category of effectiveCategories(finding)) {
+            const existing = byCategory.get(category) ?? [];
+            existing.push(finding);
+            byCategory.set(category, existing);
+        }
+    }
+    return byCategory;
+}
+function renderCategorySections(confidentFindings) {
+    const byCategory = groupByCategory(confidentFindings);
+    const sections = [];
+    for (const [category, findings] of [...byCategory.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        const lines = [`### ${DATA_CATEGORY_LABELS[category]}`, ""];
+        for (const finding of findings) {
+            const attribution = finding.processor ? ` (via ${finding.processor})` : "";
+            const aiNote = finding.llmResolution?.outcome === "resolved" ? " _(AI-assisted)_" : "";
+            lines.push(`- ${effectiveDescription(finding)}${attribution}${aiNote} — \`${locationRef(finding)}\``);
+        }
+        sections.push(lines.join("\n"));
+    }
+    return sections;
+}
+function renderProcessorSection(confidentFindings) {
+    const processors = new Map();
+    for (const finding of confidentFindings) {
+        if (!finding.processor)
+            continue;
+        const existing = processors.get(finding.processor) ?? { description: effectiveDescription(finding), locations: [] };
+        existing.locations.push(locationRef(finding));
+        processors.set(finding.processor, existing);
+    }
+    if (processors.size === 0)
+        return null;
+    const lines = ["## Third-Party Data Processors", "", "This codebase integrates with the following third-party services, detected via import/require analysis:", ""];
+    for (const [name, { description, locations }] of processors) {
+        lines.push(`- **${name}** — ${description} (\`${locations.join("`, `")}\`)`);
+    }
+    return lines.join("\n");
+}
+function renderReviewSection(reviewFindings) {
+    if (reviewFindings.length === 0)
+        return null;
+    const lines = [
+        "## Items Requiring Manual Review",
+        "",
+        "Automated analysis could not confidently classify the following items. They are **not** included in the sections above and must be reviewed manually before this policy is considered complete:",
+        "",
+    ];
+    for (const finding of reviewFindings) {
+        const attemptNote = finding.llmResolution?.reason ? ` (AI resolution attempt failed: ${finding.llmResolution.reason})` : "";
+        lines.push(`- \`${finding.evidence}\` — ${finding.description} — \`${locationRef(finding)}\`${attemptNote}`);
+    }
+    return lines.join("\n");
+}
+function renderDeclinedSection(declinedFindings) {
+    if (declinedFindings.length === 0)
+        return null;
+    const lines = [
+        "## Items Declined by AI-Assisted Review",
+        "",
+        "These items were reviewed by the AI-assisted resolution layer, which explicitly declined to classify them rather than guess. They are **not** included in the sections above and must be reviewed manually:",
+        "",
+    ];
+    for (const finding of declinedFindings) {
+        lines.push(`- \`${finding.evidence}\` — ${finding.description} — declined: "${finding.llmResolution?.reason}" — \`${locationRef(finding)}\``);
+    }
+    return lines.join("\n");
+}
+function renderLlmErrorWarning(llmError) {
+    return ["> **WARNING: AI-ASSISTED RESOLUTION DID NOT RUN**", ">", `> ${llmError}`].join("\n");
+}
+function renderContextSection(config) {
+    if (!config) {
+        return [
+            "## Scope",
+            "",
+            "No `.privacypolicy.yml` configuration was found, so this policy was generated without jurisdiction, target-market, or industry context. Run `srclawyer init` and re-run `srclawyer scan` to include that context.",
+        ].join("\n");
+    }
+    const lines = ["## Scope", ""];
+    lines.push(`- **Entity location:** ${config.entityLocation ?? "not specified"}`);
+    lines.push(`- **Target markets:** ${config.targetMarkets.length > 0 ? config.targetMarkets.join(", ") : "not specified"}`);
+    lines.push(`- **Industry:** ${config.industry ?? "not specified"}`);
+    lines.push(`- **Collects children's data:** ${config.collectsChildrensData ? "yes" : "no"}`);
+    return lines.join("\n");
+}
+function renderUnsupportedStackWarning(warning) {
+    return ["> **WARNING: INCOMPLETE SCAN — DO NOT PUBLISH WITHOUT MANUAL REVIEW**", ">", `> ${warning}`].join("\n");
+}
+function outcomeOf(finding) {
+    if (!finding.requiresReview)
+        return "confident";
+    if (finding.llmResolution?.outcome === "resolved")
+        return "resolved";
+    if (finding.llmResolution?.outcome === "declined")
+        return "declined";
+    return "unresolved";
+}
+export function generatePolicyMarkdown(result, config, llmError) {
+    const confidentFindings = result.findings.filter((f) => {
+        const outcome = outcomeOf(f);
+        return outcome === "confident" || outcome === "resolved";
+    });
+    const declinedFindings = result.findings.filter((f) => outcomeOf(f) === "declined");
+    const reviewFindings = result.findings.filter((f) => outcomeOf(f) === "unresolved");
+    const parts = ["# Privacy Policy", ""];
+    if (result.unsupportedStackWarning) {
+        parts.push(renderUnsupportedStackWarning(result.unsupportedStackWarning), "");
+    }
+    if (llmError) {
+        parts.push(renderLlmErrorWarning(llmError), "");
+    }
+    parts.push(`_Generated by SrcLawyer from static analysis of this codebase (${result.filesScanned} file(s) scanned)._`, "", renderContextSection(config), "", "## Data We Collect", "");
+    const categorySections = renderCategorySections(confidentFindings);
+    if (categorySections.length > 0) {
+        parts.push(categorySections.join("\n\n"));
+    }
+    else {
+        parts.push("No data-collection patterns were confidently identified in this codebase.");
+    }
+    const processorSection = renderProcessorSection(confidentFindings);
+    if (processorSection) {
+        parts.push("", processorSection);
+    }
+    const declinedSection = renderDeclinedSection(declinedFindings);
+    if (declinedSection) {
+        parts.push("", declinedSection);
+    }
+    const reviewSection = renderReviewSection(reviewFindings);
+    if (reviewSection) {
+        parts.push("", reviewSection);
+    }
+    parts.push("", "## Disclaimer", "", MANDATORY_DISCLAIMER);
+    return parts.join("\n") + "\n";
+}

