@mocoto/mahoraga 0.14.0

package/dist/analysts/sql/detectors/detector-sql.js

@@ -0,0 +1,207 @@
+import { messages } from '../../../core/messages/index.js';
+import { splitLines } from '../../../shared/helpers/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+const detectoresRegistrados = [];
+export function registrarDetectorSql(detector) {
+    detectoresRegistrados.push(detector);
+}
+export function obterDetectoresSql() {
+    return [...detectoresRegistrados];
+}
+const SQL_KEYWORDS = /\b(select|insert|update|delete|create|alter|drop|truncate|grant|revoke)\b/i;
+const ORM_PATTERNS = /\b(prisma|typeorm|sequelize|drizzle|knex|mikro-orm|entity|repository|@entity|@column|@table)\b/i;
+function detectarContextoOrm(src) {
+    return ORM_PATTERNS.test(src);
+}
+function criarDetectado(relPath, linha, tipo, nivel, mensagem, sugestao) {
+    return criarOcorrencia({ tipo, nivel, mensagem, relPath, linha, sugestao });
+}
+export const detectorSql = {
+    nome: 'detector-sql',
+    categoria: 'database',
+    descricao: 'Detector SQL abrangente: segurança, injeção, performance e boas práticas',
+    test: (relPath) => /\.(sql|pgsql|mysql|sqlite)$/i.test(relPath),
+    aplicar: (src, relPath, _ast, _fc, _ctx) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        const linhas = splitLines(src);
+        const isOrm = detectarContextoOrm(src);
+        const adicionar = (tipo, nivel, mensagem, sugestao, linha) => {
+            ocorrencias.push(criarDetectado(relPath, linha, tipo, nivel, mensagem, sugestao));
+        };
+        linhas.forEach((linha, index) => {
+            const num = index + 1;
+            const trim = linha.trim();
+            const _lowerTrim = trim.toLowerCase();
+            if (/\s\+\s*['"`]/.test(linha) && SQL_KEYWORDS.test(linha)) {
+                adicionar('sql-injection-dynamic', 'erro', messages.DetectorSqlMensagens.sqlInjectionDynamic, messages.DetectorSqlMensagens.sqlInjectionDynamicSugestao, num);
+            }
+            if (/\bwhere\b/i.test(linha) &&
+                /['"`]\s*\+/.test(linha)) {
+                adicionar('sql-dynamic-where', 'erro', messages.DetectorSqlMensagens.dynamicWhere, messages.DetectorSqlMensagens.dynamicWhereSugestao, num);
+            }
+            if (/\b(password|passwd|senha)\b\s+(varchar|text|char|string)/i.test(linha) &&
+                !/\b(hash|bcrypt|argon2|pbkdf|scrypt)\b/i.test(linha)) {
+                adicionar('sql-password-without-hash', 'erro', messages.DetectorSqlMensagens.passwordStoring, messages.DetectorSqlMensagens.passwordStoringSugestao, num);
+            }
+            if (/\bgrant\s+all\s+(privileges\s+)?on\b/i.test(linha)) {
+                adicionar('sql-grant-all', 'erro', messages.DetectorSqlMensagens.grantAllPrivileges, messages.DetectorSqlMensagens.grantAllPrivilegesSugestao, num);
+            }
+            if (/^\s*(insert|update|delete)\s+/i.test(trim) &&
+                index > 0 &&
+                /^\s*(insert|update|delete)\s+/i.test(linhas[index - 1]?.trim() ?? '') &&
+                !src.toLowerCase().includes('begin') &&
+                !src.toLowerCase().includes('commit')) {
+                adicionar('sql-without-transaction', 'aviso', messages.DetectorSqlMensagens.sqlWithoutTransaction, messages.DetectorSqlMensagens.sqlWithoutTransactionSugestao, num);
+            }
+            if (/\$\{.*\}\s*/.test(linha) && SQL_KEYWORDS.test(linha)) {
+                adicionar('sql-unsafe-concat', 'erro', messages.DetectorSqlMensagens.unsafeConcatInQuery, messages.DetectorSqlMensagens.unsafeConcatInQuerySugestao, num);
+            }
+            if (/\blike\b/i.test(linha) &&
+                !/\bescape\b/i.test(linha)) {
+                adicionar('sql-like-without-escape', 'aviso', messages.DetectorSqlMensagens.likeWithoutEscape, messages.DetectorSqlMensagens.likeWithoutEscapeSugestao, num);
+            }
+            if (/\border\s+by\b/i.test(linha) &&
+                /\$\{|\+ |concat\(|:coluna|:col/i.test(linha)) {
+                adicionar('sql-order-by-injection', 'erro', messages.DetectorSqlMensagens.orderByInjection, messages.DetectorSqlMensagens.orderByInjectionSugestao, num);
+            }
+            if (/\blimit\b|\boffset\b/i.test(linha) &&
+                /\$\{|\+ |:limite|:offset/i.test(linha)) {
+                adicionar('sql-limit-offset-injection', 'erro', messages.DetectorSqlMensagens.limitOffsetInjection, messages.DetectorSqlMensagens.limitOffsetInjectionSugestao, num);
+            }
+            if (/\bwhere\b/i.test(linha) && /\b(upper|lower|year|month|day|date|cast|convert|coalesce|nullif|substr|substring|trim|ltrim|rtrim|len|length|abs|round)\s*\(\s*\w+\.?\w*\s*\)/i.test(linha)) {
+                adicionar('sql-function-on-column', 'aviso', messages.DetectorSqlMensagens.functionOnColumn, messages.DetectorSqlMensagens.functionOnColumnSugestao, num);
+            }
+            if (/\bnot\s+in\s*\(/.test(linha) && /\bselect\b/i.test(linha)) {
+                adicionar('sql-not-in-subquery', 'aviso', messages.DetectorSqlMensagens.notInSubquery, messages.DetectorSqlMensagens.notInSubquerySugestao, num);
+            }
+            const orCount = (linha.match(/\bor\b/gi) || []).length;
+            if (orCount >= 3) {
+                adicionar('sql-multiple-or', 'info', messages.DetectorSqlMensagens.orWithMultipleConditions, messages.DetectorSqlMensagens.orWithMultipleConditionsSugestao, num);
+            }
+            if (/join\s+\w+/i.test(linha)) {
+                adicionar('sql-join-without-index', 'info', messages.DetectorSqlMensagens.joinWithoutIndex, messages.DetectorSqlMensagens.joinWithoutIndexSugestao, num);
+            }
+            if (/^\s*\w+\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp|blob|json)\b/i.test(trim) &&
+                !/\bnot\s+null\b/i.test(linha) &&
+                !/^\s*--|^\s*\/\//.test(trim)) {
+                adicionar('sql-missing-not-null', 'info', messages.DetectorSqlMensagens.missingNotNull, messages.DetectorSqlMensagens.missingNotNullSugestao, num);
+            }
+            if (/\bdefault\s+null\b/i.test(linha) &&
+                /^\s*\w+\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp)\b/i.test(trim)) {
+                adicionar('sql-missing-default', 'info', messages.DetectorSqlMensagens.missingDefault, messages.DetectorSqlMensagens.missingDefaultSugestao, num);
+            }
