code-auditor-mcp 3.1.1 → 3.4.0

package/dist/analyzers/orm/prismaAdapter.js

@@ -0,0 +1,170 @@
+/**
+ * Prisma ORM Adapter — Spec 15 R2
+ *
+ * Extracts table references and schema definitions from Prisma ORM code:
+ *
+ *   Schema:  model User { ... } blocks in schema.prisma files
+ *   Queries:  prisma.user.findMany(), prisma.user.create(...),
+ *             prisma.user.update(...), prisma.user.delete(...)
+ */
+// ---------------------------------------------------------------------------
+// Prisma CRUD operation → usage type mapping
+// ---------------------------------------------------------------------------
+const PRISMA_OPERATIONS = {
+    findUnique: 'select',
+    findFirst: 'select',
+    findMany: 'select',
+    findFirstOrThrow: 'select',
+    findUniqueOrThrow: 'select',
+    count: 'select',
+    aggregate: 'select',
+    groupBy: 'select',
+    create: 'insert',
+    createMany: 'insert',
+    upsert: 'insert',
+    update: 'update',
+    updateMany: 'update',
+    delete: 'delete',
+    deleteMany: 'delete',
+};
+// ---------------------------------------------------------------------------
+// Adapter
+// ---------------------------------------------------------------------------
+export class PrismaAdapter {
+    name = 'prisma';
+    fileExtensions = ['.ts', '.tsx', '.js', '.jsx', '.prisma'];
+    supportsFile(filePath) {
+        const base = filePath.split('/').pop() ?? filePath;
+        // Content-based detection for schema files
+        if (base === 'schema.prisma' || filePath.endsWith('.prisma')) {
+            return true;
+        }
+        const ext = filePath.split('.').pop()?.toLowerCase() ?? '';
+        return this.fileExtensions.includes(`.${ext}`);
+    }
+    // ── Table references from Prisma client calls ───────────────────────────
+    extractTableReferences(ast, adapter, sourceCode) {
+        // Prisma schema files (.prisma) don't contain query calls — skip
+        if (ast.filePath.endsWith('.prisma'))
+            return [];
+        const references = [];
+        // Find all call_expression nodes
+        const calls = adapter.findNodes(ast, { type: 'call_expression' });
+        for (const call of calls) {
+            const ref = this.extractPrismaCall(call, adapter, sourceCode);
+            if (ref)
+                references.push(ref);
+        }
+        return references;
+    }
+    /**
+     * Extract table + operation from prisma.modelName.operation() calls.
+     */
+    extractPrismaCall(node, adapter, sourceCode) {
+        const text = adapter.getNodeText(node, sourceCode);
+        // Match prisma.modelName.operation(...)
+        const match = text.match(/prisma\s*\.\s*(\w+)\s*\.\s*(\w+)\s*\(/);
+        if (!match)
+            return null;
+        const modelName = match[1]; // e.g. "user"
+        const operation = match[2]; // e.g. "findMany"
+        // Only handle known CRUD operations
+        const usageType = PRISMA_OPERATIONS[operation];
+        if (!usageType)
+            return null;
+        return {
+            table: modelName,
+            type: usageType,
+            location: node.location.start,
+            context: match[0],
+        };
+    }
+    // ── Schema definitions from schema.prisma ───────────────────────────────
+    extractSchemaDefinitions(ast, adapter, sourceCode) {
+        // Only extract from .prisma schema files
+        if (!ast.filePath.endsWith('.prisma') && !ast.filePath.endsWith('schema.prisma')) {
+            return [];
+        }
+        return this.parsePrismaSchema(sourceCode);
+    }
+    /**
+     * Parse model blocks from a Prisma schema file.
+     *
+     * Prisma schema syntax:
+     *   model User {
+     *     id        Int      @id @default(autoincrement())
+     *     email     String   @unique
+     *     name      String?
+     *     createdAt DateTime @default(now())
+     *   }
+     */
+    parsePrismaSchema(sourceCode) {
+        const definitions = [];
+        // Match model blocks: model Name { ... }
+        // Uses a simple brace-aware parser for Prisma's declarative syntax.
