code-auditor-mcp 4.1.1 → 5.0.1

package/dist/analyzers/orgFilterTiers.d.ts

@@ -39,6 +39,68 @@
  */
 /** Default tenant-scoping column names (lowercased by the consumer). */
 export declare const DEFAULT_ORG_FILTER_COLUMNS: string[];
+/**
+ * The historical predicate-detection column names — both the JS camelCase and
+ * the SQL snake_case spelling for each concept. Kept as the no-config fallback
+ * for {@link orgPredicateVocabulary}; the configured `orgFilterColumns` (the
+ * discovery vocabulary) takes precedence when declared.
+ */
+export declare const DEFAULT_ORG_PREDICATE_PATTERNS: string[];
+/**
+ * The tenant-column names the org-filter *predicate* detector treats as
+ * evidence, lowercased. This is the SAME vocabulary table discovery uses
+ * (`orgFilterColumns`) — one vocabulary, two consumers — so a column the
+ * discovery tier names as tenant is also a recognized predicate, and a
+ * correctly-scoped query on it never fires `missing-org-filter`.
+ *
+ * Each snake_case name is expanded to its camelCase spelling too, so the ORM
+ * member-access form (`eq(workspaces.workspaceId, …)`) matches as well as the
+ * SQL spelling (`WHERE workspace_id = …`).
+ *
+ * When `orgFilterColumns` is declared, that declaration IS the vocabulary. When
+ * it is absent (no config), fall back to the historical predicate default
+ * (8 names) ∪ the discovery default (4 names) — so a default-discovered
+ * `workspace_id` is also a recognized predicate, not a false positive.
+ *
+ * @param orgFilterColumns The declared tenant-column vocabulary, when configured.
+ * @param organizationPatterns The legacy organization-name patterns, when configured.
+ * @returns The lowercased tenant-column names (each expanded to camelCase too).
+ */
+export declare function orgPredicateVocabulary(orgFilterColumns?: readonly unknown[], organizationPatterns?: readonly unknown[]): string[];
+/** The tenant-column vocabulary the org-filter *predicate* detector reads:
+ *  `orgFilterColumns` (the discovery vocabulary) and the legacy
+ *  `organizationPatterns` fallback. Structural subset of the analyzer's
+ *  `DataAccessAnalyzerConfig`, so that config is assignable to this without
+ *  a cast. */
+export interface OrgPredicateConfig {
+    orgFilterColumns?: readonly string[];
+    organizationPatterns?: readonly string[];
+}
+/**
+ * The tenant-scoping *predicate* detector for ORM host-language shapes — does
+ * this query text apply an org/tenant filter through an ORM chain? The predicate
+ * vocabulary is the SAME vocabulary discovery uses (`orgFilterColumns`, via
+ * {@link orgPredicateVocabulary}), so a project whose tenant column is
+ * `workspace_id`/`team_id`/… is recognized here as well as by table discovery,
+ * and a correctly-scoped query on it never fires `missing-org-filter`.
+ *
+ * The raw-SQL comparison arm (`org_id = ?`, `tenant_id IN (...)`) is NOT here
+ * (Spec 70 R2 site #5): it is derived structurally from the parsed SQL AST by
+ * `whereColumnRefs` and threaded to the rule as the `sqlWhereColumns` fact. This
+ * function covers only the ORM shapes — comparison helpers (`eq(org_id, v)`),
+ * object-literal filters (`where({ org_id })`), and positional where
+ * (`where('org_id', x)`) — which have no SQL text to walk.
+ *
+ * The analyzer computes this during extraction; the migrated `missing-org-filter`
+ * rule recomputes it at analysis time from the query text + its resolved
+ * thresholds, so the predicate and the tier set can never read two different
+ * vocabularies (§69 Fix 1 — one vocabulary, two consumers).
+ *
+ * @param text The query statement text (comments stripped, query-scoped).
+ * @param config The org-filter predicate config (may be undefined).
+ * @returns True when the query carries an org/tenant-scoping predicate via an ORM shape.
