code-auditor-mcp 4.1.1 → 5.0.1

package/dist/phase/schemaUsageCandidates.js

@@ -0,0 +1,165 @@
+/**
+ * Spec 70 Item 4 (step 3) — the per-file `schema-usage-candidates` producer.
+ *
+ * The extract half of the corpus `schema-usage` reduction. The legacy
+ * `schema-usage` producer ran `findTableReferences` — six strategies — then
+ * re-homed each `TableReference` to its enclosing function. Four of the six
+ * strategies are provenance-free (ORM, query-builder, collection-adapter, and the
+ * dead `.sql` arm); two (tagged-template, DB-call) need the cross-file
+ * `dbProvenanced` seed that only the `receiver-provenance` fixed point supplies.
+ * The collapse splits them the same way `query-site-candidates` did:
+ *
+ *   • the provenance-free references are extracted *and re-homed* here while the
+ *     AST lives (via `findClosestNodeAt` + `findEnclosingFunctionIdentity`, the
+ *     exact legacy re-home);
+ *   • the two provenance-dependent strategies emit raw candidates the corpus
+ *     producer re-admits (`identifyHandle` over `classifyBuildProvenance`'s
+ *     re-derived `dbProvenanced`) and re-homes via the projected `functions`
+ *     spans.
+ *
+ * `hasSqlTag` is the one gate input a corpus producer cannot re-derive (it scans
+ * source text). `sourceCode` travels with the fact so `parseSqlTables` can anchor
+ * each SQL string against it verbatim (its contract throws on a missing match).
+ */
+import { extractOrmRefs, extractQueryBuilderRefs, extractCollectionAdapterRefs, resolveQuerySql, receiverIsThisRootedLocal, extractEnclosingFunctionSpans, extractStringFragmentSpans, findClosestNodeAt, findEnclosingFunctionIdentity, getCallee, getTemplateText, getFirstStringArgument, getCallLocation, hasTemplateArgument, } from '../analyzers/universal/schema/codeAnalysis.js';
+import { getCallExpressionCallee, getMemberExpressionReceiver, extractMemberExpressionProperty, } from '../analyzers/provenance.js';
+import { resolveReceiverRoot } from '../analyzers/receiverRoot.js';
+import { DEFAULT_SCHEMA_CONFIG, SQL_TAG_NAMES } from '../analyzers/universal/schema/config.js';
+import { hasSqlTag } from '../analyzers/universal/schema/discovery.js';
+/** Re-home one provenance-free `TableReference` to a `SchemaUsageFact` — the exact
+ *  legacy re-home (`findClosestNodeAt` + `findEnclosingFunctionIdentity`). The
+ *  identity is never null for an adapter-backed file, so the `schema-file` arm is
+ *  unreachable here (it only served the dead `.sql` strategy). */
+function rehomeRef(ref, file) {
+    const node = findClosestNodeAt(file.ast.root, ref.location, file.adapter);
+    const identity = node ? findEnclosingFunctionIdentity(node, file.adapter, file.file) : null;
+    const functionName = identity == null
+        ? file.file.endsWith('.sql') || file.file.includes('/migrations/')
+            ? 'schema-file'
+            : 'top-level'
+        : identity.topLevel
+            ? 'top-level'
+            : identity.name;
+    return {
+        tableName: ref.table,
+        filePath: file.file,
+        functionName,
+        functionStartLine: identity?.startLine ?? null,
+        functionStartColumn: identity?.startColumn ?? null,
+        usageType: ref.type,
+        line: ref.location.line,
+        column: ref.location.column,
+        rawQuery: ref.context,
+        origin: ref.origin,
+    };
+}
+/**
+ * One file's un-gated schema-usage candidates.
+ *
+ * @param file - The parsed file whose schema-usage candidates are projected.
+ * @returns A one-element array carrying the candidates.
+ */
+export function extractSchemaUsageCandidates(file) {
+    const { ast, adapter, source } = file;
+    // The provenance-free references, extracted + re-homed now.
+    const ormRefs = extractOrmRefs(ast, adapter, source).map((ref) => rehomeRef(ref, file));
+    const queryBuilderRefs = extractQueryBuilderRefs(ast, adapter, source, {
+        config: DEFAULT_SCHEMA_CONFIG,
+    }).map((ref) => rehomeRef(ref, file));
+    const collectionAdapterRefs = extractCollectionAdapterRefs(ast, adapter, source).map((ref) => rehomeRef(ref, file));
+    // The enclosing-function spans the corpus producer re-homes against.
+    const functions = extractEnclosingFunctionSpans(ast, adapter);
