@vantageos/backend-doctor 0.1.14 → 0.3.0

package/dist/detectors/source/identity-by-id.js

@@ -0,0 +1,1783 @@
+// R-53 — an actor and a target are identified by ID, resolved through the shared
+// identity package; a name never selects or authorises a row.
+//
+// Standard 2825122 §4 (R-53) and its Detector spec, read literally:
+//   reads   every public mutation/action handler and every function it calls;
+//           every gate in mcp-server/src; the import graph to
+//           `@vantageos/cloud-identity`; per write, the predicate that admitted
+//           the caller to the target.
+//   red (a) a principal ID or organisation taken from anything other than the
+//           package's resolver output;
+//       (b) a write whose admission compares a name field (assignedTo,
+//           createdBy, callerOrchestrator, name, …) with a typed or
+//           credential-carried name, or has no predicate on the target at all;
+//       (c) a branch that continues when no principal / no organisation is
+//           resolved — as master, as the service account, or on a name match;
+//       (d) a function outside the package that decides identity: compares
+//           names to authenticate, or re-implements the resolution.
+//   green   principal from the package; every write admitted by comparing stored
+//           IDs with the resolved IDs; the unresolved branch refuses.
+//   cnj     only an undelimitable predicate or an unresolvable package import.
+//   No justification-token exit. Coverage fails on itself.
+//
+// SITES. One site per public write door (convex), naming every clause it fails;
+// one per function that decides identity locally (d); one per branch that
+// continues on an unresolved principal or organisation (c), in convex/ and in
+// mcp-server/src (where the gate that forwards an org only when it has one lets
+// an org-less bearer through — the PR #1464 `bulk_complete_tasks` path).
+import * as ts from "typescript";
+import { closeOverCalls, dotted, indexFunctions, lineOf, parseFile, propReadResolved, registrations, unwrap, walk, } from "./_ast.js";
+import { decide, emptyScan, isConvexOrMcp, isJudgeable, SOURCE_STANDARD_PIN, } from "./_scan.js";
+import { recipientByNameSites } from "./recipient-by-id.js";
+export const IDENTITY_PACKAGE = "@vantageos/cloud-identity";
+export const R53_ID = "R-53 an actor and a target are identified by ID through @vantageos/cloud-identity; a name never selects or authorises a row";
+const R53_CHECK = "the principal is the package resolver's output, every write admits by comparing stored IDs with the resolved IDs, the unresolved branch refuses, and no local function decides identity";
+/** Name fields: a display label that must never be an admission operand. */
+export const NAME_TOKENS = new Set([
+    "assignedTo",
+    "createdBy",
+    "lastAssignedTo",
+    "callerOrchestrator",
+    "orchestrator",
+    "orchestratorId",
+    "assertedName",
+    "agentName",
+    "name",
+]);
+/** Stored-ID fields a target is admitted by. */
+const ID_FIELDS = new Set([
+    "orgId",
+    "ownerId",
+    "userId",
+    "tenantId",
+    "principalId",
+    "agentId",
+]);
+const WRITE = /\bdb\.(patch|replace|delete|insert)$/;
+const TARGET_WRITE = /\bdb\.(patch|replace|delete)$/;
+/** The org mapping read by the product itself: resolution, whatever feeds it. */
+const ORG_MAPPING_READ = /\.query\(\s*["'`]client_org_mapping["'`]\s*\)/;
+const HOST_READ = /\bgetUserIdentity$/;
+/** The package's principal resolvers: the ONLY sinks a host credential read
+ * may feed (first argument). The package verifies nothing about the credential
+ * (cloud-identity 0.11.0 `principal-by-id.d.ts:37`, `person-principal.d.ts:28`),
+ * so the host MUST read `ctx.auth` and hand the claims over; the read is a local
+ * identity decision only when its value goes anywhere else. */
+export const PACKAGE_RESOLVERS = new Set([
+    "resolveActingPrincipal",
+    "resolvePersonPrincipal",
+]);
+function isLiteral(e) {
+    const u = unwrap(e);
+    return (ts.isStringLiteralLike(u) ||
+        ts.isNumericLiteral(u) ||
+        u.kind === ts.SyntaxKind.NullKeyword ||
+        u.kind === ts.SyntaxKind.TrueKeyword ||
+        u.kind === ts.SyntaxKind.FalseKeyword ||
+        (ts.isIdentifier(u) && u.text === "undefined"));
+}
+/** A slug is a label, never an ID: `slug`, `orgSlug`, `clerkOrgSlug`,
+ * `org_slug`: a trailing "slug" at the start of the name or after a lowercase
+ * letter or an underscore (camelCase, snake_case and the bare word alike). */
+function isSlugName(s) {
+    return /(^|[a-z_])slug$/i.test(s);
+}
+/** Does an operand carry a name (a name field read, a name identifier)? A field
+ * is read as `x.f`, as `x["f"]`, or through ONE const alias of either
+ * (`const owner = x.f`), so spelling the read differently dodges nothing. */
+function mentionsName(e) {
+    let hit = false;
+    walk(e, (x) => {
+        const r = ts.isExpression(x) ? propReadResolved(x) : undefined;
+        if (r &&
+            (NAME_TOKENS.has(r.name) || isSlugName(r.name)) &&
+            !isPropertyNamePart(x))
+            hit = true;
+        else if (ts.isIdentifier(x) &&
+            (NAME_TOKENS.has(x.text) || isSlugName(x.text)) &&
+            !(ts.isPropertyAccessExpression(x.parent) && x.parent.name === x))
+            hit = true;
+    });
+    return hit;
+}
+/** The `name` of `a.name`: not itself a read of a binding. */
+function isPropertyNamePart(x) {
+    return (ts.isIdentifier(x) &&
+        ts.isPropertyAccessExpression(x.parent) &&
+        x.parent.name === x);
+}
+function mentionsIdField(e) {
+    let hit = false;
+    walk(e, (x) => {
+        const r = ts.isExpression(x) ? propReadResolved(x) : undefined;
+        if (r && ID_FIELDS.has(r.name) && !isPropertyNamePart(x))
+            hit = true;
+    });
+    return hit;
+}
+const EQ = new Set([
+    ts.SyntaxKind.EqualsEqualsEqualsToken,
+    ts.SyntaxKind.ExclamationEqualsEqualsToken,
+    ts.SyntaxKind.EqualsEqualsToken,
+    ts.SyntaxKind.ExclamationEqualsToken,
+]);
+/** Name comparisons in a node's OWN body: `a === b` with a name on one side
+ * and no literal on either, or `names.includes(x)` over a name list. */
+export function nameComparisons(n) {
+    const out = [];
+    walk(n, (x) => {
+        if (ts.isBinaryExpression(x) && EQ.has(x.operatorToken.kind)) {
+            if (isLiteral(x.left) || isLiteral(x.right))
+                return;
+            // exempt only when BOTH operands are ID fields: a name (or a slug)
+            // on either side is a name comparison, whatever the other side is.
+            if (mentionsIdField(x.left) && mentionsIdField(x.right))
+                return;
+            if (mentionsName(x.left) || mentionsName(x.right))
+                out.push(x);
+        }
+        // `switch (a) { case b: }` is the equality `a === b`.
+        if (ts.isCaseClause(x) && ts.isSwitchStatement(x.parent.parent)) {
+            const subject = x.parent.parent.expression;
+            if (isLiteral(subject) || isLiteral(x.expression))
+                return;
+            if (mentionsIdField(subject) && mentionsIdField(x.expression))
+                return;
+            if (mentionsName(subject) || mentionsName(x.expression))
+                out.push(x);
+        }
+        if (ts.isCallExpression(x) &&
+            ts.isPropertyAccessExpression(x.expression) &&
+            x.expression.name.text === "includes" &&
+            /allowedOrchestrators|\broster\b|allowList\b|fromAllowList/i.test(x.expression.expression.getText()) &&
+            x.arguments[0] &&
+            !isLiteral(x.arguments[0]))
+            out.push(x);
+    });
+    return out;
+}
+/** ID comparisons: a stored ID field compared with something not a literal. */
+function idComparisons(n) {
+    const out = [];
+    walk(n, (x) => {
+        if (ts.isBinaryExpression(x) &&
+            EQ.has(x.operatorToken.kind) &&
+            !isLiteral(x.left) &&
+            !isLiteral(x.right) &&
+            mentionsIdField(x.left) &&
+            mentionsIdField(x.right))
+            out.push(x);
+    });
+    return out;
+}
+/** Does `node` sit in a condition that refuses (throw / return) on its branch? */
+function admits(cmp) {
+    for (let x = cmp; x; x = x.parent) {
+        if (ts.isIfStatement(x))
+            return true;
+        if (ts.isReturnStatement(x))
+            return true;
+        if (ts.isConditionalExpression(x))
+            return true;
+        if (ts.isCaseClause(x))
+            return true;
+        // a callback handed to a call (`list.some((e) => e === name)`) is part
+        // of the enclosing predicate; any other function boundary stops.