package/dist/report/formatText.d.ts

@@ -0,0 +1,2 @@
+import type { ScanResult } from "../engine/types.js";
+export declare function formatText(result: ScanResult): string;

package/dist/report/formatText.js

@@ -0,0 +1,53 @@
+const BANNER_RULE = "=".repeat(72);
+export function formatText(result) {
+    const lines = [];
+    if (result.unsupportedStackWarning) {
+        lines.push(BANNER_RULE);
+        lines.push("WARNING:");
+        lines.push(result.unsupportedStackWarning);
+        lines.push(BANNER_RULE);
+        lines.push("");
+    }
+    lines.push(`Scanned ${result.filesScanned} file(s) across ${result.projects.length} project(s).`);
+    lines.push(`Found ${result.findings.length} finding(s), ${result.ambiguousCount} requiring review.`);
+    lines.push("");
+    const byProcessor = result.findings.filter((f) => f.processor);
+    const byField = result.findings.filter((f) => !f.processor);
+    if (byProcessor.length > 0) {
+        lines.push("Third-party processors detected:");
+        for (const f of byProcessor) {
+            lines.push(`  [${f.confidence}] ${f.processor} — ${f.location.file}:${f.location.line}`);
+            lines.push(`      ${f.description}`);
+        }
+        lines.push("");
+    }
+    if (byField.length > 0) {
+        lines.push("Data fields collected:");
+        for (const f of byField) {
+            const displayCategories = f.llmResolution?.resolvedDataCategories ?? f.dataCategories;
+            lines.push(`  [${f.confidence}] ${displayCategories.join(", ")}${reviewFlag(f)} — ${f.location.file}:${f.location.line}`);
+            lines.push(`      ${f.evidence}`);
+        }
+    }
+    const resolvedCount = result.findings.filter((f) => f.llmResolution?.outcome === "resolved").length;
+    const declinedCount = result.findings.filter((f) => f.llmResolution?.outcome === "declined").length;
+    const stillUnresolvedCount = result.findings.filter((f) => f.requiresReview && f.llmResolution?.outcome !== "resolved" && f.llmResolution?.outcome !== "declined").length;
+    if (resolvedCount > 0 || declinedCount > 0) {
+        lines.push("");
+        lines.push(`AI-assisted resolution: ${resolvedCount} resolved, ${declinedCount} declined (with a reason), ${stillUnresolvedCount} still unresolved.`);
+    }
+    else if (result.ambiguousCount > 0) {
+        lines.push("");
+        lines.push(`${result.ambiguousCount} item(s) require deeper analysis before they can be included in a policy. Run "srclawyer scan" with a "byok"/"managed" tier configured to attempt AI-assisted resolution, or resolve manually.`);
+    }
+    return lines.join("\n");
+}
+function reviewFlag(finding) {
+    if (!finding.requiresReview)
+        return "";
+    if (finding.llmResolution?.outcome === "resolved")
+        return " (resolved by AI)";
+    if (finding.llmResolution?.outcome === "declined")
+        return ` (declined by AI: ${finding.llmResolution.reason})`;
+    return " (needs review)";
+}