+    // The string-fragment spans the corpus producer re-homes *top-level* references
+    // against (the deepest node `findClosestNodeAt` returns for a table name inside
+    // a SQL string is a `string_fragment`, whose start is the top-level coordinate).
+    const stringFragments = extractStringFragmentSpans(ast, adapter);
+    // Strategy (1) — tagged templates (`sql`SELECT …``). The tag-name gate mirrors
+    // `extractTaggedTemplateRefs`' predicate; the provenance-free tag is captured,
+    // and the corpus producer resolves the per-site dialect from the tag's package.
+    const sqlTags = DEFAULT_SCHEMA_CONFIG.sqlTagNames ?? [...SQL_TAG_NAMES];
+    const tagged = [];
+    for (const callNode of adapter.findNodes(ast, {
+        custom: (node) => {
+            if (node.type !== 'call_expression')
+                return false;
+            const callee = getCallee(node, adapter, source);
+            if (!callee || !sqlTags.includes(callee))
+                return false;
+            return hasTemplateArgument(node, adapter);
+        },
+    })) {
+        const templateText = getTemplateText(callNode, adapter, source);
+        if (!templateText)
+            continue;
+        tagged.push({ tagName: getCallee(callNode, adapter, source), templateText, location: getCallLocation(callNode) });
+    }
+    // Strategy (2) — DB-call patterns. Only the *structural* half of `dbCallVerdict`
+    // runs here (callee shape, method gate, root gate); the provenance-dependent
+    // admission (`identifyHandle`) is deferred to the corpus producer, which
+    // re-derives `dbProvenanced` and re-folds the verdict. Resolvable SQL is carried
+    // as `sqlText`; an unresolvable argument is carried as `unresolved` (Spec 70 1b)
+    // so the corpus-side reduction can re-admit the call and emit the
+    // `unresolved-query` diagnostic instead of silently dropping it.
+    const dbCalls = [];
+    for (const callNode of adapter.findNodes(ast, { type: 'call_expression' })) {
+        const callee = getCallExpressionCallee(callNode, adapter);
+        if (!callee)
+            continue;
+        if (callee.type === 'identifier') {
+            const name = adapter.getNodeText(callee, source);
+            if (!name)
+                continue;
+            const sqlArgument = getFirstStringArgument(callNode, adapter, source);
+            const resolved = resolveQuerySql(callNode, ast, adapter, source);
+            if (resolved.sqlText === null && resolved.unresolved === null)
+                continue;
+            dbCalls.push({
+                calleeType: 'identifier',
+                name,
+                sqlArgument,
+                sqlText: resolved.sqlText,
+                unresolved: resolved.unresolved,
+                location: getCallLocation(callNode),
+            });
+            continue;
+        }
+        if (callee.type !== 'member_expression' && callee.type !== 'selector_expression')
+            continue;
+        const method = extractMemberExpressionProperty(callee, adapter, source);
+        if (!method)
+            continue;
+        const root = resolveReceiverRoot(callee, adapter, source);
+        if (root === null)
+            continue;
+        const sqlArgument = getFirstStringArgument(callNode, adapter, source);
+        const resolved = resolveQuerySql(callNode, ast, adapter, source);
+        if (resolved.sqlText === null && resolved.unresolved === null)
+            continue;
+        dbCalls.push({
+            calleeType: 'member',
+            method,
+            root,
+            receiver: getMemberExpressionReceiver(callee, adapter, source),
+            thisField: receiverIsThisRootedLocal(callee, adapter),
+            sqlArgument,
+            sqlText: resolved.sqlText,
+            unresolved: resolved.unresolved,
+            location: getCallLocation(callNode),
+        });
+    }
+    return [
+        {
+            file: file.file,
+            sourceCode: source,
+            hasSqlTag: hasSqlTag(source, DEFAULT_SCHEMA_CONFIG),
+            functions,
+            stringFragments,
+            tagged,
+            dbCalls,
+            ormRefs,
+            queryBuilderRefs,
+            collectionAdapterRefs,
+        },
+    ];
+}
+//# sourceMappingURL=schemaUsageCandidates.js.map