+        if (ts.isFunctionLike(x) && !(x.parent && ts.isCallExpression(x.parent)))
+            return false;
+    }
+    return false;
+}
+/** The package's own target check (cloud-identity `principal-by-id`):
+ * `assertTargetBelongsTo(principal, { orgId, ownerId? }, opts?)` at a6e5780,
+ * `await assertTargetBelongsTo(principal, target, lookups, opts?)` at PR #21. */
+export const TARGET_CHECK = "assertTargetBelongsTo";
+export function importsOf(p) {
+    const pkg = new Set();
+    const imports = { named: new Map(), namespaces: new Set() };
+    let unresolved = false;
+    for (const st of p.sf.statements) {
+        if (!ts.isImportDeclaration(st))
+            continue;
+        const from = st.moduleSpecifier.text;
+        if (from !== IDENTITY_PACKAGE)
+            continue;
+        const b = st.importClause?.namedBindings;
+        if (b && ts.isNamedImports(b))
+            for (const e of b.elements) {
+                pkg.add(e.name.text);
+                imports.named.set(e.name.text, (e.propertyName ?? e.name).text);
+            }
+        else if (b && ts.isNamespaceImport(b)) {
+            pkg.add(b.name.text);
+            imports.namespaces.add(b.name.text);
+        }
+        else if (st.importClause?.name)
+            pkg.add(st.importClause.name.text);
+        else
+            unresolved = true;
+    }
+    return { pkg, imports, unresolved };
+}
+/** The package export a callee names, through the file's own import of it
+ * (`assertTargetBelongsTo`, `x as y`, `identity.assertTargetBelongsTo`). */
+export function pkgExportOf(callee, imp) {
+    const e = unwrap(callee);
+    if (ts.isIdentifier(e))
+        return imp.named.get(e.text);
+    if (ts.isPropertyAccessExpression(e)) {
+        const head = unwrap(e.expression);
+        if (ts.isIdentifier(head) && imp.namespaces.has(head.text))
+            return e.name.text;
+    }
+    return undefined;
+}
+/** `!v.ok`, `v.ok === false`, `v.ok !== true` (either operand order). */
+export function refusesOnNotOk(c0, v) {
+    const c = unwrap(c0);
+    if (ts.isPrefixUnaryExpression(c) &&
+        c.operator === ts.SyntaxKind.ExclamationToken)
+        return dotted(c.operand) === `${v}.ok`;
+    if (!ts.isBinaryExpression(c))
+        return false;
+    const k = c.operatorToken.kind;
+    const pair = (a, b) => {
+        if (dotted(a) !== `${v}.ok`)
+            return false;
+        const lit = unwrap(b).kind;
+        return (((k === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            k === ts.SyntaxKind.EqualsEqualsToken) &&
+            lit === ts.SyntaxKind.FalseKeyword) ||
+            ((k === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+                k === ts.SyntaxKind.ExclamationEqualsToken) &&
+                lit === ts.SyntaxKind.TrueKeyword));
+    };
+    return pair(c.left, c.right) || pair(c.right, c.left);
+}
+/** The branch leaves the handler: a throw or a return of its own. */
+function exits(n) {
+    let hit = false;
+    walk(n, (y) => {
+        if (ts.isThrowStatement(y) || ts.isReturnStatement(y))
+            hit = true;
+    }, true);
+    return hit;
+}
+/** Does `stmt` precede `node` in a block enclosing `node`, up to `stop`? */
+function precedesInEnclosingBlock(stmt, node, stop) {
+    let child = node;
+    for (let q = node.parent; q && q !== stop.parent; child = q, q = q.parent) {
+        if (ts.isBlock(q) || ts.isSourceFile(q)) {
+            const i = q.statements.indexOf(stmt);
+            const j = q.statements.indexOf(child);
+            if (i >= 0 && j >= 0)
+                return i < j;
+        }
+        if (ts.isFunctionLike(q) && q !== stop)
+            return false;
+    }
+    return false;
+}
+/** The writes of `body` that a package target check admits (standard 2825122
+ * R-53 green: "the target row is checked to belong to the resolved principal or
+ * its organisation by comparing stored IDs"): a local bound to
+ * `[await] assertTargetBelongsTo(<principal>, { orgId: R.orgId[, ownerId: R.ownerId] }, …)`
+ * resolved through the file's import of the package; R a row read by
+ * `db.get(K)`; an `if (!may.ok) throw|return` preceding the write in a block
+ * that encloses it; the write addressing `K` or `R._id`. A call whose result is
+ * ignored, or whose refusal does not dominate, admits nothing. */
+function packageAdmittedWrites(body, imp, principalRoots) {
+    const out = new Set();
+    const locals = new Map();
+    walk(body, (x) => {
+        if (ts.isVariableDeclaration(x) && ts.isIdentifier(x.name))
+            locals.set(x.name.text, x);
+    }, true);
+    const writes = [];
+    walk(body, (x) => {
+        if (ts.isCallExpression(x) &&
+            TARGET_WRITE.test(dotted(x.expression) ?? ""))
+            writes.push(x);
+    }, true);
+    for (const [v, decl] of locals) {
+        const init = decl.initializer && unwrap(decl.initializer);
+        if (!init || !ts.isCallExpression(init))
+            continue;
+        if (pkgExportOf(init.expression, imp) !== TARGET_CHECK)
+            continue;
+        const [a0, a1] = init.arguments;
+        if (!a0 || !a1)
+            continue;
+        const pRoot = (dotted(a0) ?? "").split(".")[0];
+        if (!principalRoots.has(pRoot))
+            continue;
+        const t = unwrap(a1);
+        if (!ts.isObjectLiteralExpression(t))
+            continue;
+        const fields = new Map();
+        for (const pr of t.properties)
+            if (ts.isPropertyAssignment(pr) && ts.isIdentifier(pr.name))
+                fields.set(pr.name.text, pr.initializer);
+            else if (ts.isShorthandPropertyAssignment(pr))
+                fields.set(pr.name.text, pr.name);
+        const rowOf = (field) => {
+            const e = fields.get(field);
+            if (!e)
+                return undefined;
+            const r = propReadResolved(e);
+            if (!r || r.name !== field || !ts.isIdentifier(unwrap(r.obj)))
+                return undefined;
+            return unwrap(r.obj).text;
+        };
+        const row = rowOf("orgId");
+        if (!row || principalRoots.has(row))
+            continue;
+        if (fields.has("ownerId") && rowOf("ownerId") !== row)
+            continue;
+        // the row and the key that selected it
+        const keys = new Set([`${row}._id`]);
+        const rowInit = locals.get(row)?.initializer;
+        const ri = rowInit && unwrap(rowInit);
+        if (ri &&
+            ts.isCallExpression(ri) &&
+            /\bdb\.get$/.test(dotted(ri.expression) ?? "") &&
+            ri.arguments[0]) {
+            const k = dotted(ri.arguments[ri.arguments.length - 1]);
+            if (k)
+                keys.add(k);
+        }
+        // the refusal on !ok, throwing or returning
+        const refusals = [];
+        walk(body, (x) => {
+            if (ts.isIfStatement(x) &&
+                refusesOnNotOk(x.expression, v) &&
+                exits(x.thenStatement))
+                refusals.push(x);
+        }, true);
+        for (const w of writes) {
+            const sel = w.arguments[0] && dotted(w.arguments[0]);
+            if (!sel || !keys.has(sel))
+                continue;
+            if (refusals.some((r) => precedesInEnclosingBlock(r, w, body)))
+                out.add(w);
+        }
+    }
+    return out;
+}
+function callsAny(n, names) {
+    let hit = false;
+    walk(n, (x) => {
+        if (!ts.isCallExpression(x))
+            return;
+        const head = (dotted(x.expression) ?? "").split(".")[0];
+        if (names.has(head))
+            hit = true;
+    });
+    return hit;
+}
+// ---- the host credential read, followed by value -------------------------
+//
+// A `getUserIdentity()` read is CONFORMANT when every path its value takes ends
+// as the first argument of a package resolver (PACKAGE_RESOLVERS, resolved
+// through the calling file's own import of the package). The value is followed
+// as R-6 follows a boundary — through locals, renames, destructuring, a field
+// read, an object/array literal that carries it, a helper's parameter, and a
+// helper's return to EVERY one of its call sites — never by name. The only
+// condition on the raw value admitted is an ABSENCE test inside a helper whose
+// branch is `return null|undefined` (absence forwarded to the package, which
+// refuses it); any other use — a comparison, any other branch, an index key, a
+// non-resolver call, a door returning it — is a local identity decision.