+            if (/\bauto_increment\b/i.test(linha) && !/\bprimary\s+key\b/i.test(linha)) {
+                adicionar('sql-auto-increment-without-pk', 'aviso', messages.DetectorSqlMensagens.autoIncrementWithoutPK, messages.DetectorSqlMensagens.autoIncrementWithoutPKSugestao, num);
+            }
+            if (/\btext\b/i.test(linha) && !/^\s*(--|\/\/)/.test(trim)) {
+                adicionar('sql-text-instead-of-varchar', 'info', messages.DetectorSqlMensagens.textInsteadOfVarchar, messages.DetectorSqlMensagens.textInsteadOfVarcharSugestao, num);
+            }
+            if (/\bfloat\b/i.test(linha) &&
+                /(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita)/i.test(linha)) {
+                adicionar('sql-float-for-currency', 'aviso', messages.DetectorSqlMensagens.floatForCurrency, messages.DetectorSqlMensagens.floatForCurrencySugestao, num);
+            }
+            if (/\b(cpf|cnpj|email|username|login|slug|document|documento|rg|passport|uuid)\b/i.test(linha) &&
+                /^\s*\w+\s+(varchar|char|text)\b/i.test(trim) &&
+                !/\bunique\b/i.test(linha)) {
+                adicionar('sql-missing-unique', 'aviso', messages.DetectorSqlMensagens.missingUniqueConstraint, messages.DetectorSqlMensagens.missingUniqueConstraintSugestao, num);
+            }
+            if (/\b\w+_id\b/i.test(linha) &&
+                /^\s*\w+_id\s+(int|bigint|uuid|varchar)\b/i.test(trim) &&
+                !/\bforeign\s+key\b/i.test(linha) &&
+                !/\breferences\b/i.test(linha)) {
+                adicionar('sql-missing-foreign-key', 'info', messages.DetectorSqlMensagens.missingForeignKey, messages.DetectorSqlMensagens.missingForeignKeySugestao, num);
+            }
+            if (isOrm) {
+                if (/\b(for|forEach|while)\b/i.test(linha) &&
+                    /\b(find|query|select|getOne|findOne|findMany|findAll)\b/i.test(linha)) {
+                    adicionar('sql-eager-loading-missing', 'erro', messages.DetectorSqlMensagens.eagerLoadingMissing, messages.DetectorSqlMensagens.eagerLoadingMissingSugestao, num);
+                }
+                if (/\btransaction|$transaction/i.test(linha) &&
+                    /(insert|create|save|update|delete|remove)/i.test(linha)) {
+                    adicionar('sql-transaction-too-large', 'aviso', messages.DetectorSqlMensagens.transactionTooLarge, messages.DetectorSqlMensagens.transactionTooLargeSugestao, num);
+                }
+            }
+        });
+        const _srcLower = src.toLowerCase();
+        linhas.forEach((linha, index) => {
+            const num = index + 1;
+            if (/\b(password|senha|secret|key|token)\b\s*[:=]\s*['"].*['"]/i.test(linha) ||
+                /identified\s+by\s+['"].*['"]/i.test(linha)) {
+                adicionar('sql-hardcoded-credential', 'erro', messages.DetectorSqlMensagens.hardcodedCredential, messages.DetectorSqlMensagens.hardcodedCredentialSugestao, num);
+            }
+        });
+        linhas.forEach((linha, index) => {
+            if (/\bselect\s+\*\s+from\b/i.test(linha)) {
+                adicionar('sql-select-star', 'aviso', messages.DetectorSqlMensagens.selectStar, messages.DetectorSqlMensagens.selectStarSugestao, index + 1);
+            }
+        });
+        linhas.forEach((linha, index) => {
+            const num = index + 1;
+            const lc = linha.trim().toLowerCase();
+            if (/^\s*(delete|update)\s+/.test(lc) &&
+                !lc.includes('where')) {
+                const next = linhas[index + 1]?.trim().toLowerCase() || '';
+                if (!next.includes('where')) {
+                    adicionar('sql-missing-where', 'erro', messages.DetectorSqlMensagens.missingWhere, messages.DetectorSqlMensagens.missingWhereSugestao, num);
+                }
+            }
+        });
+        linhas.forEach((linha, index) => {
+            if (/\btruncate\s+table\b/i.test(linha)) {
+                adicionar('sql-truncate', 'aviso', messages.DetectorSqlMensagens.truncate, messages.DetectorSqlMensagens.truncateSugestao, index + 1);
+            }
+        });
+        linhas.forEach((linha, index) => {
+            if (/create\s+(table|procedure|view)\s+\w+/i.test(linha) &&
+                !/if\s+not\s+exists/i.test(linha)) {
+                adicionar('sql-missing-if-not-exists', 'info', messages.DetectorSqlMensagens.missingIfNotExists, messages.DetectorSqlMensagens.missingIfNotExistsSugestao, index + 1);
+            }
+        });
+        linhas.forEach((linha, index) => {
+            if (/\bvarchar\b\s*(\(|\s|$)/i.test(linha) && !/\bvarchar\(\d+\)/i.test(linha)) {
+                adicionar('sql-varchar-without-size', 'info', messages.DetectorSqlMensagens.varcharWithoutSize, messages.DetectorSqlMensagens.varcharWithoutSizeSugestao, index + 1);
+            }
+        });
+        let selectCount = 0;
+        for (const linha of linhas) {
+            if (/\bselect\b/i.test(linha))
+                selectCount++;
+        }
+        if (selectCount > 5) {
+            const firstSelect = linhas.findIndex(l => /\bselect\b/i.test(l));
+            if (firstSelect >= 0) {
+                adicionar('sql-n-plus-one', 'aviso', messages.DetectorSqlMensagens.selectNPlusOne, messages.DetectorSqlMensagens.selectNPlusOneSugestao, firstSelect + 1);
+            }
+        }
+        const whereCols = new Set();
+        for (const linha of linhas) {
+            const whereMatch = linha.match(/\bwhere\s+(.+)/i);
+            if (whereMatch) {
+                const cols = whereMatch[1].match(/\b(\w+)\s*=/g);
+                if (cols) {
+                    cols.forEach(c => {
+                        const col = c.replace(/=\s*$/, '').trim().toLowerCase();
+                        if (!/^(id|created_at|updated_at|deleted_at)$/.test(col)) {
+                            whereCols.add(col);
+                        }
+                    });
+                }
+            }
+        }
+        for (const detector of detectoresRegistrados) {
+            try {
+                const resultado = detector.testar(src, { relPath, linhas });
+                if (Array.isArray(resultado)) {
+                    ocorrencias.push(...resultado);
+                }
+            }
+            catch {
+            }
+        }
+        return ocorrencias;
+    }
+};
+export const detectorSqlBestPractices = detectorSql;
+//# sourceMappingURL=detector-sql.js.map

