//! Claim extractors for finding implicit decisions in source code.
//!
//! Each extractor looks for specific patterns that represent implicit claims:
//! - `tls_verify`: TLS certificate verification settings
//! - `tls_version`: Deprecated TLS versions (1.0, 1.1) per RFC 8996
//! - `jwt_config`: JWT validation configuration
//! - `hardcoded_secrets`: Credentials in source code
//! - `timeout_config`: HTTP/DB/Redis timeout values
//! - `dep_versions`: Dependency versions for advisory lookup
//! - `cors_config`: CORS allow-origin settings
//! - `durability_config`: WAL durability/fsync strategy settings
//! - `rate_limit`: Rate limiting configuration
//! - `weak_crypto`: Weak cryptographic algorithms (MD5, SHA1, DES, RC4)
//! - `sql_injection`: SQL query construction with string interpolation
//! - `command_injection`: OS command execution with shell/untrusted input
//! - `unreal_cpp`: Unreal Engine C++ security patterns (Exec functions)
//! - `unreal_config`: Unreal Engine INI configuration patterns
//! - `unreal_performance`: Unreal Engine performance pitfalls (Sync loading)
//! - `high_entropy_secrets`: High-entropy strings likely to be leaked secrets
//! - `auth_bypass`: Authentication bypass patterns (hardcoded creds, debug auth)
//! - `api_key_security`: API key authentication and rate limiting misconfigurations
//! - `import_graph`: Rust `use` statements for architecture boundary tracking
//! - `derive_pattern`: Rust `#[derive(...)]` annotations for API consistency
//! - `const_declarations`: Rust `const`/`static` declarations for provenance tracking
//! - `unsafe_atomic`: Rust `unsafe` blocks and `Ordering::*` patterns for safety conventions
//! - `circuit_breaker_config`: Circuit breaker disabled or missing
//! - `insecure_cookies`: Cookies missing Secure/HttpOnly flags
//! - `path_traversal`: File operations with user-controlled paths
//! - `unvalidated_redirects`: HTTP redirects with user-controlled URLs
//! - `weak_password`: Weak password policy configurations
//! - `security_headers`: Missing or disabled security headers
//! - `insecure_deserialization`: Unsafe deserialization (pickle, yaml.load, etc.)
//! - `ssrf`: HTTP requests with user-controlled URLs
//! - `orm_injection`: ORM methods with string interpolation
//! - `xxe`: XML parsing without external entity protection
//! - `config_security`: Deep parsing of YAML/JSON/TOML for nested security issues
//!
//! ## Framework-Specific Security Extractors (Phase 8.2)
//!
//! - `django_security`: Django settings and code security patterns
//! - `express_security`: Express.js middleware and cookie security
//! - `flask_security`: Flask configuration and code security
//! - `fastapi_security`: FastAPI CORS and authentication patterns
//! - `nestjs_security`: NestJS decorators and TypeORM injection
//! - `nextjs_security`: Next.js middleware bypass (CVE-2025-29927), Server Actions
//! - `spring_security`: Spring Boot CSRF, security config, actuator exposure
//! - `laravel_security`: Laravel APP_DEBUG, mass assignment, DB::raw injection
//! - `rails_security`: Rails CSRF, SQL injection, html_safe XSS
//! - `aspnet_security`: ASP.NET Core JWT validation, antiforgery, CORS
//!
//! # Declarative Extractors
//!
//! Users can also define custom extractors via `aphoria.toml` without writing
//! Rust code. See [`DeclarativeExtractor`] for details.

mod api_key_security;
mod aspnet_security;
mod auth_bypass;
mod circuit_breaker_config;
mod command_injection;
mod config_parser;
mod config_security;
mod const_declarations;
mod cors_config;
mod declarative;
mod dep_versions;
mod derive_pattern;
mod django_security;
mod durability_config;
mod express_security;
mod fastapi_security;
mod flask_security;
mod hardcoded_secrets;
mod high_entropy;
mod ignore_comments;
mod import_graph;
mod insecure_cookies;
mod insecure_deserialization;
mod jwt_config;
mod laravel_security;
mod nestjs_security;
mod nextjs_security;
mod orm_injection;
mod path_traversal;
mod rails_security;
mod rate_limit;
mod registry;
mod security_headers;
mod spring_security;
mod sql_injection;
mod ssrf;
mod timeout_config;
mod tls_verify;
mod tls_version;
mod traits;
mod unreal_config;
mod unreal_cpp;
mod unreal_performance;
mod unsafe_atomic;
mod unvalidated_redirects;
mod weak_crypto;
mod weak_password;
mod xxe;

pub use api_key_security::ApiKeySecurityExtractor;
pub use aspnet_security::AspNetSecurityExtractor;
pub use auth_bypass::AuthBypassExtractor;
pub use circuit_breaker_config::CircuitBreakerConfigExtractor;
pub use command_injection::CommandInjectionExtractor;
pub use config_parser::{parse_config, walk_config, ConfigParseError, ConfigValue};
pub use config_security::ConfigSecurityExtractor;
pub use const_declarations::ConstDeclarationsExtractor;
pub use cors_config::CorsConfigExtractor;
pub use declarative::{
    DeclarativeClaimDef, DeclarativeExtractor, DeclarativeExtractorDef, DeclarativeValue,
};
pub use dep_versions::DepVersionsExtractor;
pub use derive_pattern::DerivePatternExtractor;
pub use django_security::DjangoSecurityExtractor;
pub use durability_config::DurabilityConfigExtractor;
pub use express_security::ExpressSecurityExtractor;
pub use fastapi_security::FastApiSecurityExtractor;
pub use flask_security::FlaskSecurityExtractor;
pub use hardcoded_secrets::HardcodedSecretsExtractor;
pub use high_entropy::HighEntropySecretsExtractor;
pub use ignore_comments::IgnoreCommentParser;
pub use import_graph::ImportGraphExtractor;
pub use insecure_cookies::InsecureCookiesExtractor;
pub use insecure_deserialization::InsecureDeserializationExtractor;
pub use jwt_config::JwtConfigExtractor;
pub use laravel_security::LaravelSecurityExtractor;
pub use nestjs_security::NestJsSecurityExtractor;
pub use nextjs_security::NextJsSecurityExtractor;
pub use orm_injection::OrmInjectionExtractor;
pub use path_traversal::PathTraversalExtractor;
pub use rails_security::RailsSecurityExtractor;
pub use rate_limit::{RateLimitExtractor, RateLimitThresholds};
pub use registry::ExtractorRegistry;
pub use security_headers::SecurityHeadersExtractor;
pub use spring_security::SpringSecurityExtractor;
pub use sql_injection::SqlInjectionExtractor;
pub use ssrf::SsrfExtractor;
pub use timeout_config::{TimeoutConfigExtractor, TimeoutThresholds};
pub use tls_verify::TlsVerifyExtractor;
pub use tls_version::TlsVersionExtractor;
pub use traits::{build_claim, is_test_file, Extractor};
pub use unreal_config::UnrealConfigExtractor;
pub use unreal_cpp::UnrealCppExtractor;
pub use unreal_performance::UnrealPerformanceExtractor;
pub use unsafe_atomic::UnsafeAtomicExtractor;
pub use unvalidated_redirects::UnvalidatedRedirectsExtractor;
pub use weak_crypto::WeakCryptoExtractor;
pub use weak_password::WeakPasswordExtractor;
pub use xxe::XxeExtractor;
