code-auditor-mcp 4.1.1 → 5.0.1

package/dist/analyzers/universal/UniversalDataAccessAnalyzer.d.ts

@@ -3,10 +3,14 @@
  * Works across multiple programming languages using the adapter pattern
  * Analyzes database access patterns and data layer interactions
  */
-import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
-import type { Violation } from '../../types.js';
-import type { AST, LanguageAdapter } from '../../languages/types.js';
-import { type DetectionMode } from '../provenance.js';
+import type { AST, LanguageAdapter, ASTNode, DynamicPart } from '../../languages/types.js';
+import { type ProvenanceContext, type DetectionMode } from '../provenance.js';
+import { type HandleVerdict } from '../handleIdentification.js';
+import { type RootResolutionEnv } from '../receiverRoot.js';
+import { type GoResolutionEnv } from '../../languages/go/goResolution.js';
+import type { ResolvedWhere, DataAccessCallCandidate, LoopQueryRawCandidate } from '../../phase/types.js';
+import type { Dialect } from '../../mcp-tools/discoveryQueries.js';
+import type { AST as SqlAst } from 'node-sql-parser';
 /**
  * Configuration for Data Access analyzer
  */
@@ -17,14 +21,6 @@ export interface DataAccessAnalyzerConfig {
      *  from test files. Defaults true; set false to analyze test files (used by
      *  the oracle fixtures, which assert positive loop-query detections). */
     skipTestFiles?: boolean;
-    databases?: {
-        [key: string]: {
-            name: string;
-            importPatterns: string[];
-            queryPatterns: string[];
-            ormPatterns?: string[];
-        };
-    };
     organizationPatterns?: string[];
     orgFilterTables?: string[];
     orgFilterColumns?: string[];
@@ -40,7 +36,6 @@ export interface DataAccessAnalyzerConfig {
     }>;
     tablePatterns?: {
         orm?: RegExp[];
-        sql?: RegExp[];
         queryBuilder?: RegExp[];
     };
     performanceThresholds?: {
@@ -56,18 +51,27 @@ export interface DataAccessAnalyzerConfig {
      *  These functions accept a SQL template + bind params array — same pattern as
      *  .prepare().bind() but expressed as a simple function call rather than a method chain. */
     dbWrapperNames?: string[];
-    /** DB receiver variable names for provenance detection (e.g. db, database, sql, stmt).
-     *  Defaults to the same canonical list as the schema analyzer (DB_RECEIVER_NAMES),
-     *  but lives in THIS analyzer's namespace so the two never share config keys. */
-    dbReceiverNames?: string[];
-    /** DB call method names for provenance detection (e.g. exec, prepare, batch, run, all, first). */
-    dbCallMethods?: string[];
     /** DB binding names for provenance detection (e.g. env.DB — Cloudflare D1 bindings). */
     dbBindingNames?: string[];
+    /** Tagged-template tag names that denote raw SQL (e.g. `sql`, `db`) — the
+     *  `sql\`…\`` / `db\`…\`` Drizzle idiom. Recognized by *name*, independent of
+     *  provenance, so a tag whose receiver is an unresolved local wrapper is not
+     *  invisible to the data-access rules. Defaults to SQL_TAG_NAMES. */
+    sqlTagNames?: string[];
     /** Provenance detection mode: 'hybrid' | 'provenance' | 'names'. */
     detection?: {
         mode: DetectionMode;
     };
+    /**
+     * Spec 70 R1 — the corpus's named SQL dialect, or null when undetermined.
+     * SQL-content facts (tables, filter, write-verb, tenant predicate) are derived
+     * from a parsed SQL AST; when the dialect is null the argument cannot be parsed
+     * and those facts `cannot-fire` (empty / false) rather than falling back to a
+     * regex over text. ORM-shape table extraction (`.from('users')`, Kysely verbs,
+     * Drizzle `db.<table>.<method>()`) is host-language shape, not SQL, and does
+     * not consult this field.