+ */
+export declare function hasOrganizationFilter(text: string, config?: OrgPredicateConfig): boolean;
 /** The loose config shape the tier resolver reads. Compatible with the
  *  data-access analyzer's `DataAccessAnalyzerConfig` and with the bare
  *  `Record<string, unknown>` the pipeline passes to applicability. */
@@ -64,7 +126,9 @@ export interface OrgFilterTierSet {
     schemaOrgTables: Set<string>;
     /** Tier 3 — DDL-discovered tables carrying a tenant column, lowercased. */
     ddlOrgTables: Set<string>;
-    /** The tenant-scoping column names this config treats as evidence, lowercased. */
+    /** The tenant-scoping column names this config treats as evidence — each
+     *  snake_case spelling plus its lowercased camelCase form (so a quoted
+     *  camelCase DDL column like `"organizationId"` is still recognized). */
     tenantColumns: string[];
 }
 /**
@@ -73,17 +137,25 @@ export interface OrgFilterTierSet {
  * string[]>` folded by the schema reducer; it is undefined when the schema
  * analyzer was not part of the run (Tier 3 is then empty — the rule can still
  * fire on Tiers 1–2, which come from config alone).
+ * @param config The org-filter config (may be undefined).
+ * @param ddlTableColumns Corpus-wide DDL-declared per-table columns.
+ * @returns The resolved tenant-scoping tier set.
  */
 export declare function buildOrgFilterTierSet(config: OrgFilterConfig | undefined, ddlTableColumns: Record<string, string[]> | undefined): OrgFilterTierSet;
 /**
  * Firing predicate — true when any of the query's referenced tables requires an
  * org/tenant filter, across all three tiers.
+ * @param tables The query's referenced table names.
+ * @param tierSet The resolved tenant-scoping tier set.
+ * @returns True when any referenced table requires an org/tenant filter.
  */
 export declare function tableRequiresOrgFilter(tables: string[], tierSet: OrgFilterTierSet): boolean;
 /**
  * Applicability predicate — true when any tier declares tenancy. When false,
  * the rule is `notApplicable` (this corpus has no tenant-scoping input), never
  * `clean` (the strongest claim the tool makes).
+ * @param tierSet The resolved tenant-scoping tier set.
+ * @returns True when any tier declares tenancy.
  */
 export declare function hasDeclaredTenancy(tierSet: OrgFilterTierSet): boolean;
 //# sourceMappingURL=orgFilterTiers.d.ts.map

package/dist/analyzers/orgFilterTiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgFilterTiers.d.ts","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,UAKtC,CAAC;AAEF;;sEAEsE;AACtE,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAC,IAAI,CAAC,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SACrD,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,GACpD,gBAAgB,CA6BlB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAST;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAMrE"}
+{"version":3,"file":"orgFilterTiers.d.ts","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,UAKtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,UAS1C,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,CAAC,EAAE,SAAS,OAAO,EAAE,EACrC,oBAAoB,CAAC,EAAE,SAAS,OAAO,EAAE,GACxC,MAAM,EAAE,CAeV;AAED;;;;cAIc;AACd,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAuBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAuDT;AAED;;sEAEsE;AACtE,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAC,IAAI,CAAC,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SACrD,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B;;6EAEyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,GACpD,gBAAgB,CAwClB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAMrE"}

package/dist/analyzers/orgFilterTiers.js

@@ -44,15 +44,175 @@ export const DEFAULT_ORG_FILTER_COLUMNS = [
     'organization_id',
     'workspace_id',
 ];
+/**
+ * The historical predicate-detection column names — both the JS camelCase and
+ * the SQL snake_case spelling for each concept. Kept as the no-config fallback
+ * for {@link orgPredicateVocabulary}; the configured `orgFilterColumns` (the
+ * discovery vocabulary) takes precedence when declared.
+ */
+export const DEFAULT_ORG_PREDICATE_PATTERNS = [
+    'organizationId',
+    'organization_id',
+    'orgId',
+    'org_id',
+    'tenantId',
+    'tenant_id',
+    'companyId',
+    'company_id',
+];
+/** `workspace_id` → `workspaceId`; a name with no underscore is unchanged. */
+function toCamelCase(name) {
+    return name.replace(/_([a-z0-9])/g, (_m, c) => c.toUpperCase());
+}
+function dedupe(items) {
+    return [...new Set(items.filter((s) => s.length > 0))];
+}
+/**
+ * The tenant-column names the org-filter *predicate* detector treats as
+ * evidence, lowercased. This is the SAME vocabulary table discovery uses
+ * (`orgFilterColumns`) — one vocabulary, two consumers — so a column the
+ * discovery tier names as tenant is also a recognized predicate, and a
+ * correctly-scoped query on it never fires `missing-org-filter`.
