srclawyer 0.4.0

package/dist/rules/htmlRules.js

@@ -0,0 +1,75 @@
+import { relative } from "node:path";
+import { classifyFieldName } from "./dataCategoryLexicon.js";
+import { isSafeFieldName } from "./safeFieldNames.js";
+const INPUT_TAG_RE = /<input\b[^>]*>/gi;
+const SCRIPT_TAG_RE = /<script([^>]*)>([\s\S]*?)<\/script>/gi;
+const NON_DATA_INPUT_TYPES = new Set(["submit", "button", "reset", "image"]);
+function getAttr(tag, name) {
+    const match = new RegExp(`${name}\\s*=\\s*["']([^"']*)["']`, "i").exec(tag);
+    return match ? match[1] : null;
+}
+function lineAt(html, index) {
+    return html.slice(0, index).split("\n").length;
+}
+export function runHtmlInputRules(html, filePath, root) {
+    const relPath = relative(root, filePath);
+    const findings = [];
+    let match;
+    while ((match = INPUT_TAG_RE.exec(html))) {
+        const tag = match[0];
+        const type = (getAttr(tag, "type") ?? "text").toLowerCase();
+        if (NON_DATA_INPUT_TYPES.has(type))
+            continue;
+        const identifier = getAttr(tag, "id") ?? getAttr(tag, "name");
+        const line = lineAt(html, match.index);
+        if (type === "password") {
+            findings.push(makeFinding(relPath, line, tag, "authentication_credentials", "high", false, `<input type="password"> field collects a credential.`));
+            continue;
+        }
+        if (type === "email") {
+            findings.push(makeFinding(relPath, line, tag, "email", "high", false, `<input type="email"> field collects an email address.`));
+            continue;
+        }
+        if (type === "tel") {
+            findings.push(makeFinding(relPath, line, tag, "phone", "high", false, `<input type="tel"> field collects a phone number.`));
+            continue;
+        }
+        if (!identifier || isSafeFieldName(identifier))
+            continue;
+        const category = classifyFieldName(identifier);
+        findings.push(makeFinding(relPath, line, tag, category ?? "generic_pii", category ? "medium" : "low", !category, category
+            ? `Form field "${identifier}" classified as ${category}.`
+            : `Form field "${identifier}" could not be confidently classified — needs review.`));
+    }
+    return findings;
+}
+function makeFinding(relPath, line, tag, category, confidence, requiresReview, description) {
+    return {
+        id: `html-input:${relPath}:${line}`,
+        dataCategories: [category],
+        processor: null,
+        description,
+        confidence,
+        source: "html-input-rule",
+        location: { file: relPath, line, column: 0 },
+        evidence: tag.replace(/\s+/g, " ").trim().slice(0, 160),
+        requiresReview,
+    };
+}
+export function extractInlineScripts(html) {
+    const scripts = [];
+    let match;
+    while ((match = SCRIPT_TAG_RE.exec(html))) {
+        const attrs = match[1];
+        if (/\bsrc\s*=/i.test(attrs))
+            continue;
+        if (/\btype\s*=\s*["'](?!(?:text\/javascript|module|application\/javascript)["'])[^"']*["']/i.test(attrs))
+            continue;
+        const body = match[2];
+        const openTagLength = "<script".length + attrs.length + 1;
+        const contentStart = match.index + openTagLength;
+        const linesBefore = html.slice(0, contentStart).split("\n").length - 1;
+        scripts.push({ code: "\n".repeat(linesBefore) + body });
+    }
+    return scripts;
+}

package/dist/rules/processorProfiles.d.ts

@@ -0,0 +1,2 @@
+import type { ProcessorProfile } from "../engine/types.js";
+export declare const PROCESSOR_PROFILES: Record<string, ProcessorProfile>;