+/** `!x`, `x === null|undefined` (either order), with `x` exactly `ref`. */
+function absenceTestOf(ref) {
+    let x = ref;
+    while (x.parent &&
+        (ts.isParenthesizedExpression(x.parent) || ts.isNonNullExpression(x.parent)))
+        x = x.parent;
+    const par = x.parent;
+    if (par &&
+        ts.isPrefixUnaryExpression(par) &&
+        par.operator === ts.SyntaxKind.ExclamationToken)
+        return par;
+    if (par &&
+        ts.isBinaryExpression(par) &&
+        (par.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            par.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken)) {
+        const other = par.left === x ? par.right : par.left;
+        if (isLiteral(other) && /^(null|undefined)$/.test(unwrap(other).getText()))
+            return par;
+    }
+    return undefined;
+}
+/** `return null`, `return undefined`, `return;` — alone, or alone in a block. */
+function forwardsAbsence(s) {
+    const one = ts.isBlock(s) && s.statements.length === 1 ? s.statements[0] : s;
+    if (!ts.isReturnStatement(one))
+        return false;
+    if (!one.expression)
+        return true;
+    const e = unwrap(one.expression);
+    return (e.kind === ts.SyntaxKind.NullKeyword ||
+        (ts.isIdentifier(e) && e.text === "undefined"));
+}
+/** A Convex registration's own `handler` (a door, never a helper). */
+function isHandler(fn) {
+    return (((ts.isArrowFunction(fn) || ts.isFunctionExpression(fn)) &&
+        !!fn.parent &&
+        ts.isPropertyAssignment(fn.parent) &&
+        ts.isIdentifier(fn.parent.name) &&
+        fn.parent.name.text === "handler") ||
+        (ts.isMethodDeclaration(fn) &&
+            ts.isIdentifier(fn.name) &&
+            fn.name.text === "handler"));
+}
+function enclosingFn(n) {
+    for (let q = n.parent; q; q = q.parent)
+        if (ts.isFunctionLike(q))
+            return q;
+    return undefined;
+}
+/** An identifier in a position that is not a value read of a binding. */
+function isNameOnly(id) {
+    const p = id.parent;
+    return ((ts.isPropertyAccessExpression(p) && p.name === id) ||
+        (ts.isPropertyAssignment(p) && p.name === id) ||
+        (ts.isBindingElement(p) && p.propertyName === id) ||
+        ((ts.isVariableDeclaration(p) ||
+            ts.isFunctionDeclaration(p) ||
+            ts.isParameter(p) ||
+            ts.isBindingElement(p)) &&
+            p.name === id) ||
+        ts.isImportSpecifier(p) ||
+        ts.isExportSpecifier(p) ||
+        ts.isImportClause(p) ||
+        ts.isNamespaceImport(p) ||
+        (ts.isMethodDeclaration(p) && p.name === id) ||
+        ts.isTypeReferenceNode(p) ||
+        ts.isQualifiedName(p));
+}
+/** The binding `name` is declared from, within `scope`: the initializer of a
+ * plain declaration, or the source of a destructure that binds it. */
+function declaredFrom(name, scope) {
+    let found;
+    const binds = (b) => ts.isIdentifier(b)
+        ? b.text === name
+        : b.elements.some((el) => !ts.isOmittedExpression(el) && binds(el.name));
+    walk(scope, (n) => {
+        if (found === undefined &&
+            ts.isVariableDeclaration(n) &&
+            n.initializer !== undefined &&
+            binds(n.name))
+            found = n.initializer;
+    });
+    return found;
+}
+/** The value a member is read from: the expression under property and
+ * element accesses and casts, followed back through local bindings and
+ * destructures (`const { subject: sub } = id` -> `id`; `const SVC = "x"` ->
+ * `"x"`). Parameters and anything without a local declaration stay as is. */
+function readRoot(e, scope, depth = 0) {
+    let x = unwrap(e);
+    while (ts.isPropertyAccessExpression(x) || ts.isElementAccessExpression(x))
+        x = unwrap(x.expression);
+    if (ts.isIdentifier(x) && depth < 8) {
+        const from = declaredFrom(x.text, scope);
+        if (from !== undefined)
+            return readRoot(from, scope, depth + 1);
+    }
+    return x.getText();
+}
+function isKindMember(m) {
+    return (m.name !== undefined &&
+        (ts.isIdentifier(m.name) || ts.isStringLiteral(m.name)) &&
+        m.name.text === "kind");
+}
+/** The value one member carries, or undefined for a method or accessor. */
+function memberValue(m) {
+    if (ts.isPropertyAssignment(m))
+        return m.initializer;
+    if (ts.isShorthandPropertyAssignment(m))
+        return m.name;
+    if (ts.isSpreadAssignment(m))
+        return m.expression;
+    return undefined;
+}
+/** A credential object carrying the read must carry NOTHING ELSE: every
+ * member other than the `kind` discriminator is the read, a property of it,
+ * or a spread of it. A literal, a binding to a literal, a boolean authority,
+ * or any value from another source is a credential the package never saw
+ * verified. Inverted from a literal test, which a `const` binding defeats. */
+function carriesOnlyTheRead(obj, carrier) {
+    const own = memberValue(carrier);
+    if (own === undefined)
+        return false;
+    const scope = enclosingFn(obj) ?? obj.getSourceFile();
+    const root = readRoot(own, scope);
+    return obj.properties.every((m) => {
+        if (m === carrier || isKindMember(m))
+            return true;
+        const v = memberValue(m);
+        return v !== undefined && readRoot(v, scope) === root;
+    });
+}
+export class HostReadFlow {
+    parsed;
+    fns;
+    pkgImports;
+    defOf = new Map();
+    memo = new Map();
+    constructor(parsed, fns, pkgImports) {
+        this.parsed = parsed;
+        this.fns = fns;
+        this.pkgImports = pkgImports;
+        for (const ds of fns.values())
+            for (const d of ds)
+                this.defOf.set(d.fn, d);
+    }
+    /** Every `getUserIdentity()` call in `n` whose value does NOT end only in a
+     * package resolver. */
+    unsanctioned(n) {
+        const out = [];
+        walk(n, (x) => {
+            if (ts.isCallExpression(x) &&
+                HOST_READ.test(dotted(x.expression) ?? "") &&
+                !this.sanctioned(x))
+                out.push(x);
+        });
+        return out;
+    }
+    sanctioned(read) {
+        const m = this.memo.get(read);
+        if (m !== undefined)
+            return m;
+        const v = this.flows(read, new Set());
+        this.memo.set(read, v);
+        return v;
+    }
+    /** Does the value of expression `e` reach ONLY package resolvers? */
+    flows(e, seen) {
+        let x = e;
+        for (;;) {
+            const par = x.parent;
+            if (!par)
+                return false;
+            if (ts.isAwaitExpression(par) ||
+                ts.isParenthesizedExpression(par) ||
+                ts.isNonNullExpression(par) ||
+                ts.isAsExpression(par) ||
+                ts.isSatisfiesExpression(par) ||
+                ts.isTypeAssertionExpression(par) ||
+                (ts.isPropertyAccessExpression(par) && par.expression === x) ||
+                ts.isArrayLiteralExpression(par) ||
+                (ts.isConditionalExpression(par) && par.condition !== x) ||
+                (ts.isBinaryExpression(par) &&
+                    par.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken &&
+                    par.left === x &&
+                    // only absence may stand in for an absent credential: `?? null`.
+                    // `?? "svc_x"` substitutes a typed identity the package never verified.
+                    isLiteral(par.right) &&
+                    /^(null|undefined)$/.test(unwrap(par.right).getText()))) {
+                x = par;
+                continue;
+            }
+            if ((ts.isPropertyAssignment(par) && par.initializer === x) ||
+                ts.isShorthandPropertyAssignment(par) ||
+                ts.isSpreadAssignment(par) ||
+                ts.isSpreadElement(par)) {
+                // A credential object that carries the read must carry nothing
+                // else (see carriesOnlyTheRead).
+                const obj = par.parent;
+                if (ts.isObjectLiteralExpression(obj) &&
+                    !ts.isSpreadElement(par) &&
+                    !carriesOnlyTheRead(obj, par))
+                    return false;
+                x = obj;
+                continue;
+            }
+            break;
+        }
+        const par = x.parent;
+        if (!par)
+            return false;
+        if (ts.isVariableDeclaration(par) && par.initializer === x) {
+            const scope = enclosingFn(par) ?? par.getSourceFile();
+            return this.bindingFlows(par.name, scope, seen);
+        }
+        if (ts.isReturnStatement(par)) {
+            const fn = enclosingFn(par);
+            return fn !== undefined && this.returnFlows(fn, seen);
+        }
+        if (ts.isArrowFunction(par) && par.body === x)
+            return this.returnFlows(par, seen);
+        if (ts.isCallExpression(par) && par.expression !== x) {
+            const i = par.arguments.indexOf(x);
+            if (i < 0)
+                return false;
+            const rel = par.getSourceFile().fileName;
+            const imp = this.pkgImports.get(rel);
+            const exp = imp && pkgExportOf(par.expression, imp);
+            if (exp !== undefined)
+                return i === 0 && PACKAGE_RESOLVERS.has(exp);
+            const callee = unwrap(par.expression);
+            if (!ts.isIdentifier(callee))
+                return false;
+            const defs = this.fns.get(callee.text);
+            if (!defs?.length)
+                return false;
+            return defs.every((d) => {
+                const prm = d.fn.parameters[i];
+                if (!prm || prm.dotDotDotToken)
+                    return false;
+                const key = `param:${d.rel}:${d.line}:${i}`;
+                if (seen.has(key))
+                    return true;
+                return this.bindingFlows(prm.name, d.fn, new Set([...seen, key]));
+            });
+        }
+        return false;
+    }
+    bindingFlows(name, scope, seen) {
+        if (ts.isObjectBindingPattern(name))
+            return name.elements.every((el) => this.bindingFlows(el.name, scope, seen));
+        if (!ts.isIdentifier(name))
+            return false;
+        const refs = [];
+        walk(scope, (y) => {
+            if (ts.isIdentifier(y) && y !== name && y.text === name.text)
+                if (!isNameOnly(y) || ts.isShorthandPropertyAssignment(y.parent))
+                    refs.push(y);
+        });
+        // The value must actually REACH something: a binding read only by absence
+        // tests forwards nothing to the package, and whatever credential the helper
+        // returns instead (a literal account) is a local identity decision.