package/dist/rules/confidenceFactors.d.ts

@@ -0,0 +1,14 @@
+import type { DataCategory } from "../engine/types.js";
+/**
+ * Computing the confidence FACTORS for a field is cheap, generic, local work — the same lexicon
+ * lookups every rule already does. Turning those factors into an actual confidence/requiresReview
+ * verdict is the tuned, corpus-validated part, and that formula now lives server-side (see
+ * src/cloud/protectedLogicClient.ts). This module only ever produces factors, never a verdict.
+ */
+export interface ConfidenceFactors {
+    lexiconCategory: DataCategory | null;
+    ambiguousName: boolean;
+    runtimeVerified: boolean;
+    siblingConfidentCount?: number;
+}
+export declare function countConfidentSiblings(allFieldNames: string[], selfName: string): number;

package/dist/rules/confidenceFactors.js

@@ -0,0 +1,14 @@
+import { classifyFieldName, isAmbiguousFieldName } from "./dataCategoryLexicon.js";
+// Shared by every rule module that has a pre-materialized list of sibling field names available at
+// the point it emits a finding — counts how many OTHER names in the group independently classify as
+// confident PII, excluding `selfName` itself.
+export function countConfidentSiblings(allFieldNames, selfName) {
+    let count = 0;
+    for (const name of allFieldNames) {
+        if (name === selfName)
+            continue;
+        if (classifyFieldName(name) && !isAmbiguousFieldName(name))
+            count += 1;
+    }
+    return count;
+}

package/dist/rules/dataCategoryLexicon.d.ts

@@ -0,0 +1,3 @@
+import type { DataCategory } from "../engine/types.js";
+export declare function classifyFieldName(fieldName: string): DataCategory | null;
+export declare function isAmbiguousFieldName(fieldName: string): boolean;

package/dist/rules/dataCategoryLexicon.js

@@ -0,0 +1,26 @@
+const LEXICON = [
+    { pattern: /email/i, category: "email" },
+    // Checked before the generic "name" pattern below: bank_name/account_holder_name end in
+    // "name" and would otherwise be classified as just "name", losing the payment-specific signal.
+    { pattern: /bank[ _-]?name|routing[ _-]?number|account[ _-]?holder|iban|swift[ _-]?code/i, category: "payment_info" },
+    { pattern: /(full)?name$|firstname|lastname|surname/i, category: "name" },
+    { pattern: /phone|mobile|telephone/i, category: "phone" },
+    { pattern: /address|street|city|zip ?code|postal ?code/i, category: "physical_address" },
+    { pattern: /card ?number|creditcard|cvv|cvc|cardholder/i, category: "payment_info" },
+    { pattern: /ssn|social ?security|passport|national ?id|drivers?license/i, category: "government_id" },
+    { pattern: /password|passwd|passphrase|api ?key|access ?token|refresh ?token|secret/i, category: "authentication_credentials" },
+    { pattern: /latitude|longitude|^lat$|^lng$|geo ?location|coordinates/i, category: "location" },
+    { pattern: /device ?id|udid|advertising ?id|imei/i, category: "device_id" },
+    { pattern: /ip ?address|remoteaddr/i, category: "ip_address" },
+];
+const AMBIGUOUS_NAMES = new Set(["data", "payload", "value", "body", "info", "params", "metadata", "details", "fields", "input", "record", "item", "obj"]);
+export function classifyFieldName(fieldName) {
+    for (const entry of LEXICON) {
+        if (entry.pattern.test(fieldName))
+            return entry.category;
+    }
+    return null;
+}
+export function isAmbiguousFieldName(fieldName) {
+    return AMBIGUOUS_NAMES.has(fieldName.toLowerCase());
+}

package/dist/rules/frameworkRules.d.ts

@@ -0,0 +1,5 @@
+import type { File } from "@babel/types";
+import type { Finding } from "../engine/types.js";
+export declare const REQUEST_OBJECT_NAMES: RegExp;
+export declare const REQUEST_BODY_PROPS: RegExp;
+export declare function runFrameworkRules(ast: File, filePath: string, source: string, root: string): Finding[];