package/dist/analysts/sql/detectors/detector-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-sql.js","sourceRoot":"","sources":["../../../../src/analysts/sql/detectors/detector-sql.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AASpC,MAAM,qBAAqB,GAAwB,EAAE,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,QAA2B;IAC9D,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,YAAY,GAAG,4EAA4E,CAAC;AAClG,MAAM,YAAY,GAAG,iGAAiG,CAAC;AAEvH,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,KAAa,EACb,IAAY,EACZ,KAAgC,EAChC,QAAgB,EAChB,QAAgB;IAEhB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,IAAI,EAAE,cAAc;IACpB,SAAS,EAAE,UAAU;IACrB,SAAS,EAAE,0EAA0E;IACrF,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;IAChF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAE,IAAc,EAAE,GAAY,EAAE,IAAuB,EAAgB,EAAE;QAC7G,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,CAChB,IAAY,EACZ,KAAgC,EAChC,QAAgB,EAChB,QAAgB,EAChB,KAAa,EACP,EAAE;YACR,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAKtC,IACE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EACtD,CAAC;gBACD,SAAS,CACP,uBAAuB,EACvB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,EACjD,QAAQ,CAAC,oBAAoB,CAAC,2BAA2B,EACzD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EACxB,CAAC;gBACD,SAAS,CACP,mBAAmB,EACnB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,YAAY,EAC1C,QAAQ,CAAC,oBAAoB,CAAC,oBAAoB,EAClD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBACvE,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,EACrD,CAAC;gBACD,SAAS,CACP,2BAA2B,EAC3B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,eAAe,EAC7C,QAAQ,CAAC,oBAAoB,CAAC,uBAAuB,EACrD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,SAAS,CACP,eAAe,EACf,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,EAChD,QAAQ,CAAC,oBAAoB,CAAC,0BAA0B,EACxD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,KAAK,GAAG,CAAC;gBACT,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBACtE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACpC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrC,CAAC;gBACD,SAAS,CACP,yBAAyB,EACzB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,qBAAqB,EACnD,QAAQ,CAAC,oBAAoB,CAAC,6BAA6B,EAC3D,GAAG,CACJ,CAAC;YACJ,CAAC;YAKD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,SAAS,CACP,mBAAmB,EACnB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,EACjD,QAAQ,CAAC,oBAAoB,CAAC,2BAA2B,EACzD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;gBACvB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1B,CAAC;gBACD,SAAS,CACP,yBAAyB,EACzB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,EAC/C,QAAQ,CAAC,oBAAoB,CAAC,yBAAyB,EACvD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC7B,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7C,CAAC;gBACD,SAAS,CACP,wBAAwB,EACxB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,gBAAgB,EAC9C,QAAQ,CAAC,oBAAoB,CAAC,wBAAwB,EACtD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBACnC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EACvC,CAAC;gBACD,SAAS,CACP,4BAA4B,EAC5B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,oBAAoB,EAClD,QAAQ,CAAC,oBAAoB,CAAC,4BAA4B,EAC1D,GAAG,CACJ,CAAC;YACJ,CAAC;YAKD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gJAAgJ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7L,SAAS,CACP,wBAAwB,EACxB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,gBAAgB,EAC9C,QAAQ,CAAC,oBAAoB,CAAC,wBAAwB,EACtD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/D,SAAS,CACP,qBAAqB,EACrB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,aAAa,EAC3C,QAAQ,CAAC,oBAAoB,CAAC,qBAAqB,EACnD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACvD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,SAAS,CACP,iBAAiB,EACjB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,wBAAwB,EACtD,QAAQ,CAAC,oBAAoB,CAAC,gCAAgC,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,SAAS,CACP,wBAAwB,EACxB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,gBAAgB,EAC9C,QAAQ,CAAC,oBAAoB,CAAC,wBAAwB,EACtD,GAAG,CACJ,CAAC;YACJ,CAAC;YAKD,IACE,oGAAoG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/G,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9B,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7B,CAAC;gBACD,SAAS,CACP,sBAAsB,EACtB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,cAAc,EAC5C,QAAQ,CAAC,oBAAoB,CAAC,sBAAsB,EACpD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;gBACjC,0FAA0F,CAAC,IAAI,CAAC,IAAI,CAAC,EACrG,CAAC;gBACD,SAAS,CACP,qBAAqB,EACrB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,cAAc,EAC5C,QAAQ,CAAC,oBAAoB,CAAC,sBAAsB,EACpD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3E,SAAS,CACP,+BAA+B,EAC/B,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,sBAAsB,EACpD,QAAQ,CAAC,oBAAoB,CAAC,8BAA8B,EAC5D,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,SAAS,CACP,6BAA6B,EAC7B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,oBAAoB,EAClD,QAAQ,CAAC,oBAAoB,CAAC,4BAA4B,EAC1D,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,yFAAyF,CAAC,IAAI,CAAC,KAAK,CAAC,EACrG,CAAC;gBACD,SAAS,CACP,wBAAwB,EACxB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,gBAAgB,EAC9C,QAAQ,CAAC,oBAAoB,CAAC,wBAAwB,EACtD,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,+EAA+E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3F,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7C,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1B,CAAC;gBACD,SAAS,CACP,oBAAoB,EACpB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,uBAAuB,EACrD,QAAQ,CAAC,oBAAoB,CAAC,+BAA+B,EAC7D,GAAG,CACJ,CAAC;YACJ,CAAC;YAGD,IACE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzB,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtD,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;gBACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACD,SAAS,CACP,yBAAyB,EACzB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,EAC/C,QAAQ,CAAC,oBAAoB,CAAC,yBAAyB,EACvD,GAAG,CACJ,CAAC;YACJ,CAAC;YAID,IAAI,KAAK,EAAE,CAAC;gBAEV,IACE,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;oBACtC,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,EACtE,CAAC;oBACD,SAAS,CACP,2BAA2B,EAC3B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,EACjD,QAAQ,CAAC,oBAAoB,CAAC,2BAA2B,EACzD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAGD,IACE,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC;oBACzC,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,EACxD,CAAC;oBACD,SAAS,CACP,2BAA2B,EAC3B,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,EACjD,QAAQ,CAAC,oBAAoB,CAAC,2BAA2B,EACzD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAIH,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAGpC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;YACtB,IACE,4DAA4D,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxE,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAC3C,CAAC;gBACD,SAAS,CACP,0BAA0B,EAC1B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,EACjD,QAAQ,CAAC,oBAAoB,CAAC,2BAA2B,EACzD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS,CACP,iBAAiB,EACjB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,UAAU,EACxC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,EAChD,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;YACtB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IACE,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EACrB,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,SAAS,CACP,mBAAmB,EACnB,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,YAAY,EAC1C,QAAQ,CAAC,oBAAoB,CAAC,oBAAoB,EAClD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,SAAS,CACP,cAAc,EACd,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,EACtC,QAAQ,CAAC,oBAAoB,CAAC,gBAAgB,EAC9C,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,IACE,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpD,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,SAAS,CACP,2BAA2B,EAC3B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,EAChD,QAAQ,CAAC,oBAAoB,CAAC,0BAA0B,EACxD,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,SAAS,CACP,0BAA0B,EAC1B,MAAM,EACN,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,EAChD,QAAQ,CAAC,oBAAoB,CAAC,0BAA0B,EACxD,KAAK,GAAG,CAAC,CACV,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAGH,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,WAAW,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;gBACrB,SAAS,CACP,gBAAgB,EAChB,OAAO,EACP,QAAQ,CAAC,oBAAoB,CAAC,cAAc,EAC5C,QAAQ,CAAC,oBAAoB,CAAC,sBAAsB,EACpD,WAAW,GAAG,CAAC,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACjD,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;wBACf,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;wBACxD,IAAI,CAAC,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BACzD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAGD,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AAGF,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector SQL abrangente\n *\n * Detecta problemas em SQL organizados em categorias:\n * - Segurança: SQL injection, credenciais, GRANT ALL, transações\n * - Padrões de Injeção: LIKE sem ESCAPE, ORDER BY dinâmico, LIMIT/OFFSET dinâmico\n * - Performance: índices, funções em colunas, N+1, NOT IN, ORs múltiplos\n * - Boas Práticas: NOT NULL, DEFAULT, AUTO_INCREMENT PK, TEXT vs VARCHAR, UNIQUE, FLOAT moeda, FK\n * - ORM: eager loading, transações grandes\n */\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, ContextoExecucao, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport type DeteccaoCustomSql = {\n  nome: string;\n  descricao: string;\n  severidade: 'baixa' | 'media' | 'alta' | 'critica';\n  testar: (src: string, contexto: { relPath: string; linhas: string[] }) => Ocorrencia[] | Promise<Ocorrencia[]>;\n};\n\nconst detectoresRegistrados: DeteccaoCustomSql[] = [];\n\nexport function registrarDetectorSql(detector: DeteccaoCustomSql): void {\n  detectoresRegistrados.push(detector);\n}\n\nexport function obterDetectoresSql(): DeteccaoCustomSql[] {\n  return [...detectoresRegistrados];\n}\n\nconst SQL_KEYWORDS = /\\b(select|insert|update|delete|create|alter|drop|truncate|grant|revoke)\\b/i;\nconst ORM_PATTERNS = /\\b(prisma|typeorm|sequelize|drizzle|knex|mikro-orm|entity|repository|@entity|@column|@table)\\b/i;\n\nfunction detectarContextoOrm(src: string): boolean {\n  return ORM_PATTERNS.test(src);\n}\n\nfunction criarDetectado(\n  relPath: string,\n  linha: number,\n  tipo: string,\n  nivel: 'erro' | 'aviso' | 'info',\n  mensagem: string,\n  sugestao: string,\n): Ocorrencia {\n  return criarOcorrencia({ tipo, nivel, mensagem, relPath, linha, sugestao });\n}\n\nexport const detectorSql: Analista = {\n  nome: 'detector-sql',\n  categoria: 'database',\n  descricao: 'Detector SQL abrangente: segurança, injeção, performance e boas práticas',\n  test: (relPath: string): boolean => /\\.(sql|pgsql|mysql|sqlite)$/i.test(relPath),\n  aplicar: (src: string, relPath: string, _ast?: unknown, _fc?: string, _ctx?: ContextoExecucao): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n    const isOrm = detectarContextoOrm(src);\n\n    const adicionar = (\n      tipo: string,\n      nivel: 'erro' | 'aviso' | 'info',\n      mensagem: string,\n      sugestao: string,\n      linha: number,\n    ): void => {\n      ocorrencias.push(criarDetectado(relPath, linha, tipo, nivel, mensagem, sugestao));\n    };\n\n    linhas.forEach((linha, index) => {\n      const num = index + 1;\n      const trim = linha.trim();\n      const _lowerTrim = trim.toLowerCase();\n\n      // ── Security ────────────────────────────────────────────────────────\n\n      // SQL Injection via string concatenation\n      if (\n        /\\s\\+\\s*['\"`]/.test(linha) && SQL_KEYWORDS.test(linha)\n      ) {\n        adicionar(\n          'sql-injection-dynamic',\n          'erro',\n          messages.DetectorSqlMensagens.sqlInjectionDynamic,\n          messages.DetectorSqlMensagens.sqlInjectionDynamicSugestao,\n          num,\n        );\n      }\n\n      // Dynamic WHERE clause with + or ${}\n      if (\n        /\\bwhere\\b/i.test(linha) &&\n        /['\"`]\\s*\\+/.test(linha)\n      ) {\n        adicionar(\n          'sql-dynamic-where',\n          'erro',\n          messages.DetectorSqlMensagens.dynamicWhere,\n          messages.DetectorSqlMensagens.dynamicWhereSugestao,\n          num,\n        );\n      }\n\n      // Password storing without hash\n      if (\n        /\\b(password|passwd|senha)\\b\\s+(varchar|text|char|string)/i.test(linha) &&\n        !/\\b(hash|bcrypt|argon2|pbkdf|scrypt)\\b/i.test(linha)\n      ) {\n        adicionar(\n          'sql-password-without-hash',\n          'erro',\n          messages.DetectorSqlMensagens.passwordStoring,\n          messages.DetectorSqlMensagens.passwordStoringSugestao,\n          num,\n        );\n      }\n\n      // GRANT ALL PRIVILEGES\n      if (/\\bgrant\\s+all\\s+(privileges\\s+)?on\\b/i.test(linha)) {\n        adicionar(\n          'sql-grant-all',\n          'erro',\n          messages.DetectorSqlMensagens.grantAllPrivileges,\n          messages.DetectorSqlMensagens.grantAllPrivilegesSugestao,\n          num,\n        );\n      }\n\n      // Statements without transaction (multiple INSERT/UPDATE/DELETE in sequence)\n      if (\n        /^\\s*(insert|update|delete)\\s+/i.test(trim) &&\n        index > 0 &&\n        /^\\s*(insert|update|delete)\\s+/i.test(linhas[index - 1]?.trim() ?? '') &&\n        !src.toLowerCase().includes('begin') &&\n        !src.toLowerCase().includes('commit')\n      ) {\n        adicionar(\n          'sql-without-transaction',\n          'aviso',\n          messages.DetectorSqlMensagens.sqlWithoutTransaction,\n          messages.DetectorSqlMensagens.sqlWithoutTransactionSugestao,\n          num,\n        );\n      }\n\n      // ── Injection Patterns ──────────────────────────────────────────────\n\n      // Variable interpolation in query ${} or {{ }}\n      if (/\\$\\{.*\\}\\s*/.test(linha) && SQL_KEYWORDS.test(linha)) {\n        adicionar(\n          'sql-unsafe-concat',\n          'erro',\n          messages.DetectorSqlMensagens.unsafeConcatInQuery,\n          messages.DetectorSqlMensagens.unsafeConcatInQuerySugestao,\n          num,\n        );\n      }\n\n      // LIKE without ESCAPE\n      if (\n        /\\blike\\b/i.test(linha) &&\n        !/\\bescape\\b/i.test(linha)\n      ) {\n        adicionar(\n          'sql-like-without-escape',\n          'aviso',\n          messages.DetectorSqlMensagens.likeWithoutEscape,\n          messages.DetectorSqlMensagens.likeWithoutEscapeSugestao,\n          num,\n        );\n      }\n\n      // ORDER BY with dynamic column (variable/parameter)\n      if (\n        /\\border\\s+by\\b/i.test(linha) &&\n        /\\$\\{|\\+ |concat\\(|:coluna|:col/i.test(linha)\n      ) {\n        adicionar(\n          'sql-order-by-injection',\n          'erro',\n          messages.DetectorSqlMensagens.orderByInjection,\n          messages.DetectorSqlMensagens.orderByInjectionSugestao,\n          num,\n        );\n      }\n\n      // LIMIT/OFFSET with dynamic values\n      if (\n        /\\blimit\\b|\\boffset\\b/i.test(linha) &&\n        /\\$\\{|\\+ |:limite|:offset/i.test(linha)\n      ) {\n        adicionar(\n          'sql-limit-offset-injection',\n          'erro',\n          messages.DetectorSqlMensagens.limitOffsetInjection,\n          messages.DetectorSqlMensagens.limitOffsetInjectionSugestao,\n          num,\n        );\n      }\n\n      // ── Performance ─────────────────────────────────────────────────────\n\n      // Function on column in WHERE (e.g., WHERE YEAR(col) = ...)\n      if (/\\bwhere\\b/i.test(linha) && /\\b(upper|lower|year|month|day|date|cast|convert|coalesce|nullif|substr|substring|trim|ltrim|rtrim|len|length|abs|round)\\s*\\(\\s*\\w+\\.?\\w*\\s*\\)/i.test(linha)) {\n        adicionar(\n          'sql-function-on-column',\n          'aviso',\n          messages.DetectorSqlMensagens.functionOnColumn,\n          messages.DetectorSqlMensagens.functionOnColumnSugestao,\n          num,\n        );\n      }\n\n      // NOT IN with subquery\n      if (/\\bnot\\s+in\\s*\\(/.test(linha) && /\\bselect\\b/i.test(linha)) {\n        adicionar(\n          'sql-not-in-subquery',\n          'aviso',\n          messages.DetectorSqlMensagens.notInSubquery,\n          messages.DetectorSqlMensagens.notInSubquerySugestao,\n          num,\n        );\n      }\n\n      // Multiple OR conditions (3+)\n      const orCount = (linha.match(/\\bor\\b/gi) || []).length;\n      if (orCount >= 3) {\n        adicionar(\n          'sql-multiple-or',\n          'info',\n          messages.DetectorSqlMensagens.orWithMultipleConditions,\n          messages.DetectorSqlMensagens.orWithMultipleConditionsSugestao,\n          num,\n        );\n      }\n\n      // JOIN without index heuristic (multiple JOINs in query)\n      if (/join\\s+\\w+/i.test(linha)) {\n        adicionar(\n          'sql-join-without-index',\n          'info',\n          messages.DetectorSqlMensagens.joinWithoutIndex,\n          messages.DetectorSqlMensagens.joinWithoutIndexSugestao,\n          num,\n        );\n      }\n\n      // ── Best Practices ──────────────────────────────────────────────────\n\n      // Column without NOT NULL\n      if (\n        /^\\s*\\w+\\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp|blob|json)\\b/i.test(trim) &&\n        !