+     */
+    dialect?: Dialect | null;
     /** SQL sanitizer function names — interpolation wrapped in one of these
      *  (e.g. escapeSql(x)) is not raw.  Kept in sync with the provenance system's
      *  dbWrapperNames: any list the detector learns about, the FP guards must also consult. */
@@ -76,7 +80,9 @@ export interface DataAccessAnalyzerConfig {
 export declare const DEFAULT_DATA_ACCESS_CONFIG: DataAccessAnalyzerConfig;
 export interface DatabaseCall {
     type: string;
-    method: string;
+    /** The resolved method/property name, or null when the callee shape cannot be
+     *  walked to a name (no method name — never a guessed one). */
+    method: string | null;
     file: string;
     line: number;
     column: number;
@@ -91,6 +97,16 @@ export interface DatabaseCall {
      *  broader than the tenant-isolation org filter, used for the performance
      *  `unfiltered-query` rule. */
     hasFilter: boolean;
+    /** Spec 70 R2 — AST-derived SQL facts, parsed from the call's static SQL
+     *  argument. Each is absent (false / empty / null) when the corpus named no
+     *  dialect or the argument failed to parse: that is `cannot-fire`, not a
+     *  negative verdict. */
+    isWrite: boolean;
+    isMassWrite: boolean;
+    isUpsert: boolean;
+    isRawInsert: boolean;
+    insertColumns: string[] | null;
+    sqlWhereColumns: string[] | null;
     hasParameterizedQuery: boolean;
     hasSqlInjectionRisk: boolean;
     /** True when the injection risk is defended (manual quote-escaping) rather
@@ -98,41 +114,263 @@ export interface DatabaseCall {
     sqlEscaped: boolean;
     /** Enclosing function name for stable fingerprinting (Spec 18 Gap 2). */
     enclosingFunction?: string;
+    /** Spec 69 R3 — the resolved WHERE predicate when the `.where(...)` spreads a
+     *  local array binding (`and(...conditions)`); null/undefined otherwise. */
+    resolvedWhere?: ResolvedWhere;
+    /** Spec 70 R1.2 — the handle verdict from `identifyHandle` (`handle` with its
+     *  `via`, or `unproven` with its reason). Present only when the call was
+     *  admitted through handle identification; absent for shape-only / ORM /
+     *  tagged-template / variable-assignment candidates. A `not-handle` site is
+     *  rejected at admission and never reaches a DatabaseCall. */
+    handleVerdict?: HandleVerdict;
 }
 /**
- * Extract the set of table names referenced in a SQL/ORM fragment, via the
- * configured `tablePatterns` plus the `.from(...)` / `db.<table>.<method>()`
- * ORM shapes. SQL keywords and aggregates captured in passing are filtered out.
+ * Per-file analysis context threaded through the data-access helper chain.
+ * Bundles `adapter` / `sourceCode` / `config` / `provenanceContext` into one
+ * object so the helpers that previously took 5–6 positional params
+ * (buildDatabaseCall, extractDatabaseCalls, checkQuerySecurity, …) clear the
+ * 4-parameter gate without each defining its own bespoke context type.
  */
-export declare function extractTables(text: string, config: DataAccessAnalyzerConfig): string[];
+interface DataAccessScanContext {
+    adapter: LanguageAdapter;
+    sourceCode: string;
+    config: DataAccessAnalyzerConfig;
+    /** The parsed file AST — `handleCallSiteIdentity` reads it to resolve the
+     *  enclosing class's base-class field types (Spec 70 Q3 heritage). */
+    ast: AST;
+    provenanceContext?: ProvenanceContext;
+    /** Per-file TypeScript binding environment `identifyHandle` reads for
+     *  declaration resolution. Built once per file; absent for Go / non-code. */
+    handleEnv?: RootResolutionEnv;
+    /** Per-file Go binding environment `identifyHandle` reads for Go declaration
+     *  resolution. Built once per file; absent for TS / non-code. */
+    goEnv?: GoResolutionEnv;
+}
 /**
- * True when a SQL statement carries a write verb (INSERT/DELETE/UPDATE/REPLACE).
- * Spec 52 R2: `REPLACE INTO` is an upsert write — matched as a two-word clause
- * (not a bare `REPLACE` word) so the `REPLACE()` string function is not misread
- * as a write.
+ * Spec 68 Thing 2 (#312) — the query-builder shape test.
+ *
+ * Answers "is this a DB query?" structurally, from the call's own grammar,
+ * instead of by the receiver's name. A chain that shapes like a Drizzle/Kysely
+ * builder or a Prisma CRUD call is a query regardless of whether its receiver
+ * is named `db`, `appDb`, `tx`, or `prisma`. This replaces the receiver-name
+ * blind spot (`DB_RECEIVER_NAMES`) without growing the name list — the raw-SQL
+ * path (`db.exec(sql)`) still relies on receiver/import provenance because it
+ * has no chain grammar to lean on.
