callgraph

type Builder struct {
	// contains filtered or unexported fields
}

type BytecodeIndexCache interface {
	Get(ctx context.Context, key string) (*CachedBytecodeIndex, bool, error)
	Put(ctx context.Context, key string, value *CachedBytecodeIndex) error
}

type CachedBytecodeIndex struct {
	SchemaVersion int
	ArtifactKey   string
	MethodsIndex  map[string][]methodSignature
	TypeHierarchy map[string][]string
}

type CallChain struct {
	// Steps is ordered from user entry point to crypto call site
	Steps []CallChainStep
}

type CallChainStep struct {
	Function FunctionID
	FilePath string
	Line     int
}

type CallGraph struct {
	// Functions maps FunctionID.String() to its declaration
	Functions map[string]*FunctionDecl
	// Callers maps callee FunctionID.String() to list of caller FunctionID.String()
	// This is the reverse index for walking backwards from a crypto finding.
	Callers map[string][]string
	// TypeHierarchy maps a fully qualified type name to its fully qualified parent
	// interfaces/superclasses. E.g., "io.jsonwebtoken.JwtBuilder" →
	// ["io.jsonwebtoken.ClaimsMutator"]. Populated by TypeResolver from bytecode.
	TypeHierarchy map[string][]string
	// ExternalMethodSignatures stores resolver-derived signatures for methods that
	// are known to the graph by symbol but do not have a source declaration.
	// Keyed by fully qualified method + arity via ExternalMethodSignatureKey.
	ExternalMethodSignatures map[string][]ExternalMethodSignature
	// JavaPlatformSignatures records whether Java platform signatures from the
	// pinned runtime were available and used for this graph build.
	JavaPlatformSignatures *JavaPlatformSignatureMetadata
	// EdgeResolutions records how each caller->callee call-site/dispatch variant
	// was resolved. Keyed by EdgeResolutionKey(callerKey, calleeKey, resolution).
	// An edge with no entry is an exact, directly-resolved source call. Consumers
	// (the graph fragment export and the mining-service stitcher) use this to
	// refuse to present over-broad name/arity dispatch guesses as typed
	// reachability proof.
	EdgeResolutions map[string]EdgeResolution
}

type DiskBytecodeIndexCache struct {
	// contains filtered or unexported fields
}

type EdgeKind string

type EdgeResolution struct {
	Kind         EdgeKind
	DeclaredType string // interface/static type for dispatch edges (e.g. "dep.Sink")
	MethodName   string // base method name (no arity decoration)
	Arity        int
	CallSite     int // source line of the call expression
}

type ExternalMethodSignature struct {
	ParameterTypes    []string
	ReturnType        string
	ParameterTypeRefs []TypeRef
	ReturnTypeRef     TypeRef
}

type FileAnalysis struct {
	FilePath              string
	PackageName           string
	PackagePath           string
	Imports               map[string]string // alias (or last path segment) -> full import path
	ImportedTypes         map[string]bool   // imported symbol alias -> inferred class/type
	WildcardImports       []string          // wildcard import prefixes (e.g., "java.security")
	StaticWildcardImports []string          // static wildcard owner types (e.g., "java.util.Collections")
	Functions             []FunctionDecl
}

type FunctionCall struct {
	// Callee is the resolved target function
	Callee FunctionID
	// ReceiverVar preserves the original receiver variable name for selector calls
	// like `cipher.Encrypt()` when static type information is incomplete.
	ReceiverVar string
	// Raw is the raw call expression text (e.g., "aes.NewCipher")
	Raw string
	// FilePath is the file containing this call
	FilePath string
	// Line is the line number of the call
	Line int
	// Arguments are the raw argument expressions passed in this invocation.
	Arguments []string
	// ArgumentSources traces where each argument value comes from.
	// Parallel to Arguments — same indices. Populated by the parser's data flow analysis.
	ArgumentSources [][]SourceNode
}

type FunctionDecl struct {
	ID              FunctionID
	FilePath        string
	StartLine       int
	EndLine         int
	OwnerType       string
	OwnerName       string
	FunctionType    string
	ReturnType      string
	ReturnTypeRef   TypeRef
	Visibility      string
	OwnerVisibility string
	Parameters      []FunctionParameter
	Calls           []FunctionCall
	// ReturnSources traces where return values originate; populated by parsers (v1: Java only).
	ReturnSources []SourceNode
	// InferredReturn is the result of the post-build inference pass; nil when no inference fires.
	InferredReturn *InferredReturn
}