package/dist/rules/processorProfiles.js

@@ -0,0 +1,42 @@
+export const PROCESSOR_PROFILES = {
+    stripe: {
+        name: "Stripe",
+        dataCategories: ["payment_info", "name", "email", "physical_address"],
+        disclosureNotes: "Payment processor. Handles card data, billing name/address, and email for receipts.",
+    },
+    sendgrid: {
+        name: "SendGrid",
+        dataCategories: ["email", "name"],
+        disclosureNotes: "Transactional/marketing email delivery. Processes recipient email and name.",
+    },
+    twilio: {
+        name: "Twilio",
+        dataCategories: ["phone"],
+        disclosureNotes: "SMS/voice communications provider. Processes phone numbers.",
+    },
+    "google-analytics": {
+        name: "Google Analytics",
+        dataCategories: ["analytics_usage", "ip_address", "device_id"],
+        disclosureNotes: "Web analytics. Processes IP address, device identifiers, and usage/behavioral data.",
+    },
+    mixpanel: {
+        name: "Mixpanel",
+        dataCategories: ["analytics_usage", "device_id"],
+        disclosureNotes: "Product analytics. Processes event/usage data and device identifiers.",
+    },
+    auth0: {
+        name: "Auth0",
+        dataCategories: ["email", "authentication_credentials", "name"],
+        disclosureNotes: "Identity provider. Processes login credentials, email, and profile data.",
+    },
+    firebase: {
+        name: "Firebase",
+        dataCategories: ["email", "authentication_credentials", "device_id", "analytics_usage"],
+        disclosureNotes: "Backend platform (auth, database, analytics, messaging) depending on which modules are used.",
+    },
+    cognito: {
+        name: "Amazon Cognito",
+        dataCategories: ["email", "authentication_credentials", "phone"],
+        disclosureNotes: "Identity provider. Processes login credentials, email, and phone for MFA.",
+    },
+};

package/dist/rules/safeFieldNames.d.ts

@@ -0,0 +1 @@
+export declare function isSafeFieldName(fieldName: string): boolean;

package/dist/rules/safeFieldNames.js

@@ -0,0 +1,25 @@
+const SAFE_FIELD_NAMES = new Set([
+    "id",
+    "uuid",
+    "guid",
+    "createdat",
+    "updatedat",
+    "deletedat",
+    "timestamp",
+    "status",
+    "state",
+    "version",
+    "page",
+    "limit",
+    "offset",
+    "count",
+    "total",
+    "sort",
+    "order",
+]);
+function normalize(fieldName) {
+    return fieldName.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+export function isSafeFieldName(fieldName) {
+    return SAFE_FIELD_NAMES.has(normalize(fieldName));
+}

package/dist/rules/sdkRules.d.ts

@@ -0,0 +1,3 @@
+import type { File } from "@babel/types";
+import type { Finding } from "../engine/types.js";
+export declare function runSdkRules(ast: File, filePath: string, source: string, root: string): Finding[];

package/dist/rules/sdkRules.js

@@ -0,0 +1,65 @@
+import _traverse from "@babel/traverse";
+import { relative } from "node:path";
+import { PROCESSOR_PROFILES } from "./processorProfiles.js";