package/dist/phase/schemaUsageCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaUsageCandidates.js","sourceRoot":"","sources":["../../src/phase/schemaUsageCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAWH,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,yBAAyB,EACzB,6BAA6B,EAC7B,0BAA0B,EAC1B,iBAAiB,EACjB,6BAA6B,EAC7B,SAAS,EACT,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,mBAAmB,GAEpB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,4CAA4C,CAAC;AAGvE;;;kEAGkE;AAClE,SAAS,SAAS,CAAC,GAAmB,EAAE,IAAa;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,YAAY,GAChB,QAAQ,IAAI,IAAI;QACd,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChE,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,WAAW;QACf,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACjB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,KAAK;QACpB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,YAAY;QACZ,iBAAiB,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI;QAC9C,mBAAmB,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI;QAClD,SAAS,EAAE,GAAG,CAAC,IAAI;QACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;QACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;QAC3B,QAAQ,EAAE,GAAG,CAAC,OAAO;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEtC,4DAA4D;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;QACrE,MAAM,EAAE,qBAAqB;KACO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3F,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CACrB,CAAC;IAEF,qEAAqE;IACrE,MAAM,SAAS,GAAuB,6BAA6B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAElF,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,eAAe,GAAyB,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEvF,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IACxE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,KAAK,CAAC;YAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvD,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC,EAAE,CAAC;QACH,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY;YAAE,SAAS;QAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,iFAAiF;IACjF,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,iFAAiF;IACjF,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;gBAAE,SAAS;YACxE,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,YAAY;gBACxB,IAAI;gBACJ,WAAW;gBACX,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB;YAAE,SAAS;QAC3F,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,UAAU,EAAE,QAAQ;YACpB,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,2BAA2B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;YAC9D,SAAS,EAAE,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACrD,WAAW;YACX,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC;YACnD,SAAS;YACT,eAAe;YACf,MAAM;YACN,OAAO;YACP,OAAO;YACP,gBAAgB;YAChB,qBAAqB;SACtB;KACF,CAAC;AACJ,CAAC"}