/\\bnot\\s+null\\b/i.test(linha) &&\n        !/^\\s*--|^\\s*\\/\\//.test(trim)\n      ) {\n        adicionar(\n          'sql-missing-not-null',\n          'info',\n          messages.DetectorSqlMensagens.missingNotNull,\n          messages.DetectorSqlMensagens.missingNotNullSugestao,\n          num,\n        );\n      }\n\n      // Column with NULL default (could have explicit default)\n      if (\n        /\\bdefault\\s+null\\b/i.test(linha) &&\n        /^\\s*\\w+\\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp)\\b/i.test(trim)\n      ) {\n        adicionar(\n          'sql-missing-default',\n          'info',\n          messages.DetectorSqlMensagens.missingDefault,\n          messages.DetectorSqlMensagens.missingDefaultSugestao,\n          num,\n        );\n      }\n\n      // AUTO_INCREMENT not used as PK\n      if (/\\bauto_increment\\b/i.test(linha) && !/\\bprimary\\s+key\\b/i.test(linha)) {\n        adicionar(\n          'sql-auto-increment-without-pk',\n          'aviso',\n          messages.DetectorSqlMensagens.autoIncrementWithoutPK,\n          messages.DetectorSqlMensagens.autoIncrementWithoutPKSugestao,\n          num,\n        );\n      }\n\n      // TEXT where VARCHAR would suffice (TEXT for short columns)\n      if (/\\btext\\b/i.test(linha) && !/^\\s*(--|\\/\\/)/.test(trim)) {\n        adicionar(\n          'sql-text-instead-of-varchar',\n          'info',\n          messages.DetectorSqlMensagens.textInsteadOfVarchar,\n          messages.DetectorSqlMensagens.textInsteadOfVarcharSugestao,\n          num,\n        );\n      }\n\n      // FLOAT for currency\n      if (\n        /\\bfloat\\b/i.test(linha) &&\n        /(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita)/i.test(linha)\n      ) {\n        adicionar(\n          'sql-float-for-currency',\n          'aviso',\n          messages.DetectorSqlMensagens.floatForCurrency,\n          messages.DetectorSqlMensagens.floatForCurrencySugestao,\n          num,\n        );\n      }\n\n      // Missing UNIQUE constraint on likely-identifier columns\n      if (\n        /\\b(cpf|cnpj|email|username|login|slug|document|documento|rg|passport|uuid)\\b/i.test(linha) &&\n        /^\\s*\\w+\\s+(varchar|char|text)\\b/i.test(trim) &&\n        !/\\bunique\\b/i.test(linha)\n      ) {\n        adicionar(\n          'sql-missing-unique',\n          'aviso',\n          messages.DetectorSqlMensagens.missingUniqueConstraint,\n          messages.DetectorSqlMensagens.missingUniqueConstraintSugestao,\n          num,\n        );\n      }\n\n      // Missing FOREIGN KEY (column named *_id or id_*)\n      if (\n        /\\b\\w+_id\\b/i.test(linha) &&\n        /^\\s*\\w+_id\\s+(int|bigint|uuid|varchar)\\b/i.test(trim) &&\n        !/\\bforeign\\s+key\\b/i.test(linha) &&\n        !/\\breferences\\b/i.test(linha)\n      ) {\n        adicionar(\n          'sql-missing-foreign-key',\n          'info',\n          messages.DetectorSqlMensagens.missingForeignKey,\n          messages.DetectorSqlMensagens.missingForeignKeySugestao,\n          num,\n        );\n      }\n\n      // ── ORM-specific ────────────────────────────────────────────────────\n\n      if (isOrm) {\n        // Lazy load in loop (N+1) — query inside for/forEach/while\n        if (\n          /\\b(for|forEach|while)\\b/i.test(linha) &&\n          /\\b(find|query|select|getOne|findOne|findMany|findAll)\\b/i.test(linha)\n        ) {\n          adicionar(\n            'sql-eager-loading-missing',\n            'erro',\n            messages.DetectorSqlMensagens.eagerLoadingMissing,\n            messages.DetectorSqlMensagens.eagerLoadingMissingSugestao,\n            num,\n          );\n        }\n\n        // Single transaction with many operations\n        if (\n          /\\btransaction|$transaction/i.test(linha) &&\n          /(insert|create|save|update|delete|remove)/i.test(linha)\n        ) {\n          adicionar(\n            'sql-transaction-too-large',\n            'aviso',\n            messages.DetectorSqlMensagens.transactionTooLarge,\n            messages.DetectorSqlMensagens.transactionTooLargeSugestao,\n            num,\n          );\n        }\n      }\n    });\n\n    // ── Cross-line checks ─────────────────────────────────────────────────\n\n    const _srcLower = src.toLowerCase();\n\n    // Hardcoded credentials\n    linhas.forEach((linha, index) => {\n      const num = index + 1;\n      if (\n        /\\b(password|senha|secret|key|token)\\b\\s*[:=]\\s*['\"].*['\"]/i.test(linha) ||\n        /identified\\s+by\\s+['\"].*['\"]/i.test(linha)\n      ) {\n        adicionar(\n          'sql-hardcoded-credential',\n          'erro',\n          messages.DetectorSqlMensagens.hardcodedCredential,\n          messages.DetectorSqlMensagens.hardcodedCredentialSugestao,\n          num,\n        );\n      }\n    });\n\n    // SELECT *\n    linhas.forEach((linha, index) => {\n      if (/\\bselect\\s+\\*\\s+from\\b/i.test(linha)) {\n        adicionar(\n          'sql-select-star',\n          'aviso',\n          messages.DetectorSqlMensagens.selectStar,\n          messages.DetectorSqlMensagens.selectStarSugestao,\n          index + 1,\n        );\n      }\n    });\n\n    // DELETE/UPDATE without WHERE\n    linhas.forEach((linha, index) => {\n      const num = index + 1;\n      const lc = linha.trim().toLowerCase();\n      if (\n        /^\\s*(delete|update)\\s+/.test(lc) &&\n        !lc.includes('where')\n      ) {\n        const next = linhas[index + 1]?.trim().toLowerCase() || '';\n        if (!next.includes('where')) {\n          adicionar(\n            'sql-missing-where',\n            'erro',\n            messages.DetectorSqlMensagens.missingWhere,\n            messages.DetectorSqlMensagens.missingWhereSugestao,\n            num,\n          );\n        }\n      }\n    });\n\n    // TRUNCATE\n    linhas.forEach((linha, index) => {\n      if (/\\btruncate\\s+table\\b/i.test(linha)) {\n        adicionar(\n          'sql-truncate',\n          'aviso',\n          messages.DetectorSqlMensagens.truncate,\n          messages.DetectorSqlMensagens.truncateSugestao,\n          index + 1,\n        );\n      }\n    });\n\n    // Missing IF NOT EXISTS\n    linhas.forEach((linha, index) => {\n      if (\n        /create\\s+(table|procedure|view)\\s+\\w+/i.test(linha) &&\n        !/if\\s+not\\s+exists/i.test(linha)\n      ) {\n        adicionar(\n          'sql-missing-if-not-exists',\n          'info',\n          messages.DetectorSqlMensagens.missingIfNotExists,\n          messages.DetectorSqlMensagens.missingIfNotExistsSugestao,\n          index + 1,\n        );\n      }\n    });\n\n    // VARCHAR without size\n    linhas.forEach((linha, index) => {\n      if (/\\bvarchar\\b\\s*(\\(|\\s|$)/i.test(linha) && !/\\bvarchar\\(\\d+\\)/i.test(linha)) {\n        adicionar(\n          'sql-varchar-without-size',\n          'info',\n          messages.DetectorSqlMensagens.varcharWithoutSize,\n          messages.DetectorSqlMensagens.varcharWithoutSizeSugestao,\n          index + 1,\n        );\n      }\n    });\n\n    // N+1 heuristic: many SELECTs in sequence\n    let selectCount = 0;\n    for (const linha of linhas) {\n      if (/\\bselect\\b/i.test(linha)) selectCount++;\n    }\n    if (selectCount > 5) {\n      const firstSelect = linhas.findIndex(l => /\\bselect\\b/i.test(l));\n      if (firstSelect >= 0) {\n        adicionar(\n          'sql-n-plus-one',\n          'aviso',\n          messages.DetectorSqlMensagens.selectNPlusOne,\n          messages.DetectorSqlMensagens.selectNPlusOneSugestao,\n          firstSelect + 1,\n        );\n      }\n    }\n\n    // No-index columns heuristic: columns in WHERE that look like non-PK text fields\n    const whereCols = new Set<string>();\n    for (const linha of linhas) {\n      const whereMatch = linha.match(/\\bwhere\\s+(.+)/i);\n      if (whereMatch) {\n        const cols = whereMatch[1].match(/\\b(\\w+)\\s*=/g);\n        if (cols) {\n          cols.forEach(c => {\n            const col = c.replace(/=\\s*$/, '').trim().toLowerCase();\n            if (!/^(id|created_at|updated_at|deleted_at)$/.test(col)) {\n              whereCols.add(col);\n            }\n          });\n        }\n      }\n    }\n\n    // Run registered plugin detectors\n    for (const detector of detectoresRegistrados) {\n      try {\n        const resultado = detector.testar(src, { relPath, linhas });\n        if (Array.isArray(resultado)) {\n          ocorrencias.push(...resultado);\n        }\n      } catch {\n        // Silently skip detector errors\n      }\n    }\n\n    return ocorrencias;\n  }\n};\n\n/** Backward-compat alias */\nexport const detectorSqlBestPractices = detectorSql;\n"]}

