code-auditor-mcp 4.1.1 → 5.0.1

package/dist/analyzers/provenance.d.ts

@@ -19,36 +19,11 @@
  *   names                 — legacy English-only name matching (opt-in escape hatch)
  */
 import type { AST, LanguageAdapter, ASTNode } from '../languages/types.js';
-/** Database packages — spec R1.1 */
-export declare const DB_PACKAGES: ReadonlySet<string>;
+import type { Dialect } from '../mcp-tools/discoveryQueries.js';
+import type { TsWithinFileProvenanceExtract } from './tsExpressionDescriptor.js';
 /** Validator packages — spec R4.1 */
 export declare const VALIDATOR_PACKAGES: ReadonlySet<string>;
-/** Known DB type names — spec R1.1 (propagation rule 8) */
-export declare const DB_TYPES: ReadonlySet<string>;
-/**
- * DB call methods — the fixed API surface (language-invariant).
- *
- * Spec 33 Item 11 FP category 5: the bare-identifier hybrid fallback in
- * `isDBProvenanced` treated any `get(...)` / `each(...)` / `values(...)` call
- * as a DB query, flagging lodash-style object accessors (e.g.
- * `@directus/utils`'s `get(item, ...)`) as sql-injection. Those three names
- * are also common non-DB methods (lodash `get`, jQuery/iterator
- * `each`, Map/WebSocket `.values()`), so they are removed from the fallback —
- * mirroring the `get`/`each` trim in CHANGELOG 3.4.9 (DB_CALL_METHOD_NAMES).
- *
- * `query` is deliberately RETAINED: it is a genuine query-execution method on
- * mysql2, pg, node-postgres, D1 and Planetscale (`.query(...)`), and the
- * spec-19 data-access fixtures exercise it as a canonical DB entry point.
- * Removing it would turn real SQL-injection positives into false negatives.
- *
- * `raw` is deliberately retained: it is a genuine raw-execution method on
- * D1 prepared statements, Knex, and Kysely, and the Item-6 taint-tracking
- * fixtures exercise it as the canonical raw-SQL entry point.
- */
-export declare const DB_CALL_METHODS: ReadonlySet<string>;
-/** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
-export declare const ORM_METHODS: ReadonlySet<string>;
-export type ProvenanceReason = 'package' | 'binding' | 'type' | 'propagation' | 'fallback' | 'wrapper';
+export type ProvenanceReason = 'package' | 'binding' | 'propagation' | 'fallback' | 'wrapper' | 'module' | 'sql-argument';
 export interface ProvenanceEvidence {
     identifier: string;
     reason: ProvenanceReason;
@@ -56,6 +31,16 @@ export interface ProvenanceEvidence {
     source: string;
     /** Chain of propagation — each hop records the intermediate identifier */
     chain: string[];
+    /**
+     * The npm package the handle traces to (base name, no subpath — `pg`, not
+     * `pg/lib`), when its provenance names one — set for a package-import seed
+     * and carried through propagation. This is the *structured* counterpart of
+     * `source` (which is a human label): it is what `resolveSiteDialect` reads to
+     * derive a per-call-site SQL dialect (`pg` → postgresql) instead of parsing
+     * the label. Absent for wrapper / type-annotation / in-repo-module evidence,
+     * which names no package.
+     */
+    packageName?: string;
 }
 export type DetectionMode = 'hybrid' | 'provenance' | 'names';
 export interface DetectionConfig {
@@ -68,6 +53,15 @@ export interface ProvenanceContext {
     validatorProvenanced: Map<string, ProvenanceEvidence>;
     /** Active detection mode */
     mode: DetectionMode;
+    /**
+     * Receiver roots of DB-shaped call sites (a DB/ORM method call), *proven or
+     * unproven*. This is the file-gate signal: a file whose only DB signal is a
+     * type-annotated handle with a non-literal SQL argument (unproven under
+     * criterion 9, no dialect to parse) still passes the gate so `dynamic-sql-
+     * construction` / `unresolved-query` can report the site rather than drop it.