+import { redactSecrets } from "../engine/secretRedaction.js";
+// @babel/traverse's ESM default export is wrapped under interop; unwrap it defensively.
+const traverse = (_traverse.default ?? _traverse);
+const SDK_MATCHERS = [
+    { processorKey: "stripe", packagePatterns: [/^stripe$/] },
+    { processorKey: "sendgrid", packagePatterns: [/^@sendgrid\/mail$/] },
+    { processorKey: "twilio", packagePatterns: [/^twilio$/] },
+    { processorKey: "google-analytics", packagePatterns: [/^react-ga4?$/, /^universal-analytics$/, /^@google-analytics\/data$/] },
+    { processorKey: "mixpanel", packagePatterns: [/^mixpanel-browser$/, /^mixpanel$/] },
+    { processorKey: "auth0", packagePatterns: [/^auth0$/, /^@auth0\//] },
+    { processorKey: "firebase", packagePatterns: [/^firebase$/, /^firebase-admin/, /^@firebase\//] },
+    { processorKey: "cognito", packagePatterns: [/^amazon-cognito-identity-js$/, /^@aws-sdk\/client-cognito-identity-provider$/] },
+];
+function matchProcessor(source) {
+    return SDK_MATCHERS.find((matcher) => matcher.packagePatterns.some((p) => p.test(source)));
+}
+export function runSdkRules(ast, filePath, source, root) {
+    const findings = [];
+    const lines = source.split("\n");
+    const seenProcessors = new Set();
+    traverse(ast, {
+        ImportDeclaration(path) {
+            const src = path.node.source.value;
+            const matcher = matchProcessor(src);
+            if (!matcher)
+                return;
+            emitFinding(matcher, path.node.loc?.start.line ?? 1);
+        },
+        CallExpression(path) {
+            const callee = path.node.callee;
+            if (callee.type !== "Identifier" || callee.name !== "require")
+                return;
+            const arg = path.node.arguments[0];
+            if (!arg || arg.type !== "StringLiteral")
+                return;
+            const matcher = matchProcessor(arg.value);
+            if (!matcher)
+                return;
+            emitFinding(matcher, path.node.loc?.start.line ?? 1);
+        },
+    });
+    function emitFinding(matcher, line) {
+        const dedupeKey = `${matcher.processorKey}:${filePath}`;
+        if (seenProcessors.has(dedupeKey))
+            return;
+        seenProcessors.add(dedupeKey);
+        const profile = PROCESSOR_PROFILES[matcher.processorKey];
+        const evidenceLine = lines[line - 1] ?? "";
+        findings.push({
+            id: `sdk:${matcher.processorKey}:${relative(root, filePath)}:${line}`,
+            dataCategories: profile.dataCategories,
+            processor: profile.name,
+            description: `${profile.name} integration detected. ${profile.disclosureNotes}`,
+            confidence: "high",
+            source: "sdk-rule",
+            location: { file: relative(root, filePath), line, column: 0 },
+            evidence: redactSecrets(evidenceLine.trim()).slice(0, 200),
+            requiresReview: false,
+        });
+    }
+    return findings;
+}