+        if (!refs.some((r) => absenceTestOf(r) === undefined))
+            return false;
+        return refs.every((r) => this.refFlows(r, seen));
+    }
+    /** One read of a bound value: an absence test forwarded to the package, or
+     * a value that flows on. */
+    refFlows(ref, seen) {
+        const test = absenceTestOf(ref);
+        if (test) {
+            let c = test;
+            while (c.parent && ts.isParenthesizedExpression(c.parent))
+                c = c.parent;
+            const host = c.parent;
+            if (host &&
+                ts.isIfStatement(host) &&
+                host.expression === c &&
+                !host.elseStatement &&
+                forwardsAbsence(host.thenStatement)) {
+                const fn = enclosingFn(host);
+                return fn !== undefined && !isHandler(fn);
+            }
+            // `id === null ? null : { …id… }` — absence forwarded inside the value
+            if (host &&
+                ts.isConditionalExpression(host) &&
+                host.condition === c &&
+                [host.whenTrue, host.whenFalse].some((b) => unwrap(b).kind === ts.SyntaxKind.NullKeyword))
+                return this.flows(host, seen);
+            return false;
+        }
+        return this.flows(ref, seen);
+    }
+    /** A function's return reaches only package resolvers, at EVERY call site. */
+    returnFlows(fn, seen) {
+        if (isHandler(fn))
+            return false;
+        const d = this.defOf.get(fn);
+        if (!d)
+            return false;
+        const key = `ret:${d.rel}:${d.line}`;
+        if (seen.has(key))
+            return true;
+        const next = new Set([...seen, key]);
+        const sites = [];
+        for (const p of this.parsed)
+            walk(p.sf, (y) => {
+                if (ts.isIdentifier(y) && y.text === d.name && !isNameOnly(y))
+                    sites.push(y);
+            });
+        if (sites.length === 0)
+            return false;
+        return sites.every((s) => {
+            let c = s;
+            while (c.parent && ts.isParenthesizedExpression(c.parent))
+                c = c.parent;
+            return (!!c.parent &&
+                ts.isCallExpression(c.parent) &&
+                c.parent.expression === c &&
+                this.flows(c.parent, next));
+        });
+    }
+}
+// ---- the org-kind read, by Clerk org ID ------------------------------------
+//
+// Ruling (task k1742q0vm05x2f5pqawnz1eah18fp01p): "a client_org_mapping read is
+// conformant ONLY when it is keyed by the Clerk org ID (org_…) and only feeds
+// orgKindOf / assertTargetBelongsTo; a read keyed by slug or name stays a
+// violation." cloud-identity 0.11.0 asks the host for `lookups.orgKindOf(orgId)`
+// and the host answers it from its own org table, so ONE shape of that read is
+// not a local identity decision. A `.query("client_org_mapping")` call is
+// conformant only when ALL of these hold; every other reach of the table keeps
+// the pre-ruling verdict, byte for byte:
+//
+//   (1) KEYED BY ID. The chain is exactly one key constraint —
+//       `.withIndex("by_clerk_org_id", (q) => q.eq("clerkOrgId", K))` or
+//       `.filter((q) => q.eq(q.field("clerkOrgId"), K))` — then `.unique()` or
+//       `.first()`. Any other index (by_clerk_slug), any other field, a second
+//       filter, or any other method is not this read.
+//   (2) THE KEY IS THE ID THE PACKAGE HANDED OVER. How the detector decides it:
+//       K is, after unwrapping, an identifier naming a PARAMETER of the function
+//       holding the read, never assigned in that function; and that parameter is
+//       (a) the adapter's own first parameter — the org ID the package passes to
+//       `orgKindOf(orgId)`, i.e. the resolved principal's org — or (b) a helper's
+//       parameter that EVERY call site of the helper fills with exactly that
+//       adapter parameter. A literal, a field read (`identity.orgSlug`,
+//       `row.name`), a computed value (`orgId.toLowerCase()`), a door's argument,
+//       or a reassigned parameter is not the package's ID: red. The detector does
+//       not read the value's type or its `org_` prefix — it reads WHERE the value
+//       came from, which is the only thing a static reader can establish.
+//   (3) THE RESULT FEEDS ONLY THE ADAPTER. The function holding the read is
+//       either an `orgKindOf` member of an object literal that reaches a
+//       package call (`resolveActingPrincipal`, `assertTargetBelongsTo`, through
+//       the file's own import) as a NON-first argument — directly, through a
+//       local, or as the return of a helper every call site of which does the
+//       same — or a named helper (never `withOrgScope` / `lookupOrgMapping`)
+//       every reference of which is the whole body of such an adapter. And that
+//       function decides nothing else: its only call is the read chain, and its
+//       body is the read bound to a local, `if (…) return <literal>` branches,
+//       and a call-free return (no throw, no write, no other call).
+//
+// The same read answers `organisationById` (task: vantage-peers #1465 / #1466).
+// cloud-identity 0.11.0 `resolveActingPrincipal` ALWAYS calls
+// `lookups.organisationById(orgId)` (principal-by-id.d.ts, `PrincipalLookups`,
+// `OrganisationRow = { id, active }`) and refuses an inactive organisation
+// from its answer, so the host must read its org table there too. Conditions
+// (1)–(3) apply unchanged, with `organisationById` in place of `orgKindOf`,
+// plus:
+//   (4) THE ANSWER IS THE ROW'S. Every non-absent return of an
+//       `organisationById` adapter (or of the helper that is its whole body) is
+//       an object literal `{ id, active }` — directly or as a branch of a
+//       call-free conditional — whose values read only the row binding or the
+//       adapter's key, `active` reading the row; an `if` branch and an absent
+//       branch return only null / undefined. A fabricated `active: true`, or a
+//       row answered on absence, is a local decision that the org is active.
+//   (5) A BUILDER ONLY ASSEMBLES. When the lookups object reaches the package
+//       as the return of a named builder (`principalLookups(ctx)`), that
+//       builder's own body — nested adapters excluded — is variable statements
+//       and one final return: no `if`, conditional, switch, loop, try, throw,
+//       `&&` / `||` / `??`, and no expression statement. Applies to both
+//       adapters.
+export const ORG_KIND_ADAPTER = "orgKindOf";
+export const ORG_BY_ID_ADAPTER = "organisationById";
+/** The host adapters that may hold the ID-keyed mapping read. */
+export const ORG_ID_ADAPTERS = new Set([
+    ORG_KIND_ADAPTER,
+    ORG_BY_ID_ADAPTER,
+]);
+export const ORG_ID_INDEX = "by_clerk_org_id";
+export const ORG_ID_FIELD = "clerkOrgId";
+/** The sinks a lookups object may reach (as a non-first argument). */
+const LOOKUPS_SINKS = new Set([
+    "resolveActingPrincipal",
+    TARGET_CHECK,
+]);
+/** Never an adapter, whatever they read: the product's own org resolvers. */
+const LOCAL_RESOLVER_NAMES = new Set([
+    "withOrgScope",
+    "lookupOrgMapping",
+]);
+/** `(q) => q.eq(<field-expr>, K)` — the field expression and K, else undefined. */
+function eqCallback(cb) {
+    if (!cb)
+        return undefined;
+    const f = unwrap(cb);
+    if (!ts.isArrowFunction(f) || f.parameters.length !== 1)
+        return undefined;
+    const q = f.parameters[0].name;
+    if (!ts.isIdentifier(q))
+        return undefined;
+    let body = f.body;
+    if (ts.isBlock(body)) {
+        const one = body.statements.length === 1 ? body.statements[0] : undefined;
+        if (!one || !ts.isReturnStatement(one) || !one.expression)
+            return undefined;
+        body = one.expression;
+    }
+    const c = unwrap(body);
+    if (!ts.isCallExpression(c) ||
+        dotted(c.expression) !== `${q.text}.eq` ||
+        c.arguments.length !== 2)
+        return undefined;
+    return { field: c.arguments[0], key: c.arguments[1] };
+}
+/** (1): the chain from `.query("client_org_mapping")` — its key K and its top
+ * call (`….unique()`), or undefined when it is not the ID-keyed read. */
+function idKeyedChain(read) {
+    let key;
+    let x = read;
+    for (;;) {
+        const pa = x.parent;
+        if (!pa || !ts.isPropertyAccessExpression(pa) || pa.expression !== x)
+            return undefined;
+        const call = pa.parent;
+        if (!call || !ts.isCallExpression(call) || call.expression !== pa)
+            return undefined;
+        const m = pa.name.text;
+        if (m === "unique" || m === "first") {
+            if (!key || call.arguments.length)
+                return undefined;
+            return { key, top: call };
+        }
+        if (key)
+            return undefined; // exactly one key constraint
+        if (m === "withIndex") {
+            const [ix, cb] = call.arguments;
+            if (!ix || !ts.isStringLiteralLike(ix) || ix.text !== ORG_ID_INDEX)
+                return undefined;
+            const eq = eqCallback(cb);
+            const fld = eq && unwrap(eq.field);
+            if (!eq ||
+                !fld ||
+                !ts.isStringLiteralLike(fld) ||
+                fld.text !== ORG_ID_FIELD)
+                return undefined;
+            key = eq.key;
+        }
+        else if (m === "filter") {
+            const eq = eqCallback(call.arguments[0]);
+            const fld = eq && unwrap(eq.field);
+            if (!eq ||
+                !fld ||
+                !ts.isCallExpression(fld) ||
+                !/\.field$/.test(dotted(fld.expression) ?? "") ||
+                fld.arguments.length !== 1 ||
+                !ts.isStringLiteralLike(fld.arguments[0]) ||
+                fld.arguments[0].text !== ORG_ID_FIELD)
+                return undefined;
+            key = eq.key;
+        }
+        else
+            return undefined;
+        x = call;
+    }
+}
+/** Is `name` assigned anywhere in `fn` (`=`, compound, `++`/`--`)? */
+function assignedIn(fn, name) {
+    let hit = false;
+    walk(fn, (y) => {
