@opencodehub/ingestion 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,69 @@
+# @opencodehub/ingestion
+
+The indexing pipeline. Walks a repo, extracts symbols and edges via
+tree-sitter (WASM by default, native opt-in), then runs a 30-phase DAG
+that emits the graph and supporting artifacts under `<repo>/.codehub/`.
+
+## Surface
+
+```ts
+import { runIngestion, DEFAULT_PHASES } from "@opencodehub/ingestion/pipeline";
+
+await runIngestion({
+  repoRoot: "/path/to/repo",
+  phases: DEFAULT_PHASES,
+  // ...embeddings, summaries, scan, sbom toggles
+});
+```
+
+- The pipeline runs serially in topological order — determinism is
+  worth more than the parallelism win at MVP scale
+  (`packages/ingestion/src/pipeline/phases/default-set.ts:14-17`).
+- The runner validates the DAG (missing dependencies, cycles) on every
+  invocation (`packages/ingestion/src/pipeline/runner.ts`).
+- Parse runtime defaults to `web-tree-sitter` (WASM); set
+  `OCH_NATIVE_PARSER=1` to opt into native on Node 22 (root `CLAUDE.md`,
+  Parse runtime section).
+
+## Phases
+
+The 30-phase ordering, sourced from
+`packages/ingestion/src/pipeline/phases/default-set.ts:55-135`. Phases
+group by what they read from the repo or graph.
+
+| Group              | Phases                                                                                                |
+| ------------------ | ----------------------------------------------------------------------------------------------------- |
+| Discovery          | `scan`, `profile`, `repo-node`, `structure`, `markdown`                                               |
+| Parse + scope      | `parse`, `incremental-scope`, `complexity`                                                            |
+| Heuristic graph    | `routes`, `openapi`, `tools`, `orm`, `cross-file`, `accesses`                                         |
+| SCIP overlay       | `scip-index`, `confidence-demote`, `mro`                                                              |
+| Clustering         | `communities`, `dead-code`, `processes`, `fetches`                                                    |
+| Temporal           | `temporal`, `cochange`, `ownership`                                                                   |
+| Supply chain       | `dependencies`, `sbom`                                                                                |
+| Annotation         | `annotate`, `risk-snapshot`                                                                           |
+| Optional emitters  | `summarize`, `embeddings`                                                                             |
+
+## Design
+
+- **Single canonical ordering** — the runner consumes `DEFAULT_PHASES`
+  as the source of truth. Adding a phase is one import + one array
+  entry; the DAG validator does the rest.
+- **Heuristic first, SCIP overlay second** — `parse` and friends emit
+  confidence-0.5 edges; `scip-index` upgrades them to 1.0 and
+  `confidence-demote` drops the unconfirmed survivors to 0.2 with a
+  `+scip-unconfirmed` reason suffix
+  (`packages/ingestion/src/pipeline/phases/default-set.ts:90-95`).
+- **Dual parser runtime** — WASM is the default for cross-platform
+  determinism; the native N-API addon is opt-in for Node 22 dev boxes.
+  The `complexity` phase still requires native and degrades with a
+  one-shot stderr warning otherwise (root `CLAUDE.md`).
+- **Silent toggles** — `summarize`, `embeddings`, `sbom`, and the
+  scanner phase are no-ops unless their option is on, so a default
+  `analyze` writes only the deterministic graph.
+- **Phase outputs are typed** — each phase declares an output type
+  consumed by `ctx.phaseOutputs[<name>]`, surfacing dependency drift at
+  compile time (`packages/ingestion/src/pipeline/types.ts`).
+
+See ADR 0013 for the storage backend the pipeline writes into and the
+root README's "Embedding backends" section for the optional
+`embeddings` phase.

package/dist/extract/index.d.ts

@@ -0,0 +1,8 @@
+/** Barrel exports for the extraction scaffolds used by the routes / tools / orm pipeline phases. */
+export { detectPrismaCalls, detectSupabaseCalls } from "./orm-detector.js";
+export type { ImportedSymbol, ReceiverOrigin, ResolvedTypeInfo, TsMorphProject, } from "./receiver-resolver.js";
+export { importsMapFromExtracted, resolveReceiver } from "./receiver-resolver.js";
+export { detectExpressRoutes, detectNextJsRoutes } from "./route-detector.js";
+export { detectMcpTools } from "./tool-detector.js";
+export type { ExtractedOrmEdge, ExtractedRoute, ExtractedTool, ExtractInput } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/extract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/extract/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAEpG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/extract/index.js

