@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/103-ci-workflow-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"103-ci-workflow-auditor.js","sourceRoot":"","sources":["../../agents/103-ci-workflow-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,aAAa,GAAG,uFAAuF,CAAC;AAC9G,gFAAgF;AAChF,MAAM,aAAa,GAAG,6DAA6D,CAAC;AACpF;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC7E,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO;IAChF,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;IACtF,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ;IACjF,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS;IACtF,gFAAgF;IAChF,gFAAgF;IAChF,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB;IAC1E,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI;CACpE,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAuBD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAuC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAErC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjF,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,cAAc,GAClB,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QACzC,gEAAgE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,IAAI,qBAAqB,IAAI,cAAc,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,EAAE,+CAA+C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,MAAM,sBAAsB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,+EAA+E;SACxF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAEjC,wEAAwE;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC7C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,+DAA+D;YAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtD,IAAI,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB;YAC1E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,qBAAqB,CAAC;IAEjC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe;gBAClC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,8DAA8D;aAC5E,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAE1F,MAAM,KAAK,GAAG,CAAC,CAAc,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,sBAAsB,SAAS,CAAC,MAAM,iBAAiB,OAAO,CAAC,MAAM,cAAc,KAAK,CAAC,8BAA8B,CAAC,iBAAiB,KAAK,CAAC,kBAAkB,CAAC,sBAAsB,KAAK,CAAC,iBAAiB,CAAC,qBAAqB,KAAK,CAAC,yBAAyB,CAAC,gBAAgB;SACnS,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,GAAkB;QAClC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACtG,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,8BAA8B;gBACjC,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iCAAiC,IAAI,EAAE;oBAC1D,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,UAAU;oBACpB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,+SAA+S;iBACxU,CAAC;YACJ,KAAK,kBAAkB;gBACrB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,EAAE;oBAC9C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,wCAAwC,GAAG,CAAC,MAAM,sFAAsF,GAAG,CAAC,MAAM,MAAM;iBAC7L,CAAC;YACJ,KAAK,iBAAiB;gBACpB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,IAAI,EAAE;oBAC7C,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,4CAA4C,GAAG,CAAC,MAAM,mGAAmG;iBAC9L,CAAC;YACJ,KAAK,yBAAyB;gBAC5B,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,4BAA4B,IAAI,EAAE;oBACrD,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,kJAAkJ;iBAC3K,CAAC;QACN,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,SAAmB,EAAE,IAAqB;QAClF,MAAM,KAAK,GAAoB;YAC7B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,SAAS;YACT,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAChD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,iCAAiC;gBACvC,WAAW,EAAE,sBAAsB,IAAI,CAAC,MAAM,oBAAoB,SAAS,CAAC,MAAM,cAAc;aACjG,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/104-n-plus-one-detector.d.ts

@@ -0,0 +1,57 @@
+/**
+ * N+1 Query Detector — static heuristic that flags ORM/database queries
+ * executed inside a loop body. Querying per-iteration instead of batching
+ * is the classic N+1: invisible on a 3-row dev database, a latency cliff
+ * (and DB-connection exhaustion) on a 50k-row production table.
+ *
+ * Detection: find loop-body spans (for / for-of / for-await / while /
+ * .map / .forEach / .flatMap) and flag any ORM query call whose position
+ * falls inside one. ORM call shapes reuse the conventions from #94:
+ *   - Prisma:  prisma.<model>.findMany / findUnique / findFirst / count / ...
+ *   - Drizzle: db.select(...).from / db.query.<x> / db.insert/update/delete
+ *   - TypeORM / generic repo: <repo>.find / findOne / findBy / findOneBy
+ *   - Raw:     knex(...), .query(, .execute(
+ *
+ * Severity is medium / advisory — a query in a loop is *usually* an N+1
+ * but can be deliberate (bounded, transactional), so it's flagged for
+ * review, not asserted as a bug.
+ *
+ * Persists `evidence/n-plus-one-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface NPlusOneHit {
+    file: string;
+    line: number;
+    loop: string;
+    snippet: string;
+}
+export interface NPlusOneAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: NPlusOneHit[];
+}
+interface LoopSpan {
+    start: number;
+    end: number;
+    kind: string;
+}
+/** Find the body spans of all loops in a file. */
+export declare function findLoopSpans(content: string): LoopSpan[];
+/**
+ * Scan a file for ORM query calls that fall inside a loop body. Returns the
+ * innermost enclosing loop kind for each hit. Dedupes by line.
