code-auditor-mcp 4.1.1 → 5.0.1

package/dist/languages/sql/dialectDetection.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Dialect detection — the SQL-content facts' honest up-front gate.
+ *
+ * Spec 70 (SQL as a parsed format) closes on a hard rule: no silent wrong
+ * answers. `parseSql` requires a {@link Dialect}, and before this module the
+ * dialect came *only* from a project's explicit `databaseType` config. A repo
+ * that names no dialect — which is nearly every real repo — never reached the
+ * parser at all: the twelve converted SQL-content sites derived from an AST that
+ * was never built, and their facts silently read as "no tables / no write / no
+ * filter". The parse-failure measurement passed a dialect explicitly per corpus;
+ * the real pipeline did not, so its rates did not describe what a user gets.
+ *
+ * The fix is detection, not configuration. A repo's *declared dependencies*
+ * name its database: `pg` / `@neondatabase/serverless` is postgres,
+ * `better-sqlite3` / `bun:sqlite` / a D1 binding is sqlite, `mysql2` is mysql.
+ * This is the same manifest the package-manifest surface (R4) validates against.
+ * Explicit config overrides it. Only when nothing in the manifest indicates a
+ * dialect does {@link detectDialect} return a null dialect with a named reason —
+ * the caller turns that into a `cannot-fire` diagnostic ("dialect undetermined"),
+ * which is honest abstention rather than the silent empty set of facts it was.
+ *
+ * There is no hardcoded default. A manifest that names *multiple* dialects
+ * (`pg` and `mysql2` together) is also honest abstention — an `ambiguous`
+ * reason, never a guess at whichever package sorts first.
+ */
+import type { Dialect } from '../../mcp-tools/discoveryQueries.js';
+/** The result of dialect detection: a resolved dialect, or null + a named reason. */
+export interface DialectDetection {
+    /** The detected dialect, or null when the manifest indicates none / too many. */
+    readonly dialect: Dialect | null;
+    /** The named reason when `dialect` is null (used in cannot-fire messages). */
+    readonly reason: string | null;
+}
+/**
+ * The dialect a single DB-driver package names, or null when the package is not
+ * a single-dialect driver — a cross-dialect ORM/query-builder (`knex`,
+ * `kysely`, `drizzle-orm`, `@prisma/client`), a non-SQL store (`mongodb`), or
+ * any package outside the map. This is the per-call-site companion to
+ * {@link detectDialect}: a receiver traced to `pg` is postgres, to `mysql2` is
+ * mysql, to `better-sqlite3` is sqlite, and to `knex` names no dialect (the
+ * caller falls back to repo-level detection, or abstains).
+ *
+ * @param packageName The base npm package name (no subpath — `pg`, not
+ *   `pg/lib`; `@neondatabase/serverless`, not its subpaths).
+ */
+export declare function dialectForPackage(packageName: string): Dialect | null;
+/**
+ * Detect a project's SQL dialect from its dependency manifest. Reads
+ * `package.json` `dependencies` + `devDependencies` and `wrangler.toml` (for a
+ * Cloudflare D1 binding). Returns a null dialect with a named reason when the
+ * manifest names no dialect or names more than one — never a guessed default.
+ *
+ * @param projectRoot The project directory containing package.json / wrangler.toml.
+ * @returns The detected dialect (or null with a reason when none or more than one is named).
+ */
+export declare function detectDialect(projectRoot: string): DialectDetection;
+//# sourceMappingURL=dialectDetection.d.ts.map

package/dist/languages/sql/dialectDetection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialectDetection.d.ts","sourceRoot":"","sources":["../../../src/languages/sql/dialectDetection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEnE,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAErE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CA2CnE"}

