code-auditor-mcp 4.1.1 → 5.0.1

package/dist/phase/dataAccessCalls.js

@@ -0,0 +1,42 @@
+/**
+ * Spec 68 §3.2 — the `data-access-calls` FileProcessor extraction.
+ *
+ * Re-homes the "extract resolved calls" half of `UniversalDataAccessAnalyzer`
+ * as a pure per-file processor. The analyzer's `analyzeWithFacts` did two jobs:
+ * extract `DatabaseCall[]` and derive violations from them. The producer keeps
+ * only the extraction — the calls the missing-org-filter / unfiltered-query /
+ * sql-injection-risk rules read. The analyzer's `extractDataAccessCalls` export
+ * is the synchronous extraction (its body was never actually awaited), run on
+ * {@link DEFAULT_DATA_ACCESS_CONFIG} since config is the §10 tuning surface and
+ * is not available to a `process(file)` call.
+ *
+ * `DatabaseCall` is structurally identical to the `ResolvedQuery` fact, so the
+ * mapping is the identity — this module owns only the `AstFile` → fact
+ * unwrapping, and the fact shape is pinned in `phase/types.ts`.
+ */
+import { extractDataAccessCalls as extractAnalyzerCalls, } from '../analyzers/universal/UniversalDataAccessAnalyzer.js';
+/** Extract the per-file resolved DB calls from one parsed file.
+ *
+ *  Spec 69 §10 S5a — when the legacy pipeline's cross-file resolution pre-pass
+ *  seeded this file's provenanced identifiers (`file.receiverProvenance`), thread
+ *  them as the extraction's provenance seed. This makes the finding path's
+ *  "proven handle" notion identical to the disposition classifier's, so a
+ *  query-shaped call on a proven handle is extracted (and can fire), a
+ *  proven-not-a-handle is skipped, and an unproven receiver is not silently
+ *  clean. Absent a seed (slice tests), the extraction runs on the default
+ *  config exactly as before.
+ *
+ * @param file the parsed file to extract DB calls from
+ * @returns the file's resolved DB calls
+ */
+export function extractDataAccessCalls(file) {
+    const seed = file.receiverProvenance;
+    // Spec 70 R1 — thread the corpus dialect (when the runner named one) so the
+    // producer's SQL-content facts parse; absent a dialect they `cannot-fire`.
+    const dialect = file.sqlDialect ?? null;
+    const config = (seed || dialect)
+        ? { _receiverProvenance: seed, dialect }
+        : undefined;
+    return extractAnalyzerCalls(file.ast, file.adapter, file.source, config);
+}
+//# sourceMappingURL=dataAccessCalls.js.map

package/dist/phase/dataAccessCalls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataAccessCalls.js","sourceRoot":"","sources":["../../src/phase/dataAccessCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,sBAAsB,IAAI,oBAAoB,GAE/C,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACrC,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;QAC9B,CAAC,CAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAA0C;QACjF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/dist/phase/dataAccessCallsCandidates.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Spec 70 Item 4 (step 3) — the per-file `data-access-calls-candidates` producer.
+ *
+ * The extract half of the corpus `data-access-calls` reduction. The legacy
+ * `data-access-calls` producer did two jobs: extract the resolved DB calls and
+ * fold the provenance-dependent half of `buildDatabaseCall` (the `identifyHandle`
+ * admission verdict → the injection-risk gate, and the per-site dialect → the SQL
+ * parse) over the cross-file `dbProvenanced` seed. The collapse splits them: this
+ * producer runs only the provenance-free half — the text-derived shape, the static
+ * security arms 1–3, the organization filter, the enclosing identity, the resolved
+ * WHERE — while the AST lives, projecting the two provenance-dependent inputs as
+ * identities (`handle*` and `site*`), so the corpus producer re-folds them once the
+ * `receiver-provenance` fixed point supplies the seed. The producer runs on the
+ * empty-provenance scan (the analyzer's `buildCandidateScan`), so no cross-file
+ * seed is read here; config is the §10 tuning surface, omitted → defaults.
+ */
+import type { AstFile, DataAccessCallCandidate } from './types.js';
+/** Extract one file's raw, provenance-free data-access-call candidates.
+ *
+ *  @param file the parsed file to project data-access-call candidates from
+ *  @returns the file's `DataAccessCallCandidate[]` (no raw-side dedup — the corpus
+ *    producer dedups after re-folding admission)
+ */
+export declare function extractDataAccessCallCandidates(file: AstFile): DataAccessCallCandidate[];
+//# sourceMappingURL=dataAccessCallsCandidates.d.ts.map

package/dist/phase/dataAccessCallsCandidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataAccessCallsCandidates.d.ts","sourceRoot":"","sources":["../../src/phase/dataAccessCallsCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAGnE;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,GAAG,uBAAuB,EAAE,CAExF"}