+        if (ts.isBinaryExpression(y) &&
+            y.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+            y.operatorToken.kind <= ts.SyntaxKind.LastAssignment &&
+            ts.isIdentifier(unwrap(y.left)) &&
+            unwrap(y.left).text === name)
+            hit = true;
+        if ((ts.isPrefixUnaryExpression(y) || ts.isPostfixUnaryExpression(y)) &&
+            (y.operator === ts.SyntaxKind.PlusPlusToken ||
+                y.operator === ts.SyntaxKind.MinusMinusToken) &&
+            ts.isIdentifier(unwrap(y.operand)) &&
+            unwrap(y.operand).text === name)
+            hit = true;
+    });
+    return hit;
+}
+/** The literal-ish return a branch of the adapter may take. */
+function returnsLiteral(s) {
+    const one = ts.isBlock(s) && s.statements.length === 1 ? s.statements[0] : s;
+    return (ts.isReturnStatement(one) && (!one.expression || isLiteral(one.expression)));
+}
+function hasCall(n) {
+    let hit = false;
+    walk(n, (y) => {
+        if (ts.isCallExpression(y))
+            hit = true;
+    });
+    return hit;
+}
+/** (3), the body half: the function's only call is the read chain, and it
+ * decides nothing but its own return. */
+function decidesNothingElse(fn, top) {
+    const body = fn.body;
+    if (!body)
+        return false;
+    let stray = false;
+    walk(body, (y) => {
+        if (ts.isCallExpression(y) && !(y.pos >= top.pos && y.end <= top.end))
+            stray = true;
+        if (ts.isThrowStatement(y))
+            stray = true;
+    });
+    if (stray)
+        return false;
+    if (!ts.isBlock(body))
+        return true;
+    return body.statements.every((st) => {
+        if (ts.isVariableStatement(st)) {
+            const ds = st.declarationList.declarations;
+            return (ds.length === 1 &&
+                ts.isIdentifier(ds[0].name) &&
+                !!ds[0].initializer &&
+                unwrap(ds[0].initializer) === top);
+        }
+        if (ts.isIfStatement(st))
+            return (!st.elseStatement &&
+                !hasCall(st.expression) &&
+                returnsLiteral(st.thenStatement));
+        if (ts.isReturnStatement(st))
+            return (!st.expression ||
+                unwrap(st.expression) === top ||
+                !hasCall(st.expression));
+        return false;
+    });
+}
+/** The adapter member (`orgKindOf` / `organisationById`) a function is: the
+ * object literal holding it and the adapter's name. */
+function adapterObjectOf(fn) {
+    const named = (n) => n &&
+        (ts.isIdentifier(n) || ts.isStringLiteralLike(n)) &&
+        ORG_ID_ADAPTERS.has(n.text)
+        ? n.text
+        : undefined;
+    if (ts.isMethodDeclaration(fn)) {
+        const adapter = named(fn.name);
+        return adapter && ts.isObjectLiteralExpression(fn.parent)
+            ? { obj: fn.parent, adapter }
+            : undefined;
+    }
+    let x = fn;
+    while (x.parent && ts.isParenthesizedExpression(x.parent))
+        x = x.parent;
+    const pa = x.parent;
+    if ((ts.isArrowFunction(fn) || ts.isFunctionExpression(fn)) &&
+        pa &&
+        ts.isPropertyAssignment(pa) &&
+        pa.initializer === x &&
+        ts.isObjectLiteralExpression(pa.parent)) {
+        const adapter = named(pa.name);
+        if (adapter)
+            return { obj: pa.parent, adapter };
+    }
+    return undefined;
+}
+/** (4): every answer of an `organisationById` body is absence, or the row's own
+ * `{ id, active }` — values reading only the row binding or the key, `active`
+ * reading the row. `decidesNothingElse` has already held the body to the read,
+ * `if` branches and call-free returns. */
+function answersOnlyTheRow(fn, top, key) {
+    const body = fn.body;
+    if (!body || !ts.isBlock(body))
+        return false; // the raw row is not { id, active }
+    let row;
+    for (const st of body.statements)
+        if (ts.isVariableStatement(st)) {
+            const d = st.declarationList.declarations[0];
+            if (d &&
+                ts.isIdentifier(d.name) &&
+                d.initializer &&
+                unwrap(d.initializer) === top)
+                row = d.name.text;
+        }
+    if (!row)
+        return false;
+    const rowName = row;
+    const absent = (e) => {
+        if (!e)
+            return true;
+        const u = unwrap(e);
+        return (u.kind === ts.SyntaxKind.NullKeyword ||
+            (ts.isIdentifier(u) && u.text === "undefined"));
+    };
+    const reads = (v, allowed) => {
+        let ok = true;
+        walk(v, (y) => {
+            if (ts.isIdentifier(y) && !isNameOnly(y) && !allowed.has(y.text))
+                ok = false;
+        });
+        return ok;
+    };
+    const allowed = new Set([rowName, key]);
+    // `active` is the row's own field: `row.f`, or `row.f` compared (=== / ==)
+    // with a literal. `!!row`, `row !== null`, `row.f || true`, `row.f ?? true`
+    // and a conditional all answer "active" for any row that exists.
+    const rowField = (e) => {
+        const u = unwrap(e);
+        return (ts.isPropertyAccessExpression(u) &&
+            ts.isIdentifier(u.expression) &&
+            u.expression.text === rowName);
+    };
+    const literal = (e) => {
+        const u = unwrap(e);
+        return (u.kind === ts.SyntaxKind.TrueKeyword ||
+            u.kind === ts.SyntaxKind.FalseKeyword ||
+            ts.isStringLiteralLike(u) ||
+            ts.isNumericLiteral(u));
+    };
+    const readsRowField = (e) => {
+        const u = unwrap(e);
+        if (rowField(u))
+            return true;
+        if (ts.isBinaryExpression(u) &&
+            (u.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+                u.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken))
+            return ((rowField(u.left) && literal(u.right)) ||
+                (literal(u.left) && rowField(u.right)));
+        return false;
+    };
+    const answer = (e) => {
+        const u = unwrap(e);
+        if (absent(u))
+            return true;
+        if (ts.isConditionalExpression(u))
+            return answer(u.whenTrue) && answer(u.whenFalse);
+        if (!ts.isObjectLiteralExpression(u))
+            return false;
+        const seen = new Set();
+        for (const m of u.properties) {
+            if (!ts.isPropertyAssignment(m) ||
+                !(ts.isIdentifier(m.name) || ts.isStringLiteralLike(m.name)))
+                return false;
+            const k = m.name.text;
+            if ((k !== "id" && k !== "active") || seen.has(k))
+                return false;
+            seen.add(k);
+            if (!reads(m.initializer, allowed))
+                return false;
+            if (k === "active" && !readsRowField(m.initializer))
+                return false;
+        }
+        return seen.has("active");
+    };
+    return body.statements.every((st) => {
+        if (ts.isVariableStatement(st))
+            return true;
+        if (ts.isIfStatement(st)) {
+            const one = ts.isBlock(st.thenStatement) && st.thenStatement.statements.length === 1
+                ? st.thenStatement.statements[0]
+                : st.thenStatement;
+            return ts.isReturnStatement(one) && absent(one.expression);
+        }
+        if (ts.isReturnStatement(st))
+            return st.expression === undefined || answer(st.expression);
+        return false;
+    });
+}
+/** (5): a builder whose return carries the lookups object only assembles it —
+ * its own body, nested functions excluded, decides nothing. */
+function assemblesOnly(fn) {
+    const body = fn.body;
+    if (!body)
+        return false;
+    let decides = false;
+    const visit = (y) => {
+        if (y !== body && ts.isFunctionLike(y))
+            return;
+        if (ts.isIfStatement(y) ||
+            ts.isConditionalExpression(y) ||
+            ts.isSwitchStatement(y) ||
+            ts.isThrowStatement(y) ||
+            ts.isTryStatement(y) ||
+            ts.isIterationStatement(y, false) ||
+            (ts.isBinaryExpression(y) &&
+                (y.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+                    y.operatorToken.kind === ts.SyntaxKind.BarBarToken ||
+                    y.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken)))
+            decides = true;
+        y.forEachChild(visit);
+    };
+    visit(body);
+    if (decides)
+        return false;
+    if (!ts.isBlock(body))
+        return true;
+    const sts = body.statements;
+    return (sts.length > 0 &&
+        ts.isReturnStatement(sts[sts.length - 1]) &&
+        sts.slice(0, -1).every((st) => ts.isVariableStatement(st)));
+}
+class OrgKindReads {
+    parsed;
+    pkgImports;
+    defOf = new Map();
+    conformant = new Set();
+    constructor(parsed, fns, pkgImports) {
+        this.parsed = parsed;
+        this.pkgImports = pkgImports;
+        for (const ds of fns.values())
+            for (const d of ds)
+                this.defOf.set(d.fn, d);
+        for (const p of parsed)
+            walk(p.sf, (x) => {
+                if (this.isMappingQuery(x) && this.judge(x))
+                    this.conformant.add(x);
+            });
+    }
+    isMappingQuery(x) {
+        if (!ts.isCallExpression(x))
+            return false;
+        const a0 = x.arguments[0];
+        return (/\.query$/.test(dotted(x.expression) ?? "") &&
+            x.arguments.length === 1 &&
+            !!a0 &&
+            ts.isStringLiteralLike(a0) &&
+            a0.text === "client_org_mapping");
+    }
+    judge(read) {
+        const chain = idKeyedChain(read);
+        if (!chain)
+            return false;
+        const k = unwrap(chain.key);
+        if (!ts.isIdentifier(k))
+            return false;
+        const fn = enclosingFn(read);
+        if (!fn || isHandler(fn))
+            return false;
+        const pi = fn.parameters.findIndex((p) => ts.isIdentifier(p.name) && p.name.text === k.text);
+        if (pi < 0 || assignedIn(fn, k.text))
+            return false;
+        if (!decidesNothingElse(fn, chain.top))
+            return false;
+        // (a) the read sits in the adapter itself, keyed by its first parameter.
