al-sem 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (231) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +361 -0
  3. package/package.json +64 -0
  4. package/scripts/d40-diff.ts +44 -0
  5. package/scripts/fetch-native-parser.ts +179 -0
  6. package/scripts/precision-sample.ts +99 -0
  7. package/scripts/precision-study.ts +42 -0
  8. package/scripts/precision-tabulate.ts +52 -0
  9. package/src/cli/baseline.ts +31 -0
  10. package/src/cli/diff.ts +199 -0
  11. package/src/cli/events-chains.ts +56 -0
  12. package/src/cli/events-fanout.ts +87 -0
  13. package/src/cli/exit-code.ts +30 -0
  14. package/src/cli/fingerprint-indexes.ts +130 -0
  15. package/src/cli/fingerprint-query.ts +543 -0
  16. package/src/cli/fingerprint-witness.ts +493 -0
  17. package/src/cli/fingerprint.ts +292 -0
  18. package/src/cli/format-compact-json.ts +45 -0
  19. package/src/cli/format-events.ts +77 -0
  20. package/src/cli/format-fingerprint.ts +295 -0
  21. package/src/cli/format-html.ts +503 -0
  22. package/src/cli/format-json.ts +13 -0
  23. package/src/cli/format-policy.ts +95 -0
  24. package/src/cli/format-sarif.ts +186 -0
  25. package/src/cli/format-terminal.ts +153 -0
  26. package/src/cli/index.ts +566 -0
  27. package/src/cli/policy.ts +204 -0
  28. package/src/config/roots-config.ts +302 -0
  29. package/src/deps/cache-versions.ts +74 -0
  30. package/src/deps/canonical-json.ts +27 -0
  31. package/src/deps/dependency-artifact.ts +144 -0
  32. package/src/deps/dependency-cache.ts +262 -0
  33. package/src/deps/dependency-dag.ts +128 -0
  34. package/src/deps/dependency-package-discovery.ts +85 -0
  35. package/src/deps/dependency-pipeline.ts +483 -0
  36. package/src/deps/dependency-projection.ts +211 -0
  37. package/src/deps/dependency-resolver.ts +154 -0
  38. package/src/deps/workspace-dependencies.ts +114 -0
  39. package/src/detectors/capability-query.ts +145 -0
  40. package/src/detectors/confidence.ts +52 -0
  41. package/src/detectors/d1-db-op-in-loop.ts +457 -0
  42. package/src/detectors/d10-self-modifying-loop.ts +114 -0
  43. package/src/detectors/d11-modify-without-get.ts +129 -0
  44. package/src/detectors/d12-dead-integration-event.ts +81 -0
  45. package/src/detectors/d13-cross-app-internal-call.ts +105 -0
  46. package/src/detectors/d14-dead-routine.ts +151 -0
  47. package/src/detectors/d16-obsolete-routine-call.ts +94 -0
  48. package/src/detectors/d17-min-version-drift.ts +157 -0
  49. package/src/detectors/d18-constant-filter-in-loop.ts +151 -0
  50. package/src/detectors/d19-unused-parameter.ts +116 -0
  51. package/src/detectors/d2-event-fanout-in-loop.ts +240 -0
  52. package/src/detectors/d20-unreachable-after-exit.ts +92 -0
  53. package/src/detectors/d21-read-without-load.ts +128 -0
  54. package/src/detectors/d22-flowfield-without-calcfields.ts +168 -0
  55. package/src/detectors/d29-subscriber-modify-on-event-record.ts +163 -0
  56. package/src/detectors/d3-load-state.ts +72 -0
  57. package/src/detectors/d3-missing-setloadfields.ts +234 -0
  58. package/src/detectors/d32-constant-boolean-parameter.ts +185 -0
  59. package/src/detectors/d33-unfiltered-bulk-write.ts +173 -0
  60. package/src/detectors/d34-commit-in-loop.ts +206 -0