package/dist/rules/typedRequestBodyRules.d.ts

@@ -0,0 +1,4 @@
+import type { File } from "@babel/types";
+import type { Finding } from "../engine/types.js";
+import type { TsProjectHandle } from "../engine/tsProject.js";
+export declare function runTypedRequestBodyRules(ast: File, filePath: string, source: string, root: string, getTsProject: () => TsProjectHandle | null): Finding[];

package/dist/rules/typedRequestBodyRules.js

@@ -0,0 +1,83 @@
+import _traverse from "@babel/traverse";
+import { relative } from "node:path";
+import { classifyFieldName, isAmbiguousFieldName } from "./dataCategoryLexicon.js";
+import { isSafeFieldName } from "./safeFieldNames.js";
+import { redactSecrets } from "../engine/secretRedaction.js";
+import { REQUEST_BODY_PROPS, REQUEST_OBJECT_NAMES } from "./frameworkRules.js";
+import { countConfidentSiblings } from "./confidenceFactors.js";
+const traverse = (_traverse.default ?? _traverse);
+function isRequestJsonOrBodyEntryPoint(node) {
+    if (node.type === "MemberExpression") {
+        return (node.object.type === "Identifier" &&
+            REQUEST_OBJECT_NAMES.test(node.object.name) &&
+            node.property.type === "Identifier" &&
+            REQUEST_BODY_PROPS.test(node.property.name));
+    }
+    if (node.type === "AwaitExpression" && node.argument.type === "CallExpression") {
+        const callee = node.argument.callee;
+        return (callee.type === "MemberExpression" &&
+            callee.object.type === "Identifier" &&
+            REQUEST_OBJECT_NAMES.test(callee.object.name) &&
+            callee.property.type === "Identifier" &&
+            callee.property.name === "json");
+    }
+    return false;
+}
+export function runTypedRequestBodyRules(ast, filePath, source, root, getTsProject) {
+    const findings = [];
+    const lines = source.split("\n");
+    const relPath = relative(root, filePath);
+    const emitted = new Set();
+    function emit(fieldName, line, siblingFieldNames) {
+        if (isSafeFieldName(fieldName))
+            return;
+        const dedupeKey = `${fieldName}:${line}`;
+        if (emitted.has(dedupeKey))
+            return;
+        emitted.add(dedupeKey);
+        const lexiconCategory = classifyFieldName(fieldName);
+        const ambiguousName = isAmbiguousFieldName(fieldName);
+        const siblingConfidentCount = countConfidentSiblings(siblingFieldNames, fieldName);
+        const evidenceLine = lines[line - 1] ?? "";
+        // runtimeVerified: false, always — a type annotation is compile-time-only and can silently lie
+        // relative to runtime reality (an `as X` cast, a stale interface). The scoring call's hard gate
+        // means requiresReview will come back true regardless of category/ambiguousName; confidence/
+        // requiresReview here are the provisional safe fallback until that call patches them in.
+        findings.push({
+            id: `type:${relPath}:${line}:${fieldName}`,
+            dataCategories: lexiconCategory ? [lexiconCategory] : ["generic_pii"],
+            processor: null,
+            description: lexiconCategory
+                ? `Request field "${fieldName}" inferred from a TypeScript type annotation (not runtime-verified); classified as ${lexiconCategory}.`
+                : `Request field "${fieldName}" inferred from a TypeScript type annotation (not runtime-verified); could not confidently classify — needs review.`,
+            confidence: "low",
+            source: "type-rule",
+            location: { file: relPath, line, column: 0 },
+            evidence: redactSecrets(evidenceLine.trim()).slice(0, 200),
+            requiresReview: true,
+            confidenceFactors: { lexiconCategory, ambiguousName, runtimeVerified: false, siblingConfidentCount },
+        });
+    }
+    traverse(ast, {
+        VariableDeclarator(path) {
+            const { id, init } = path.node;
+            if (!init || !isRequestJsonOrBodyEntryPoint(init))
+                return;
+            if (id.type !== "Identifier" || !id.typeAnnotation || id.typeAnnotation.type !== "TSTypeAnnotation")
+                return;
+            const pos = id.loc?.start;
+            if (!pos)
+                return;
+            const tsProject = getTsProject();
+            if (!tsProject)
+                return;
+            const members = tsProject.getObjectTypeMembersAt(filePath, pos.line, pos.column);
+            if (!members)
+                return;
+            const line = path.node.loc?.start.line ?? pos.line;
+            for (const fieldName of members)
+                emit(fieldName, line, members);
+        },
+    });
+    return findings;
+}