+     * It is *not* a handle decision — `identifyHandle` is the only thing that is.
+     */
+    dbActivity: Set<string>;
 }
 export interface InferredReceiverSet {
     identifiers: string[];
@@ -93,10 +87,10 @@ export declare function extractDBProvenancedImports(ast: AST, adapter: LanguageA
  */
 export declare function extractValidatorProvenancedImports(ast: AST, adapter: LanguageAdapter): Map<string, ProvenanceEvidence>;
 /**
- * Propagate provenance through assignments, destructuring, parameters,
- * class fields, and type annotations within a single file.
+ * Propagate provenance through assignments, destructuring, default
+ * parameters, and class-field initializers within a single file.
  *
- * The 8 single-file propagation rules (spec R1):
+ * The 7 single-file propagation rules (spec R1):
  *   1. new Expression → variable
  *   2. DB-provenanced call return → variable
  *   3. member expression on DB receiver → variable
@@ -104,7 +98,6 @@ export declare function extractValidatorProvenancedImports(ast: AST, adapter: La
  *   5. array destructuring from DB source
  *   6. default parameter with DB value
  *   7. class field initialized with DB value
- *   8. type annotation with known DB type
  * @param adapter
  * @param ast
  * @param seedMap
@@ -112,6 +105,17 @@ export declare function extractValidatorProvenancedImports(ast: AST, adapter: La
  * @returns
  */
 export declare function propagateProvenance(ast: AST, adapter: LanguageAdapter, sourceCode: string, seedMap: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+/**
+ * Extract the "receiver" identifier from a member expression chain.
+ * For `db.prepare` → "db"
+ * For `this.db.prepare` → "db" (walk to the deepest non-member identifier)
+ *
+ * @param node the member/selector expression node
+ * @param adapter the language adapter used to walk child nodes
+ * @param sourceCode the file source text for reading node text
+ * @returns the receiver identifier text, or `null`
+ */
+export declare function getMemberExpressionReceiver(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): string | null;
 /**
  * Get the callee of a call expression (everything before arguments).
  *
@@ -119,14 +123,22 @@ export declare function propagateProvenance(ast: AST, adapter: LanguageAdapter,
  * guards must agree on: a bare `identifier`, a `member_expression`/`selector`,
  * and — for `await fn<T>(...)` — an `await_expression` wrapping the callee plus
  * a `type_arguments` child (skipped, not mistaken for the callee).
+ * @param node The call-expression node whose callee to extract.
+ * @param adapter The language adapter for child traversal.
+ * @returns The callee node, or null when none is found.
  */
 export declare function getCallExpressionCallee(node: ASTNode, adapter: LanguageAdapter): ASTNode | null;
 export interface BuildProvenanceContextOptions {
     mode: DetectionMode;
-    /** Name lists used in hybrid/names fallback modes */
-    dbReceiverNames?: string[];
+    /**
+     * Cross-file resolution seeds — the per-file provenanced identifiers produced
+     * by the phase model's `computeReceiverProvenance` (package import /
+     * declaration / propagation / wrapper / cross-file import). Merged into the
+     * import seeds before propagation; this is the declaration-based replacement
+     * for the deleted name-list fallback (Spec 69 §10).
+     */
+    seedProvenance?: ReadonlyMap<string, ProvenanceEvidence>;
     dbBindingNames?: string[];
-    dbCallMethods?: string[];
     /**
      * Known DB wrapper function names — e.g. d1Query, d1Exec.
      * These are project-specific functions that wrap D1/DB API calls
@@ -139,6 +151,14 @@ export interface BuildProvenanceContextOptions {
     dbWrapperNames?: string[];
     /** Validator package list override (defaults to VALIDATOR_PACKAGES) */
     validatorPackageList?: string[];
+    /**
+     * The corpus's named SQL dialect for R3 (sql-argument) handle inference. When
+     * non-null, a call whose argument parses as SQL under this dialect proves its
+     * receiver a DB handle (Spec 70 criterion 8) — the replacement for the deleted
+     * type-name handle tests (criterion 9). Absent (null/undefined), the R3 step
+     * abstains: `identifyHandle` reports `unproven` rather than guessing a dialect.