+ *
+ * Two admitting conditions, union (not intersection):
+ *   1. verb + companion chain grammar — {@link hasChainCompanion};
+ *   2. Prisma object form — {@link isPrismaObjectForm}.
+ *
+ * A third admitter — catalog-resolved argument (a bare `.from(table)` /
+ * `.query(table)` whose verb argument resolves to a `resolution` table) —
+ * was evaluated and REJECTED. The residual gap after admitter 1+2 contains no
+ * such chain: the real misses are *variable-split* builders (the companion verb
+ * lives in a prior statement, e.g. `const q = baseQuery.where(…)`), which
+ * catalog resolution does not address. Gating on an under-discovered catalog
+ * would just rebuild the receiver-name failure one layer up. See the
+ * extraction-completeness gate (scripts/verify-extraction-completeness.ts) for
+ * the pinned residual.
+ *
+ * @param node the candidate call node to classify
+ * @param adapter the language adapter used to read the callee
+ * @param sourceCode the file source text for reading callee text
+ * @returns true when the call is query-builder shaped (chain companion or Prisma object form)
  */
-export declare function hasWriteVerb(text: string): boolean;
+export declare function isQueryBuilderShape(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
+/** The explicit lowercased column list of a raw-SQL INSERT/REPLACE, or null for
+ *  a positional INSERT (`INSERT INTO t VALUES (…)`, no column list). Mirrors
+ *  sqlAst's `insertColumns` but preserves the null-vs-empty distinction the
+ *  tenant-predicate rule needs.
+ * @param sqlAst - The parsed SQL statement to read the column list from.
+ * @returns The lowercased explicit column list, or `null` for a positional
+ *   insert or a non-INSERT/REPLACE statement. */
+export declare function rawInsertColumnsFromAst(sqlAst: SqlAst): string[] | null;
+/** The Kysely builder write verb carried as a camelCase method name — a
+ *  host-language chain shape, not SQL.  `selectFrom`/`selectAll` are reads.
+ *  Read from the callee's member chain, not the source text: a `.insertInto(…)`
+ *  inside a string argument (`db.raw(".insertInto(x)")`) is not a chain member.
+ *
+ * @param node the candidate call-expression node
+ * @param adapter the language adapter used to read the member chain
+ * @param sourceCode the file source text for reading node text
+ * @returns the Kysely write verb, or null when the chain is not a write */
+export declare function builderWriteVerb(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): 'insert' | 'update' | 'delete' | null;
+/** True when an ORM chain carries a row-limiting shape (`.where(...)`, `.having(...)`,
+ *  `.limit(...)`, `.andWhere(...)`, `.orWhere(...)`) — the host-language analog of
+ *  SQL's WHERE/HAVING/LIMIT that the AST walk cannot see because there is no SQL.
+ *  Read from the member chain, not the source text: a `.where(…)` inside a string
+ *  argument is a string, not a chain member.
+ *
+ * @param node the candidate call-expression node
+ * @param adapter the language adapter used to read the member chain
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the chain carries a row-limiting shape */
+export declare function hasOrmFilterShape(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
 /**
- * Universal data access analyzer.
+ * True when a member_expression is the `Promise.all` global, not a D1 `.all()`
+ * call. `hasEagerMethodInCallChain` walks up an argument chain, so a
+ * `Promise.all([db.prepare(x).bind(y)])` would otherwise mistake `Promise.all`'s
+ * "all" property for the eager D1 read method (Spec 52 R1). `Promise` is the
+ * only collision in the eager set — none of run/first/raw/exec/batch are
+ * Promise methods.
+ *
+ * @param memberExpr the member-expression node to classify
+ * @param adapter the language adapter used to read the member property
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the member is the global `Promise.all`
  */
-export declare class UniversalDataAccessAnalyzer extends UniversalAnalyzer {
-    readonly name = "data-access";
-    readonly description = "Analyzes database access patterns and data layer interactions";
-    readonly category = "security";
-    protected analyzeAST(ast: AST, adapter: LanguageAdapter, config: DataAccessAnalyzerConfig, sourceCode: string): Promise<Violation[]>;
-    /**
-     * Spec 62 Amendment B — run the full data-access scan and return BOTH the
-     * violations and the extracted query facts (`DatabaseCall[]`). The pipeline's
-     * data-access visitor emits the calls as facts for the Stage-4
-     * `missing-org-filter` derived reducer to join against the declared + DDL
-     * tenant tiers; the remaining rules (sql-injection, loop-query,
-     * unfiltered-query, hardcoded-connection, complex-query) fire here at Stage 2
-     * exactly as before. Emitting the calls as a by-product of this one scan
-     * avoids a second traversal or re-parse.