+ *
+ * Each snake_case name is expanded to its camelCase spelling too, so the ORM
+ * member-access form (`eq(workspaces.workspaceId, …)`) matches as well as the
+ * SQL spelling (`WHERE workspace_id = …`).
+ *
+ * When `orgFilterColumns` is declared, that declaration IS the vocabulary. When
+ * it is absent (no config), fall back to the historical predicate default
+ * (8 names) ∪ the discovery default (4 names) — so a default-discovered
+ * `workspace_id` is also a recognized predicate, not a false positive.
+ *
+ * @param orgFilterColumns The declared tenant-column vocabulary, when configured.
+ * @param organizationPatterns The legacy organization-name patterns, when configured.
+ * @returns The lowercased tenant-column names (each expanded to camelCase too).
+ */
+export function orgPredicateVocabulary(orgFilterColumns, organizationPatterns) {
+    const declared = orgFilterColumns ?? [];
+    if (declared.length) {
+        return dedupe(declared.flatMap((c) => {
+            const lower = String(c).toLowerCase();
+            return [lower, toCamelCase(lower)];
+        }));
+    }
+    const patterns = (organizationPatterns ?? []).length
+        ? organizationPatterns
+        : DEFAULT_ORG_PREDICATE_PATTERNS;
+    return dedupe([
+        ...patterns.map((p) => String(p).toLowerCase()),
+        ...DEFAULT_ORG_FILTER_COLUMNS.flatMap((c) => [c, toCamelCase(c)]),
+    ]);
+}
+/**
+ * True when the `eq(…)`/helper call starting at `eqIndex` is the *condition* of
+ * a join verb — `innerJoin(organizations, eq(a.org_id, b.org_id))` — rather
+ * than a predicate under `.where(...)`. A join's second argument is another
+ * *column* (`b.org_id`), scoping how rows match, not which rows come back, so it
+ * is not tenant isolation. The `eq(…)` under `.where(...)` whose second argument
+ * is a dotted *value* (`session.orgId`) is a filter and must NOT be excluded.
+ *
+ * The check is structural, not semantic: a helper call is a join condition iff
+ * the text immediately before it — at the same nesting depth — is a join verb's
+ * argument list (`joinVerb(<first-arg>, `). This is the one signal that survives
+ * both a bare table first arg (`innerJoin(organizations, …)`) and a dotted one
+ * (`innerJoin(schema.organizations, …)`), without resolving object types.
+ */
+function isJoinCondition(text, eqIndex) {
+    const before = text.slice(0, eqIndex);
+    return /\b(?:innerJoin|leftJoin|rightJoin|fullJoin|crossJoin|join)\s*\(\s*[^(),]*\s*,\s*$/.test(before);
+}
+/**
+ * The tenant-scoping *predicate* detector for ORM host-language shapes — does
+ * this query text apply an org/tenant filter through an ORM chain? The predicate
+ * vocabulary is the SAME vocabulary discovery uses (`orgFilterColumns`, via
+ * {@link orgPredicateVocabulary}), so a project whose tenant column is
+ * `workspace_id`/`team_id`/… is recognized here as well as by table discovery,
+ * and a correctly-scoped query on it never fires `missing-org-filter`.
+ *
+ * The raw-SQL comparison arm (`org_id = ?`, `tenant_id IN (...)`) is NOT here
+ * (Spec 70 R2 site #5): it is derived structurally from the parsed SQL AST by
+ * `whereColumnRefs` and threaded to the rule as the `sqlWhereColumns` fact. This
+ * function covers only the ORM shapes — comparison helpers (`eq(org_id, v)`),
+ * object-literal filters (`where({ org_id })`), and positional where
+ * (`where('org_id', x)`) — which have no SQL text to walk.
+ *
+ * The analyzer computes this during extraction; the migrated `missing-org-filter`
+ * rule recomputes it at analysis time from the query text + its resolved
+ * thresholds, so the predicate and the tier set can never read two different
+ * vocabularies (§69 Fix 1 — one vocabulary, two consumers).
+ *
+ * @param text The query statement text (comments stripped, query-scoped).
+ * @param config The org-filter predicate config (may be undefined).