package/dist/phase/schemaValidations.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Spec 68 §3.2 — the `schema-validations` corpus processor.
+ *
+ * The legacy schema Stage-3 reducer called `analyzeJsonSchemas(jsonFiles,
+ * readJson, schemaConfig)` over the `.json` file set, where `readJson` parsed a
+ * file on demand. This processor re-homes that one call: it builds the file
+ * list from the `json-document` fact, re-derives the same `readJson` projection
+ * (`null` for a parse error, the literal `null`, or any non-object value), and
+ * calls the same `analyzeJsonSchemas` free function. The resulting violations
+ * — already `{ rule, file, line:1, column:1, severity, message }` — are
+ * projected onto the `SchemaValidationFact` shape, one element per violation.
+ *
+ * The validation logic is NOT re-homed here: `analyzeJsonSchemas` is already a
+ * module-level free function with no analyzer-class or pipeline dependency (it
+ * survives §15), so the processor imports it and stays byte-identical by
+ * construction. The 17 schema-json rules then filter this fact by rule id.
+ *
+ * Config: the corpus-processor interface does not thread config (like
+ * `mined-conventions`, it reads the shared default), so `DEFAULT_SCHEMA_CONFIG`
+ * is the sole source. The §10 config bridge is where a project's
+ * `schemaFilePatterns` / `schemaDataPairs` override reach the phase model; this
+ * slice keeps the config-free parity the legacy reducer had under its default.
+ */
+import type { SchemaAnalyzerConfig } from '../analyzers/universal/schema/types.js';
+import type { JsonDocumentFact, SchemaValidationFact } from './types.js';
+/**
+ * Reduce the `json-document` fact through the legacy validation free functions.
+ *
+ * @param documents - The parsed JSON documents to validate.
+ * @param config - The schema-json config (defaults to {@link DEFAULT_SCHEMA_CONFIG}).
+ * @returns One `SchemaValidationFact` per validation violation produced.
+ */
+export declare function buildSchemaValidations(documents: readonly JsonDocumentFact[], config?: SchemaAnalyzerConfig): SchemaValidationFact[];
+//# sourceMappingURL=schemaValidations.d.ts.map

package/dist/phase/schemaValidations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaValidations.d.ts","sourceRoot":"","sources":["../../src/phase/schemaValidations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,MAAM,GAAE,oBAA4C,GACnD,oBAAoB,EAAE,CAqBxB"}

package/dist/phase/schemaValidations.js

@@ -0,0 +1,53 @@
+/**
+ * Spec 68 §3.2 — the `schema-validations` corpus processor.
+ *
+ * The legacy schema Stage-3 reducer called `analyzeJsonSchemas(jsonFiles,
+ * readJson, schemaConfig)` over the `.json` file set, where `readJson` parsed a
+ * file on demand. This processor re-homes that one call: it builds the file
+ * list from the `json-document` fact, re-derives the same `readJson` projection
+ * (`null` for a parse error, the literal `null`, or any non-object value), and
+ * calls the same `analyzeJsonSchemas` free function. The resulting violations
+ * — already `{ rule, file, line:1, column:1, severity, message }` — are
+ * projected onto the `SchemaValidationFact` shape, one element per violation.
+ *
+ * The validation logic is NOT re-homed here: `analyzeJsonSchemas` is already a
+ * module-level free function with no analyzer-class or pipeline dependency (it
+ * survives §15), so the processor imports it and stays byte-identical by
+ * construction. The 17 schema-json rules then filter this fact by rule id.
+ *
+ * Config: the corpus-processor interface does not thread config (like
+ * `mined-conventions`, it reads the shared default), so `DEFAULT_SCHEMA_CONFIG`
+ * is the sole source. The §10 config bridge is where a project's
+ * `schemaFilePatterns` / `schemaDataPairs` override reach the phase model; this
+ * slice keeps the config-free parity the legacy reducer had under its default.
+ */
+import { analyzeJsonSchemas } from '../analyzers/universal/schema/jsonSchema.js';
+import { DEFAULT_SCHEMA_CONFIG } from '../analyzers/universal/schema/config.js';
+/**
+ * Reduce the `json-document` fact through the legacy validation free functions.
+ *
+ * @param documents - The parsed JSON documents to validate.
+ * @param config - The schema-json config (defaults to {@link DEFAULT_SCHEMA_CONFIG}).
+ * @returns One `SchemaValidationFact` per validation violation produced.
+ */
+export function buildSchemaValidations(documents, config = DEFAULT_SCHEMA_CONFIG) {
+    const files = documents.map((d) => d.file);
+    const jsonByFile = new Map(documents.map((d) => [d.file, d.json]));
+    // The exact `readJson` the legacy reducer built over `context.readSource`:
+    // `null` for an absent file, a parse error, the literal `null`, or any
+    // non-object value — an array/string/number/boolean document reads back null.
+    const readJson = (filePath) => {
+        const json = jsonByFile.get(filePath) ?? null;
+        return json !== null && typeof json === 'object' ? json : null;
+    };
+    const result = analyzeJsonSchemas(files, readJson, config);
+    return result.violations.map((v) => ({
+        rule: v.rule,
+        file: v.file,
+        line: v.line ?? 1,
+        column: v.column ?? 1,
+        severity: v.severity,
+        message: v.message,
+    }));
+}
+//# sourceMappingURL=schemaValidations.js.map