+     */
+    sqlDialect?: Dialect | null;
 }
 /**
  * Build a ProvenanceContext for a file.
@@ -153,34 +173,172 @@ export interface BuildProvenanceContextOptions {
  */
 export declare function buildProvenanceContext(ast: AST, adapter: LanguageAdapter, sourceCode: string, options: BuildProvenanceContextOptions): ProvenanceContext;
 /**
- * Bundled inputs for the DB-provenance decision helpers: the adapter and
- * source needed to read node text, the resolved provenance context, and the
- * (already defaulted) set of DB call methods.  Collapses the five positional
- * parameters the `isDB*` family used to thread through every call into one.
+ * Collect the receiver roots of DB-shaped call sites (a member/selector call
+ * whose first argument is a static SQL string literal, or whose receiver root
+ * resolves handle/unproven), *proven or unproven*. This is the file-gate signal
+ * — see `ProvenanceContext.dbActivity` — not a handle decision (that is
+ * `identifyHandle`'s job alone, criterion 2).
+ *
+ * The discriminator is the package discriminant — the receiver root's
+ * disposition — not the method name: `join` is `Array.prototype.join` and also
+ * `SQL JOIN`. A static SQL literal proves DB shape outright; a dynamic SQL
+ * argument (`db.exec('DROP ' + x)`, `db.prepare(sql)`) is admitted by the
+ * receiver's resolution (`db` → handle/unproven) while `array.join(',')` is
+ * dropped because `array` resolves to a JS global (not-handle). Unlike R3
+ * (`applySqlArgumentInference`) it needs no dialect. Runs unconditionally,
+ * before R3's dialect gate.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (used for the callee walk and Go skip).
+ * @param sourceCode - The file's source text (for node-text reads).
+ * @param dbProvenanced - the propagated DB-provenanced map the receiver
+ *   discriminant reads as its provenance seed.
+ * @returns The set of DB-shaped receiver roots, or an empty set for Go.
+ */
+export declare function collectDbActivity(ast: AST, adapter: LanguageAdapter, sourceCode: string, dbProvenanced?: ReadonlyMap<string, ProvenanceEvidence>): Set<string>;
+/**
+ * R3: a call whose argument parses as SQL proves its receiver a DB handle.
+ * Folds the one entry point `identifyHandle` (criterion 2: no second decision
+ * path) over DB-shaped call sites and adds every receiver it proves a handle to
+ * `dbProvenanced`. This is the replacement for the type-name handle tests
+ * criterion 9 deleted: a receiver typed `D1Database` / `MockDB` is no longer
+ * proven by its annotation, but `db.query('SELECT …')` still is — by the parsed
+ * argument, not the name.
+ *
+ * The declaration-resolution arm of `identifyHandle` re-runs here, but it is
+ * harmless and already the same evidence `propagateProvenance` produced: for a
+ * type-annotated receiver it now returns `unproven` (criterion 9), and
+ * `combineVerdicts`' `handle > not-handle > unproven` precedence lets the
+ * sql-argument proof win. A receiver already in the map is left untouched.
+ *
+ * @param ast - the parsed file AST whose call sites R3 folds over.
+ * @param adapter - the language adapter (name, extraction helpers) for the file.
+ * @param sourceCode - the raw file source, for callee/method text extraction.
+ * @param dbProvenanced - the running receiver→evidence map to extend in place.
+ * @param sqlDialect - the corpus's named SQL dialect (or null), threaded to the SQL parser.
+ * @returns the same `dbProvenanced` map, now also carrying every receiver R3 proved.