+        const own = adapterObjectOf(fn);
+        if (own)
+            return (pi === 0 &&
+                (own.adapter !== ORG_BY_ID_ADAPTER ||
+                    answersOnlyTheRow(fn, chain.top, k.text)) &&
+                this.feedsPackage(own.obj, new Set()));
+        // (b) a helper used ONLY as the whole body of such an adapter, the key
+        // filled with the adapter's own first parameter.
+        const d = this.defOf.get(fn);
+        if (!d || LOCAL_RESOLVER_NAMES.has(d.name))
+            return false;
+        const sites = [];
+        for (const p of this.parsed)
+            walk(p.sf, (y) => {
+                if (ts.isIdentifier(y) && y.text === d.name && !isNameOnly(y))
+                    sites.push(y);
+            });
+        const adapters = sites.map((s) => this.adapterForwards(s, pi));
+        return (sites.length > 0 &&
+            adapters.every((a) => a !== undefined) &&
+            (!adapters.includes(ORG_BY_ID_ADAPTER) ||
+                answersOnlyTheRow(fn, chain.top, k.text)));
+    }
+    /** `orgKindOf: (orgId) => H(…, orgId, …)` (or `{ return [await] H(…) }`,
+     * or the same under `organisationById`), the key slot filled with exactly
+     * the adapter's first parameter. The adapter's name, or undefined. */
+    adapterForwards(site, keyAt) {
+        let c = site;
+        while (c.parent && ts.isParenthesizedExpression(c.parent))
+            c = c.parent;
+        const call = c.parent;
+        if (!call || !ts.isCallExpression(call) || call.expression !== c)
+            return undefined;
+        let x = call;
+        while (x.parent &&
+            (ts.isAwaitExpression(x.parent) || ts.isParenthesizedExpression(x.parent)))
+            x = x.parent;
+        let fn = x.parent;
+        if (fn && ts.isReturnStatement(fn)) {
+            const blk = fn.parent;
+            if (!ts.isBlock(blk) || blk.statements.length !== 1)
+                return undefined;
+            fn = blk.parent;
+        }
+        else if (!(fn && ts.isArrowFunction(fn) && fn.body === x))
+            return undefined;
+        if (!fn || !ts.isFunctionLike(fn))
+            return undefined;
+        const adapter = fn;
+        const own = adapterObjectOf(adapter);
+        const p0 = adapter.parameters[0]?.name;
+        if (!own || !p0 || !ts.isIdentifier(p0))
+            return undefined;
+        if (assignedIn(adapter, p0.text))
+            return undefined;
+        const arg = call.arguments[keyAt];
+        const a = arg && unwrap(arg);
+        return a &&
+            ts.isIdentifier(a) &&
+            a.text === p0.text &&
+            this.feedsPackage(own.obj, new Set())
+            ? own.adapter
+            : undefined;
+    }
+    /** Does the value at `e` reach ONLY a package call, as a non-first argument
+     * (the lookups slot of resolveActingPrincipal / assertTargetBelongsTo)? */
+    feedsPackage(e, seen) {
+        let x = e;
+        while (x.parent &&
+            (ts.isAwaitExpression(x.parent) ||
+                ts.isParenthesizedExpression(x.parent) ||
+                ts.isNonNullExpression(x.parent) ||
+                ts.isAsExpression(x.parent) ||
+                ts.isSatisfiesExpression(x.parent)))
+            x = x.parent;
+        const par = x.parent;
+        if (!par)
+            return false;
+        if (ts.isCallExpression(par) && par.expression !== x) {
+            const i = par.arguments.indexOf(x);
+            const imp = this.pkgImports.get(par.getSourceFile().fileName);
+            const exp = imp && pkgExportOf(par.expression, imp);
+            return i >= 1 && exp !== undefined && LOOKUPS_SINKS.has(exp);
+        }
+        if (ts.isVariableDeclaration(par) && par.initializer === x) {
+            if (!ts.isIdentifier(par.name))
+                return false;
+            const scope = enclosingFn(par) ?? par.getSourceFile();
+            const refs = [];
+            walk(scope, (y) => {
+                if (ts.isIdentifier(y) &&
+                    y !== par.name &&
+                    y.text === par.name.text &&
+                    !isNameOnly(y))
+                    refs.push(y);
+            });
+            return refs.length > 0 && refs.every((r) => this.feedsPackage(r, seen));
+        }
+        const fn = ts.isReturnStatement(par)
+            ? enclosingFn(par)
+            : ts.isArrowFunction(par) && par.body === x
+                ? par
+                : undefined;
+        if (!fn || isHandler(fn))
+            return false;
+        // (5) the builder returning the lookups object only assembles it.
+        if (!assemblesOnly(fn))
+            return false;
+        const d = this.defOf.get(fn);
+        if (!d)
+            return false;
+        const key = `ret:${d.rel}:${d.line}`;
+        if (seen.has(key))
+            return true;
+        const next = new Set([...seen, key]);
+        const sites = [];
+        for (const p of this.parsed)
+            walk(p.sf, (y) => {
+                if (ts.isIdentifier(y) && y.text === d.name && !isNameOnly(y))
+                    sites.push(y);
+            });
+        return (sites.length > 0 &&
+            sites.every((s) => {
+                let c = s;
+                while (c.parent && ts.isParenthesizedExpression(c.parent))
+                    c = c.parent;
+                return (!!c.parent &&
+                    ts.isCallExpression(c.parent) &&
+                    c.parent.expression === c &&
+                    this.feedsPackage(c.parent, next));
+            }));
+    }
+}
+/**
+ * The `client_org_mapping` reads the org-kind ruling admits (see OrgKindReads),
+ * computed over `parsed` so a caller holding the same AST nodes can test
+ * membership. Exported for CR-2 (local-identity.ts), which must not re-derive
+ * R-53's ruling.
