code-auditor-mcp 4.1.0 → 5.0.1

package/dist/phase/rules/crossDomain.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Spec 68 §3.2 — the cross-domain lifecycle rules, migrated to `analyze(ctx)`.
+ *
+ * Two of the five `cross-domain` rules are a clean reduction over the
+ * `schema-usage` fact: `written-never-read` and `read-never-written`. Both ask
+ * "is this table used on one side of the read/write lifecycle but not the
+ * other?" — a pure set-difference over the table names in the fact, with the
+ * one-sided detector anchored to a single row per table. Their violation logic
+ * is re-homed verbatim from `CrossDomainAnalyzer`'s `detectWrittenNeverRead` /
+ * `detectReadNeverWritten` (and its `nonQueryBuilderTableFilter` /
+ * `usageIdentityLabel` helpers), which were SQL-over-`schema_usage` queries with
+ * no other input.
+ *
+ * The facade-origin exclusion is the one subtlety: a table whose *every* row
+ * carries a facade `origin` (`query-builder` for a fluent knex-style builder, or
+ * `collection-adapter` for a `SqliteCollectionAdapter` binding) is accessed
+ * through a facade whose read/write methods the extractor does not record — not
+ * a one-sided lifecycle defect — so both detectors skip it. The read/write
+ * *sets* themselves are computed regardless of origin, which is what lets a
+ * query-builder read balance a raw-SQL create (cp_test). The filter is
+ * therefore: a table participates only if it has at least one non-facade row.
+ * (`collection-adapter` is the `whitelist`-table false positive: the extractor
+ * records only the constructor's `select` binding — `new SqliteCollectionAdapter(db,
+ * 'whitelist')` — and none of the facade's interpolated `INSERT`/`UPDATE`, so a
+ * facade-only table read as read-never-written.)
+ *
+ * The anchor line is the first row after sorting, which reproduces the legacy
+ * SQL's `SELECT DISTINCT … ORDER BY table_name, file_path` exactly. SQLite sorts
+ * a `DISTINCT` result by the ORDER BY columns first, then the remaining SELECT
+ * columns in REVERSE order, so the full key is (table_name, file_path,
+ * usage_type, line, function_start_column, function_start_line, function_name)
+ * with NULLs first. That reverse-column tiebreak is load-bearing: the composite
+ * data-access fixture writes `users` with INSERT/UPDATE/DELETE/INSERT/UPDATE,
+ * and the DELETE (not the first INSERT) is the anchor.
+ *
+ * Also here: `multi-table-write` (transaction-boundary risk) — migrated on top
+ * of two further facts, `call-graph` (the `functions` + `graph_cache` identity
+ * projection, read from the index) and `batch-functions` (the per-file AST
+ * projection of the legacy `.batch(` re-parse). Its `analyze(ctx)` reproduces
+ * the legacy `detectTransactionBoundaryRisk` / `groupWriterTables` /
+ * `expandWrittenTables` / `flagTransactionBoundaryWrites` verbatim over those
+ * facts.
+ *
+ * Also here: `no-validator-reachable` (validation bypass) — migrated on top of
+ * the `call-graph` fact (widened with the `functions` table's `used_imports` /
+ * `is_exported` columns for validator provenance) plus `schema-usage`. Its
+ * `analyze(ctx)` reproduces the legacy `detectValidationBypass` /
+ * `buildValidatorIds` / `bfsReachesValidator` / `computeWriterCoverage` /
+ * `groupWritersByDirectory` / `flagUnvalidatedWriters` verbatim over those
+ * facts, reading the opt-in `validatorBypass` thresholds (validators, modeShare,
+ * minCorpus, depth) from `ctx.thresholds`.
+ *
+ * Also here: `uncovered-risk` (coverage by importance) — migrated on top of the
+ * widened `call-graph` (now carrying `lineNumber`), the `hotspot` fact, and the
+ * `coverage` fact. Its `analyze(ctx)` reproduces the legacy `detectUncoveredRisk`
+ * / `detectMeasuredUncovered` / `detectStaticReachUncovered` /
+ * `queryHighRiskFunctions` / `getUntestedTopDecile` / `computeTestReachableIds`
+ * verbatim over those facts, reading the opt-in `coverage` thresholds
+ * (topRiskDecile, testGlobs, staticReachDepth) from `ctx.thresholds`. Both
+ * `no-validator-reachable` and `uncovered-risk` gate on the opt-in config key
+ * being present, exactly as the legacy `runDetectors` did (`if (bypass)` /
+ * `if (coverage)`).
+ */
+import type { RuleDefinition } from '../types.js';
+/** The shared declaration for the TS cross-domain rules in this slice. */
+type CrossDomainNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage'];
+};
+/** The declared inputs of `multi-table-write`: schema writes + call graph +
+ *  batch-function spans. */
+type MultiTableWriteNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage', 'call-graph', 'batch-functions'];
+};
+/** The declared inputs of `no-validator-reachable`: schema writes + the
+ *  (widened) call graph for validator provenance + BFS reach. */
+type ValidatorReachNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage', 'call-graph'];
+};
+/** The declared inputs of `uncovered-risk`: the (widened) call graph + hotspot
+ *  scores + coverage data — the ranking and both coverage paths' inputs. */
+type UncoveredRiskNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['call-graph', 'hotspot', 'coverage'];
+};
+/** The two TypeScript cross-domain rules this slice migrates, in registry order. */
+export declare const crossDomainRules: readonly RuleDefinition<CrossDomainNeeds>[];
+/** `multi-table-write` — the index-backed sibling (call-graph + batch-functions
+ *  facts) registered alongside `crossDomainRules` but typed separately. */
+export declare const multiTableWriteRule: RuleDefinition<MultiTableWriteNeeds>;
+/** `no-validator-reachable` — the validation-bypass sibling (call-graph
+ *  validator provenance + BFS reach) registered alongside the other
+ *  cross-domain rules but typed separately. */
+export declare const noValidatorReachableRule: RuleDefinition<ValidatorReachNeeds>;
+/** `uncovered-risk` — the coverage-by-importance sibling (call-graph + hotspot +
+ *  coverage facts) registered alongside the other cross-domain rules but typed
+ *  separately. */
+export declare const uncoveredRiskRule: RuleDefinition<UncoveredRiskNeeds>;
+export {};
+//# sourceMappingURL=crossDomain.d.ts.map

package/dist/phase/rules/crossDomain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossDomain.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/crossDomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAyF,MAAM,aAAa,CAAC;AAIzI,0EAA0E;AAC1E,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;CAC3C,CAAC;AAEF;4BAC4B;AAC5B,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;CAC5E,CAAC;AAEF;iEACiE;AACjE,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;CACzD,CAAC;AAEF;4EAC4E;AAC5E,KAAK,kBAAkB,GAAG;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;CAChE,CAAC;AA++BF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,CAAC,gBAAgB,CAAC,EAGvE,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,oBAAoB,CAAmB,CAAC;AAEzF;;+CAE+C;AAC/C,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,mBAAmB,CAAwB,CAAC;AAElG;;kBAEkB;AAClB,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,kBAAkB,CAAiB,CAAC"}