package/dist/analysts/sql/detectors/index.d.ts

@@ -0,0 +1,3 @@
+export * from './detector-sql.js';
+export * from './detector-sql-best-practices.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/sql/detectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/sql/detectors/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC"}

package/dist/analysts/sql/detectors/index.js

@@ -0,0 +1,3 @@
+export * from './detector-sql.js';
+export * from './detector-sql-best-practices.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/sql/detectors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/sql/detectors/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kCAAkC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './detector-sql.js';\nexport * from './detector-sql-best-practices.js';\n"]}

package/dist/analysts/sql/index.d.ts

@@ -0,0 +1,5 @@
+export * from './analysts/analyst-sql.js';
+export * from './corrections/index.js';
+export * from './detectors/index.js';
+export * from './scorers/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/sql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysts/sql/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}

package/dist/analysts/sql/index.js

@@ -0,0 +1,5 @@
+export * from './analysts/analyst-sql.js';
+export * from './corrections/index.js';
+export * from './detectors/index.js';
+export * from './scorers/index.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/sql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysts/sql/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Analistas de SQL\n *\n * Analisa arquivos SQL em busca de injeções, performance ruim e comandos perigosos.\n */\n\nexport * from './analysts/analyst-sql.js';\nexport * from './corrections/index.js';\nexport * from './detectors/index.js';\nexport * from './scorers/index.js';\n"]}

package/dist/analysts/sql/scorers/index.d.ts

@@ -0,0 +1,2 @@
+export * from './scorer-sql.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/sql/scorers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/sql/scorers/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAC"}

package/dist/analysts/sql/scorers/index.js

@@ -0,0 +1,2 @@
+export * from './scorer-sql.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/sql/scorers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/sql/scorers/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './scorer-sql.js';\n"]}

package/dist/analysts/sql/scorers/scorer-sql.d.ts

@@ -0,0 +1,33 @@
+export interface SqlScoreResult {
+    score: number;
+    maxScore: number;
+    percentage: number;
+    issues: string[];
+    strengths: string[];
+}
+export interface SqlScoreDetalhado extends SqlScoreResult {
+    seguranca: {
+        score: number;
+        maxScore: number;
+        percentage: number;
+    };
+    performance: {
+        score: number;
+        maxScore: number;
+        percentage: number;
+    };
+    boasPraticas: {
+        score: number;
+        maxScore: number;
+        percentage: number;
+    };
+}
+export declare function pontuarSql(src: string, _relPath: string): SqlScoreResult;
+export declare function pontuarSqlDetalhado(src: string, _relPath: string): SqlScoreDetalhado;
+export declare const pontuadorSql: {
+    nome: string;
+    categoria: string;
+    descricao: string;
+    pontuar: typeof pontuarSql;
+};
+//# sourceMappingURL=scorer-sql.d.ts.map

package/dist/analysts/sql/scorers/scorer-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorer-sql.d.ts","sourceRoot":"","sources":["../../../../src/analysts/sql/scorers/scorer-sql.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CASxE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAwMpF;AAED,eAAO,MAAM,YAAY;;;;;CAKxB,CAAC"}

package/dist/analysts/sql/scorers/scorer-sql.js

@@ -0,0 +1,184 @@
+import { splitLines } from '../../../shared/helpers/index.js';
+export function pontuarSql(src, _relPath) {
+    const detalhado = pontuarSqlDetalhado(src, _relPath);
+    return {
+        score: detalhado.score,
+        maxScore: detalhado.maxScore,
+        percentage: detalhado.percentage,
+        issues: detalhado.issues,
+        strengths: detalhado.strengths,
+    };
+}
+export function pontuarSqlDetalhado(src, _relPath) {
+    const issues = [];
+    const strengths = [];
+    const linhas = splitLines(src);
+    const srcLower = src.toLowerCase();
+    let seguranca = 0;
+    const maxSeguranca = 40;
+    const hardcodedCreds = (src.match(/\b(password|senha|secret|key|token)\b\s*[:=]\s*['"]/gi) || []).length;
+    if (hardcodedCreds === 0) {
+        seguranca += 8;
+    }
+    else {
+        issues.push(`${hardcodedCreds} credencial(is) hardcoded`);
+    }
+    const concatPatterns = (src.match(/\s\+\s*['"`].*?(select|insert|update|delete)/gi) || []).length;
+    if (concatPatterns === 0) {
+        seguranca += 8;
+    }
+    else {
+        issues.push(`${concatPatterns} padrão(ões) de concatenação SQL`);
+    }
+    const deletes = (src.match(/\bdelete\s+/gi) || []).length;
+    const updates = (src.match(/\bupdate\s+\w+\s+set/gi) || []).length;
+    const withWhere = (src.match(/\bwhere\b/gi) || []).length;
+    const totalMutations = deletes + updates;
+    if (totalMutations === 0 || withWhere >= totalMutations) {
+        seguranca += 8;
+    }
+    else {
+        seguranca += Math.max(0, 8 - (totalMutations - withWhere) * 4);
+        issues.push(`${totalMutations - withWhere} operação(ões) sem WHERE`);
+    }
+    if (!/\bgrant\s+all\s+(privileges\s+)?on\b/i.test(src)) {
+        seguranca += 6;
+    }
+    else {
+        issues.push('GRANT ALL PRIVILEGES detectado');
+    }
+    if ((srcLower.includes('begin') && srcLower.includes('commit')) ||
+        (srcLower.includes('begin transaction') && srcLower.includes('commit'))) {
+        seguranca += 5;
+        strengths.push('Transações corretamente encapsuladas');
+    }
+    else if (!/(insert|update|delete)/i.test(src)) {
+        seguranca += 5;
+    }
+    else {
+        issues.push('Instruções sem transação');
+    }
+    const dynamicPatterns = (src.match(/\$\{.*\}.*(where|order by|limit|offset)/gi) || []).length;
+    if (dynamicPatterns === 0) {
+        seguranca += 5;
+    }
+    else {
+        issues.push(`${dynamicPatterns} padrão(ões) de SQL dinâmico`);
+    }
+    let performance = 0;
+    const maxPerformance = 30;
+    const selectStar = (src.match(/\bselect\s+\*\s+from/gi) || []).length;
+    if (selectStar === 0) {
+        performance += 8;
+    }
+    else {
+        performance += Math.max(0, 8 - selectStar * 3);
+        issues.push(`${selectStar} SELECT * detectado(s)`);
+    }
+    const funcOnCol = (src.match(/\b(upper|lower|year|month|day|cast|convert|coalesce|nullif|substr|substring|trim|len|length|abs|round)\s*\(\s*\w+\.?\w*\s*\)\s*(=|<|>|!=)/gi) || []).length;
+    if (funcOnCol === 0) {
+        performance += 6;
+    }
+    else {
+        issues.push(`${funcOnCol} função(ões) em coluna no WHERE`);
+    }
+    if (!/\bnot\s+in\s*\(\s*select\b/i.test(src)) {
+        performance += 5;
+    }
+    else {
+        issues.push('NOT IN com subconsulta detectado');
+    }
+    const linhasComOr = linhas.filter(linha => (linha.match(/\bor\b/gi) || []).length >= 3).length;
+    if (linhasComOr === 0) {
+        performance += 4;
+    }
+    else {
+        issues.push(`${linhasComOr} linha(s) com múltiplos OR`);
+    }
+    if (!/\bjoin\b/i.test(src) ||
+        /(index|idx_)/i.test(src)) {
+        performance += 4;
+    }
+    else if (/\bjoin\b/i.test(src)) {
+        issues.push('JOIN sem índice mencionado');
+    }
+    const selectStatements = (src.match(/\bselect\b/gi) || []).length;
+    if (selectStatements <= 5) {
+        performance += 3;
+    }
+    else {
+        issues.push(`${selectStatements} consultas SELECT - possível N+1`);
+    }
+    let boasPraticas = 0;
+    const maxBoasPraticas = 30;
+    const varcharNoSize = (src.match(/\bvarchar\b\s*(\(|\s|$)/gi) || []).filter(m => !/varchar\(\d+\)/i.test(m)).length;
+    if (varcharNoSize === 0) {
+        boasPraticas += 7;
+    }
+    else {
+        issues.push(`${varcharNoSize} VARCHAR sem tamanho`);
+    }
+    const creates = (src.match(/\bcreate\s+(table|procedure|view)\b/gi) || []).length;
+    const ifNotExists = (src.match(/\bif\s+not\s+exists\b/gi) || []).length;
+    if (creates === 0 || ifNotExists >= creates) {
+        boasPraticas += 5;
+    }
+    else {
+        issues.push(`${creates - ifNotExists} CREATE sem IF NOT EXISTS`);
+    }
+    if (!/\btruncate\s+table\b/i.test(src)) {
+        boasPraticas += 4;
+    }
+    else {
+        issues.push('TRUNCATE TABLE detectado');
+    }
+    const colDefs = (src.match(/^\s*\w+\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp|blob|json)\b/gi) || []).length;
+    const withNotNull = (src.match(/\bnot\s+null\b/gi) || []).length;
+    if (colDefs === 0 || withNotNull >= colDefs) {
+        boasPraticas += 4;
+    }
+    else {
+        issues.push(`${colDefs - withNotNull} coluna(s) sem NOT NULL`);
+    }
+    if (!/(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita).*float|float.*(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita)/i.test(src)) {
+        boasPraticas += 4;
+    }
+    else {
+        issues.push('FLOAT para valor monetário');
+    }
+    if (!/\b(cpf|cnpj|email|username|login|slug)\b.*(varchar|char)/i.test(src) ||
+        /\bunique\b/i.test(src)) {
+        boasPraticas += 3;
+    }
+    else {
+        issues.push('Identificadores sem UNIQUE');
+    }
+    if (!/\b\w+_id\s+(int|bigint|uuid|varchar)\b/i.test(src) || /\bforeign\s+key\b/i.test(src)) {
+        boasPraticas += 3;
+    }
+    else {
+        issues.push('Possível FK sem constraint');
+    }
+    const score = seguranca + performance + boasPraticas;
+    const maxScore = maxSeguranca + maxPerformance + maxBoasPraticas;
+    if (strengths.length === 0 && score > 0) {
+        strengths.push('Script SQL com boas práticas');
+    }
+    return {
+        score,
+        maxScore,
+        percentage: maxScore > 0 ? Math.round((score / maxScore) * 100) : 0,
+        issues,
+        strengths,
+        seguranca: { score: seguranca, maxScore: maxSeguranca, percentage: Math.round((seguranca / maxSeguranca) * 100) },
+        performance: { score: performance, maxScore: maxPerformance, percentage: Math.round((performance / maxPerformance) * 100) },
+        boasPraticas: { score: boasPraticas, maxScore: maxBoasPraticas, percentage: Math.round((boasPraticas / maxBoasPraticas) * 100) },
+    };
+}
+export const pontuadorSql = {
+    nome: 'pontuador-sql',
+    categoria: 'database',
+    descricao: 'Pontua qualidade de SQL (segurança 40%, performance 30%, boas práticas 30%)',
+    pontuar: pontuarSql,
+};
+//# sourceMappingURL=scorer-sql.js.map