  */
-interface DBProvenanceQuery {
-    adapter: LanguageAdapter;
-    sourceCode: string;
-    context: ProvenanceContext;
-    methods: ReadonlySet<string>;
+export declare function applySqlArgumentInference(ast: AST, adapter: LanguageAdapter, sourceCode: string, dbProvenanced: Map<string, ProvenanceEvidence>, sqlDialect: Dialect | null): Map<string, ProvenanceEvidence>;
+/**
+ * A serializable R3 site — one member-expression call whose static SQL argument
+ * is a parseable literal, exactly the sites `applySqlArgumentInference` folds
+ * `identifyHandle` over. `format` is absent because the R3 path is always
+ * `typescript` (Go resolves cross-file and has no TS `RootResolutionEnv`). The
+ * receiver-provenance corpus consumers carry this per file and re-run
+ * `identifyHandle` corpus-side with the seeded provenance + rehydrated bindings.
+ */
+export interface R3Site {
+    readonly root: string;
+    readonly receiver: string;
+    readonly method: string;
+    readonly sqlArgument: string;
+    readonly thisField: boolean;
+    /** The enclosing class's base-class heritage text (`WorkflowEntrypoint<Env>`),
+     *  or null when the site is not a `this` reference or the enclosing class has no
+     *  base class (Spec 70 Q3). Resolved at fold time, not here — the raw `extends`
+     *  text is carried so the fold can look it up in declared dependencies' `.d.ts`.
+     */
+    readonly thisHeritage: string | null;
 }
 /**
- * Determine if a call-expression node's callee is DB-provenanced.
+ * Extract the R3 sites of a TS-family file — the member calls whose static SQL
+ * argument proves their receiver a handle (Spec 70 criterion 8). This is the
+ * provenance-free extraction half of {@link applySqlArgumentInference}: the same
+ * candidate filter (DB/ORM shape) and the same static-argument test, but it
+ * records the site instead of folding `identifyHandle`. The corpus-side
+ * `applyR3FromSites` mirror re-runs the verdict once the seeded provenance and
+ * bindings are known.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (used for the callee walk and Go skip).
+ * @param sourceCode - The file's source text (for static-argument reads).
+ * @returns The recorded R3 sites, or `[]` for Go.
+ */
+export declare function extractR3Sites(ast: AST, adapter: LanguageAdapter, sourceCode: string): R3Site[];
+/**
+ * Learn DB-wrapper names and merge them into the provenance map.
+ *
+ * A wrapper is a named function/class whose own body performs a DB operation —
+ * either a `fetch` to the Cloudflare D1 HTTP query API, or a call that delegates
+ * to an already DB-provenanced identifier/receiver. Adding the wrapper's name to
+ * `dbProvenanced` lets `isDBProvenanced` treat a bare call like `d1(sql)` as a
+ * DB call, so its SQL argument reaches the table rules (unknown-table /
+ * stale-table-reference) and the data-access rules instead of bypassing them.
  *
- * This replaces the old `isDBCallee()` / `isDbCallNode()` name-based
- * pattern matching in UniversalDataAccessAnalyzer.
+ * The class form (`options.classes`) is the object-form of the function form: its
+ * body (fields + methods + constructor) constructs or calls a DB driver, so the
+ * class *is* a DB handle — e.g. `export class Database { constructor() {
+ * this.sql = neon(url) } query(t) { return this.sql(t) } }`. Class bodies are
+ * scanned *through* method bodies (the driver call lives in the constructor) but
+ * never into nested classes or nested function declarations — an inner named
+ * function's DB op is not mis-attributed to the outer class.
  *
- * Checks:
- *   1. Simple identifier call → is the identifier DB-provenanced?
- *   2. Member expression call → is the receiver DB-provenanced AND is the
- *      method in the DB call method set?
- *   3. ORM patterns → receiver is DB-provenanced and method matches ORM API
+ * This is structural evidence, not name matching, so it is only run in hybrid
+ * mode (alongside the name fallbacks), never strict `provenance`/`names` modes.