+ */
+export function conformantMappingReads(parsed) {
+    const pkgImports = new Map();
+    for (const p of parsed)
+        pkgImports.set(p.rel, importsOf(p).imports);
+    return new OrgKindReads(parsed, indexFunctions(parsed), pkgImports)
+        .conformant;
+}
+/** `n`'s text with every conformant org-kind read cut out, so the pre-ruling
+ * text test still sees every other reach of the table exactly as before. */
+function textWithout(n, ok) {
+    const text = n.getText();
+    const base = n.getStart();
+    const cuts = [];
+    walk(n, (y) => {
+        if (ts.isCallExpression(y) && ok.has(y))
+            cuts.push([y.getStart() - base, y.getEnd() - base]);
+    });
+    if (!cuts.length)
+        return text;
+    let out = "";
+    let at = 0;
+    for (const [a, b] of cuts.sort((p, q) => p[0] - q[0])) {
+        out += text.slice(at, a);
+        at = b;
+    }
+    return out + text.slice(at);
+}
+/** The product resolves identity itself in `n`: an org-mapping read (other than
+ * the conformant org-kind read), or a host credential read whose value goes
+ * anywhere but a package resolver. */
+function resolvesLocallyIn(n, flow, okReads) {
+    return (ORG_MAPPING_READ.test(textWithout(n, okReads)) ||
+        flow.unsanctioned(n).length > 0);
+}
+function facts(files) {
+    const parsed = files
+        .filter((f) => isConvexOrMcp(f) && isJudgeable(f) && /\.tsx?$/.test(f.rel))
+        .map(parseFile);
+    const fns = indexFunctions(parsed);
+    const pkgNames = new Map();
+    const pkgImports = new Map();
+    const pkgUnresolved = [];
+    for (const p of parsed) {
+        const i = importsOf(p);
+        pkgNames.set(p.rel, i.pkg);
+        pkgImports.set(p.rel, i.imports);
+        if (i.unresolved)
+            pkgUnresolved.push(p.rel);
+    }
+    const usesPackage = closeOverCalls(fns, (d) => callsAny(d.fn, pkgNames.get(d.rel) ?? new Set()));
+    const flow = new HostReadFlow(parsed, fns, pkgImports);
+    const okReads = new OrgKindReads(parsed, fns, pkgImports).conformant;
+    const resolvesLocally = closeOverCalls(fns, (d) => resolvesLocallyIn(d.fn, flow, okReads));
+    const nameAdmitting = closeOverCalls(fns, (d) => nameComparisons(d.fn).some(admits));
+    return {
+        parsed,
+        fns,
+        pkgNames,
+        pkgImports,
+        usesPackage,
+        resolvesLocally,
+        nameAdmitting,
+        pkgUnresolved,
+        flow,
+        okReads,
+    };
+}
+function calledFns(n) {
+    const out = [];
+    walk(n, (x) => {
+        if (ts.isCallExpression(x)) {
+            const e = unwrap(x.expression);
+            if (ts.isIdentifier(e) && !out.includes(e.text))
+                out.push(e.text);
+        }
+    });
+    return out;
+}
+const firstDef = (f, n) => f.fns.get(n)?.[0];
+const where = (d) => (d ? ` (${d.rel}:${d.line})` : "");
+// ---- (c) unresolved pass-through -----------------------------------------
+const ABSENT_SUBJECT = /identity|principal|org|actor|scope|proof/i;
+/** The identifier an absence test is about: `!x`, `x === null|undefined`. */
+function absenceSubject(c0) {
+    const c = unwrap(c0);
+    if (ts.isPrefixUnaryExpression(c) &&
+        c.operator === ts.SyntaxKind.ExclamationToken)
+        return dotted(c.operand);
+    if (ts.isBinaryExpression(c) &&
+        (c.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            c.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken)) {
+        const [a, b] = [c.left, c.right];
+        if (isLiteral(b) && /^(null|undefined)$/.test(unwrap(b).getText()))
+            return dotted(a);
+        if (isLiteral(a) && /^(null|undefined)$/.test(unwrap(a).getText()))
+            return dotted(b);
+    }
+    return undefined;
+}
+/** convex-side: `if (<no identity/org>) … isMaster: true` — the unresolved
+ * caller continues as master. */
+function masterOnAbsence(p) {
+    const out = [];
+    walk(p.sf, (x) => {
+        if (!ts.isIfStatement(x))
+            return;
+        const subj = absenceSubject(x.expression);
+        if (!subj || !ABSENT_SUBJECT.test(subj))
+            return;
+        let master;
+        walk(x.thenStatement, (y) => {
+            if (!master &&
+                ts.isPropertyAssignment(y) &&
+                ts.isIdentifier(y.name) &&
+                y.name.text === "isMaster" &&
+                unwrap(y.initializer).kind === ts.SyntaxKind.TrueKeyword)
+                master = y;
+        });
+        if (!master)
+            return;
+        let fn = "<module>";
+        for (let q = x; q; q = q.parent) {
+            if (ts.isFunctionDeclaration(q) && q.name) {
+                fn = q.name.text;
+                break;
+            }
+            if (ts.isVariableDeclaration(q) && ts.isIdentifier(q.name)) {
+                fn = q.name.text;
+                break;
+            }
+        }
+        out.push({ n: lineOf(master), fn, subject: subj });
+    });
+    return out;
+}
+/** mcp-side: a forward to Convex that carries the org only when it was
+ * resolved — `...(org !== undefined ? { …org… } : {})` — with no refusal on
+ * the absent org before it. */
+function orgOptionalForward(p) {
+    const out = [];
+    walk(p.sf, (x) => {
+        if (!ts.isSpreadAssignment(x))
+            return;
+        const c = unwrap(x.expression);
+        if (!ts.isConditionalExpression(c))
+            return;
+        const f = unwrap(c.whenFalse);
+        if (!ts.isObjectLiteralExpression(f) || f.properties.length > 0)
+            return;
+        const cond = unwrap(c.condition);
+        let org;
+        if (ts.isIdentifier(cond))
+            org = cond.text;
+        else if (ts.isBinaryExpression(cond) &&
+            (cond.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+                cond.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken) &&
+            isLiteral(cond.right))
+            org = dotted(cond.left);
+        if (!org || !/org/i.test(org))
+            return;
+        // the object is an argument of a Convex call (mutation/action/query)
+        let call;
+        for (let q = x.parent; q; q = q.parent) {
+            if (ts.isCallExpression(q)) {
+                call = q;
+                break;
+            }
+            if (ts.isFunctionLike(q))
+                break;
+        }
+        if (!call || !/\.(mutation|action)$/.test(dotted(call.expression) ?? ""))
+            return;
+        // a refusal on the absent org before the forward voids it
+        let refused = false;
+        let child = call;
+        for (let q = call.parent; q && !ts.isSourceFile(q); child = q, q = q.parent) {
+            if (ts.isBlock(q))
+                for (const st of q.statements) {
+                    if (st === child)
+                        break;
+                    if (ts.isIfStatement(st) &&
+                        absenceSubject(st.expression) === org &&
+                        (() => {
+                            let ex = false;
+                            walk(st.thenStatement, (y) => {
+                                if (ts.isReturnStatement(y) || ts.isThrowStatement(y))
+                                    ex = true;
+                            });
+                            return ex;
+                        })())
+                        refused = true;
+                }
+            if (ts.isFunctionLike(q))
+                break;
+        }
+        if (refused)
+            return;
+        const a0 = call.arguments[0] && unwrap(call.arguments[0]);
+        const target = a0 && ts.isStringLiteralLike(a0) ? a0.text : (a0?.getText() ?? "?");
+        const owner = ownerOf(x, p.rel);
+        out.push({
+            n: lineOf(x),
+            org,
+            call: target,
+            owner: owner?.name ?? "<module>",
+        });
+    });
+    return out;
+}
+/** The innermost NAMED function a node sits in — a helper or an MCP tool
+ * handler. A Convex registration's own `handler` is a DOOR (judged under (b)),
+ * not a local identity layer: undefined. */
+function ownerOf(n, rel) {
+    for (let x = n.parent; x; x = x.parent) {
+        if ((ts.isArrowFunction(x) ||
+            ts.isFunctionExpression(x) ||
+            ts.isMethodDeclaration(x)) &&
+            x.parent &&
+            ((ts.isPropertyAssignment(x.parent) &&
+                ts.isIdentifier(x.parent.name) &&
+                x.parent.name.text === "handler") ||
+                (ts.isMethodDeclaration(x) &&
+                    ts.isIdentifier(x.name) &&
+                    x.name.text === "handler")))
+            return undefined;
+        if ((ts.isArrowFunction(x) || ts.isFunctionExpression(x)) &&
+            x.parent &&
+            ts.isCallExpression(x.parent) &&
+            /^(defineTool|tool|registerTool)$/.test((dotted(x.parent.expression) ?? "").split(".").pop() ?? "")) {
+            const label = x.parent.arguments.find((a) => ts.isStringLiteralLike(a) ||
+                (ts.isIdentifier(a) && /_TOOL_NAME$/.test(a.text)));
+            return {
+                rel,
+                n: lineOf(x.parent),
+                name: `tool ${label ? label.getText() : "<anonymous>"}`,
+            };
+        }
+        if (ts.isFunctionDeclaration(x) && x.name)
+            return { rel, n: lineOf(x), name: x.name.text };
+        if (ts.isMethodDeclaration(x) && ts.isIdentifier(x.name))
+            return { rel, n: lineOf(x), name: x.name.text };
+        if ((ts.isArrowFunction(x) || ts.isFunctionExpression(x)) &&
+            x.parent &&
+            (ts.isVariableDeclaration(x.parent) ||
+                ts.isPropertyAssignment(x.parent)) &&
+            ts.isIdentifier(x.parent.name))
+            return { rel, n: lineOf(x.parent), name: x.parent.name.text };
+    }
+    return undefined;
+}
+export function scanR53(files) {
+    return scanR53Detailed(files).scan;
+}
+export function scanR53Detailed(files) {
+    const scan = emptyScan();
+    const f = facts(files);
+    for (const rel of f.pkgUnresolved)
+        scan.cnj.push({
+            rel,
+            n: 0,
+            note: `import: an import of ${IDENTITY_PACKAGE} whose bindings cannot be read`,
+        });
+    let doors = 0;
+    let gates = 0;
+    // (d) local identity layers — the INNERMOST named function that compares
+    // names to admit, or that reads the credential / the org mapping itself.
+    const layers = new Map();
+    const note = (owner, why) => {
+        const key = `${owner.rel}:${owner.n}:${owner.name}`;
+        const e = layers.get(key) ?? { ...owner, why: [] };
+        if (!e.why.some((w) => w.slice(0, 12) === why.slice(0, 12)))
+            e.why.push(why);
+        layers.set(key, e);
+    };
+    for (const p of f.parsed) {
+        for (const cmp of nameComparisons(p.sf).filter(admits)) {
+            const o = ownerOf(cmp, p.rel);
+            if (o)
+                note(o, `compares names to admit (\`${cmp.getText().replace(/\s+/g, " ").slice(0, 90)}\`, line ${lineOf(cmp)})`);
+        }
+        walk(p.sf, (x) => {
+            if (!ts.isCallExpression(x))
+                return;
+            const callee = dotted(x.expression) ?? "";
+            const a0 = x.arguments[0];
+            // the credential read, or the org lookup keyed on a credential claim
+            // (`client_org_mapping` through its clerk index) — resolution itself.
