candor-ts 0.21.0 → 0.23.0

package/AGENTS.md

@@ -12,7 +12,7 @@ chains by hand.
 > **Already installed? Report the version and ask before upgrading — before you scan.** If this
 > project already has candor (a `.candor/` report directory, or `candor-ts` reachable via `npx`/a
 > global install), do this *first*: run `npx -y candor-ts --version` (offline) and **tell the user
-> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.21)."*
+> plainly which version they're on** — e.g. *"This project is on candor-ts `<version>` (spec 0.23)."*
 > On a build too old for the flag, read `candor.version` / `candor.spec` from an existing
 > `.candor/report*.json`, or `npm ls -g candor-ts`.
 >

package/Cases.ts

@@ -32,6 +32,10 @@ class Holder { cb: () => void = () => {}; }
 const h = new Holder();
 export function unknown_dyn(): void { const cb = h.cb; cb(); }
 
+// An OPAQUE callback handed to a SYNCHRONOUS invoker (forEach) is an unresolvable call -> Unknown,
+// never silently pure (four-way sync-callback-invoker rung).
+export function sync_callback_opaque(xs: number[], cb: (x: number) => void): void { xs.forEach(cb); }
+
 // --- multi-effect union in one body ---
 export function combined(): void { try { fsm.readFileSync("/tmp/x"); netm.connect(1, "h"); } catch {} }
 

package/README.md

@@ -184,7 +184,7 @@ pure-vs-Unknown ruling (PART 16) — the engines must answer identically, on eve
 | A call resolving to a *type* (function-typed field/param) → `Unknown`, never silent-pure | SPEC §4 |
 | Unmatched external calls contribute nothing (curated-classifier caveat) | SEMANTICS §8 C1 |
 | The literal surfaces `hosts`/`cmds`/`paths`/`tables`, literal-read only | SPEC §2 |
-| `{ candor: { version, toolchain, spec: "0.21" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
+| `{ candor: { version, toolchain, spec: "0.23" }, functions }` envelope; pure fns omitted | SPEC §2/§2.1 |
 | Call-graph sidecar with **every** analyzed function a key | SPEC §2.2 |
 | The gate: AS-EFF-006 / 008 / 009, loud on an unreadable policy | SPEC §6.2 |
 
@@ -202,7 +202,7 @@ read the Rust source".
 
 ## Status
 
-0.19.x, speaking candor-spec 0.21: the analysis core, the gate (`--policy` / `--gate-json` /
+0.19.x, speaking candor-spec 0.23: the analysis core, the gate (`--policy` / `--gate-json` /
 `.candor/config`), the full §3.1 query surface (including `containment`, `blindspots`, the
 `--include-unknown` dispatch frontier), the MCP server, the LSP server, and the watch loop are
 real, behaviorally tested (`npm test` — the behavioral suite across six harnesses), **soundness-fuzzed

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "candor-ts",
-  "version": "0.21.0",
-  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.21)",
+  "version": "0.23.0",
+  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.23)",
   "type": "module",
   "dependencies": {
     "@types/node": "^25.9.2",
@@ -13,7 +13,9 @@
     "candor-ts-mcp": "./mcp.mjs",
     "candor-ts-watch": "./watch.mjs",
     "candor-mcp": "./mcp.mjs",
-    "candor-lsp": "./lsp.mjs"
+    "candor-lsp": "./lsp.mjs",
+    "candor-ts-verify": "./verify.mjs",
+    "candor-ts-sensitivity": "./sensitivity.mjs"
   },
   "scripts": {
     "lint": "eslint *.mjs",
@@ -55,7 +57,14 @@
     "surface.mjs",
     "mcp.mjs",
     "watch.mjs",
-    "lsp.mjs"
+    "lsp.mjs",
+    "verify.mjs",
+    "verify-core.mjs",
+    "verify-preload.mjs",
+    "verify-emit.mjs",
+    "verify-loader.mjs",
+    "verify-syscall.mjs",
+    "sensitivity.mjs"
   ],
   "devDependencies": {
     "@eslint/js": "^9.39.4",

package/query-core.mjs

@@ -29,7 +29,7 @@ function siblings(prefix, predicate) {
 // sibling is `.encountered-*`/`.calibrated.json` passes the existence check but loads ZERO functions →
 // an authoritative-empty result (silent under-report; review find). `.gate.json` has no functions array,
 // so merging it "disclosed a malformed report" on every query over the recommended CI layout — noisy, excluded.
-export const isReport = (f) => !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.includes(".encountered-") && !f.endsWith(".calibrated.json") && !f.endsWith(".gate.json");
+export const isReport = (f) => !f.endsWith(".callgraph.json") && !f.endsWith(".hierarchy.json") && !f.endsWith(".locs.json") && !f.includes(".encountered-") && !f.endsWith(".calibrated.json") && !f.endsWith(".gate.json");
 