@@ -0,0 +1,6 @@
+/** Barrel exports for the extraction scaffolds used by the routes / tools / orm pipeline phases. */
+export { detectPrismaCalls, detectSupabaseCalls } from "./orm-detector.js";
+export { importsMapFromExtracted, resolveReceiver } from "./receiver-resolver.js";
+export { detectExpressRoutes, detectNextJsRoutes } from "./route-detector.js";
+export { detectMcpTools } from "./tool-detector.js";
+//# sourceMappingURL=index.js.map

package/dist/extract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extract/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAEpG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO3E,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/extract/orm-detector.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ORM call detectors for Prisma and Supabase.
+ *
+ * Regexes authored fresh from:
+ *   - Prisma Client API:     https://www.prisma.io/docs/orm/reference/prisma-client-reference
+ *   - Supabase JS reference: https://supabase.com/docs/reference/javascript/select
+ *
+ * Receiver precision (P06): each candidate call site's receiver identifier
+ * is confirmed against the file's import graph before an edge is emitted.
+ * Prisma edges require a `@prisma/client` import; Supabase edges require a
+ * `@supabase/supabase-js` import. When no import map is supplied AND
+ * {@link ExtractInput.strictDetectors} is `false`, the detector falls back
+ * to the pre-P06 regex-only heuristic (tagged `reason: "heuristic"` so
+ * downstream can filter).
+ */
+import type { ExtractedOrmEdge, ExtractInput } from "./types.js";
+export declare function detectPrismaCalls(input: ExtractInput): readonly ExtractedOrmEdge[];
+export declare function detectSupabaseCalls(input: ExtractInput): readonly ExtractedOrmEdge[];
+//# sourceMappingURL=orm-detector.d.ts.map

package/dist/extract/orm-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-detector.d.ts","sourceRoot":"","sources":["../../src/extract/orm-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsCjE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,gBAAgB,EAAE,CAsClF;AAmBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,gBAAgB,EAAE,CA+CpF"}