-     */
-    analyzeWithFacts(ast: AST, adapter: LanguageAdapter, config: DataAccessAnalyzerConfig, sourceCode: string): Promise<{
-        violations: Violation[];
-        calls: DatabaseCall[];
-    }>;
+export declare function isPromiseAllMember(memberExpr: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
+/**
+ * Check the two-statement prepare→bind pattern: db.prepare() is assigned to
+ * a variable whose value is later .bind()'ed in the same function scope.
+ *
+ *   const stmt = db.prepare(sql);
+ *   const result = stmt.bind(x).all();
+ *
+ * The direct-chain check (isInPrepareBindChain Step 3) only catches the
+ * single-expression form `db.prepare(sql).bind(x).all()`.  This method
+ * catches the common idiom where the prepared statement is stored in a local
+ * before being bound.
+ *
+ * @param prepareCall the `db.prepare(...)` call-expression node
+ * @param adapter the language adapter used to read the parent assignment
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the prepare result is stored then `.bind()`ed in scope
+ */
+export declare function isPrepareAssignedToVariable(prepareCall: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
+/**
+ * Extract the set of table names referenced by the ORM chain shapes — read
+ * structurally from the callee chain ({@link collectOrmTableReferences}) plus
+ * the user-configured `orm` table patterns. This is the host-language shape
+ * detector only; SQL relations are derived structurally by sqlAst's
+ * `extractTableNames`, not here (Spec 70 R2 site #1). The default `orm` patterns
+ * carry only the non-structural `table: 'users'` / `table = "users"` shape; the
+ * `.from(x)` / join / Kysely-verb shapes that used to live there as regexes are
+ * now read structurally, so a `.from(…)` inside a string argument is not a table.
+ * @param node The ORM/query-builder candidate node.
+ * @param adapter The language adapter (drives node traversal).
+ * @param sourceCode The file source text.
+ * @param config The data-access analyzer config holding table patterns.
+ * @returns The set of table names referenced by ORM shapes.
+ */
+export declare function extractOrmTables(node: ASTNode, adapter: LanguageAdapter, sourceCode: string, config: DataAccessAnalyzerConfig): string[];
+/**
+ * True when a single dynamic interpolation part is provably safe — via a
+ * config-driven sanitizer allowlist, the adapter's cross-function safety
+ * analysis, or a static-constant resolution for bare identifiers.  Otherwise
+ * the part counts as unresolved (a candidate injection).
+ *
+ * @param part the dynamic interpolation part to classify
+ * @param ast the file's parsed AST
+ * @param scan the data-access scan context (adapter, source, config)
+ * @returns true when the part is provably safe, false when unresolved
+ */
+export declare function isSafeDynamicPart(part: DynamicPart, ast: AST, scan: DataAccessScanContext): boolean;
+/**
+ * One loop-query candidate: a loop whose body issues a DB call, with every
+ * signal the finding needs pre-computed. The `loop-queries` producer projects
+ * this into its fact; the legacy `checkLoopQueries` maps it to a violation.
+ */
+export interface LoopQueryCandidate {
+    file: string;
+    line: number;
+    column: number;
+    symbol: string;
+    loopLine: number;
+    depth: number;
 }
+/**
+ * True when `name` is a parameter of `fnNode` whose type annotation names a
+ * prepared-statement type. The type is the signal (mirroring how a local
+ * declarator's `.prepare()` initializer is), never the parameter's name: a
+ * `*Statement`/`*Statements` annotation means the value is a compiled statement
+ * (or a bundle of them), so a loop that re-runs it re-runs pre-prepared SQL.
+ *
+ * @param name the parameter name to match
+ * @param fnNode the function node whose parameters are inspected
+ * @param adapter the language adapter used to read parameter nodes
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the named parameter is annotated with a statement type
+ */
+export declare function parameterBoundToStatementType(name: string, fnNode: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
+/**
+ * R4.1: Determine if a node is a database call expression.