  *
- * @param node  the call-expression node whose callee is under test
- * @param query  bundled adapter, source, provenance context, and DB methods
- * @returns  true if the call's callee resolves to a DB-provenanced target
+ * @param ast the parsed file AST
+ * @param adapter the language adapter used to walk nodes
+ * @param sourceCode the file source text for reading node text
+ * @param dbProvenanced the provenance map to merge learned wrapper names into
+ * @param options when `classes` is true, also scan wrapper classes
+ * @returns the provenance map with wrapper names added
  */
-export declare function isDBProvenanced(node: ASTNode, query: DBProvenanceQuery): boolean;
+export declare function detectDbWrappers(ast: AST, adapter: LanguageAdapter, sourceCode: string, dbProvenanced: Map<string, ProvenanceEvidence>, options?: {
+    classes?: boolean;
+}): Map<string, ProvenanceEvidence>;
+/**
+ * Form-5 (Spec 69 §10 S5f) — function return resolution.
+ *
+ * A call to an in-repo function resolves to its *returned construction*,
+ * transitively: `export function getDB() { return new Database() }` proves
+ * `getDB` is a DB handle because the returned expression is already provenanced —
+ * the identifier's name is irrelevant. It is the binding form the two
+ * `cli-integration` fixtures need: `const db = getDB()` in an importing file
+ * resolves through the export fixed point (a provenanced `getDB` export is seeded
+ * in importers) and then propagates via the existing rule 2 (call to a provenanced
+ * identifier).
+ *
+ * This deliberately does NOT learn to accept mocks: a `getDB(): MockDB` with no
+ * provenanced client anywhere in its chain is honestly not a handle, and stays
+ * unprovenanced.
+ *
+ * @param ast the parsed file AST
+ * @param adapter the language adapter used to find function nodes
+ * @param sourceCode the file source text for reading return expressions
+ * @param dbProvenanced the provenance map to merge learned names into
+ * @returns the provenance map with DB-returning function names added
+ */
+export declare function detectDbReturningFunctions(ast: AST, adapter: LanguageAdapter, sourceCode: string, dbProvenanced: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+/**
+ * True when `call` is a `fetch(...)` to the Cloudflare D1 HTTP query API
+ * (`…/d1/database/<id>/query`). That endpoint is specific enough that a match
+ * is conclusive evidence the surrounding function is a D1 wrapper.
+ *
+ * @param call the candidate call-expression node
+ * @param adapter the language adapter used to read the callee and arguments
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the call names `fetch` with a literal `/d1/database/` URL
+ */
+export declare function isD1RestCall(call: ASTNode, adapter: LanguageAdapter, sourceCode: string): boolean;
+/**
+ * Resolve the SQL dialect a call site should parse its SQL argument under, from
+ * the package its receiver traces to (Spec 70 — per-site dialect). The dialect
+ * is a property of the *located fact*, not the repo: `pool.query(…)` where
+ * `pool` resolves to `pg` is postgres, `conn.query(…)` where `conn` resolves to
+ * `mysql2` is mysql. A repo with two drivers is therefore not "ambiguous" for a
+ * site whose receiver resolves to one of them — that site names its dialect and
+ * parses honestly.
+ *
+ * Returns null when the receiver carries no package (a wrapper, a type
+ * annotation, an in-repo module, a cross-dialect ORM like `knex`) or when that
+ * package names no single dialect — the caller then falls back to repo-level
+ * detection (`detectDialect`), and abstains only when that is also null.
+ *
+ * @param node The call-expression node whose callee is under test.
+ * @param adapter The language adapter for child traversal.
+ * @param sourceCode The file source text (for reading node text).
+ * @param provenanceContext The resolved provenance context for this file.
+ * @returns The receiver's dialect, or null when the receiver doesn't resolve to one.
+ */
+export declare function resolveSiteDialect(node: ASTNode, adapter: LanguageAdapter, sourceCode: string, provenanceContext: ProvenanceContext | undefined): Dialect | null;
 /**
  * Check if an identifier is validator-provenanced (R4 infrastructure).