package/dist/extract/orm-detector.js

@@ -0,0 +1,209 @@
+/**
+ * ORM call detectors for Prisma and Supabase.
+ *
+ * Regexes authored fresh from:
+ *   - Prisma Client API:     https://www.prisma.io/docs/orm/reference/prisma-client-reference
+ *   - Supabase JS reference: https://supabase.com/docs/reference/javascript/select
+ *
+ * Receiver precision (P06): each candidate call site's receiver identifier
+ * is confirmed against the file's import graph before an edge is emitted.
+ * Prisma edges require a `@prisma/client` import; Supabase edges require a
+ * `@supabase/supabase-js` import. When no import map is supplied AND
+ * {@link ExtractInput.strictDetectors} is `false`, the detector falls back
+ * to the pre-P06 regex-only heuristic (tagged `reason: "heuristic"` so
+ * downstream can filter).
+ */
+import { resolveReceiver } from "./receiver-resolver.js";
+const PRISMA_MODULE = "@prisma/client";
+const SUPABASE_MODULE = "@supabase/supabase-js";
+// ---------------------------------------------------------------------------
+// Prisma
+// ---------------------------------------------------------------------------
+/** Prisma Client operation names — the public model-delegate surface. */
+const PRISMA_OPS = new Set([
+    "findUnique",
+    "findUniqueOrThrow",
+    "findMany",
+    "findFirst",
+    "findFirstOrThrow",
+    "create",
+    "createMany",
+    "createManyAndReturn",
+    "update",
+    "updateMany",
+    "updateManyAndReturn",
+    "upsert",
+    "delete",
+    "deleteMany",
+    "count",
+    "aggregate",
+    "groupBy",
+]);
+/**
+ * Match `<ident>.<model>.<op>(` where the identifier contains `prisma`
+ * (case-insensitive). Model name must be a valid JS identifier; op must be
+ * one of `PRISMA_OPS`.
+ */
+const PRISMA_CALL_RE = /\b([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g;
+export function detectPrismaCalls(input) {
+    const { filePath, content, importsByFile, tsMorphProject, strictDetectors } = input;
+    if (!/prisma/i.test(content))
+        return [];
+    const out = [];
+    PRISMA_CALL_RE.lastIndex = 0;
+    let match = PRISMA_CALL_RE.exec(content);
+    while (match !== null) {
+        const receiver = match[1] ?? "";
+        const model = match[2];
+        const op = match[3];
+        match = PRISMA_CALL_RE.exec(content);
+        if (model === undefined || op === undefined)
+            continue;
+        if (!/prisma/i.test(receiver))
+            continue;
+        if (!PRISMA_OPS.has(op))
+            continue;
+        // `prisma.$transaction(...)` etc. use `$` prefix — already excluded
+        // because `$transaction` isn't in `PRISMA_OPS` and a `$`-prefixed token
+        // wouldn't be treated as a model anyway.
+        if (model.startsWith("$"))
+            continue;
+        const emitReason = verifyReceiver({
+            receiver,
+            filePath,
+            expectedModule: PRISMA_MODULE,
+            importsByFile,
+            tsMorphProject,
+            strictDetectors: strictDetectors === true,
+        });
+        if (emitReason === null)
+            continue;
+        out.push({
+            callerFile: filePath,
+            modelName: model,
+            operation: op,
+            orm: "prisma",
+            confidence: 0.9,
+            reason: emitReason,
+        });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Supabase
+// ---------------------------------------------------------------------------
+/** Supabase query-builder leaf operations we treat as "writes/reads". */
+const SUPABASE_OPS = ["select", "insert", "upsert", "update", "delete"];
+/**
+ * Match `<ident>.from('table')` / `.from("table")` / \`.from(\`table\`)\`.
+ * The `from()` call is what binds a table name in supabase-js.
+ */
+const SUPABASE_FROM_RE = /\b([A-Za-z_$][\w$]*)\s*\.\s*from\s*\(\s*(?:'([^']+)'|"([^"]+)"|`([^`$]+)`)\s*\)/g;
+/** Window (in characters) after `.from(...)` to look for the leaf op. */
+const SUPABASE_OP_WINDOW = 10;
+export function detectSupabaseCalls(input) {
+    const { filePath, content, importsByFile, tsMorphProject, strictDetectors } = input;
+    if (!/supabase/i.test(content))
+        return [];