+ */
+export declare function scanNPlusOne(content: string): Array<Omit<NPlusOneHit, 'file'>>;
+export declare class NPlusOneDetectorAgent extends BaseAgent {
+    readonly agentId = 104;
+    readonly agentName = "N+1 Query Detector";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+export {};
+//# sourceMappingURL=104-n-plus-one-detector.d.ts.map

package/dist/agents/104-n-plus-one-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"104-n-plus-one-detector.d.ts","sourceRoot":"","sources":["../../agents/104-n-plus-one-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAqBzC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,EAAE,CAAC;CACrB;AA0DD,UAAU,QAAQ;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CA6BzD;AAaD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAkD9E;AAED,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,wBAAwB;cAE1B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwE7C,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/104-n-plus-one-detector.js

@@ -0,0 +1,329 @@
+/**
+ * N+1 Query Detector — static heuristic that flags ORM/database queries
+ * executed inside a loop body. Querying per-iteration instead of batching
+ * is the classic N+1: invisible on a 3-row dev database, a latency cliff
+ * (and DB-connection exhaustion) on a 50k-row production table.
+ *
+ * Detection: find loop-body spans (for / for-of / for-await / while /
+ * .map / .forEach / .flatMap) and flag any ORM query call whose position
+ * falls inside one. ORM call shapes reuse the conventions from #94:
+ *   - Prisma:  prisma.<model>.findMany / findUnique / findFirst / count / ...
+ *   - Drizzle: db.select(...).from / db.query.<x> / db.insert/update/delete
+ *   - TypeORM / generic repo: <repo>.find / findOne / findBy / findOneBy
+ *   - Raw:     knex(...), .query(, .execute(
+ *
+ * Severity is medium / advisory — a query in a loop is *usually* an N+1
+ * but can be deliberate (bounded, transactional), so it's flagged for
+ * review, not asserted as a bug.
+ *
+ * Persists `evidence/n-plus-one-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** ORM / DB query call shapes (the things that are expensive in a loop). */
+const ORM_CALL_PATTERNS = [
+    /\bprisma\.[a-zA-Z_$][\w$]*\.(?:findMany|findUnique|findFirst|create|update|upsert|delete|count|aggregate|groupBy)\b/,
+    /\bdb\.(?:select|insert|update|delete)\b/,
+    /\bdb\.query\.[a-zA-Z_$][\w$]*/,
+    /\.(?:findAll|findAndCountAll|findByPk|findById|findOne|findOneBy|findBy|aggregate|find)\s*\(/,
+    /(?<!this)\.(?:query|execute)\s*\(/,
+    /\bknex\s*\(/,
+];
+const ORM_CALL_RE = new RegExp(ORM_CALL_PATTERNS.map((r) => `(?:${r.source})`).join('|'), 'g');
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+/** Read a balanced `{...}` or `(...)` slice, string/comment-aware. */
+function readBalanced(content, openIdx, open) {
+    const close = open === '{' ? '}' : ')';
+    if (content[openIdx] !== open)
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    let lineComment = false;
+    let blockComment = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        const next = content[i + 1];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (lineComment) {
+            if (ch === '\n')
+                lineComment = false;
+            continue;
+        }
+        if (blockComment) {
+            if (ch === '*' && next === '/') {
+                blockComment = false;
+                i++;
+            }
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            lineComment = true;
+            i++;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            blockComment = true;
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === open)
+            depth++;
+        else if (ch === close) {
+            depth--;
+            if (depth === 0)
+                return { start: openIdx, end: i };
+        }
+    }
+    return null;
+}
+/** Find the body spans of all loops in a file. */
+export function findLoopSpans(content) {
+    const spans = [];
+    // Brace loops: for (...) { , for await (...) {, while (...) {
+    const braceLoop = /\b(for\s+await|for|while)\s*\(/g;
+    let m;
+    while ((m = braceLoop.exec(content)) !== null) {
+        // skip the header parens, then find the body brace
+        const headerParen = content.indexOf('(', m.index);
+        const header = readBalanced(content, headerParen, '(');
+        if (!header)
+            continue;
+        // next non-space char should be '{' for a block body
+        let j = header.end + 1;
+        while (j < content.length && /\s/.test(content[j]))
+            j++;
+        if (content[j] === '{') {
+            const body = readBalanced(content, j, '{');
+            if (body)
+                spans.push({ start: body.start, end: body.end, kind: m[1].trim() });
+        }
+    }
+    // Callback loops: .map( / .forEach( / .flatMap(  — body is the arg span.