package/dist/phase/dataAccessCallsCandidates.js

@@ -0,0 +1,27 @@
+/**
+ * Spec 70 Item 4 (step 3) — the per-file `data-access-calls-candidates` producer.
+ *
+ * The extract half of the corpus `data-access-calls` reduction. The legacy
+ * `data-access-calls` producer did two jobs: extract the resolved DB calls and
+ * fold the provenance-dependent half of `buildDatabaseCall` (the `identifyHandle`
+ * admission verdict → the injection-risk gate, and the per-site dialect → the SQL
+ * parse) over the cross-file `dbProvenanced` seed. The collapse splits them: this
+ * producer runs only the provenance-free half — the text-derived shape, the static
+ * security arms 1–3, the organization filter, the enclosing identity, the resolved
+ * WHERE — while the AST lives, projecting the two provenance-dependent inputs as
+ * identities (`handle*` and `site*`), so the corpus producer re-folds them once the
+ * `receiver-provenance` fixed point supplies the seed. The producer runs on the
+ * empty-provenance scan (the analyzer's `buildCandidateScan`), so no cross-file
+ * seed is read here; config is the §10 tuning surface, omitted → defaults.
+ */
+import { extractDataAccessCallCandidates as extractAnalyzerCandidates } from '../analyzers/universal/UniversalDataAccessAnalyzer.js';
+/** Extract one file's raw, provenance-free data-access-call candidates.
+ *
+ *  @param file the parsed file to project data-access-call candidates from
+ *  @returns the file's `DataAccessCallCandidate[]` (no raw-side dedup — the corpus
+ *    producer dedups after re-folding admission)
+ */
+export function extractDataAccessCallCandidates(file) {
+    return extractAnalyzerCandidates(file.ast, file.adapter, file.source);
+}
+//# sourceMappingURL=dataAccessCallsCandidates.js.map

package/dist/phase/dataAccessCallsCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataAccessCallsCandidates.js","sourceRoot":"","sources":["../../src/phase/dataAccessCallsCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,+BAA+B,IAAI,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAErI;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,OAAO,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/dist/phase/dynamicSql.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Spec 68 §3.2 — the per-file `dynamic-sql` producer.
+ *
+ * Re-homes the "find dangerous query/execute string-argument call sites" half of
+ * `checkSQLInjection` (in `codeAnalysis.ts`, the Spec-34 helper the legacy
+ * `UniversalSchemaAnalyzer` calls) as a pure per-file processor. The analyzer did
+ * two jobs: collect the dynamic-SQL candidates and derive violations from them.
+ * The producer keeps only the collection — the candidates the
+ * `dynamic-sql-construction` rule reads.
+ *
+ * `DynamicSqlCandidate` is structurally identical to the `DynamicSqlFact` fact,
+ * so the mapping is the identity — this module owns only the `AstFile` → fact
+ * unwrapping, and the fact shape is pinned in `phase/types.ts`.
+ */
+import type { AstFile, DynamicSqlFact } from './types.js';
+/** Extract the per-file dynamic-SQL construction candidates from one parsed file. */
+export declare function extractDynamicSql(file: AstFile): DynamicSqlFact[];
+//# sourceMappingURL=dynamicSql.d.ts.map

package/dist/phase/dynamicSql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamicSql.d.ts","sourceRoot":"","sources":["../../src/phase/dynamicSql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1D,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAEjE"}

package/dist/phase/dynamicSql.js

@@ -0,0 +1,20 @@
+/**
+ * Spec 68 §3.2 — the per-file `dynamic-sql` producer.
+ *
+ * Re-homes the "find dangerous query/execute string-argument call sites" half of
+ * `checkSQLInjection` (in `codeAnalysis.ts`, the Spec-34 helper the legacy
+ * `UniversalSchemaAnalyzer` calls) as a pure per-file processor. The analyzer did
+ * two jobs: collect the dynamic-SQL candidates and derive violations from them.
+ * The producer keeps only the collection — the candidates the
+ * `dynamic-sql-construction` rule reads.
+ *
+ * `DynamicSqlCandidate` is structurally identical to the `DynamicSqlFact` fact,
+ * so the mapping is the identity — this module owns only the `AstFile` → fact
+ * unwrapping, and the fact shape is pinned in `phase/types.ts`.
+ */
+import { collectDynamicSqlCandidates } from '../analyzers/universal/schema/codeAnalysis.js';
+/** Extract the per-file dynamic-SQL construction candidates from one parsed file. */
+export function extractDynamicSql(file) {
+    return collectDynamicSqlCandidates(file.ast, file.adapter, file.source);
+}
+//# sourceMappingURL=dynamicSql.js.map