+ * @returns True when the query carries an org/tenant-scoping predicate via an ORM shape.
+ */
+export function hasOrganizationFilter(text, config) {
+    const candidates = orgPredicateVocabulary(config?.orgFilterColumns, config?.organizationPatterns);
+    // An org-scoping column is a *filter* only when it is used as a predicate
+    // operand — the key side of a filter object (`where({ org_id })`), the first
+    // argument of a predicate helper (`eq(org_id, v)`), or the column argument of
+    // a positional where (`where('org_id', x)`). A column that merely appears in a
+    // projection (`.select({ organizationId: col })`) is NOT a filter.
+    // The candidates are joined with `|`; wrap them in `(?:…)` so the word
+    // boundaries and the operator/key suffix below bind to EVERY alternative, not
+    // just the first (`\borganizationid`) and last (`company_id\b…`) of them.
+    const alt = `(?:${candidates.map((c) => c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})`;
+    // ORM comparison-helper form: the org column as the FIRST argument of a
+    // predicate helper — `eq(org_id, v)`, `inArray(org_id, vs)`, `lt(org_id, v)`.
+    // The old bare-column match caught these by accident; the operator/object/
+    // positional regexes do not (they expect `org_id =` / `{ org_id: }` /
+    // `where('org_id')`). A helper's first arg is the column and its second arg
+    // is the value. Distinguish that from a JOIN-on-org — `innerJoin(x, eq(a.org_id,
+    // b.org_id))` — whose second arg is *another column* (`b.org_id`), not a value:
+    // a join scopes how rows match, not which rows come back, so it is not tenant
+    // isolation. The old blanket negative lookahead rejected ANY dotted second arg,
+    // which also rejected a dotted *value* — `eq(workspaces.workspaceId,
+    // session.workspaceId)` is a correctly-scoped predicate, not a join, but its
+    // `session.workspaceId` looked like a column to that lookahead. So the join
+    // exclusion is now scoped to the shape itself: an `eq(col, dotted)` is only a
+    // join when it is the argument of a join verb (`innerJoin(x, eq(a.org_id,
+    // b.org_id))`); the same shape under `.where(...)` is a predicate.
+    const helperRe = new RegExp(`\\b(?:eq|ne|notEq|gt|gte|lt|lte|inArray|notInArray|like|ilike|notIlike|between|notBetween)\\s*\\(\\s*(?:[\\w$]+\\.)*\\s*\\b${alt}\\b\\s*,`, 'gi');
+    for (const m of text.matchAll(helperRe)) {
+        if (!isJoinCondition(text, m.index ?? 0))
+            return true;
+    }
+    // Object-literal filter: the column as a value key inside a predicate/set
+    // object (`.where({ org_id: v })`, `.values({ org_id: v })`, Prisma
+    // `where: { org_id: v }`). The colon is a filter signal ONLY inside a
+    // scoping verb; a `.select({ org_id: col })` projection is a SELECT alias,
+    // not a predicate, so a bare `org_id:` must not match (Spec 68 Thing 2
+    // `sample_ownership`). This is strictly narrower than the old bare-`:`
+    // match: it can only stop firing on projections, never start on new text.
+    const objectFilterRe = new RegExp(`\\b(?:where|andWhere|orWhere|whereEq|whereNot|having|on|set|values|data)\\s*(?:\\(|:)\\s*\\{[^{}]*\\b${alt}\\b\\s*:`, 'i');
+    if (objectFilterRe.test(text))
+        return true;
+    // Positional ORM where: `.where('org_id', x)` / `.andWhere("org_id", x)`.
+    const positionalRe = new RegExp(`\\b(?:where|andWhere|orWhere|whereEq|whereNot|having|on)\\s*\\(\\s*['"\`]\\s*${alt}\\s*['"\`]`, 'i');
+    return positionalRe.test(text);
+}
 /**
  * Build the full tenant-scoping tier set from config + DDL-discovered
  * per-table columns. `ddlTableColumns` is the corpus-wide `Record<table,
  * string[]>` folded by the schema reducer; it is undefined when the schema
  * analyzer was not part of the run (Tier 3 is then empty — the rule can still
  * fire on Tiers 1–2, which come from config alone).
+ * @param config The org-filter config (may be undefined).
+ * @param ddlTableColumns Corpus-wide DDL-declared per-table columns.