+    const cbLoop = /\.(map|forEach|flatMap)\s*\(/g;
+    while ((m = cbLoop.exec(content)) !== null) {
+        const paren = m.index + m[0].length - 1;
+        const body = readBalanced(content, paren, '(');
+        if (body)
+            spans.push({ start: body.start, end: body.end, kind: `.${m[1]}()` });
+    }
+    return spans;
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/**
+ * Scan a file for ORM query calls that fall inside a loop body. Returns the
+ * innermost enclosing loop kind for each hit. Dedupes by line.
+ */
+export function scanNPlusOne(content) {
+    // Match against code only — loops/queries in comments or string literals
+    // aren't real. Line numbers/snippets come from the original source.
+    const masked = maskNonCode(content);
+    const spans = findLoopSpans(masked);
+    if (spans.length === 0)
+        return [];
+    const hits = [];
+    const seenLines = new Set();
+    const re = new RegExp(ORM_CALL_RE.source, 'g');
+    let m;
+    while ((m = re.exec(masked)) !== null) {
+        const idx = m.index;
+        // `Array.prototype.find(cb)` / `.findIndex(cb)` is not a DB query. Skip a
+        // bare `.find(` whose first argument is a callback (arrow / function).
+        if (/^\.find\s*\($/.test(m[0])) {
+            const after = masked.slice(idx + m[0].length, idx + m[0].length + 80);
+            // Array.prototype.find(cb) — first arg is a callback.
+            if (/^\s*(?:async\s+)?(?:function\b|(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>)/.test(after))
+                continue;
+            // jscodeshift / AST tooling: `root.find(j.TSTypeReference, …)` — first arg
+            // is an `obj.NodeType` reference, not a DB query filter. (A bare
+            // `manager.find(Entity, …)` has no dot in arg 1 and still flags.)
+            if (/^\s*[A-Za-z_$][\w$]*\s*\.\s*[A-Z]/.test(after))
+                continue;
+        }
+        // Find the innermost loop span containing this call (smallest span).
+        let enclosing = null;
+        for (const s of spans) {
+            if (idx > s.start && idx < s.end) {
+                if (!enclosing || s.end - s.start < enclosing.end - enclosing.start)
+                    enclosing = s;
+            }
+        }
+        if (!enclosing)
+            continue;
+        // Batch pagination is not an N+1: a query carrying a take/cursor/skip bound
+        // inside a `while` / `for await` loop walks the table in fixed-size pages
+        // (the correct pattern), unlike a per-item query in a `for…of` / `.map`.
+        if (enclosing.kind === 'while' || enclosing.kind === 'for await') {
+            const parenIdx = masked.indexOf('(', idx + m[0].length);
+            if (parenIdx !== -1 && parenIdx - (idx + m[0].length) <= 2) {
+                const args = readBalanced(masked, parenIdx, '(');
+                if (args && /\b(?:take|cursor|skip|first|last)\s*:/.test(masked.slice(args.start, args.end + 1))) {
+                    continue;
+                }
+            }
+        }
+        const line = lineOf(content, idx);
+        if (seenLines.has(line))
+            continue;
+        seenLines.add(line);
+        hits.push({ line, loop: enclosing.kind, snippet: snippetOf(content, idx) });
+    }
+    return hits;
+}
+export class NPlusOneDetectorAgent extends BaseAgent {
+    agentId = 104;
+    agentName = 'N+1 Query Detector';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanNPlusOne(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'n-plus-one-detector',
+                description: `Scanned ${filesScanned} non-test file(s) — no database queries found inside loop bodies.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push({
+                id: `${this.agentId}-n-plus-one-${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`,
+                type: 'code-bug-logic',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'n-plus-one-detector',
+                description: `Database query inside a ${hit.loop} loop at ${hit.file}:${hit.line} — likely an N+1. Each iteration issues its own query; on a large dataset that's a latency cliff and can exhaust the connection pool. Batch it (e.g. a single \`findMany({ where: { id: { in: [...] } } })\` or a join/include). \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'n-plus-one-detector',
+            description: `N+1 audit: ${allHits.length} query-in-loop site(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'n-plus-one-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/n-plus-one-audit.json',
+                description: `N+1 audit: ${hits.length} query-in-loop site(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=104-n-plus-one-detector.js.map