+        const modelRegex = /model\s+(\w+)\s*\{/g;
+        let match;
+        while ((match = modelRegex.exec(sourceCode)) !== null) {
+            const modelName = match[1];
+            const blockStart = match.index + match[0].length;
+            // Find closing brace (brace-aware)
+            const blockEnd = this.findMatchingBrace(sourceCode, blockStart - 1);
+            if (blockEnd === -1)
+                continue;
+            const blockBody = sourceCode.slice(blockStart, blockEnd);
+            // Count lines before this model to compute its line number
+            const lineNumber = sourceCode.slice(0, match.index).split('\n').length;
+            const columns = this.parseModelFields(blockBody);
+            definitions.push({
+                tableName: modelName,
+                columns,
+                location: { line: lineNumber, column: 1 },
+            });
+        }
+        return definitions;
+    }
+    /**
+     * Find the matching closing brace starting from the opening brace position.
+     */
+    findMatchingBrace(text, openBraceIndex) {
+        let depth = 1;
+        for (let i = openBraceIndex + 1; i < text.length; i++) {
+            if (text[i] === '{')
+                depth++;
+            else if (text[i] === '}') {
+                depth--;
+                if (depth === 0)
+                    return i;
+            }
+        }
+        return -1;
+    }
+    /**
+     * Parse individual field definitions from a model body.
+     *
+     * Each field: fieldName FieldType @attributes...
+     */
+    parseModelFields(body) {
+        const fields = [];
+        const lines = body.split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('@@')) {
+                continue;
+            }
+            // Match: fieldName FieldType ...
+            const fieldMatch = trimmed.match(/^(\w+)\s+(\w+)(\?)?/);
+            if (!fieldMatch)
+                continue;
+            const fieldName = fieldMatch[1];
+            let fieldType = fieldMatch[2];
+            const optional = fieldMatch[3]; // "?" suffix
+            if (optional)
+                fieldType += '?';
+            // Skip relation fields (types that are other model names are still valid)
+            fields.push({ name: fieldName, type: fieldType });
+        }
+        return fields;
+    }
+}
+//# sourceMappingURL=prismaAdapter.js.map

package/dist/analyzers/orm/prismaAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prismaAdapter.js","sourceRoot":"","sources":["../../../src/analyzers/orm/prismaAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,iBAAiB,GAA8C;IACnE,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,QAAQ;IAClB,gBAAgB,EAAE,QAAQ;IAC1B,iBAAiB,EAAE,QAAQ;IAC3B,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ;IACpB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,QAAQ,CAAC;IAChB,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAEpE,YAAY,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;QACnD,2CAA2C;QAC3C,IAAI,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAE3E,sBAAsB,CACpB,GAAQ,EACR,OAAwB,EACxB,UAAkB;QAElB,iEAAiE;QACjE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,UAAU,GAAwB,EAAE,CAAC;QAE3C,iCAAiC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9D,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,IAAS,EACT,OAAwB,EACxB,UAAkB;QAElB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAEnD,wCAAwC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;QAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAE9C,oCAAoC;QACpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC7B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SAClB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAE3E,wBAAwB,CACtB,GAAQ,EACR,OAAwB,EACxB,UAAkB;QAElB,yCAAyC;QACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;OAUG;IACK,iBAAiB,CAAC,UAAkB;QAC1C,MAAM,WAAW,GAA0B,EAAE,CAAC;QAE9C,yCAAyC;QACzC,oEAAoE;QACpE,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACzC,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEjD,mCAAmC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,KAAK,CAAC,CAAC;gBAAE,SAAS;YAE9B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEzD,2DAA2D;YAC3D,MAAM,UAAU,GACd,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAEjD,WAAW,CAAC,IAAI,CAAC;gBACf,SAAS,EAAE,SAAS;gBACpB,OAAO;gBACP,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,IAAY,EAAE,cAAsB;QAC5D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CACtB,IAAY;QAEZ,MAAM,MAAM,GAA0C,EAAE,CAAC;QAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;YAE7C,IAAI,QAAQ;gBAAE,SAAS,IAAI,GAAG,CAAC;YAE/B,0EAA0E;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/analyzers/orm/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ORM Adapter Types — Spec 15 R2
+ *
+ * ORM adapters extract table references and schema definitions from
+ * ORM-specific source code patterns (Drizzle, Prisma). They complement
+ * the raw-SQL extraction in UniversalSchemaAnalyzer, feeding into the
+ * schema_usage table for cross-domain lifecycle analysis.