package/dist/languages/sql/dialectDetection.js

@@ -0,0 +1,135 @@
+/**
+ * Dialect detection — the SQL-content facts' honest up-front gate.
+ *
+ * Spec 70 (SQL as a parsed format) closes on a hard rule: no silent wrong
+ * answers. `parseSql` requires a {@link Dialect}, and before this module the
+ * dialect came *only* from a project's explicit `databaseType` config. A repo
+ * that names no dialect — which is nearly every real repo — never reached the
+ * parser at all: the twelve converted SQL-content sites derived from an AST that
+ * was never built, and their facts silently read as "no tables / no write / no
+ * filter". The parse-failure measurement passed a dialect explicitly per corpus;
+ * the real pipeline did not, so its rates did not describe what a user gets.
+ *
+ * The fix is detection, not configuration. A repo's *declared dependencies*
+ * name its database: `pg` / `@neondatabase/serverless` is postgres,
+ * `better-sqlite3` / `bun:sqlite` / a D1 binding is sqlite, `mysql2` is mysql.
+ * This is the same manifest the package-manifest surface (R4) validates against.
+ * Explicit config overrides it. Only when nothing in the manifest indicates a
+ * dialect does {@link detectDialect} return a null dialect with a named reason —
+ * the caller turns that into a `cannot-fire` diagnostic ("dialect undetermined"),
+ * which is honest abstention rather than the silent empty set of facts it was.
+ *
+ * There is no hardcoded default. A manifest that names *multiple* dialects
+ * (`pg` and `mysql2` together) is also honest abstention — an `ambiguous`
+ * reason, never a guess at whichever package sorts first.
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * npm/TypeScript database drivers that imply a *single* dialect. This is
+ * deliberately drivers only, not query builders or ORMs: `knex`, `kysely`,
+ * `drizzle-orm` and `@prisma/client` target any dialect, and `mongodb` /
+ * `mongoose` are not SQL — none of them name a dialect, so none is mapped.
+ */
+const PACKAGE_DIALECTS = {
+    // PostgreSQL drivers.
+    pg: 'postgresql',
+    postgres: 'postgresql',
+    'pg-pool': 'postgresql',
+    'pg-promise': 'postgresql',
+    '@neondatabase/serverless': 'postgresql',
+    '@vercel/postgres': 'postgresql',
+    // MySQL drivers.
+    mysql2: 'mysql',
+    mysql: 'mysql',
+    mariadb: 'mysql',
+    '@planetscale/database': 'mysql',
+    // SQLite drivers.
+    'better-sqlite3': 'sqlite',
+    'bun:sqlite': 'sqlite',
+    'node:sqlite': 'sqlite',
+    sqlite3: 'sqlite',
+    '@libsql/client': 'sqlite',
+    '@cloudflare/d1': 'sqlite',
+};
+/**
+ * The dialect a single DB-driver package names, or null when the package is not
+ * a single-dialect driver — a cross-dialect ORM/query-builder (`knex`,
+ * `kysely`, `drizzle-orm`, `@prisma/client`), a non-SQL store (`mongodb`), or
+ * any package outside the map. This is the per-call-site companion to
+ * {@link detectDialect}: a receiver traced to `pg` is postgres, to `mysql2` is
+ * mysql, to `better-sqlite3` is sqlite, and to `knex` names no dialect (the
+ * caller falls back to repo-level detection, or abstains).
+ *
+ * @param packageName The base npm package name (no subpath — `pg`, not
+ *   `pg/lib`; `@neondatabase/serverless`, not its subpaths).
+ */
+export function dialectForPackage(packageName) {
+    return PACKAGE_DIALECTS[packageName] ?? null;
+}
+/**
+ * True when `wrangler.toml` declares a D1 binding (`[[d1_databases]]`). A D1
+ * binding is SQLite; the binding table is the definitive signal (Workers types
+ * alone do not imply D1 — a Worker may use only KV/R2).
+ */
+function wranglerDeclaresD1(projectRoot) {
+    const tomlPath = path.join(projectRoot, 'wrangler.toml');
+    try {
+        const content = readFileSync(tomlPath, 'utf8');
+        return /^\[\[d1_databases\]\]/im.test(content);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detect a project's SQL dialect from its dependency manifest. Reads
+ * `package.json` `dependencies` + `devDependencies` and `wrangler.toml` (for a
+ * Cloudflare D1 binding). Returns a null dialect with a named reason when the
+ * manifest names no dialect or names more than one — never a guessed default.
+ *
+ * @param projectRoot The project directory containing package.json / wrangler.toml.
+ * @returns The detected dialect (or null with a reason when none or more than one is named).
+ */
+export function detectDialect(projectRoot) {
+    const byDialect = new Map();
+    const packagePath = path.join(projectRoot, 'package.json');
+    let manifest = null;
+    try {
+        manifest = JSON.parse(readFileSync(packagePath, 'utf8'));
+    }
+    catch {
+        manifest = null;
+    }
+    if (manifest) {
+        const deps = { ...(manifest.dependencies ?? {}), ...(manifest.devDependencies ?? {}) };
+        for (const name of Object.keys(deps)) {
+            const dialect = PACKAGE_DIALECTS[name];
+            if (dialect) {
+                const list = byDialect.get(dialect) ?? [];
+                list.push(name);
+                byDialect.set(dialect, list);
+            }
+        }
+    }
+    if (wranglerDeclaresD1(projectRoot)) {
+        const list = byDialect.get('sqlite') ?? [];
+        list.push('wrangler d1_databases');
+        byDialect.set('sqlite', list);
+    }
+    const dialects = [...byDialect.keys()];
+    if (dialects.length === 1) {
+        return { dialect: dialects[0], reason: null };
+    }
+    if (dialects.length > 1) {
+        const detail = dialects
+            .map((d) => `${d} via ${byDialect.get(d).join(', ')}`)
+            .join('; ');
+        return { dialect: null, reason: `dialect undetermined (ambiguous drivers: ${detail})` };
+    }
+    return {
+        dialect: null,
+        reason: 'dialect undetermined (no database driver in package.json or wrangler.toml)',
+    };
+}
+//# sourceMappingURL=dialectDetection.js.map

package/dist/languages/sql/dialectDetection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialectDetection.js","sourceRoot":"","sources":["../../../src/languages/sql/dialectDetection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B;;;;;GAKG;AACH,MAAM,gBAAgB,GAAsC;IAC1D,sBAAsB;IACtB,EAAE,EAAE,YAAY;IAChB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,YAAY;IAC1B,0BAA0B,EAAE,YAAY;IACxC,kBAAkB,EAAE,YAAY;IAChC,iBAAiB;IACjB,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,OAAO;IAChB,uBAAuB,EAAE,OAAO;IAChC,kBAAkB;IAClB,gBAAgB,EAAE,QAAQ;IAC1B,YAAY,EAAE,QAAQ;IACtB,aAAa,EAAE,QAAQ;IACvB,OAAO,EAAE,QAAQ;IACjB,gBAAgB,EAAE,QAAQ;IAC1B,gBAAgB,EAAE,QAAQ;CAC3B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,gBAAgB,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAiG,IAAI,CAAC;IAClH,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAS,SAAS,CAAC,GAAG,CAAC,CAAC,CAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aACnE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4CAA4C,MAAM,GAAG,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,4EAA4E;KACrF,CAAC;AACJ,CAAC"}