+ * Spec 21: provenance-based detection (conjunctive guard — never name alone).
+ *
+ * Spec 70 R3/R4: handle-ness is decided once, by `identifyHandle` (via
+ * `handleVerdictForCall`); only a proven `handle` — a parsed SQL argument (R3)
+ * or a package in the manifest (R4) — is a DB node for the loop walk. `unproven`
+ * is `cannot-fire` (visible, never a finding), so a `map.delete()` / `set.join()`
+ * on an unresolved receiver does not read as a DB call inside a loop.
+ *
+ * The legacy `dbPatterns` substring fallback (a call whose *text* contained
+ * `select`/`insert`/`delete`/…) is deleted, not fixed: `buildDataAccessScan`
+ * always provides a provenance context (`mode` defaults to `'hybrid'`), so the
+ * no-context / `names`-mode arm was unreachable in a default run. Without
+ * provenance there is no honest handle verdict, so the node is not a DB call.
+ *
+ * @param node the candidate call node to classify
+ * @param scan the data-access scan context (adapter, source, provenance)
+ * @returns true when the node's handle verdict is `handle`
+ */
+export declare function isDbCallNode(node: ASTNode, scan: DataAccessScanContext): boolean;
+/**
+ * Spec 68 §3.2 — the `data-access-calls` FileProcessor extraction, factored out
+ * of `analyzeWithFacts` so the phase-model producer can obtain the per-file
+ * resolved calls synchronously (the analyzer method is `async` but does no real
+ * awaits — its body is entirely synchronous). Returns the `DatabaseCall[]` the
+ * missing-org-filter / unfiltered-query / sql-injection-risk rules read, with no
+ * violation production and no side effects. Config is the §10 tuning surface;
+ * omitted here, the extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast The parsed file AST.
+ * @param adapter The language adapter for the file's syntax.
+ * @param sourceCode The raw source text.
+ * @param config The data-access analyzer config (defaults when omitted).
+ * @returns The database calls extracted from the file.
+ */
+export declare function extractDataAccessCalls(ast: AST, adapter: LanguageAdapter, sourceCode: string, config?: DataAccessAnalyzerConfig): DatabaseCall[];
+/**
+ * Extract the loop-query candidates (loops whose body issues a DB call) as the
+ * serializable `LoopQueryCandidate[]` the `loop-queries` producer projects. The
+ * candidate set is exactly what `checkLoopQueries` reduces to findings, computed
+ * on the same provenance context — so detection parity holds by construction,
+ * not by re-implementation. Config is the §10 tuning surface; omitted here, the
+ * extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast The parsed file AST.
+ * @param adapter The language adapter for the file's syntax.
+ * @param sourceCode The raw source text.
+ * @param config The data-access analyzer config (defaults when omitted).
+ * @returns The loop-query candidates extracted from the file.
+ */
+export declare function extractLoopQueries(ast: AST, adapter: LanguageAdapter, sourceCode: string, config?: DataAccessAnalyzerConfig): LoopQueryCandidate[];
+/**
+ * Extract the raw, provenance-free `data-access-calls-candidates` for one file —
+ * the extract half of the corpus `data-access-calls` reduction (Spec 70 Item 4,
+ * step 3). No dedup happens here: the broadened discovery can perturb line-dedup
+ * (a bound bare call and a member call on the same line), so the corpus producer
+ * dedups after re-folding admission. Config is the §10 tuning surface; omitted
+ * here, extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (drives node discovery + text reads).
+ * @param sourceCode - The file's source text.
+ * @param config - Optional data-access config; defaults to the shared config.
+ * @returns The raw, provenance-free `data-access-calls-candidates`.
+ */
+export declare function extractDataAccessCallCandidates(ast: AST, adapter: LanguageAdapter, sourceCode: string, config?: DataAccessAnalyzerConfig): DataAccessCallCandidate[];
+/**
+ * Extract the raw, provenance-free `loop-query-candidates` for one file — the
+ * extract half of the corpus `loop-queries` reduction. Mirrors `collectLoopQueryCandidates`
+ * with the broadened discovery and without the three provenance-dependent steps
+ * (the strict-handle filter, the per-loop dedup, the stable symbol), which the
+ * corpus producer re-folds once `dbProvenanced` is re-derived. The provenance-free
+ * discriminators (statement-construction, sql-string-construction, for-of-iterable,
+ * hoisted-reuse, batch-argument, LLM/queue suppression) already ran here.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (drives node discovery + text reads).