+ */
+import type { AST, LanguageAdapter } from '../../languages/types.js';
+export interface OrmTableReference {
+    table: string;
+    type: 'select' | 'insert' | 'update' | 'delete' | 'create' | 'reference';
+    location: {
+        line: number;
+        column: number;
+    };
+    context: string;
+}
+export interface OrmSchemaDefinition {
+    tableName: string;
+    columns: Array<{
+        name: string;
+        type: string;
+    }>;
+    location: {
+        line: number;
+        column: number;
+    };
+}
+export interface OrmAdapter {
+    /** Unique name for this adapter (e.g. "drizzle", "prisma") */
+    readonly name: string;
+    /** File extensions this adapter handles */
+    readonly fileExtensions: string[];
+    /**
+     * Whether this adapter can handle the given file.
+     * Default checks file extension, but adapters can override for
+     * content-based detection (e.g. Prisma checks for `schema.prisma`).
+     */
+    supportsFile(filePath: string): boolean;
+    /**
+     * Extract table references from ORM-specific patterns in the AST.
+     * Called during per-file analysis when the file matches this adapter.
+     *
+     * @param ast        — Parsed AST of the source file
+     * @param adapter    — Language adapter for AST navigation
+     * @param sourceCode — Raw source text
+     * @returns Array of extracted table references
+     */
+    extractTableReferences(ast: AST, adapter: LanguageAdapter, sourceCode: string): OrmTableReference[];
+    /**
+     * Extract schema/table definitions from ORM schema declarations.
+     * For Drizzle this is pgTable/mysqlTable/sqliteTable calls.
+     * For Prisma this is `model` blocks in schema.prisma.
+     *
+     * @param ast        — Parsed AST of the source file
+     * @param adapter    — Language adapter for AST navigation
+     * @param sourceCode — Raw source text
+     * @returns Array of extracted schema definitions
+     */
+    extractSchemaDefinitions(ast: AST, adapter: LanguageAdapter, sourceCode: string): OrmSchemaDefinition[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/analyzers/orm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/orm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAW,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO9E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACzE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,2CAA2C;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;IAElC;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAExC;;;;;;;;OAQG;IACH,sBAAsB,CACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,iBAAiB,EAAE,CAAC;IAEvB;;;;;;;;;OASG;IACH,wBAAwB,CACtB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,EAAE,CAAC;CAC1B"}

package/dist/analyzers/orm/types.js

@@ -0,0 +1,10 @@
+/**
+ * ORM Adapter Types — Spec 15 R2
+ *
+ * ORM adapters extract table references and schema definitions from
+ * ORM-specific source code patterns (Drizzle, Prisma). They complement
+ * the raw-SQL extraction in UniversalSchemaAnalyzer, feeding into the
+ * schema_usage table for cross-domain lifecycle analysis.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/analyzers/orm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/analyzers/orm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/analyzers/provenance.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Provenance Resolver — Spec 21
+ *
+ * Language-neutral DB and validator receiver detection through
+ * provenance tracking instead of English name matching.
+ *
+ * "Where did this variable's value come from?" rather than
+ * "Is this variable named 'db'?"
+ *
+ * ─── Architecture ───
+ *   1. extractDBProvenancedImports   → seed identifiers from known package imports
+ *   2. propagateProvenance           → follow assignments, destructuring, params
+ *   3. buildProvenanceContext        → combine seeds + propagation + fallbacks (R3)
+ *   4. isDBProvenanced               → answer: is this call-expression DB-bound?
+ *
+ * ─── Modes (R3) ───
+ *   hybrid     (default) — provenance-primary + conjunctive name-fallback
+ *   provenance            — strict provenance only, never consults name lists
+ *   names                 — legacy English-only name matching (opt-in escape hatch)
+ */
+import type { AST, LanguageAdapter, ASTNode } from '../languages/types.js';
+/** Database packages — spec R1.1 */
+export declare const DB_PACKAGES: ReadonlySet<string>;
+/** Validator packages — spec R4.1 */
+export declare const VALIDATOR_PACKAGES: ReadonlySet<string>;
+/** Known DB type names — spec R1.1 (propagation rule 8) */
+export declare const DB_TYPES: ReadonlySet<string>;
+/** DB call methods — the fixed API surface (language-invariant) */
+export declare const DB_CALL_METHODS: ReadonlySet<string>;
+/** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
+export declare const ORM_METHODS: ReadonlySet<string>;
+export type ProvenanceReason = 'package' | 'binding' | 'type' | 'propagation' | 'fallback';
+export interface ProvenanceEvidence {
+    identifier: string;
+    reason: ProvenanceReason;
+    /** Human-readable source of provenance, e.g. "import from better-sqlite3" */
+    source: string;
+    /** Chain of propagation — each hop records the intermediate identifier */
+    chain: string[];
+}
+export type DetectionMode = 'hybrid' | 'provenance' | 'names';
+export interface DetectionConfig {
+    mode: DetectionMode;
+}
+export interface ProvenanceContext {
+    /** All DB-provenanced identifiers in the current file */
+    dbProvenanced: Map<string, ProvenanceEvidence>;
+    /** All validator-provenanced identifiers in the current file */
+    validatorProvenanced: Map<string, ProvenanceEvidence>;
+    /** Active detection mode */
+    mode: DetectionMode;
+}
+export interface InferredReceiverSet {
+    identifiers: string[];
+    evidence: Array<{
+        identifier: string;
+        reason: string;
+    }>;
+}
+/**
+ * Extract all DB-provenanced identifiers from a file's import statements.