package/dist/rules/webApiRules.d.ts

@@ -0,0 +1,3 @@
+import type { File } from "@babel/types";
+import type { Finding } from "../engine/types.js";
+export declare function runWebApiRules(ast: File, filePath: string, source: string, root: string): Finding[];

package/dist/rules/webApiRules.js

@@ -0,0 +1,89 @@
+import _traverse from "@babel/traverse";
+import { relative } from "node:path";
+import { classifyFieldName, isAmbiguousFieldName } from "./dataCategoryLexicon.js";
+import { isSafeFieldName } from "./safeFieldNames.js";
+import { redactSecrets } from "../engine/secretRedaction.js";
+const traverse = (_traverse.default ?? _traverse);
+const STORAGE_OBJECT_NAMES = /^(localStorage|sessionStorage)$/;
+function hasTruthyProperty(obj, key) {
+    return obj.properties.some((prop) => {
+        if (prop.type !== "ObjectProperty" || prop.key.type !== "Identifier" || prop.key.name !== key)
+            return false;
+        return !(prop.value.type === "BooleanLiteral" && prop.value.value === false);
+    });
+}
+export function runWebApiRules(ast, filePath, source, root) {
+    const findings = [];
+    const lines = source.split("\n");
+    const relPath = relative(root, filePath);
+    const emitted = new Set();
+    function emit(id, line, description, dataCategories, confidence, requiresReview) {
+        const dedupeKey = `${id}:${line}`;
+        if (emitted.has(dedupeKey))
+            return;
+        emitted.add(dedupeKey);
+        const evidenceLine = lines[line - 1] ?? "";
+        findings.push({
+            id: `webapi:${relPath}:${line}:${id}`,
+            dataCategories,
+            processor: null,
+            description,
+            confidence,
+            source: "web-api-rule",
+            location: { file: relPath, line, column: 0 },
+            evidence: redactSecrets(evidenceLine.trim()).slice(0, 200),
+            requiresReview,
+        });
+    }
+    traverse(ast, {
+        CallExpression(path) {
+            const callee = path.node.callee;
+            if (callee.type !== "MemberExpression" || callee.property.type !== "Identifier")
+                return;
+            const methodName = callee.property.name;
+            const line = path.node.loc?.start.line ?? 1;
+            if (methodName === "getUserMedia") {
+                const arg = path.node.arguments[0];
+                if (arg && arg.type === "ObjectExpression") {
+                    const wantsAudio = hasTruthyProperty(arg, "audio");
+                    const wantsVideo = hasTruthyProperty(arg, "video");
+                    if (wantsAudio) {
+                        emit("getUserMedia:audio", line, "Microphone access requested via getUserMedia().", ["microphone_audio"], "high", false);
+                    }
+                    if (wantsVideo) {
+                        emit("getUserMedia:video", line, "Camera access requested via getUserMedia().", ["camera_video"], "high", false);
+                    }
+                    if (!wantsAudio && !wantsVideo) {
+                        emit("getUserMedia:unknown", line, "getUserMedia() called but audio/video constraints could not be determined statically.", ["generic_pii"], "low", true);
+                    }
+                }
+                else {
+                    emit("getUserMedia:dynamic", line, "getUserMedia() called with a non-literal constraints object — audio/video scope could not be determined statically.", ["microphone_audio", "camera_video"], "low", true);
+                }
+                return;
+            }
+            if (methodName === "getCurrentPosition" || methodName === "watchPosition") {
+                emit(`geolocation:${methodName}`, line, `Precise device location requested via ${methodName}().`, ["location"], "medium", false);
+                return;
+            }
+            if (methodName === "setItem" && callee.object.type === "Identifier" && STORAGE_OBJECT_NAMES.test(callee.object.name)) {
+                const storageKind = callee.object.name;
+                const keyArg = path.node.arguments[0];
+                if (keyArg && keyArg.type === "StringLiteral" && isSafeFieldName(keyArg.value)) {
+                    return;
+                }
+                if (keyArg && keyArg.type === "StringLiteral") {
+                    const category = classifyFieldName(keyArg.value);
+                    const ambiguous = isAmbiguousFieldName(keyArg.value);
+                    emit(`${storageKind}:${keyArg.value}`, line, category
+                        ? `Value stored in ${storageKind} under key "${keyArg.value}", classified as ${category}.`
+                        : `Value stored in ${storageKind} under key "${keyArg.value}"; could not confidently classify — needs review.`, [category ?? "generic_pii"], category ? "medium" : "low", ambiguous || !category);
+                }
+                else {
+                    emit(`${storageKind}:dynamic`, line, `Value stored in ${storageKind} under a dynamically computed key — needs review.`, ["generic_pii"], "low", true);
+                }
+            }
+        },
+    });
+    return findings;
+}