+    const out = [];
+    SUPABASE_FROM_RE.lastIndex = 0;
+    let match = SUPABASE_FROM_RE.exec(content);
+    while (match !== null) {
+        const receiver = match[1] ?? "";
+        const table = match[2] ?? match[3] ?? match[4];
+        const end = SUPABASE_FROM_RE.lastIndex;
+        match = SUPABASE_FROM_RE.exec(content);
+        if (table === undefined)
+            continue;
+        if (!/supabase/i.test(receiver))
+            continue;
+        // Look ahead up to SUPABASE_OP_WINDOW characters for `.<op>(`.
+        const tail = content.slice(end, end + SUPABASE_OP_WINDOW + 8);
+        let matchedOp;
+        for (const op of SUPABASE_OPS) {
+            // Permit whitespace but require the dot to land within the window.
+            const probe = new RegExp(`^\\s*\\.\\s*${op}\\s*\\(`);
+            if (probe.test(tail)) {
+                matchedOp = op;
+                break;
+            }
+        }
+        if (matchedOp === undefined)
+            continue;
+        const emitReason = verifyReceiver({
+            receiver,
+            filePath,
+            expectedModule: SUPABASE_MODULE,
+            importsByFile,
+            tsMorphProject,
+            strictDetectors: strictDetectors === true,
+        });
+        if (emitReason === null)
+            continue;
+        out.push({
+            callerFile: filePath,
+            modelName: table,
+            operation: matchedOp,
+            orm: "supabase",
+            confidence: 0.85,
+            reason: emitReason,
+        });
+    }
+    return out;
+}
+/**
+ * Confirm the receiver identifier resolves back to `expectedModule` via the
+ * import graph (and, optionally, ts-morph). Returns the provenance tag to
+ * attach to the emitted edge, or `null` when the detector should drop the
+ * candidate.
+ *
+ *  - `"receiver-confirmed"` — the resolver matched `expectedModule`.
+ *  - `"heuristic"`          — resolver could not pinpoint the receiver, but
+ *                             the expected module is imported elsewhere in
+ *                             the file (common for ORM clients wrapped by
+ *                             a local factory), OR no import map was
+ *                             supplied at all and strict-mode is off.
+ *  - `null`                 — resolver returned a DIFFERENT module, OR
+ *                             strict-mode is on and no positive match found.
+ */
+function verifyReceiver(args) {
+    const { receiver, filePath, expectedModule, importsByFile, tsMorphProject, strictDetectors } = args;
+    const origin = resolveReceiver(receiver, filePath, importsByFile, tsMorphProject);
+    if (origin !== null) {
+        if (origin.moduleName === expectedModule)
+            return "receiver-confirmed";
+        // Resolved to a DIFFERENT module — this is a real false positive the
+        // heuristic would have otherwise emitted. Always drop.
+        return null;
+    }
+    // Resolver could not pinpoint the receiver's origin. If the expected
+    // module is imported anywhere in the file we treat this as a weaker
+    // "same-module" heuristic — typical for Prisma clients constructed from
+    // `new PrismaClient()` or wrapped by a `createClient()` factory where
+    // the receiver identifier isn't itself imported. `strictDetectors`
+    // disables this fallback.
+    if (importsByFile !== undefined) {
+        if (strictDetectors)
+            return null;
+        if (fileImportsModule(filePath, expectedModule, importsByFile))
+            return "heuristic";
+        return null;
+    }
+    // No import map plumbed at all — fall back to the pre-P06 regex emit
+    // unless strict mode is on.
+    if (strictDetectors)
+        return null;
+    return "heuristic";
+}
+/** `true` when `filePath` imports from `moduleName` (exact specifier match). */
+function fileImportsModule(filePath, moduleName, importsByFile) {
+    const imports = importsByFile.get(filePath);
+    if (imports === undefined)
+        return false;
+    for (const imp of imports) {
+        if (imp.source === moduleName)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=orm-detector.js.map