+ *
+ * An import like `import Database from 'better-sqlite3'` produces
+ * `Database` as DB-provenanced with reason "package".
+ */
+export declare function extractDBProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
+/**
+ * Extract all validator-provenanced identifiers from a file's imports.
+ * Same pattern as extractDBProvenancedImports but for validator packages.
+ */
+export declare function extractValidatorProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
+/**
+ * Propagate provenance through assignments, destructuring, parameters,
+ * class fields, and type annotations within a single file.
+ *
+ * The 8 single-file propagation rules (spec R1):
+ *   1. new Expression → variable
+ *   2. DB-provenanced call return → variable
+ *   3. member expression on DB receiver → variable
+ *   4. object destructuring from DB source
+ *   5. array destructuring from DB source
+ *   6. default parameter with DB value
+ *   7. class field initialized with DB value
+ *   8. type annotation with known DB type
+ */
+export declare function propagateProvenance(ast: AST, adapter: LanguageAdapter, sourceCode: string, seedMap: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+export interface BuildProvenanceContextOptions {
+    mode: DetectionMode;
+    /** Name lists used in hybrid/names fallback modes */
+    dbReceiverNames?: string[];
+    dbBindingNames?: string[];
+    dbCallMethods?: string[];
+    /** Validator package list override (defaults to VALIDATOR_PACKAGES) */
+    validatorPackageList?: string[];
+}
+/**
+ * Build a ProvenanceContext for a file.
+ *
+ * This is the main entry point — call once per file before analysis.
+ * Combines import extraction, propagation, and mode-based fallback.
+ */
+export declare function buildProvenanceContext(ast: AST, adapter: LanguageAdapter, sourceCode: string, options: BuildProvenanceContextOptions): ProvenanceContext;
+/**
+ * Determine if a call-expression node's callee is DB-provenanced.
+ *
+ * This replaces the old `isDBCallee()` / `isDbCallNode()` name-based
+ * pattern matching in UniversalDataAccessAnalyzer.
+ *
+ * Checks:
+ *   1. Simple identifier call → is the identifier DB-provenanced?
+ *   2. Member expression call → is the receiver DB-provenanced AND is the
+ *      method in the DB call method set?
+ *   3. ORM patterns → receiver is DB-provenanced and method matches ORM API
+ */
+export declare function isDBProvenanced(node: ASTNode, adapter: LanguageAdapter, sourceCode: string, context: ProvenanceContext, dbCallMethods?: ReadonlySet<string>): boolean;
+/**
+ * Check if an identifier is validator-provenanced (R4 infrastructure).
+ *
+ * This will be consumed by Spec 15's validator-bypass detection.
+ */
+export declare function isValidatorProvenanced(identifier: string, context: ProvenanceContext): boolean;
+/**
+ * Infer additional DB receivers by tracing identifiers that call DB methods
+ * back through assignment chains to provenanced sources.
+ *
+ * This is the conjunctive inference guard in action: an identifier is only
+ * inferred if it (a) appears as a receiver of a known DB call method AND
+ * (b) can be traced back to a provenanced source through assignments.
+ *
+ * Deferred: full implementation in R2 step.
+ */
+export declare function inferReceivers(provenancedSet: Map<string, ProvenanceEvidence>, fileAst: AST, adapter: LanguageAdapter, sourceCode: string): InferredReceiverSet;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/analyzers/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/analyzers/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAM3E,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAiB1C,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAWvC,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAY9C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CA4B1C,CAAC;AAMH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,gEAAgE;IAChE,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAwBD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA6BjC;AAED;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA4BjC;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAgJjC;AA8UD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CA0CnB;AA8FD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,EAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAoCT;AAiID;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAET;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC/C,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,CAmDrB"}