  61. package/src/detectors/d35-commit-in-event-subscriber.ts +138 -0
  62. package/src/detectors/d36-late-setloadfields.ts +162 -0
  63. package/src/detectors/d37-validate-without-persist.ts +271 -0
  64. package/src/detectors/d38-subscriber-to-obsolete-event.ts +140 -0
  65. package/src/detectors/d39-record-left-dirty-across-chain.ts +165 -0
  66. package/src/detectors/d4-repeated-lookup-in-loop.ts +128 -0
  67. package/src/detectors/d40-transitive-load-missing.ts +217 -0
  68. package/src/detectors/d41-transitive-filter-loss.ts +200 -0
  69. package/src/detectors/d42-cross-call-wrong-setloadfields.ts +243 -0
  70. package/src/detectors/d43-event-ishandled-skip.ts +257 -0
  71. package/src/detectors/d44-event-multi-subscriber-overlap.ts +223 -0
  72. package/src/detectors/d45-event-transitive-table-exposure.ts +159 -0
  73. package/src/detectors/d5-set-based-opportunity.ts +162 -0
  74. package/src/detectors/d7-recursive-event-expansion.ts +151 -0
  75. package/src/detectors/d8-commit-in-transaction.ts +132 -0
  76. package/src/detectors/d9-transaction-span-summary.ts +107 -0
  77. package/src/detectors/detector-context.ts +121 -0
  78. package/src/detectors/finding-grouping.ts +61 -0
  79. package/src/detectors/path-merge.ts +174 -0
  80. package/src/detectors/registry.ts +176 -0
  81. package/src/detectors/table-display.ts +42 -0
  82. package/src/diff/diff-abi.ts +195 -0
  83. package/src/diff/diff-capabilities.ts +179 -0
  84. package/src/diff/diff-engine.ts +146 -0
  85. package/src/diff/diff-events.ts +323 -0
  86. package/src/diff/diff-identity.ts +73 -0
  87. package/src/diff/diff-indexes.ts +199 -0
  88. package/src/diff/diff-permissions.ts +260 -0
  89. package/src/diff/diff-policy.ts +101 -0
  90. package/src/diff/diff-preflight.ts +66 -0
  91. package/src/diff/diff-renames.ts +104 -0
  92. package/src/diff/diff-schema.ts +232 -0
  93. package/src/diff/format-diff.ts +148 -0
  94. package/src/engine/attribute-parser.ts +50 -0
  95. package/src/engine/capability-cone.ts +531 -0
  96. package/src/engine/combined-graph.ts +357 -0
  97. package/src/engine/control-flow-walker.ts +1317 -0
  98. package/src/engine/dispatch-sites.ts +199 -0
  99. package/src/engine/effect-lattice.ts +81 -0
  100. package/src/engine/entry-points.ts +57 -0
  101. package/src/engine/event-flow.ts +524 -0
  102. package/src/engine/event-relay.ts +92 -0
  103. package/src/engine/op-classification.ts +92 -0
  104. package/src/engine/path-walker.ts +189 -0
  105. package/src/engine/reverse-call-graph.ts +23 -0
  106. package/src/engine/root-classifier-overlay.ts +194 -0
  107. package/src/engine/root-classifier.ts +135 -0
  108. package/src/engine/scc.ts +110 -0
  109. package/src/engine/source-anchor.ts +25 -0
  110. package/src/engine/summary-context.ts +104 -0
  111. package/src/engine/summary-engine.ts +296 -0
  112. package/src/engine/summary-runner.ts +560 -0
  113. package/src/engine/transaction-spans.ts +112 -0
  114. package/src/engine/uncertainty-util.ts +54 -0
  115. package/src/hash.ts +31 -0
  116. package/src/index/attribute-from-node.ts +141 -0
  117. package/src/index/callee-from-node.ts +181 -0
  118. package/src/index/capability/background.ts +90 -0