+ * @returns The resolved tenant-scoping tier set.
  */
 export function buildOrgFilterTierSet(config, ddlTableColumns) {
-    const tenantColumns = (config?.orgFilterColumns ?? DEFAULT_ORG_FILTER_COLUMNS).map((c) => String(c).toLowerCase());
+    // The tier-discovery vocabulary carries BOTH the snake_case spelling and its
+    // lowercased camelCase form. A quoted camelCase DDL identifier
+    // (`"organizationId"`) lowercases to `organizationid` — one token, not
+    // `organization_id` — and would otherwise be invisible to Tier 3, while the
+    // predicate vocabulary (`orgPredicateVocabulary`) already recognizes the
+    // camelCase spelling. This is the same "two vocabularies for one concept"
+    // asymmetry §69 Fix 1 closed; expanding the tier set here closes the
+    // discovery half (§69 Fix 3).
+    const tenantColumns = dedupe((config?.orgFilterColumns ?? DEFAULT_ORG_FILTER_COLUMNS).flatMap((c) => {
+        const lower = String(c).toLowerCase();
+        return [lower, toCamelCase(lower).toLowerCase()];
+    }));
     const tenantSet = new Set(tenantColumns);
     const orgFilterTables = new Set((config?.orgFilterTables ?? []).map((t) => String(t).toLowerCase()));
     const schemaOrgTables = new Set();
@@ -74,6 +234,9 @@ export function buildOrgFilterTierSet(config, ddlTableColumns) {
 /**
  * Firing predicate — true when any of the query's referenced tables requires an
  * org/tenant filter, across all three tiers.
+ * @param tables The query's referenced table names.
+ * @param tierSet The resolved tenant-scoping tier set.
+ * @returns True when any referenced table requires an org/tenant filter.
  */
 export function tableRequiresOrgFilter(tables, tierSet) {
     return tables.some((t) => {
@@ -87,6 +250,8 @@ export function tableRequiresOrgFilter(tables, tierSet) {
  * Applicability predicate — true when any tier declares tenancy. When false,
  * the rule is `notApplicable` (this corpus has no tenant-scoping input), never
  * `clean` (the strongest claim the tool makes).
+ * @param tierSet The resolved tenant-scoping tier set.
+ * @returns True when any tier declares tenancy.
  */
 export function hasDeclaredTenancy(tierSet) {
     return (tierSet.orgFilterTables.size > 0 ||

package/dist/analyzers/orgFilterTiers.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgFilterTiers.js","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,cAAc;CACf,CAAC;AA6BF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,eAAqD;IAErD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvF,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CACxB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAEzC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAC9E,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACxE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgB,EAChB,OAAyB;IAEzB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"orgFilterTiers.js","sourceRoot":"","sources":["../../src/analyzers/orgFilterTiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,gBAAgB;IAChB,iBAAiB;IACjB,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC;AAEF,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,gBAAqC,EACrC,oBAAyC;IAEzC,MAAM,QAAQ,GAAG,gBAAgB,IAAI,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM;QAClD,CAAC,CAAC,oBAAqB;QACvB,CAAC,CAAC,8BAA8B,CAAC;IACnC,OAAO,MAAM,CAAC;QACZ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;KAClE,CAAC,CAAC;AACL,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,mFAAmF,CAAC,IAAI,CAC7F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,MAA2B;IAE3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAElG,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,mEAAmE;IACnE,uEAAuE;IACvE,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE/F,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,iFAAiF;IACjF,gFAAgF;IAChF,8EAA8E;IAC9E,gFAAgF;IAChF,qEAAqE;IACrE,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,8HAA8H,GAAG,UAAU,EAC3I,IAAI,CACL,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,wGAAwG,GAAG,UAAU,EACrH,GAAG,CACJ,CAAC;IACF,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,gFAAgF,GAAG,YAAY,EAC/F,GAAG,CACJ,CAAC;IACF,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AA+BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,eAAqD;IAErD,6EAA6E;IAC7E,+DAA+D;IAC/D,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,aAAa,GAAG,MAAM,CAC1B,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAEzC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACpE,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IACE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAC9E,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACxE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgB,EAChB,OAAyB;IAEzB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,OAAO,CACL,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QAChC,OAAO,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAC9B,CAAC;AACJ,CAAC"}