package/dist/phase/schemaValidations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaValidations.js","sourceRoot":"","sources":["../../src/phase/schemaValidations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAIhF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAsC,EACtC,SAA+B,qBAAqB;IAEpD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAiB,EAAE;QACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC9C,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC;QACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/phase/secretCandidates.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Spec 68 §3.2 — the per-file `secret-candidates` producer.
+ *
+ * Projects the credential-position strings a source file holds onto the
+ * serializable `SecretCandidate` fact. It re-homes the *extraction* half of
+ * `UniversalSecretsAnalyzer` — `inspectNode`'s four cases and the AST-dependent
+ * helpers it used (`stringValue`, `directStringChild`, `declaratorName`,
+ * `assignmentKey`, `pairKeyAndValue`) — while leaving the *classification*
+ * (`isSecretName`, `looksLikeRealSecret`, `isCredentialSelector`,
+ * `isTestOrFixtureFile`) to the rule. The producer only projects what the AST
+ * makes reachable: a candidate's name/key/args plus the enclosing node's start
+ * position (the legacy analyzer anchored at the enclosing node, not the string).
+ *
+ * A `call` candidate carries the sibling string-argument *values* (not nodes) so
+ * the rule can re-run the selector/secret split `checkCredentialCall` did. The
+ * producer emits a call candidate only when the call has ≥2 string arguments
+ * (the legacy early-return), but does not apply `isCredentialSelector` — that is
+ * the rule's pure decision over the extracted text.
+ */
+import type { AstFile, SecretCandidate } from './types.js';
+/**
+ * One file's credential-position strings as `SecretCandidate[]`.
+ *
+ * @param file - The parsed file whose credential-position strings are projected.
+ * @returns The file's candidate secret strings with their positions.
+ */
+export declare function extractSecretCandidates(file: AstFile): SecretCandidate[];
+//# sourceMappingURL=secretCandidates.d.ts.map

package/dist/phase/secretCandidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretCandidates.d.ts","sourceRoot":"","sources":["../../src/phase/secretCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAkH3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CAOxE"}