 // A report exists at the prefix if there's an exact `<prefix>.json` (candor-ts) OR a sibling
 // `<prefix>.<crate>.scan.json` (the candor-scan/Rust multi-report form) — the loaders read both, so a

package/query.mjs

@@ -202,7 +202,7 @@ function renderPathHuman(fns, cg, fnQ, eff) {
 // package.json; SPEC_VERSION is the spec contract this build speaks. Reused, never re-littered.
 const QUERY_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = JSON.parse(fs.readFileSync(path.join(QUERY_DIR, "package.json"), "utf8")).version;
-const SPEC_VERSION = "0.21";
+const SPEC_VERSION = "0.23";
 
 // ---- the §3.3.1 canonical query grammar (⟨0.10⟩, additive over 0.9) --------------------------------
 // One shape for every verb: `<verb> <verb-args…> [--report <locator>] [--policy <file>] [--json]

package/scan-core.mjs

@@ -109,6 +109,11 @@ export const KAPPA_RULES = [
    /^(capture|captureImmediate|identify|identifyImmediate|alias|groupIdentify|flush|shutdown|isFeatureEnabled|getFeatureFlag|getFeatureFlagPayload|getAllFlags|getAllFlagsAndPayloads|getRemoteConfigPayload|reloadFeatureFlags)$/,
    "Net"],
   [/^(pg|mysql2?|mongodb|ioredis|redis|sqlite3|better-sqlite3|knex)$/, null, "Db"],
+  // Template-literal SQL clients that EXECUTE the query through a `sql`…`` tag: postgres.js (porsager),
+  // @vercel/postgres, slonik. Whole-module Db (the client factory + the tag both reach the connection, like
+  // pg's `new Pool()`). NOT `sql-template-tag` — that only BUILDS a query object (executed via pg), so it is
+  // a pure builder and stays uncurated. The tag call is classified through the TaggedTemplateExpression arm.
+  [/^(postgres|@vercel\/postgres|slonik)$/, null, "Db"],
   // bull/bullmq are Redis-backed job queues — the queue/worker/job ops issue Redis commands (Db). Their
   // surface is almost entirely I/O, but be VERB-precise (the I/O ops) so inert event-wiring
   // (`queue.on(...)`) and `new Queue()`/`new Worker()` construction (which only opens a lazy connection)
@@ -163,8 +168,14 @@ export const KAPPA_RULES = [
   // builders; `createQueryBuilder` is pure, its `getMany`/`execute` is the I/O). Found on the
   // first framework-APP scan: a TypeORM/Nest application — Db-heavy by construction — read zero
   // Db because the ORM resolved into an unlisted package (the JVM's Spring-Data lesson, replayed).
+  // The verb set is the QUERY surface PLUS the DataSource lifecycle that performs connection/DDL I/O:
+  // `initialize`/`connect` OPEN the pool (a real round-trip to the server), and
+  // `synchronize`/`runMigrations`/`undoLastMigration`/`dropDatabase` execute DDL/migration SQL — all Db.
+  // (Found dogfooding ukri-tfs: `buildPostgresDataSource` did `new DataSource(o).initialize()` and read
+  // PURE — a false all-clear on a fn that opens a database connection.) Still module-gated to typeorm, so
+  // these generic-looking verbs only fire on a typeorm-typed receiver; the pure builder heads stay pure.
   [/^(typeorm|@nestjs\/typeorm)$/,
-   /^(find|save|remove|softRemove|recover|insert|update|upsert|delete|restore|count|exist|sum|average|minimum|maximum|query|clear|increment|decrement|getMany|getOne|getOneOrFail|getRawMany|getRawOne|getCount|getExists|execute|stream|transaction)/,
+   /^(find|save|remove|softRemove|recover|insert|update|upsert|delete|restore|count|exist|sum|average|minimum|maximum|query|clear|increment|decrement|getMany|getOne|getOneOrFail|getRawMany|getRawOne|getCount|getExists|execute|stream|transaction|initialize|connect|synchronize|runMigrations|undoLastMigration|dropDatabase)/,
    "Db"],
   [/^(@prisma\/client|\.prisma|\.prisma\/client)$/,
    /^(\$?(queryRaw|executeRaw|transaction)|find(Many|Unique|First)|create|createMany|update|updateMany|upsert|delete|deleteMany|aggregate|count|groupBy)/,