package/dist/rules/frameworkRules.js

@@ -0,0 +1,98 @@
+import _traverse from "@babel/traverse";
+import { relative } from "node:path";
+import { classifyFieldName, isAmbiguousFieldName } from "./dataCategoryLexicon.js";
+import { isSafeFieldName } from "./safeFieldNames.js";
+import { redactSecrets } from "../engine/secretRedaction.js";
+import { countConfidentSiblings } from "./confidenceFactors.js";
+const traverse = (_traverse.default ?? _traverse);
+// Exported so other rule modules anchoring detection to "this value came from an incoming request"
+// (e.g. zodPreFilter.ts) can match the exact same shapes, rather than redefining them independently.
+export const REQUEST_OBJECT_NAMES = /^(req|request)$/;
+export const REQUEST_BODY_PROPS = /^(body|query|params)$/;
+function fieldsFromObjectPattern(pattern) {
+    const names = [];
+    for (const prop of pattern.properties) {
+        if (prop.type === "ObjectProperty" && prop.key.type === "Identifier") {
+            names.push(prop.key.name);
+        }
+    }
+    return names;
+}
+export function runFrameworkRules(ast, filePath, source, root) {
+    const findings = [];
+    const lines = source.split("\n");
+    const relPath = relative(root, filePath);
+    const emitted = new Set();
+    function emit(fieldName, line, node, siblingFieldNames = []) {
+        if (isSafeFieldName(fieldName))
+            return;
+        const dedupeKey = `${fieldName}:${line}`;
+        if (emitted.has(dedupeKey))
+            return;
+        emitted.add(dedupeKey);
+        const lexiconCategory = classifyFieldName(fieldName);
+        const ambiguousName = isAmbiguousFieldName(fieldName);
+        const siblingConfidentCount = countConfidentSiblings(siblingFieldNames, fieldName);
+        const evidenceLine = lines[line - 1] ?? "";
+        // Confidence/requiresReview are provisional here — the safe fallback until the batched
+        // protected-logic scoring call (src/cloud/protectedLogicClient.ts) patches them in scanEngine.ts.
+        // dataCategories uses the local lexicon result directly since categorization itself is local,
+        // generic, and unprotected; only the CONFIDENCE verdict is cloud-scored.
+        findings.push({
+            id: `field:${relPath}:${line}:${fieldName}`,
+            dataCategories: lexiconCategory ? [lexiconCategory] : ["generic_pii"],
+            processor: null,
+            description: lexiconCategory
+                ? `Request field "${fieldName}" collected, classified as ${lexiconCategory}.`
+                : `Request field "${fieldName}" collected; could not confidently classify — needs review.`,
+            confidence: "low",
+            source: "framework-rule",
+            location: { file: relPath, line, column: node.loc?.start.column ?? 0 },
+            evidence: redactSecrets(evidenceLine.trim()).slice(0, 200),
+            requiresReview: true,
+            confidenceFactors: { lexiconCategory, ambiguousName, runtimeVerified: true, siblingConfidentCount },
+        });
+    }
+    traverse(ast, {
+        MemberExpression(path) {
+            const { object, property } = path.node;
+            if (object.type !== "Identifier" || !REQUEST_OBJECT_NAMES.test(object.name))
+                return;
+            if (property.type !== "Identifier" || !REQUEST_BODY_PROPS.test(property.name))
+                return;
+            const parent = path.parent;
+            if (parent.type === "MemberExpression" && parent.property.type === "Identifier") {
+                emit(parent.property.name, parent.loc?.start.line ?? path.node.loc?.start.line ?? 1, parent);
+                return;
+            }
+            if (parent.type === "VariableDeclarator" && parent.id.type === "ObjectPattern") {
+                const line = parent.loc?.start.line ?? 1;
+                const siblingFieldNames = fieldsFromObjectPattern(parent.id);
+                for (const fieldName of siblingFieldNames) {
+                    emit(fieldName, line, parent, siblingFieldNames);
+                }
+            }
+        },
+        AwaitExpression(path) {
+            const argument = path.node.argument;
+            if (argument.type !== "CallExpression")
+                return;
+            const callee = argument.callee;
+            if (callee.type !== "MemberExpression")
+                return;
+            if (callee.object.type !== "Identifier" || !REQUEST_OBJECT_NAMES.test(callee.object.name))
+                return;
+            if (callee.property.type !== "Identifier" || callee.property.name !== "json")
+                return;
+            const parent = path.parent;
+            if (parent.type === "VariableDeclarator" && parent.id.type === "ObjectPattern") {
+                const line = parent.loc?.start.line ?? 1;
+                const siblingFieldNames = fieldsFromObjectPattern(parent.id);
+                for (const fieldName of siblingFieldNames) {
+                    emit(fieldName, line, parent, siblingFieldNames);
+                }
+            }
+        },
+    });
+    return findings;
+}

package/dist/rules/htmlRules.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../engine/types.js";
+export declare function runHtmlInputRules(html: string, filePath: string, root: string): Finding[];
+export interface ExtractedScript {
+    code: string;
+}
+export declare function extractInlineScripts(html: string): ExtractedScript[];