package/dist/rules/zodPreFilter.d.ts

@@ -0,0 +1,9 @@
+export interface ZodCandidate {
+    id: string;
+    codeFragment: string;
+    /** fragmentLineToSourceLine[i] = the original 1-based source line for fragment line i+1. Lets
+     *  resolveProtectedLogic() translate a server-reported fragment line back to a real location,
+     *  since the fragment is a non-contiguous excerpt of the original file, not a raw slice. */
+    fragmentLineToSourceLine: number[];
+}
+export declare function findZodCandidates(source: string, filePath: string, root: string): ZodCandidate[];

package/dist/rules/zodPreFilter.js

@@ -0,0 +1,91 @@
+import { relative } from "node:path";
+import { redactSecrets } from "../engine/secretRedaction.js";
+import { parseSource } from "../engine/astUtils.js";
+/**
+ * The real Zod schema/anchor detection (which call sites count as "this validates incoming request
+ * data" vs. a third-party API response or an env-var schema — the actual scope-boundary reasoning)
+ * runs server-side now (protected-logic cloud service). This module's only job is deciding WHETHER a
+ * file is worth sending, and extracting a syntactically complete, minimal fragment to send — not the
+ * tuned "is this genuinely a request-input validator" logic itself.
+ *
+ * Extraction is AST-boundary-based, not a raw line-count window: earlier drafts joined arbitrary
+ * +/-N-line windows around each anchor/declaration, which silently produced invalid syntax whenever a
+ * window boundary landed inside a multi-line import, or inside a long enclosing function — a real
+ * golden-corpus file (formbricks' signup action) hit both, and the whole fragment failed to parse
+ * server-side with zero error surfaced (a schema simply went undetected). Extracting whole top-level
+ * statements instead guarantees every included chunk is independently valid, so concatenating a subset
+ * of them is always a valid Program — no re-implementation of the protected scope-boundary reasoning
+ * is needed to get that guarantee, just "which top-level statement is this line part of."
+ */
+const ZOD_IMPORT_RE = /from\s+["']zod(?:\/v[34](?:-mini)?)?["']/;
+const ANCHOR_CALL_RE = /\.(?:parse|safeParse|parseAsync|safeParseAsync|inputSchema)\s*\(/;
+// Resolving "which identifier does this anchor call reference, and where is IT declared at the top
+// level" is plain lexical lookup, not the protected scope-boundary judgment — safe to do locally so a
+// schema declared far from its anchor (very common: define near the top, use in an export lower down)
+// still gets included.
+const INPUT_SCHEMA_ARG_RE = /\.inputSchema\(\s*([A-Za-z_$][\w$]*)/;
+const PARSE_RECEIVER_RE = /([A-Za-z_$][\w$]*)\.(?:parse|safeParse|parseAsync|safeParseAsync)\(/;
+function lineRange(node) {
+    if (!node.loc)
+        return null;
+    return [node.loc.start.line - 1, node.loc.end.line - 1]; // 0-based, inclusive
+}
+function findEnclosingStatement(body, line0) {
+    return body.find((stmt) => stmt.loc && stmt.loc.start.line - 1 <= line0 && line0 <= stmt.loc.end.line - 1);
+}
+function findDeclarationStatement(body, name) {
+    return body.find((stmt) => stmt.type === "VariableDeclaration" &&
+        stmt.declarations.some((d) => d.id.type === "Identifier" && d.id.name === name));
+}
+export function findZodCandidates(source, filePath, root) {
+    if (!ZOD_IMPORT_RE.test(source))
+        return [];
+    const lines = source.split("\n");
+    const matchLineIndexes = [];
+    lines.forEach((line, i) => {
+        if (ANCHOR_CALL_RE.test(line))
+            matchLineIndexes.push(i);
+    });
+    if (matchLineIndexes.length === 0)
+        return [];
+    const ast = parseSource(source, filePath);
+    if (!ast)
+        return [];
+    const body = ast.program.body;
+    const includedLines = new Set();
+    const includeRange = (range) => {
+        if (!range)
+            return;
+        for (let i = range[0]; i <= range[1]; i++)
+            includedLines.add(i);
+    };
+    for (const directive of ast.program.directives)
+        includeRange(lineRange(directive));
+    for (const stmt of body) {
+        if (stmt.type === "ImportDeclaration")
+            includeRange(lineRange(stmt));
+    }
+    // One candidate per file, not per match — a single fragment covering every anchor-shaped
+    // statement plus the top-of-file imports, merged and deduped. Keeps this a single call per file
+    // rather than one per match; the server already handles "multiple schemas in one fragment" naturally.
+    for (const matchLine of matchLineIndexes) {
+        const enclosing = findEnclosingStatement(body, matchLine);
+        if (!enclosing)
+            continue;
+        includeRange(lineRange(enclosing));
+        const line = lines[matchLine];
+        const referencedName = line.match(INPUT_SCHEMA_ARG_RE)?.[1] ?? line.match(PARSE_RECEIVER_RE)?.[1];
+        if (!referencedName)
+            continue;
+        const declStmt = findDeclarationStatement(body, referencedName);
+        if (declStmt)
+            includeRange(lineRange(declStmt));
+    }
+    if (includedLines.size === 0)
+        return [];
+    const sortedIndexes = [...includedLines].sort((a, b) => a - b);
+    const fragment = sortedIndexes.map((i) => lines[i]).join("\n");
+    const fragmentLineToSourceLine = sortedIndexes.map((i) => i + 1);
+    const relPath = relative(root, filePath);
+    return [{ id: relPath, codeFragment: redactSecrets(fragment), fragmentLineToSourceLine }];
+}

package/dist/schemaParsers/graphql.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../engine/types.js";
+export declare function parseGraphQLSchema(filePath: string, root: string): Finding[];