package/dist/phase/secretCandidates.js

@@ -0,0 +1,132 @@
+/**
+ * Spec 68 §3.2 — the per-file `secret-candidates` producer.
+ *
+ * Projects the credential-position strings a source file holds onto the
+ * serializable `SecretCandidate` fact. It re-homes the *extraction* half of
+ * `UniversalSecretsAnalyzer` — `inspectNode`'s four cases and the AST-dependent
+ * helpers it used (`stringValue`, `directStringChild`, `declaratorName`,
+ * `assignmentKey`, `pairKeyAndValue`) — while leaving the *classification*
+ * (`isSecretName`, `looksLikeRealSecret`, `isCredentialSelector`,
+ * `isTestOrFixtureFile`) to the rule. The producer only projects what the AST
+ * makes reachable: a candidate's name/key/args plus the enclosing node's start
+ * position (the legacy analyzer anchored at the enclosing node, not the string).
+ *
+ * A `call` candidate carries the sibling string-argument *values* (not nodes) so
+ * the rule can re-run the selector/secret split `checkCredentialCall` did. The
+ * producer emits a call candidate only when the call has ≥2 string arguments
+ * (the legacy early-return), but does not apply `isCredentialSelector` — that is
+ * the rule's pure decision over the extracted text.
+ */
+import { walkAST } from '../languages/adapterBridge.js';
+/** Extract the raw text of a `string` literal, preferring the `string_fragment`
+ *  child (content without quotes) and falling back to stripping delimiters. */
+function stringValue(node, adapter, sourceCode) {
+    const frag = node.children?.find((c) => c.type === 'string_fragment');
+    if (frag)
+        return adapter.getNodeText(frag, sourceCode);
+    let text = adapter.getNodeText(node, sourceCode).trim();
+    if ((text.startsWith("'") && text.endsWith("'")) ||
+        (text.startsWith('"') && text.endsWith('"')) ||
+        (text.startsWith('`') && text.endsWith('`'))) {
+        text = text.slice(1, -1);
+    }
+    return text;
+}
+/** Find a direct `string` child (the literal value), not a nested one. */
+function directStringChild(node, adapter, sourceCode) {
+    for (const c of node.children ?? []) {
+        if (c.type === 'string')
+            return stringValue(c, adapter, sourceCode);
+    }
+    return null;
+}
+/** Extract the variable name from a `variable_declarator`. */
+function declaratorName(node, adapter, sourceCode) {
+    const name = node.children?.find((c) => c.type === 'identifier');
+    return name ? adapter.getNodeText(name, sourceCode) : null;
+}
+/** Extract the assigned field name from an `assignment_expression` left side. */
+function assignmentKey(node, adapter, sourceCode) {
+    const left = node.children?.find((c) => c.type === 'member_expression' || c.type === 'subscript_expression' || c.type === 'identifier');
+    if (!left)
+        return null;
+    if (left.type === 'member_expression') {
+        const prop = left.children?.find((c) => c.type === 'property_identifier');
+        return prop ? adapter.getNodeText(prop, sourceCode) : null;
+    }
+    if (left.type === 'subscript_expression') {
+        const key = left.children?.find((c) => c.type === 'string');
+        return key ? stringValue(key, adapter, sourceCode) : null;
+    }
+    return adapter.getNodeText(left, sourceCode);
+}
+/** Extract `{ key, value }` from an object `pair` node. */
+function pairKeyAndValue(node, adapter, sourceCode) {
+    const strings = (node.children ?? []).filter((c) => c.type === 'string');
+    if (strings.length === 0)
+        return null;
+    const keyNode = node.children?.find((c) => c.type === 'property_identifier') ?? strings[0];
+    const valueNode = strings[strings.length - 1];
+    if (valueNode === keyNode && strings.length < 2)
+        return null;
+    const key = keyNode.type === 'property_identifier'
+        ? adapter.getNodeText(keyNode, sourceCode)
+        : stringValue(keyNode, adapter, sourceCode);
+    const value = stringValue(valueNode, adapter, sourceCode);
+    return { key, value };
+}
+/** Project one node onto a candidate, or `null` when it is not a credential
+ *  position (or has no string value to carry). */
+function candidateFor(node, adapter, sourceCode, filePath) {
+    const loc = { file: filePath, line: node.location.start.line, column: node.location.start.column };
+    // 1. `const <name> = '<value>'`
+    if (node.type === 'variable_declarator') {
+        const name = declaratorName(node, adapter, sourceCode);
+        const value = directStringChild(node, adapter, sourceCode);
+        if (name && value !== null)
+            return { position: 'declarator', name, value, ...loc };
+        return null;
+    }
+    // 2. `<obj>.<field> = '<value>'` / `<field> = '<value>'`
+    if (node.type === 'assignment_expression') {
+        const key = assignmentKey(node, adapter, sourceCode);
+        const value = directStringChild(node, adapter, sourceCode);
+        if (key && value !== null)
+            return { position: 'assignment', name: key, value, ...loc };
+        return null;
+    }
+    // 3. `{ <key>: '<value>' }`
+    if (node.type === 'pair') {
+        const pv = pairKeyAndValue(node, adapter, sourceCode);
+        if (pv)
+            return { position: 'pair', name: pv.key, value: pv.value, ...loc };
+        return null;
+    }
+    // 4. `fn('<selector>', '<secret>')` — a call with ≥2 string arguments.
+    if (node.type === 'call_expression') {
+        const argsNode = node.children?.find((c) => c.type === 'arguments');
+        if (!argsNode)
+            return null;
+        const stringArgs = (argsNode.children ?? []).filter((c) => c.type === 'string');
+        if (stringArgs.length < 2)
+            return null;
+        return { position: 'call', args: stringArgs.map((a) => stringValue(a, adapter, sourceCode)), ...loc };
+    }
+    return null;
+}
+/**
+ * One file's credential-position strings as `SecretCandidate[]`.
+ *
+ * @param file - The parsed file whose credential-position strings are projected.
+ * @returns The file's candidate secret strings with their positions.
+ */
+export function extractSecretCandidates(file) {
+    const out = [];
+    walkAST(file.ast.root, (node) => {
+        const candidate = candidateFor(node, file.adapter, file.source, file.file);
+        if (candidate)
+            out.push(candidate);
+    });
+    return out;
+}
+//# sourceMappingURL=secretCandidates.js.map