+ * @param sourceCode - The file's source text.
+ * @param config - Optional data-access config; defaults to the shared config.
+ * @returns The raw, provenance-free `loop-query-candidates`.
+ */
+export declare function extractLoopQueryRawCandidates(ast: AST, adapter: LanguageAdapter, sourceCode: string, config?: DataAccessAnalyzerConfig): LoopQueryRawCandidate[];
+export {};
 //# sourceMappingURL=UniversalDataAccessAnalyzer.d.ts.map

package/dist/analyzers/universal/UniversalDataAccessAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UniversalDataAccessAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/universal/UniversalDataAccessAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAwB,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAyB1B;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAEvC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;6EAEyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IAIxB,SAAS,CAAC,EAAE;QACV,CAAC,GAAG,EAAE,MAAM,GAAG;YACb,IAAI,EAAE,MAAM,CAAC;YACb,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,aAAa,EAAE,MAAM,EAAE,CAAC;YACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IAGF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAIhC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,KAAK,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,CAAC,CAAC;IAGH,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAGF,qBAAqB,CAAC,EAAE;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAGF,gBAAgB,CAAC,EAAE;QACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IAEF;;gGAE4F;IAC5F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;qFAEiF;IACjF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,oEAAoE;IACpE,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAEpC;;+FAE2F;IAC3F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,eAAO,MAAM,0BAA0B,EAAE,wBA6DxC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;qBAGiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;mCAE+B;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;6EACyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAsmCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAkCtF;AA2ED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlD;AAorBD;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,iBAAiB;IAChE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,WAAW,mEAAmE;IACvF,QAAQ,CAAC,QAAQ,cAAc;cAEf,UAAU,CACxB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,wBAAwB,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC;IAIvB;;;;;;;;;OASG;IACG,gBAAgB,CACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,wBAAwB,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAAC,KAAK,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CAsD/D"}
+{"version":3,"file":"UniversalDataAccessAnalyzer.d.ts","sourceRoot":"","sources":["../../../src/analyzers/universal/UniversalDataAccessAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAML,KAAK,iBAAiB,EAEtB,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAe5C,OAAO,KAAK,EAAE,aAAa,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,KAAK,EAAE,GAAG,IAAI,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4BrD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAEvC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;6EAEyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IAGxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAIhC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,KAAK,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,CAAC,CAAC;IAKH,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAGF,qBAAqB,CAAC,EAAE;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAGF,gBAAgB,CAAC,EAAE;QACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IAEF;;gGAE4F;IAC5F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;yEAGqE;IACrE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,oEAAoE;IACpE,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAEpC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAEzB;;+FAE2F;IAC3F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,eAAO,MAAM,0BAA0B,EAAE,wBA4CxC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;mEAC+D;IAC/D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;qBAGiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;mCAE+B;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB;;;4BAGwB;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;6EACyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;gFAC4E;IAC5E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;kEAI8D;IAC9D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AA0BD;;;;;;GAMG;AACH,UAAU,qBAAqB;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,wBAAwB,CAAC;IACjC;0EACsE;IACtE,GAAG,EAAE,GAAG,CAAC;IACT,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;iFAC6E;IAC7E,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;qEACiE;IACjE,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA2KD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAMT;AAySD;;;;;;iDAMiD;AACjD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAKvE;AAED;;;;;;;;2EAQ2E;AAC3E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAMvC;AAED;;;;;;;;;+DAS+D;AAC/D,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAIT;AA0hBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAU7G;AAoTD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,OAAO,EACpB,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAuDT;AA4OD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,wBAAwB,GAC/B,MAAM,EAAE,CAWV;AAsED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CA0CT;AA2QD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AA+YD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAsBT;AAkcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAST;AAyLD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,wBAAwB,GAChC,YAAY,EAAE,CAEhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,wBAAwB,GAChC,kBAAkB,EAAE,CAEtB;AA0VD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,wBAAwB,GAChC,uBAAuB,EAAE,CAY3B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,wBAAwB,GAChC,qBAAqB,EAAE,CAmEzB"}