+            const keyedOnClaim = () => {
+                for (let q = x; q.parent; q = q.parent) {
+                    const par = q.parent;
+                    if (ts.isPropertyAccessExpression(par) &&
+                        par.name.text === "withIndex" &&
+                        ts.isCallExpression(par.parent) &&
+                        /clerk/i.test(par.parent.arguments[0]?.getText() ?? ""))
+                        return true;
+                    if (!ts.isPropertyAccessExpression(par) && !ts.isCallExpression(par))
+                        return false;
+                }
+                return false;
+            };
+            const what = HOST_READ.test(callee) && !f.flow.sanctioned(x)
+                ? "getUserIdentity()"
+                : /\.query$/.test(callee) &&
+                    a0 &&
+                    ts.isStringLiteralLike(a0) &&
+                    a0.text === "client_org_mapping" &&
+                    !f.okReads.has(x) &&
+                    keyedOnClaim()
+                    ? 'query("client_org_mapping").withIndex(<clerk claim>)'
+                    : undefined;
+            if (!what)
+                return;
+            const o = ownerOf(x, p.rel);
+            if (o)
+                note(o, `resolves identity itself (\`${what}\`, line ${lineOf(x)}) instead of delegating to ${IDENTITY_PACKAGE}`);
+        });
+    }
+    for (const e of layers.values()) {
+        gates++;
+        scan.violate.push({
+            rel: e.rel,
+            n: e.n,
+            note: `${e.name}: (d) local identity layer — ${e.why.join("; ")}`,
+        });
+    }
+    // (c) unresolved pass-through.
+    for (const p of f.parsed) {
+        for (const m of masterOnAbsence(p))
+            scan.violate.push({
+                rel: p.rel,
+                n: m.n,
+                note: `${m.fn}: (c) continues as master when \`${m.subject}\` is unresolved (\`isMaster: true\` on the absence branch) instead of refusing`,
+            });
+        if (/(^|\/)mcp-server\/src\//.test(p.rel))
+            for (const o of orgOptionalForward(p))
+                scan.violate.push({
+                    rel: p.rel,
+                    n: o.n,
+                    note: `${o.owner}: (c) forwards the organisation to ${o.call} only when \`${o.org}\` resolved — an org-less bearer still reaches ${o.call}, with no organisation, never refused`,
+                });
+    }
+    // doors — every public convex mutation/action that writes.
+    for (const p of f.parsed) {
+        if (!/(^|\/)convex\//.test(p.rel))
+            continue;
+        const pkg = f.pkgNames.get(p.rel) ?? new Set();
+        for (const reg of registrations(p)) {
+            if (reg.builder !== "mutation" && reg.builder !== "action")
+                continue;
+            const body = reg.handler.body;
+            if (!body)
+                continue;
+            let writes = 0;
+            let targetWrites = 0;
+            walk(body, (x) => {
+                if (!ts.isCallExpression(x))
+                    return;
+                const c = dotted(x.expression) ?? "";
+                if (WRITE.test(c) || /\brun(Mutation|Action)$/.test(c))
+                    writes++;
+                if (TARGET_WRITE.test(c))
+                    targetWrites++;
+            });
+            if (writes === 0)
+                continue;
+            doors++;
+            const called = calledFns(body);
+            const reasons = [];
+            // (a) principal source
+            const viaPkg = callsAny(body, pkg) || called.some((n) => f.usesPackage.has(n));
+            const local = called.find((n) => f.resolvesLocally.has(n));
+            const ownLocal = resolvesLocallyIn(body, f.flow, f.okReads);
+            if (local || ownLocal)
+                reasons.push(`(a) principal resolved by ${local ? `local ${local}()${where(firstDef(f, local))}` : "the handler itself"}, not by ${IDENTITY_PACKAGE}`);
+            else if (!viaPkg)
+                reasons.push("(a) no principal resolved at all before the write");
+            // (b) admission predicate
+            const ownNames = nameComparisons(body).filter(admits);
+            const helperNames = called.filter((n) => f.nameAdmitting.has(n));
+            if (ownNames.length)
+                reasons.push(`(b) admission compares a name (\`${ownNames[0].getText().replace(/\s+/g, " ").slice(0, 80)}\`, line ${lineOf(ownNames[0])})`);
+            else if (helperNames.length)
+                reasons.push(`(b) admission compares names in ${helperNames
+                    .slice(0, 3)
+                    .map((n) => `${n}()${where(firstDef(f, n))}`)
+                    .join(", ")}`);
+            // the locals bound to a package call (never to its target check), or
+            // to a local helper that delegates to the package: the principal.
+            const imp = f.pkgImports.get(p.rel) ?? {
+                named: new Map(),
+                namespaces: new Set(),
+            };
+            // `principals`: bound to the package itself (clause c reads these);
+            // `principalRoots`: also bound to a local helper that delegates to it
+            // (an admissible first argument of the target check).
+            const principals = new Set();
+            const principalRoots = new Set();
+            walk(body, (x) => {
+                if (ts.isVariableDeclaration(x) &&
+                    ts.isIdentifier(x.name) &&
+                    x.initializer) {
+                    const i = unwrap(x.initializer);
+                    if (!ts.isCallExpression(i))
+                        return;
+                    if (pkgExportOf(i.expression, imp) === TARGET_CHECK)
+                        return;
+                    const head = (dotted(i.expression) ?? "").split(".")[0];
+                    if (pkg.has(head))
+                        principals.add(x.name.text);
+                    if (pkg.has(head) || f.usesPackage.has(head))
+                        principalRoots.add(x.name.text);
+                }
+            });
+            // the resolver's principal under another local: `const p = who.principal`,
+            // `const p = who`, `const { principal } = who` (to a fixed point).
+            for (let grew = true; grew;) {
+                grew = false;
+                walk(body, (x) => {
+                    if (!ts.isVariableDeclaration(x) || !x.initializer)
+                        return;
+                    const src = dotted(x.initializer);
+                    if (!src)
+                        return;
+                    const [root, ...rest] = src.split(".");
+                    if (!principalRoots.has(root))
+                        return;
+                    if (rest.length > 1 || (rest.length === 1 && rest[0] !== "principal"))
+                        return;
+                    const bound = [];
+                    if (ts.isIdentifier(x.name))
+                        bound.push(x.name.text);
+                    else if (ts.isObjectBindingPattern(x.name) && rest.length === 0)
+                        for (const el of x.name.elements) {
+                            const key = (el.propertyName ?? el.name).getText();
+                            if (key === "principal" && ts.isIdentifier(el.name))
+                                bound.push(el.name.text);
+                        }
+                    for (const b of bound)
+                        if (!principalRoots.has(b)) {
+                            principalRoots.add(b);
+                            grew = true;
+                        }
+                });
+            }
+            if (targetWrites > 0 && !ownNames.length && !helperNames.length) {
+                const ids = idComparisons(body);
+                const admitted = packageAdmittedWrites(body, imp, principalRoots);
+                if (ids.length === 0 &&
+                    !called.some((n) => f.usesPackage.has(n)) &&
+                    admitted.size < targetWrites)
+                    reasons.push("(b) no predicate on the target at all");
+            }
+            // (c) at the door: a package principal must be refused when absent.
+            if (viaPkg && !local && !ownLocal) {
+                let refused = false;
+                walk(body, (x) => {
+                    const subj = ts.isIfStatement(x)
+                        ? absenceSubject(x.expression)
+                        : undefined;
+                    if (ts.isIfStatement(x) &&
+                        subj &&
+                        principals.has(subj.split(".")[0])) {
+                        walk(x.thenStatement, (y) => {
+                            if (ts.isThrowStatement(y) || ts.isReturnStatement(y))
+                                refused = true;
+                        });
+                    }
+                });
+                // a throwing `require…`/`assert…` export refuses by itself — never
+                // the target check, which returns a result the door must read.
+                const requiring = [...pkg].some((n) => /^require|^assert/.test(n) &&
+                    imp.named.get(n) !== TARGET_CHECK &&
+                    callsAny(body, new Set([n])));
+                if (!refused && !requiring)
+                    reasons.push("(c) the package principal is used with no refusal on its absence");
+            }
+            const site = { rel: p.rel, n: reg.line };
+            if (reasons.length)
+                scan.violate.push({
+                    ...site,
+                    note: `${reg.name}: ${reasons.join(" | ")}`,
+                });
+            else
+                scan.conform.push({
+                    ...site,
+                    note: `${reg.name}: principal from ${IDENTITY_PACKAGE}, target admitted by stored-ID comparison, unresolved refused`,
+                });
+        }
+    }
+    // clause 1, recipient side: a recipient / target agent selected by a name
+    // the caller typed (see recipient-by-id.ts). One site per deciding line.
+    for (const s of recipientByNameSites(f.parsed, f.fns))
+        scan.violate.push(s);
+    return { scan, doors, gates };
+}
+export const R53 = {
+    id: R53_ID,
+    run: (tree) => {
+        const d = scanR53Detailed(tree.files);
+        return decide("R-53", R53_ID, R53_CHECK, d.scan, "R-53: no applicable site — no public write door in convex/ and no identity gate in convex/ or mcp-server/src was read. NOT a clean bill.");
+    },
+};
+export const SOURCE_IDENTITY_BY_ID_DETECTORS = [
+    { detector: R53, ruleId: "R-53", standardPin: SOURCE_STANDARD_PIN },
+];