  119. package/src/index/capability/commit.ts +44 -0
  120. package/src/index/capability/dispatch.ts +164 -0
  121. package/src/index/capability/events.ts +65 -0
  122. package/src/index/capability/extractor.ts +124 -0
  123. package/src/index/capability/file-blob.ts +137 -0
  124. package/src/index/capability/http.ts +159 -0
  125. package/src/index/capability/hyperlink.ts +60 -0
  126. package/src/index/capability/isolated-storage.ts +179 -0
  127. package/src/index/capability/table.ts +113 -0
  128. package/src/index/capability/telemetry.ts +84 -0
  129. package/src/index/capability/ui.ts +55 -0
  130. package/src/index/capability/value-source.ts +202 -0
  131. package/src/index/expression-from-node.ts +117 -0
  132. package/src/index/indexer.ts +102 -0
  133. package/src/index/intraprocedural-body.ts +1467 -0
  134. package/src/index/intraprocedural-ops.ts +253 -0
  135. package/src/index/intraprocedural-refs.ts +188 -0
  136. package/src/index/object-indexer.ts +279 -0
  137. package/src/index/routine-indexer.ts +282 -0
  138. package/src/index/routine-signature.ts +46 -0
  139. package/src/index/variable-indexer.ts +134 -0
  140. package/src/index/variable-initializer-extractor.ts +155 -0
  141. package/src/index/variable-type-normalizer.ts +83 -0
  142. package/src/index.ts +267 -0
  143. package/src/mcp/server.ts +72 -0
  144. package/src/mcp/session.ts +49 -0
  145. package/src/mcp/tools/explain-path.ts +75 -0
  146. package/src/mcp/tools/get-analysis-health.ts +62 -0
  147. package/src/mcp/tools/get-finding.ts +47 -0
  148. package/src/mcp/tools/get-routine-summary.ts +126 -0
  149. package/src/mcp/tools/list-findings.ts +85 -0
  150. package/src/mcp/tools/list-hotspots.ts +78 -0
  151. package/src/mcp/tools/list-rollups.ts +103 -0
  152. package/src/mcp/tools/validators.ts +25 -0
  153. package/src/model/attributes.ts +120 -0
  154. package/src/model/callee.ts +45 -0
  155. package/src/model/capability.ts +187 -0
  156. package/src/model/coverage.ts +85 -0
  157. package/src/model/entities.ts +628 -0
  158. package/src/model/expression.ts +98 -0
  159. package/src/model/finding.ts +110 -0
  160. package/src/model/graph-edge.ts +93 -0
  161. package/src/model/graph.ts +62 -0
  162. package/src/model/identity.ts +81 -0
  163. package/src/model/ids.ts +90 -0
  164. package/src/model/index.ts +13 -0
  165. package/src/model/model.ts +51 -0
  166. package/src/model/permission.ts +76 -0
  167. package/src/model/root-classification.ts +116 -0
  168. package/src/model/stable-identity.ts +102 -0
  169. package/src/model/summary.ts +96 -0
  170. package/src/parser/ast.ts +82 -0
  171. package/src/parser/native/ffi.ts +145 -0
  172. package/src/parser/native/parse-index-pool.ts +148 -0
  173. package/src/parser/native/parse-index-worker.ts +94 -0
  174. package/src/parser/native/wrapper.ts +353 -0
  175. package/src/parser/parser-init.ts +43 -0
  176. package/src/perf/profiler.ts +66 -0
  177. package/src/policy/policy-default.yaml +83 -0
  178. package/src/policy/policy-engine.ts +339 -0
  179. package/src/policy/policy-loader.ts +257 -0
  180. package/src/policy/policy-schema.json +379 -0
  181. package/src/policy/policy-types.ts +81 -0
  182. package/src/policy/predicate-compiler.ts +151 -0