package/dist/analysts/sql/scorers/scorer-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorer-sql.js","sourceRoot":"","sources":["../../../../src/analysts/sql/scorers/scorer-sql.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgB7C,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAAgB;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAGnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,YAAY,GAAG,EAAE,CAAC;IAGxB,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzG,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,2BAA2B,CAAC,CAAC;IAC5D,CAAC;IAGD,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAClG,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,kCAAkC,CAAC,CAAC;IACnE,CAAC;IAGD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;IACzC,IAAI,cAAc,KAAK,CAAC,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QACxD,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,GAAG,SAAS,0BAA0B,CAAC,CAAC;IACvE,CAAC;IAGD,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAGD,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACvE,CAAC;QACD,SAAS,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IAGD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC9F,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC1B,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,8BAA8B,CAAC,CAAC;IAChE,CAAC;IAGD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,cAAc,GAAG,EAAE,CAAC;IAG1B,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACtE,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,6IAA6I,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1L,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IAGD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,4BAA4B,CAAC,CAAC;IAC1D,CAAC;IAGD,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EACzB,CAAC;QACD,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAGD,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAClE,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAC1B,WAAW,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,kCAAkC,CAAC,CAAC;IACrE,CAAC;IAGD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,eAAe,GAAG,EAAE,CAAC;IAG3B,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpH,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,sBAAsB,CAAC,CAAC;IACtD,CAAC;IAGD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,KAAK,CAAC,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;QAC5C,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,WAAW,2BAA2B,CAAC,CAAC;IACnE,CAAC;IAGD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IAGD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,qGAAqG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChJ,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACjE,IAAI,OAAO,KAAK,CAAC,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;QAC5C,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,WAAW,yBAAyB,CAAC,CAAC;IACjE,CAAC;IAGD,IACE,CAAC,8LAA8L,CAAC,IAAI,CAAC,GAAG,CAAC,EACzM,CAAC;QACD,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAGD,IACE,CAAC,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC;QACtE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EACvB,CAAC;QACD,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAGD,IAAI,CAAC,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3F,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;IACrD,MAAM,QAAQ,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;IAEjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM;QACN,SAAS;QACT,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,YAAY,CAAC,GAAG,GAAG,CAAC,EAAE;QACjH,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,cAAc,CAAC,GAAG,GAAG,CAAC,EAAE;QAC3H,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,eAAe,CAAC,GAAG,GAAG,CAAC,EAAE;KACjI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,UAAU;IACrB,SAAS,EAAE,6EAA6E;IACxF,OAAO,EAAE,UAAU;CACpB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [GRAFICO] Pontuador de qualidade SQL\n *\n * Avalia a qualidade do SQL baseado em:\n * - Segurança (40%): injeção, credenciais, WHERE, GRANT, transações\n * - Performance (30%): SELECT *, índices, funções, N+1, NOT IN, ORs\n * - Boas Práticas (30%): tipos, constraints, defaults, FK, UNIQUE\n */\n\nimport { splitLines } from '@shared/helpers';\n\nexport interface SqlScoreResult {\n  score: number;\n  maxScore: number;\n  percentage: number;\n  issues: string[];\n  strengths: string[];\n}\n\nexport interface SqlScoreDetalhado extends SqlScoreResult {\n  seguranca: { score: number; maxScore: number; percentage: number };\n  performance: { score: number; maxScore: number; percentage: number };\n  boasPraticas: { score: number; maxScore: number; percentage: number };\n}\n\nexport function pontuarSql(src: string, _relPath: string): SqlScoreResult {\n  const detalhado = pontuarSqlDetalhado(src, _relPath);\n  return {\n    score: detalhado.score,\n    maxScore: detalhado.maxScore,\n    percentage: detalhado.percentage,\n    issues: detalhado.issues,\n    strengths: detalhado.strengths,\n  };\n}\n\nexport function pontuarSqlDetalhado(src: string, _relPath: string): SqlScoreDetalhado {\n  const issues: string[] = [];\n  const strengths: string[] = [];\n  const linhas = splitLines(src);\n  const srcLower = src.toLowerCase();\n\n  // ── Segurança (40 pontos) ──────────────────────────────────────────────\n  let seguranca = 0;\n  const maxSeguranca = 40;\n\n  // No hardcoded credentials (8 pts)\n  const hardcodedCreds = (src.match(/\\b(password|senha|secret|key|token)\\b\\s*[:=]\\s*['\"]/gi) || []).length;\n  if (hardcodedCreds === 0) {\n    seguranca += 8;\n  } else {\n    issues.push(`${hardcodedCreds} credencial(is) hardcoded`);\n  }\n\n  // No SQL injection patterns (8 pts)\n  const concatPatterns = (src.match(/\\s\\+\\s*['\"`].*?(select|insert|update|delete)/gi) || []).length;\n  if (concatPatterns === 0) {\n    seguranca += 8;\n  } else {\n    issues.push(`${concatPatterns} padrão(ões) de concatenação SQL`);\n  }\n\n  // All DELETE/UPDATE have WHERE (8 pts)\n  const deletes = (src.match(/\\bdelete\\s+/gi) || []).length;\n  const updates = (src.match(/\\bupdate\\s+\\w+\\s+set/gi) || []).length;\n  const withWhere = (src.match(/\\bwhere\\b/gi) || []).length;\n  const totalMutations = deletes + updates;\n  if (totalMutations === 0 || withWhere >= totalMutations) {\n    seguranca += 8;\n  } else {\n    seguranca += Math.max(0, 8 - (totalMutations - withWhere) * 4);\n    issues.push(`${totalMutations - withWhere} operação(ões) sem WHERE`);\n  }\n\n  // No GRANT ALL (6 pts)\n  if (!