package/dist/extract/orm-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-detector.js","sourceRoot":"","sources":["../../src/extract/orm-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,YAAY;IACZ,mBAAmB;IACnB,UAAU;IACV,WAAW;IACX,kBAAkB;IAClB,QAAQ;IACR,YAAY;IACZ,qBAAqB;IACrB,QAAQ;IACR,YAAY;IACZ,qBAAqB;IACrB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,cAAc,GAClB,gFAAgF,CAAC;AAEnF,MAAM,UAAU,iBAAiB,CAAC,KAAmB;IACnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACpF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,GAA2B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QACtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,oEAAoE;QACpE,wEAAwE;QACxE,yCAAyC;QACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEpC,MAAM,UAAU,GAAG,cAAc,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,cAAc,EAAE,aAAa;YAC7B,aAAa;YACb,cAAc;YACd,eAAe,EAAE,eAAe,KAAK,IAAI;SAC1C,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,QAAQ;YACb,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAEjF;;;GAGG;AACH,MAAM,gBAAgB,GACpB,kFAAkF,CAAC;AAErF,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACpF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,GAA2B,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC;QACvC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QAE1C,+DAA+D;QAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,kBAAkB,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,SAA6B,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,SAAS,GAAG,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,cAAc,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,cAAc,EAAE,eAAe;YAC/B,aAAa;YACb,cAAc;YACd,eAAe,EAAE,eAAe,KAAK,IAAI;SAC1C,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CAAC,IAAwB;IAC9C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,GAC1F,IAAI,CAAC;IAEP,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc;YAAE,OAAO,oBAAoB,CAAC;QACtE,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,0BAA0B;IAC1B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,eAAe;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,CAAC;YAAE,OAAO,WAAW,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,4BAA4B;IAC5B,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CACxB,QAAgB,EAChB,UAAkB,EAClB,aAAyD;IAEzD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/extract/property-access.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared property-access walker powering the ACCESSES-edge emitter.
+ *
+ * Per-function/method body, we scan the source text between `startLine` and
+ * `endLine` (inclusive, 1-indexed) and look for:
+ *   - Member expressions  (`a.b`)            → read
+ *   - Assignment targets  (`a.b = ...`)      → write
+ *   - Subscript accesses  (`a["b"]`)         → read (also "b" when LHS)
+ *
+ * We deliberately do not consume the tree-sitter parse tree: the unified
+ * query does not surface member/attribute/assignment/subscript nodes. A
+ * source-text walker that first strips comments + string literals via
+ * {@link stripComments} is deterministic, language-agnostic, and avoids a
+ * round-trip through the worker pool.
+ *
+ * Per-language providers pass a {@link PropertyAccessConfig} selecting which
+ * flavour of assignment operators to treat as writes (Python augments include
+ * `:=`; some languages use `=` only). The walker is careful to:
+ *   - Skip property names that collide with keywords (`this`, `self`, `if`...).
+ *   - Skip chained receivers (`a.b.c` → only the last segment is treated as
+ *     a property read anchored to the *most recent* identifier).
+ *   - Skip function-call members (`a.foo()` is a call, not a property read).
+ *   - Skip optional chaining (`a?.b`) is kept (TS/JS-only; detected).
+ *
+ * Flat property names only (v2 scope): `user.address.street` yields reads
+ * on `address` (for `user`) and `street` (for `address`). Qualified paths
+ * are a future extension.
+ */
+import type { ExtractedDefinition, PropertyAccess } from "../providers/extraction-types.js";
+/**
+ * Per-language tuning for the walker.
+ *
+ * `commentStripped`: passes the stripped string through verbatim when `true`
+ *   (TS/JS/Python share the same stripping rules via
+ *   {@link stripComments}; more exotic comment grammars can pre-process
+ *   their source before calling the walker).
+ *
+ * `memberSeparator`: `.` for every language supported by v2. Kept as a
+ *   parameter so a future Ruby / Kotlin / Swift addition can swap in `::`
+ *   or `->` without forking the walker.
+ *
+ * `assignmentOperators`: regex alternation snippet matching the write
+ *   operators the language recognises. TS/JS use `=`, `+=`, `-=`, etc.;
+ *   Python additionally accepts `:=`.
+ */
+export interface PropertyAccessConfig {
+    readonly commentStripped?: boolean;
+    readonly memberSeparator: "." | "::" | "->";
+    readonly assignmentOperators: readonly string[];
+}
+export declare const TS_ACCESS_CONFIG: PropertyAccessConfig;
+export declare const PYTHON_ACCESS_CONFIG: PropertyAccessConfig;
+interface EnclosingDef {
+    readonly id: string;
+    readonly startLine: number;
+    readonly endLine: number;
+    readonly qualifiedName: string;
+}
+/**
+ * Extract every property access inside the given function/method bodies.
+ *
+ * `enclosingDefs` is a filtered view of `definitions` (Function / Method /
+ * Constructor kinds only) with pre-resolved `NodeId`s so the walker doesn't
+ * re-derive them.
+ */
+export declare function extractPropertyAccesses(filePath: string, sourceText: string, enclosingDefs: readonly EnclosingDef[], config: PropertyAccessConfig): readonly PropertyAccess[];
+/** Stable ordering: (enclosingSymbolId, propertyName, startLine, reason). */
+export declare function sortAccesses(accesses: readonly PropertyAccess[]): readonly PropertyAccess[];
+/**
+ * Convenience filter — providers call this to narrow the `ExtractedDefinition`
+ * list down to callable owners, then hand each through `idForDefinition` from
+ * the parse phase before invoking {@link extractPropertyAccesses}.
+ */
+export declare function callableDefs(defs: readonly ExtractedDefinition[]): readonly ExtractedDefinition[];
+export {};
+//# sourceMappingURL=property-access.d.ts.map

package/dist/extract/property-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"property-access.d.ts","sourceRoot":"","sources":["../../src/extract/property-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAE5F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,eAAO,MAAM,gBAAgB,EAAE,oBAuB9B,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,oBAoBlC,CAAC;AA0CF,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,SAAS,YAAY,EAAE,EACtC,MAAM,EAAE,oBAAoB,GAC3B,SAAS,cAAc,EAAE,CAiG3B;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,cAAc,EAAE,CAY3F;AAiCD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,mBAAmB,EAAE,CAIjG"}