  183. package/src/policy/predicate-evaluator.ts +267 -0
  184. package/src/policy/predicate-fields.ts +439 -0
  185. package/src/projection/actionable-anchor.ts +48 -0
  186. package/src/projection/finding-filters.ts +44 -0
  187. package/src/projection/finding-fingerprint.ts +54 -0
  188. package/src/projection/finding-groups.ts +41 -0
  189. package/src/projection/finding-summary.ts +110 -0
  190. package/src/projection/rollup-findings.ts +105 -0
  191. package/src/providers/discover.ts +88 -0
  192. package/src/providers/external.ts +46 -0
  193. package/src/providers/types.ts +36 -0
  194. package/src/providers/workspace.ts +117 -0
  195. package/src/resolve/call-resolver.ts +117 -0
  196. package/src/resolve/coverage.ts +61 -0
  197. package/src/resolve/event-graph.ts +166 -0
  198. package/src/resolve/implicit-edges.ts +53 -0
  199. package/src/resolve/record-types.ts +36 -0
  200. package/src/resolve/resolver.ts +23 -0
  201. package/src/resolve/semantic-graph.ts +29 -0
  202. package/src/resolve/symbol-table.ts +69 -0
  203. package/src/snapshot/app-snapshot.ts +74 -0
  204. package/src/snapshot/compose.ts +100 -0
  205. package/src/snapshot/derive/callsite-evidence.ts +76 -0
  206. package/src/snapshot/derive/capability-facts.ts +70 -0
  207. package/src/snapshot/derive/contracts.ts +131 -0
  208. package/src/snapshot/derive/coverage.ts +35 -0
  209. package/src/snapshot/derive/event-declarations.ts +140 -0
  210. package/src/snapshot/derive/identity-table.ts +58 -0
  211. package/src/snapshot/derive/inputs.ts +91 -0
  212. package/src/snapshot/derive/operation-evidence.ts +70 -0
  213. package/src/snapshot/derive/permissions.ts +186 -0
  214. package/src/snapshot/derive/root-classifications.ts +56 -0
  215. package/src/snapshot/derive/schema.ts +130 -0
  216. package/src/snapshot/derive/typed-edges.ts +60 -0
  217. package/src/snapshot/derive/workspace-fingerprint.ts +19 -0
  218. package/src/snapshot/deserialize.ts +40 -0
  219. package/src/snapshot/serialize-cbor-gz.ts +12 -0
  220. package/src/snapshot/serialize-cbor.ts +19 -0
  221. package/src/snapshot/serialize-json.ts +22 -0
  222. package/src/snapshot/shard.ts +134 -0
  223. package/src/snapshot/types.ts +181 -0
  224. package/src/symbols/app-manifest.ts +96 -0
  225. package/src/symbols/app-package-zip.ts +50 -0
  226. package/src/symbols/embedded-source-reader.ts +41 -0
  227. package/src/symbols/package-hash.ts +81 -0
  228. package/src/symbols/symbol-reader.ts +101 -0
  229. package/src/symbols/symbol-reference-parser.ts +378 -0
  230. package/src/symbols/symbol-reference-reader.ts +27 -0
  231. package/tsconfig.json +18 -0
@@ -0,0 +1,117 @@
1
+ // src/index/expression-from-node.ts
2
+ // Build a structured `ExpressionInfo` from a tree-sitter expression node.
3
+ //
4
+ // Used by the body indexer to populate `CallSite.argumentInfos` and
5
+ // `RecordOperation.fieldArgumentInfos`. Same shape regardless of where the
6
+ // expression appears — detectors that need a literal-vs-non-literal decision
7
+ // (D18) or quoted-vs-unquoted name disambiguation (D4, D22) read the
8
+ // resulting `ExpressionInfo` through the `model/expression.ts` helpers
9
+ // instead of re-parsing the raw text.