/\\bgrant\\s+all\\s+(privileges\\s+)?on\\b/i.test(src)) {\n    seguranca += 6;\n  } else {\n    issues.push('GRANT ALL PRIVILEGES detectado');\n  }\n\n  // Has transaction wrapping (5 pts)\n  if (\n    (srcLower.includes('begin') && srcLower.includes('commit')) ||\n    (srcLower.includes('begin transaction') && srcLower.includes('commit'))\n  ) {\n    seguranca += 5;\n    strengths.push('Transações corretamente encapsuladas');\n  } else if (!/(insert|update|delete)/i.test(src)) {\n    seguranca += 5;\n  } else {\n    issues.push('Instruções sem transação');\n  }\n\n  // No dynamic WHERE/ORDER BY/LIMIT (5 pts)\n  const dynamicPatterns = (src.match(/\\$\\{.*\\}.*(where|order by|limit|offset)/gi) || []).length;\n  if (dynamicPatterns === 0) {\n    seguranca += 5;\n  } else {\n    issues.push(`${dynamicPatterns} padrão(ões) de SQL dinâmico`);\n  }\n\n  // ── Performance (30 pontos) ────────────────────────────────────────────\n  let performance = 0;\n  const maxPerformance = 30;\n\n  // No SELECT * (8 pts)\n  const selectStar = (src.match(/\\bselect\\s+\\*\\s+from/gi) || []).length;\n  if (selectStar === 0) {\n    performance += 8;\n  } else {\n    performance += Math.max(0, 8 - selectStar * 3);\n    issues.push(`${selectStar} SELECT * detectado(s)`);\n  }\n\n  // No function on column in WHERE (6 pts)\n  const funcOnCol = (src.match(/\\b(upper|lower|year|month|day|cast|convert|coalesce|nullif|substr|substring|trim|len|length|abs|round)\\s*\\(\\s*\\w+\\.?\\w*\\s*\\)\\s*(=|<|>|!=)/gi) || []).length;\n  if (funcOnCol === 0) {\n    performance += 6;\n  } else {\n    issues.push(`${funcOnCol} função(ões) em coluna no WHERE`);\n  }\n\n  // No NOT IN with subquery (5 pts)\n  if (!/\\bnot\\s+in\\s*\\(\\s*select\\b/i.test(src)) {\n    performance += 5;\n  } else {\n    issues.push('NOT IN com subconsulta detectado');\n  }\n\n  // No excessive OR (4 pts)\n  const linhasComOr = linhas.filter(linha => (linha.match(/\\bor\\b/gi) || []).length >= 3).length;\n  if (linhasComOr === 0) {\n    performance += 4;\n  } else {\n    issues.push(`${linhasComOr} linha(s) com múltiplos OR`);\n  }\n\n  // JOINs with index mention (4 pts)\n  if (\n    !/\\bjoin\\b/i.test(src) ||\n    /(index|idx_)/i.test(src)\n  ) {\n    performance += 4;\n  } else if (/\\bjoin\\b/i.test(src)) {\n    issues.push('JOIN sem índice mencionado');\n  }\n\n  // No N+1 pattern (3 pts)\n  const selectStatements = (src.match(/\\bselect\\b/gi) || []).length;\n  if (selectStatements <= 5) {\n    performance += 3;\n  } else {\n    issues.push(`${selectStatements} consultas SELECT - possível N+1`);\n  }\n\n  // ── Boas Práticas (30 pontos) ──────────────────────────────────────────\n  let boasPraticas = 0;\n  const maxBoasPraticas = 30;\n\n  // VARCHAR with size (7 pts)\n  const varcharNoSize = (src.match(/\\bvarchar\\b\\s*(\\(|\\s|$)/gi) || []).filter(m => !/varchar\\(\\d+\\)/i.test(m)).length;\n  if (varcharNoSize === 0) {\n    boasPraticas += 7;\n  } else {\n    issues.push(`${varcharNoSize} VARCHAR sem tamanho`);\n  }\n\n  // Has IF NOT EXISTS (5 pts)\n  const creates = (src.match(/\\bcreate\\s+(table|procedure|view)\\b/gi) || []).length;\n  const ifNotExists = (src.match(/\\bif\\s+not\\s+exists\\b/gi) || []).length;\n  if (creates === 0 || ifNotExists >= creates) {\n    boasPraticas += 5;\n  } else {\n    issues.push(`${creates - ifNotExists} CREATE sem IF NOT EXISTS`);\n  }\n\n  // No TRUNCATE (4 pts)\n  if (!/\\btruncate\\s+table\\b/i.test(src)) {\n    boasPraticas += 4;\n  } else {\n    issues.push('TRUNCATE TABLE detectado');\n  }\n\n  // NOT NULL on columns (4 pts)\n  const colDefs = (src.match(/^\\s*\\w+\\s+(int|varchar|text|char|decimal|numeric|float|double|boolean|date|timestamp|blob|json)\\b/gi) || []).length;\n  const withNotNull = (src.match(/\\bnot\\s+null\\b/gi) || []).length;\n  if (colDefs === 0 || withNotNull >= colDefs) {\n    boasPraticas += 4;\n  } else {\n    issues.push(`${colDefs - withNotNull} coluna(s) sem NOT NULL`);\n  }\n\n  // No FLOAT for currency (4 pts)\n  if (\n    !/(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita).*float|float.*(preco|price|valor|value|salario|salary|custo|cost|total|amount|money|revenue|receita)/i.test(src)\n  ) {\n    boasPraticas += 4;\n  } else {\n    issues.push('FLOAT para valor monetário');\n  }\n\n  // UNIQUE on identifiers (3 pts)\n  if (\n    !/\\b(cpf|cnpj|email|username|login|slug)\\b.*(varchar|char)/i.test(src) ||\n    /\\bunique\\b/i.test(src)\n  ) {\n    boasPraticas += 3;\n  } else {\n    issues.push('Identificadores sem UNIQUE');\n  }\n\n  // Has FOREIGN KEY (3 pts)\n  if (!/\\b\\w+_id\\s+(int|bigint|uuid|varchar)\\b/i.test(src) || /\\bforeign\\s+key\\b/i.test(src)) {\n    boasPraticas += 3;\n  } else {\n    issues.push('Possível FK sem constraint');\n  }\n\n  const score = seguranca + performance + boasPraticas;\n  const maxScore = maxSeguranca + maxPerformance + maxBoasPraticas;\n\n  if (strengths.length === 0 && score > 0) {\n    strengths.push('Script SQL com boas práticas');\n  }\n\n  return {\n    score,\n    maxScore,\n    percentage: maxScore > 0 ? Math.round((score / maxScore) * 100) : 0,\n    issues,\n    strengths,\n    seguranca: { score: seguranca, maxScore: maxSeguranca, percentage: Math.round((seguranca / maxSeguranca) * 100) },\n    performance: { score: performance, maxScore: maxPerformance, percentage: Math.round((performance / maxPerformance) * 100) },\n    boasPraticas: { score: boasPraticas, maxScore: maxBoasPraticas, percentage: Math.round((boasPraticas / maxBoasPraticas) * 100) },\n  };\n}\n\nexport const pontuadorSql = {\n  nome: 'pontuador-sql',\n  categoria: 'database',\n  descricao: 'Pontua qualidade de SQL (segurança 40%, performance 30%, boas práticas 30%)',\n  pontuar: pontuarSql,\n};\n"]}

package/dist/analysts/strategists/archetypes-defs.d.ts

@@ -0,0 +1,4 @@
+import type { ArquetipoEstruturaDef } from '../../types/index.js';
+export declare const ARQUETIPOS: ArquetipoEstruturaDef[];
+export declare function normalizarCaminho(caminho: string): string;
+//# sourceMappingURL=archetypes-defs.d.ts.map

package/dist/analysts/strategists/archetypes-defs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetypes-defs.d.ts","sourceRoot":"","sources":["../../../src/analysts/strategists/archetypes-defs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,GAAG,CAAC;AAE/C,eAAO,MAAM,UAAU,EAAE,qBAAqB,EAiH5C,CAAC;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD"}