package/dist/phase/secretCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretCandidates.js","sourceRoot":"","sources":["../../src/phase/secretCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAGxD;+EAC+E;AAC/E,SAAS,WAAW,CAAC,IAAa,EAAE,OAAwB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACtE,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,IAAa,EAAE,OAAwB,EAAE,UAAkB;IACpF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,SAAS,cAAc,CAAC,IAAa,EAAE,OAAwB,EAAE,UAAkB;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAa,EAAE,OAAwB,EAAE,UAAkB;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CACtG,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CACtB,IAAa,EACb,OAAwB,EACxB,UAAkB;IAElB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,qBAAqB;QAChD,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC;QAC1C,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;kDACkD;AAClD,SAAS,YAAY,CACnB,IAAa,EACb,OAAwB,EACxB,UAAkB,EAClB,QAAgB;IAEhB,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnG,gCAAgC;IAChC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,GAAG,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;IACxG,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/phase/securityCandidates.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Spec 68 §3.2 — the per-file `security-candidates` producer.
+ *
+ * Projects the three single-file security constructs (Spec 61 R6) onto the
+ * serializable `SecurityCandidate` fact. It re-homes the *structural* half of
+ * `UniversalSecurityAnalyzer` — the AST walk that decides whether a shell call's
+ * command is interpolated/concatenated, whether a require/import specifier is
+ * computed, and whether a template substitution reaches an HTML sink unescaped —
+ * while leaving the *pure-text* classification (`isConfigPath`, the
+ * test/fixture skip) and the finding construction (message/resolution/severity)
+ * to the rule.
+ *
+ * The producer never decides "is this a finding": it projects the positional
+ * context and the resolved name/prop, exactly as `secretCandidates.ts` does for
+ * `secret-candidates`. For `unescaped-html` the producer re-homes the full
+ * three-phase sink-flow analysis (`collectLocalFlow` → `collectSinkRoots` →
+ * `propagateSinkFlow`) and the per-substitution resolution of the interpolated
+ * member access; the rule's only job is to skip test/fixture files and assemble
+ * the message/resolution.
+ */
+import type { AstFile, SecurityCandidate } from './types.js';
+/**
+ * One file's security constructs as `SecurityCandidate[]`.
+ *
+ * @param file - The parsed file whose security constructs are projected.
+ * @returns The file's command-injection, dynamic-require, and HTML-sink candidates.
+ */
+export declare function extractSecurityCandidates(file: AstFile): SecurityCandidate[];
+//# sourceMappingURL=securityCandidates.d.ts.map

package/dist/phase/securityCandidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityCandidates.d.ts","sourceRoot":"","sources":["../../src/phase/securityCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA4a7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,CAqB5E"}