  *
@@ -206,5 +364,41 @@ export declare function isValidatorProvenanced(identifier: string, context: Prov
  * @returns
  */
 export declare function inferReceivers(provenancedSet: Map<string, ProvenanceEvidence>, fileAst: AST, adapter: LanguageAdapter, sourceCode: string): InferredReceiverSet;
-export {};
+/**
+ * Extract the top-level identifier name from an initializer-expression node.
+ * Walks the node structurally to its root identifier — through `await`,
+ * parentheses, calls, member access, and subscripts — so `await db.connect()`
+ * yields `db` rather than `await`, and `(db.prepare(sql))` yields `db`.
+ * E.g., `db.prepare(sql)` → ["db"], `getConnection()` → ["getConnection"].
+ *
+ * @param node the initializer-expression node to walk from
+ * @param adapter the language adapter used to walk child nodes
+ * @param sourceCode the file source text for reading node text
+ * @returns the root identifier name, or an empty array when there is none
+ */
+export declare function extractTopLevelIdentifiers(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): string[];
+/**
+ * Extract the property name from a member expression node.
+ * For `db.prepare` → "prepare", for `db.sql.prepare` → "prepare"
+ *
+ * @param node the member/selector expression node
+ * @param adapter the language adapter used to read children
+ * @param sourceCode the file source text for reading node text
+ * @returns the property identifier text, or `null`
+ */
+export declare function extractMemberExpressionProperty(node: ASTNode, adapter: LanguageAdapter, sourceCode: string): string | null;
+/**
+ * Project a single file's AST into the serializable {@link TsWithinFileProvenanceExtract}
+ * that `classifyTsWithinFileProvenance` re-runs the provenance fixed point over.
+ *
+ * Everything here is provenance-free (structural reads of the AST + source text),
+ * so it can run once at parse time and be carried as a file fact. The semantic
+ * resolution — which name a value resolves to under the current provenance map —
+ * is deferred to the classify arm.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (drives the walk + node-text reads).
+ * @param sourceCode - The file's source text (for structural reads).
+ * @returns The provenance-free `TsWithinFileProvenanceExtract` projection.
+ */
+export declare function extractTsWithinFileProvenance(ast: AST, adapter: LanguageAdapter, sourceCode: string): TsWithinFileProvenanceExtract;
 //# sourceMappingURL=provenance.d.ts.map

package/dist/analyzers/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/analyzers/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAM3E,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAiB1C,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAWvC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAS9C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CA4B1C,CAAC;AAMH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEvG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,gEAAgE;IAChE,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAqED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAEjC;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAEjC;AAiND;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqBjC;AAsSD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,GAAG,IAAI,CAmBhB;AAuDD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CA+CnB;AAoQD;;;;;GAKG;AACH,UAAU,iBAAiB;IACzB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CA8BhF;AA2HD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAET;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC/C,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,CAerB"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/analyzers/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAchE,OAAO,KAAK,EAEV,6BAA6B,EAI9B,MAAM,6BAA6B,CAAC;AAWrC,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAMH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE1H,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,gEAAgE;IAChE,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAyGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAEjC;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,GACvB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAEjC;AA0PD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA0BjC;AAmXD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAuBf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,GAAG,IAAI,CAmBhB;AAuDD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,iBAAiB,CAmDnB;AA0BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,aAAa,GAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAa,GACjE,GAAG,CAAC,MAAM,CAAC,CAkCb;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC9C,UAAU,EAAE,OAAO,GAAG,IAAI,GACzB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAoEjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAyCV;AA4ID;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC9C,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAejC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAsBjC;AA4HD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAgCjG;AAwDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,GAC/C,OAAO,GAAG,IAAI,CAyBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAET;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC/C,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,mBAAmB,CAerB;AA+MD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAKV;AA4CD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAUf;AAmHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,6BAA6B,CA2H/B"}