10
+
11
+ import type { ExpressionInfo, ExpressionKind } from "../model/expression.ts";
12
+ import type { Node as SyntaxNode } from "../parser/native/wrapper.ts";
13
+
14
+ /** Strip surrounding single or double quotes. */
15
+ function stripQuoteChars(text: string): string {
16
+ if (text.length < 2) return text;
17
+ const first = text[0];
18
+ const last = text[text.length - 1];
19
+ if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
20
+ return text.slice(1, -1);
21
+ }
22
+ return text;
23
+ }
24
+
25
+ /** Map a tree-sitter node type into the closed `ExpressionKind` enum. */
26
+ function kindOf(nodeType: string): ExpressionKind {
27
+ switch (nodeType) {
28
+ case "string_literal":
29
+ case "integer":
30
+ case "decimal":
31
+ case "boolean":
32
+ case "identifier":
33
+ case "quoted_identifier":
34
+ case "qualified_enum_value":
35
+ case "database_reference":
36
+ case "unary_expression":
37
+ case "member_expression":
38
+ case "call_expression":
39
+ case "parenthesized_expression":
40
+ return nodeType;
41
+ default:
42
+ return "other";
43
+ }
44
+ }
45
+
46
+ /**
47
+ * For `unary_expression`, return the operand's kind when the operand is a
48
+ * numeric literal (`integer` / `decimal`). The signed text — `text` field —
49
+ * acts as the value. Used by D18 to treat `-5` / `+5.5` as loop-invariant
50
+ * literals just like a bare `5`.
51
+ */
52
+ function unaryLiteralValue(node: SyntaxNode, text: string): string | undefined {
53
+ for (const child of node.namedChildren) {
54
+ if (child === null) continue;
55
+ if (child.type === "integer" || child.type === "decimal") return text;
56
+ return undefined;
57
+ }
58
+ return undefined;
59
+ }
60
+
61
+ /** Pull derived `value` / `qualifier` / `member` fields for the kinds that have them. */
62
+ function deriveParts(
63
+ node: SyntaxNode,
64
+ kind: ExpressionKind,
65
+ text: string,
66
+ ): { value?: string; qualifier?: string; member?: string } {
67
+ switch (kind) {
68
+ case "string_literal":
69
+ case "quoted_identifier":
70
+ return { value: stripQuoteChars(text) };
71
+ case "integer":
72
+ case "decimal":
73
+ case "boolean":
74
+ case "identifier":
75
+ return { value: text };
76
+ case "qualified_enum_value": {
77
+ const qualifier = node.childForFieldName("enum_type")?.text;
78
+ const memberRaw = node.childForFieldName("value")?.text;
79
+ const member = memberRaw !== undefined ? stripQuoteChars(memberRaw) : undefined;
80
+ return {
81
+ value: member,
82
+ ...(qualifier !== undefined ? { qualifier } : {}),
83
+ ...(member !== undefined ? { member } : {}),
84
+ };
85
+ }
86
+ case "database_reference": {
87
+ const qualifier = node.childForFieldName("keyword")?.text;
88
+ const memberRaw = node.childForFieldName("table_name")?.text;
89
+ const member = memberRaw !== undefined ? stripQuoteChars(memberRaw) : undefined;
90
+ return {
91
+ value: member,
92
+ ...(qualifier !== undefined ? { qualifier } : {}),
93
+ ...(member !== undefined ? { member } : {}),
94
+ };
95
+ }
96
+ case "unary_expression": {
97
+ const value = unaryLiteralValue(node, text);
98
+ return value !== undefined ? { value } : {};
99
+ }
100
+ default:
101
+ return {};
102
+ }
103
+ }
104
+
105
+ /** Build an `ExpressionInfo` from an arbitrary expression node. */
106
+ export function expressionInfoFromNode(node: SyntaxNode): ExpressionInfo {
107
+ const kind = kindOf(node.type);
108
+ const text = node.text;
109
+ const parts = deriveParts(node, kind, text);
110
+ return {
111
+ kind,
112
+ text,
113
+ ...(parts.value !== undefined ? { value: parts.value } : {}),
114
+ ...(parts.qualifier !== undefined ? { qualifier: parts.qualifier } : {}),
115
+ ...(parts.member !== undefined ? { member: parts.member } : {}),
116
+ };
117
+ }
@@ -0,0 +1,102 @@
1
+ import { sha256Hex } from "../hash.ts";
2
+ import type { App } from "../model/entities.ts";
3
+ import type { Diagnostic } from "../model/finding.ts";
4
+ import type { ModelIdentity } from "../model/identity.ts";
5
+ import type { SemanticIndex } from "../model/model.ts";
6
+ import { NativeParserUnavailableError, parseALSource } from "../parser/parser-init.ts";
7
+ import type { SourceUnit } from "../providers/types.ts";
8
+ import { indexObjects } from "./object-indexer.ts";
9
+ import { indexRoutines } from "./routine-indexer.ts";
10
+
11
+ export interface BuildIndexResult {
12
+ index: SemanticIndex;
13
+ diagnostics: Diagnostic[];
14
+ }
15
+
16
+ /**
17
+ * Parse and index every source unit into a SemanticIndex. Parse/index failures degrade
18
+ * gracefully: the offending unit is skipped with a diagnostic; other units still index.