package/dist/schemaParsers/graphql.js

@@ -0,0 +1,52 @@
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+import { classifyFieldName, isAmbiguousFieldName } from "../rules/dataCategoryLexicon.js";
+import { isSafeFieldName } from "../rules/safeFieldNames.js";
+const TYPE_BLOCK_START = /^\s*(type|input)\s+(\w+)/;
+const FIELD_LINE = /^\s*(\w+)\s*(\([^)]*\))?\s*:\s*[\[\]!\w]+/;
+const GRAPHQL_CONNECTION_FIELDS = new Set(["edges", "node", "pageInfo", "cursor", "hasNextPage", "hasPreviousPage", "totalCount"]);
+export function parseGraphQLSchema(filePath, root) {
+    const raw = readFileSync(filePath, "utf8");
+    const relPath = relative(root, filePath);
+    const lines = raw.split("\n");
+    const findings = [];
+    let depth = 0;
+    let inTypeBlock = false;
+    lines.forEach((rawLine, idx) => {
+        const line = rawLine.split("#")[0];
+        if (TYPE_BLOCK_START.test(line)) {
+            inTypeBlock = true;
+            depth = 0;
+        }
+        if (inTypeBlock) {
+            depth += (line.match(/{/g) ?? []).length;
+            depth -= (line.match(/}/g) ?? []).length;
+            if (depth <= 0 && line.includes("}")) {
+                inTypeBlock = false;
+                return;
+            }
+            const fieldMatch = FIELD_LINE.exec(line);
+            if (fieldMatch && !TYPE_BLOCK_START.test(line)) {
+                const fieldName = fieldMatch[1];
+                if (GRAPHQL_CONNECTION_FIELDS.has(fieldName) || isSafeFieldName(fieldName))
+                    return;
+                const category = classifyFieldName(fieldName);
+                const ambiguous = isAmbiguousFieldName(fieldName);
+                findings.push({
+                    id: `graphql:${relPath}:${idx + 1}:${fieldName}`,
+                    dataCategories: category ? [category] : ["generic_pii"],
+                    processor: null,
+                    description: category
+                        ? `GraphQL field "${fieldName}" classified as ${category}.`
+                        : `GraphQL field "${fieldName}" could not be confidently classified — needs review.`,
+                    confidence: category ? "medium" : "low",
+                    source: "graphql",
+                    location: { file: relPath, line: idx + 1, column: 0 },
+                    evidence: line.trim(),
+                    requiresReview: ambiguous || !category,
+                });
+            }
+        }
+    });
+    return findings;
+}

package/dist/schemaParsers/openapi.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../engine/types.js";
+export declare function parseOpenApiSpec(filePath: string, root: string): Finding[];

package/dist/schemaParsers/openapi.js

@@ -0,0 +1,60 @@
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+import { parseDocument, LineCounter, isMap, isPair, isScalar } from "yaml";
+import { classifyFieldName, isAmbiguousFieldName } from "../rules/dataCategoryLexicon.js";
+import { isSafeFieldName } from "../rules/safeFieldNames.js";
+export function parseOpenApiSpec(filePath, root) {
+    const raw = readFileSync(filePath, "utf8");
+    const lineCounter = new LineCounter();
+    const doc = parseDocument(raw, { lineCounter, keepSourceTokens: true });
+    if (!doc.contents)
+        return [];
+    const relPath = relative(root, filePath);
+    const findings = [];
+    const seen = new Set();
+    const schemasNode = doc.getIn(["components", "schemas"], true);
+    if (isMap(schemasNode)) {
+        for (const schemaPair of schemasNode.items) {
+            if (!isPair(schemaPair))
+                continue;
+            const schemaBody = schemaPair.value;
+            if (!isMap(schemaBody))
+                continue;
+            const properties = schemaBody.get("properties", true);
+            if (!isMap(properties))
+                continue;
+            for (const propPair of properties.items) {
+                if (!isPair(propPair) || !isScalar(propPair.key))
+                    continue;
+                const fieldName = String(propPair.key.value);
+                const range = propPair.key.range;
+                const line = lineCounter.linePos(range ? range[0] : 0).line;
+                pushFinding(fieldName, line, relPath, findings, seen);
+            }
+        }
+    }
+    return findings;
+}
+function pushFinding(fieldName, line, relPath, findings, seen) {
+    if (isSafeFieldName(fieldName))
+        return;
+    const key = `${relPath}:${fieldName}`;
+    if (seen.has(key))
+        return;
+    seen.add(key);
+    const category = classifyFieldName(fieldName);
+    const ambiguous = isAmbiguousFieldName(fieldName);
+    findings.push({
+        id: `openapi:${relPath}:${line}:${fieldName}`,
+        dataCategories: category ? [category] : ["generic_pii"],
+        processor: null,
+        description: category
+            ? `OpenAPI schema field "${fieldName}" classified as ${category}.`
+            : `OpenAPI schema field "${fieldName}" could not be confidently classified — needs review.`,
+        confidence: category ? "medium" : "low",
+        source: "openapi",
+        location: { file: relPath, line, column: 0 },
+        evidence: fieldName,
+        requiresReview: ambiguous || !category,
+    });
+}