type FunctionID struct {
	// Package is the full package/module path (e.g., "crypto/aes" or "javax.crypto")
	Package string
	// Type is the owning type for methods (Go: receiver like "*Block", Java: class like "Cipher").
	// Empty for plain functions.
	Type string
	// Name is the function/method name (e.g., "NewCipher")
	Name string
}

type FunctionParameter struct {
	Type    string
	TypeRef TypeRef
}

type GoParser struct {
	// contains filtered or unexported fields
}

type InferredReturn struct {
	// Type is the inferred fully-qualified return type name, e.g. "javax.crypto.SecretKey".
	Type string
	// TypeRef is the structured generic form when applicable; zero value when none.
	TypeRef TypeRef
	// Confidence is the inference confidence level: "high", "medium", or "low".
	Confidence string
	// Origin is one of: "constructor", "kb-direct", "kb-conditional", "propagated",
	// or the internal-only "join-failed" (never exported).
	Origin string
	// Provenance is the recursive provenance chain (subset of ReturnSources, normalised).
	Provenance []SourceNode
}

type JavaBytecodeTypeResolver struct {
	// contains filtered or unexported fields
}

type JavaParser struct {
	// contains filtered or unexported fields
}

type JavaPlatformSignatureMetadata struct {
	RequestedMajor    string
	RuntimeVersion    string
	SignaturesUsed    bool
	SignatureSource   string
	UnavailableReason string
}

type PackageDir struct {
	Dir                  string // Absolute filesystem path
	ImportPath           string // Package/module path (e.g., "crypto/aes" or "javax.crypto")
	Version              string // Dependency version when applicable (e.g., "1.2.3")
	CompiledArtifactPath string // Absolute path to a compiled artifact for type-only resolution
}

type Parser interface {
	// ParseDirectory parses all relevant source files in dir.
	// packagePath is the canonical namespace (Go import path, Java package, etc.).
	ParseDirectory(dir string, packagePath string) ([]*FileAnalysis, error)
	// SkipDirs returns directory names to skip during recursive traversal.
	SkipDirs() map[string]bool
	// SubPackagePath constructs a child package path from parent + directory name.
	SubPackagePath(parentPath, dirName string) string
	// PackageSeparator returns the separator used in package paths ("/" for Go, "." for Java).
	PackageSeparator() string
}

type ParserOption func(*parserConfig)

type PythonParser struct {
	// contains filtered or unexported fields
}

type RustParser struct {
	// contains filtered or unexported fields
}

type SourceLocation struct {
	FilePath string
	Line     int
}

type SourceNode struct {
	// Type classifies the origin: VALUE, VARIABLE, FIELD, PARAMETER, CALL_RESULT, EXPRESSION
	Type string
	// Name is the variable/field/parameter name (e.g., "secret", "algorithm")
	Name string
	// DeclaredType is the type if known (e.g., "byte[]", "io.jsonwebtoken.SignatureAlgorithm")
	DeclaredType string
	// Value is the actual value for VALUE nodes (e.g., "\"AES\"", "256")
	Value string
	// ParameterIndex is set for PARAMETER nodes — which param (0-based)
	ParameterIndex int
	// CallTarget is set for CALL_RESULT nodes — the function that produced this value
	CallTarget *FunctionID
	// Location is where this source is defined
	Location *SourceLocation
	// SourceNodes traces where THIS node's value came from (recursive)
	SourceNodes []SourceNode
}

type StrictResolver interface {
	StrictFailure() bool
}

type Tracer struct {
	// contains filtered or unexported fields
}

type TypeRef struct {
	Name              string
	GenericParameters []TypeRef
}

type TypeResolver interface {
	// ResolveTypes enriches function declarations and calls in the graph with
	// type information that tree-sitter alone cannot provide. It receives the
	// full graph and the source/artifact directories, and modifies calls in-place.
	ResolveTypes(graph *CallGraph, sourceRoots []PackageDir) error
}