package/dist/agents/104-n-plus-one-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"104-n-plus-one-detector.js","sourceRoot":"","sources":["../../agents/104-n-plus-one-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,iBAAiB,GAA0B;IAC/C,qHAAqH;IACrH,yCAAyC;IACzC,+BAA+B;IAC/B,8FAA8F;IAC9F,mCAAmC;IACnC,aAAa;CACd,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAiB/F,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe,EAAE,IAAe;IACrE,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,EAAE,CAAC;YAAC,MAAM,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAAC,IAAI,EAAE,KAAK,IAAI;gBAAE,WAAW,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACpE,IAAI,YAAY,EAAE,CAAC;YAAC,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAAC,YAAY,GAAG,KAAK,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9F,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,WAAW,GAAG,IAAI,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtE,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,YAAY,GAAG,IAAI,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,IAAI,EAAE,KAAK,IAAI;YAAE,KAAK,EAAE,CAAC;aACpB,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,8DAA8D;IAC9D,MAAM,SAAS,GAAG,iCAAiC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,mDAAmD;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,qDAAqD;QACrD,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,MAAM,GAAG,+BAA+B,CAAC;IAC/C,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;QACpB,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YACtE,sDAAsD;YACtD,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YAChG,2EAA2E;YAC3E,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;QAChE,CAAC;QACD,qEAAqE;QACrE,IAAI,SAAS,GAAoB,IAAI,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,KAAK;oBAAE,SAAS,GAAG,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,IAAI,IAAI,uCAAuC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjG,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,SAAS;IACzC,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,oBAAoB,CAAC;IAEhC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,WAAW,YAAY,mEAAmE;aACxG,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE;gBAC/E,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,2BAA2B,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,sOAAsO,GAAG,CAAC,OAAO,IAAI;gBACrU,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,cAAc,OAAO,CAAC,MAAM,iCAAiC,YAAY,WAAW;SAClG,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAmB;QACjF,MAAM,KAAK,GAAkB;YAC3B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,cAAc,IAAI,CAAC,MAAM,iCAAiC,YAAY,UAAU;aAC9F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/105-unbounded-query-auditor.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Unbounded Query Auditor — static check for list queries that fetch a
+ * whole table with no row limit. Sibling to #104 (N+1): where #104 catches
+ * "too many queries", this catches "one query, too many rows". A
+ * `findMany()` with no `take` is fine on a 10-row dev table and an OOM /
+ * timeout on a 10M-row prod table.
+ *
+ * Detected patterns:
+ *   - Prisma:  prisma.<model>.findMany(...) whose args contain no `take`.
+ *              (Empty findMany() is the clearest case.)
+ *   - Drizzle: a db.select()... .from(...) statement with no `.limit(` and
+ *              no `.where(` before the statement terminator. (A `where`
+ *              clause means the result is at least scoped; we only flag the
+ *              clearly-unbounded full-table reads.)
+ *
+ * Findings:
+ *   - 105-unbounded-findmany    medium  code-bug-logic
+ *   - 105-unbounded-select      medium  code-bug-logic
+ *   - 105-clean / 105-summary   info
+ *
+ * Medium / advisory — small lookup tables make this a non-issue, so it's
+ * flagged for review, not asserted. Persists
+ * `evidence/unbounded-query-audit.json`. Read-only, parallel-safe, static.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type UnboundedKind = 'unbounded-findmany' | 'unbounded-select' | 'unbounded-findall';
+export interface UnboundedHit {
+    kind: UnboundedKind;
+    file: string;
+    line: number;
+    snippet: string;
+}
+export interface UnboundedQueryAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: UnboundedHit[];
+}
+/** Scan a file for unbounded Prisma findMany / Drizzle select statements. */
+export declare function scanUnbounded(content: string): Array<Omit<UnboundedHit, 'file'>>;
+export declare class UnboundedQueryAuditorAgent extends BaseAgent {
+    readonly agentId = 105;
+    readonly agentName = "Unbounded Query Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=105-unbounded-query-auditor.d.ts.map

package/dist/agents/105-unbounded-query-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"105-unbounded-query-auditor.d.ts","sourceRoot":"","sources":["../../agents/105-unbounded-query-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAE5F,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA6DD,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAgEhF;AAQD,qBAAa,0BAA2B,SAAQ,SAAS;IACvD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,6BAA6B;cAE/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAyE7C,OAAO,CAAC,YAAY;CAyBrB"}