19
+ */
20
+ export async function buildSemanticIndex(
21
+ units: SourceUnit[],
22
+ identity: ModelIdentity,
23
+ modelInstanceId: string,
24
+ ): Promise<BuildIndexResult> {
25
+ const diagnostics: Diagnostic[] = [];
26
+ const index: SemanticIndex = {
27
+ identity,
28
+ apps: identity.apps.map(
29
+ (a): App => ({
30
+ appGuid: a.appGuid,
31
+ publisher: a.publisher,
32
+ name: a.name,
33
+ version: a.version,
34
+ }),
35
+ ),
36
+ objects: [],
37
+ routines: [],
38
+ tables: [],
39
+ };
40
+
41
+ let parserDownGuard = false;
42
+ for (const unit of units) {
43
+ if (parserDownGuard) break;
44
+ if (unit.kind !== "source" || unit.content === undefined) continue;
45
+ let tree: Awaited<ReturnType<typeof parseALSource>> | undefined;
46
+ try {
47
+ tree = await parseALSource(unit.content);
48
+ const sourceHash = sha256Hex(unit.content);
49
+ const objResults = indexObjects({
50
+ tree,
51
+ appGuid: unit.appGuid,
52
+ sourceUnitId: unit.id,
53
+ modelInstanceId,
54
+ sourceHash,
55
+ });
56
+ if (objResults.length === 0) {
57
+ diagnostics.push({
58
+ severity: "info",
59
+ stage: "index",
60
+ message: `No object declaration found in ${unit.relativePath}`,
61
+ sourceRef: unit.id,
62
+ });
63
+ continue;
64
+ }
65
+ for (const objResult of objResults) {
66
+ if (!objResult.object || !objResult.objectNode) continue;
67
+ objResult.object.analysisRole = unit.analysisRole ?? "primary";
68
+ index.objects.push(objResult.object);
69
+ if (objResult.table) index.tables.push(objResult.table);
70
+ const routines = indexRoutines({
71
+ objectNode: objResult.objectNode,
72
+ object: objResult.object,
73
+ sourceUnitId: unit.id,
74
+ modelInstanceId,
75
+ });
76
+ for (const r of routines) r.analysisRole = unit.analysisRole ?? "primary";
77
+ index.routines.push(...routines);
78
+ }
79
+ } catch (err) {
80
+ if (err instanceof NativeParserUnavailableError) {
81
+ diagnostics.push({
82
+ severity: "error",
83
+ stage: "parse",
84
+ message: `[PARSER001] native parser unavailable: ${err.message}`,
85
+ });
86
+ parserDownGuard = true;
87
+ continue;
88
+ }
89
+ diagnostics.push({
90
+ severity: "warning",
91
+ stage: "index",
92
+ message: `Failed to index ${unit.relativePath}: ${(err as Error).message}`,
93
+ sourceRef: unit.id,
94
+ });
95
+ } finally {
96
+ // Free WASM-backed tree-sitter `Tree` — JS GC alone doesn't reclaim it.
97
+ tree?.delete();
98
+ }
99
+ }
100
+
101
+ return { index, diagnostics };
102
+ }