package/dist/phase/dynamicSql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamicSql.js","sourceRoot":"","sources":["../../src/phase/dynamicSql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC"}

package/dist/phase/exportForm.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Spec 68 §3.2 — the per-file `export-form` producer.
+ *
+ * Projects the adapter's `extractExports` (`ExportInfo[]`) onto the serializable
+ * `ExportFormFact`: the exported name plus `isDefault`. The `conventions/export-shape`
+ * rule reads this to resolve a function's export form (default vs named) against
+ * the directory's dominant form; the finding anchors to the function's
+ * `function-index` line, not the export statement, so position is not projected.
+ *
+ * This is the AST-extracted exports set the legacy conventions reducer read as
+ * `exportsMap` (pipelineAdapters.ts builds that map from the same `extractExports`
+ * call), so the phase fact is byte-identical in the `(name, isDefault)` pair the
+ * detector compares.
+ */
+import type { AstFile, ExportFormFact } from './types.js';
+/**
+ * One file's export declarations as `ExportFormFact[]`.
+ *
+ * @param file - The parsed file whose exports are projected.
+ * @returns The exported `(name, isDefault)` pairs in the file.
+ */
+export declare function extractExportForm(file: AstFile): ExportFormFact[];
+//# sourceMappingURL=exportForm.d.ts.map

package/dist/phase/exportForm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exportForm.d.ts","sourceRoot":"","sources":["../../src/phase/exportForm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAOjE"}

package/dist/phase/exportForm.js

@@ -0,0 +1,29 @@
+/**
+ * Spec 68 §3.2 — the per-file `export-form` producer.
+ *
+ * Projects the adapter's `extractExports` (`ExportInfo[]`) onto the serializable
+ * `ExportFormFact`: the exported name plus `isDefault`. The `conventions/export-shape`
+ * rule reads this to resolve a function's export form (default vs named) against
+ * the directory's dominant form; the finding anchors to the function's
+ * `function-index` line, not the export statement, so position is not projected.
+ *
+ * This is the AST-extracted exports set the legacy conventions reducer read as
+ * `exportsMap` (pipelineAdapters.ts builds that map from the same `extractExports`
+ * call), so the phase fact is byte-identical in the `(name, isDefault)` pair the
+ * detector compares.
+ */
+/**
+ * One file's export declarations as `ExportFormFact[]`.
+ *
+ * @param file - The parsed file whose exports are projected.
+ * @returns The exported `(name, isDefault)` pairs in the file.
+ */
+export function extractExportForm(file) {
+    const infos = file.adapter.extractExports(file.ast);
+    return infos.map((exp) => ({
+        file: file.file,
+        name: exp.name,
+        isDefault: exp.isDefault,
+    }));
+}
+//# sourceMappingURL=exportForm.js.map

package/dist/phase/exportForm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exportForm.js","sourceRoot":"","sources":["../../src/phase/exportForm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/phase/exportSymbols.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Spec 70 Item 4 (2a) — the per-file `export-symbols` producer.
+ *
+ * Projects `collectExports` (receiverResolution.ts) — the *same* function the
+ * legacy `resolveCorpusReceivers` fixed point calls — onto the serializable full
+ * export set the cross-file receiver-provenance fixed point resolves against:
+ * every exported name (including the `'*'` star re-export), the re-export
+ * `source` when present, and `isDefault`. Using the exact legacy extractor (not
+ * a re-implementation) makes the export set byte-identical by construction, so
+ * the parity assertion in step 2.5 is a diff of the wiring, not of the
+ * extraction.
+ */
+import type { AstFile, ExportSymbolFact } from './types.js';
+/**
+ * One file's exported symbols as `ExportSymbolFact[]`.
+ *
+ * @param file - The parsed file whose exports are projected.
+ * @returns The file's full export set (named, default, and star re-exports).
+ */
+export declare function extractExportSymbols(file: AstFile): ExportSymbolFact[];
+//# sourceMappingURL=exportSymbols.d.ts.map

package/dist/phase/exportSymbols.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exportSymbols.d.ts","sourceRoot":"","sources":["../../src/phase/exportSymbols.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAOtE"}

package/dist/phase/exportSymbols.js

@@ -0,0 +1,28 @@
+/**
+ * Spec 70 Item 4 (2a) — the per-file `export-symbols` producer.
+ *
+ * Projects `collectExports` (receiverResolution.ts) — the *same* function the
+ * legacy `resolveCorpusReceivers` fixed point calls — onto the serializable full
+ * export set the cross-file receiver-provenance fixed point resolves against:
+ * every exported name (including the `'*'` star re-export), the re-export
+ * `source` when present, and `isDefault`. Using the exact legacy extractor (not
+ * a re-implementation) makes the export set byte-identical by construction, so
+ * the parity assertion in step 2.5 is a diff of the wiring, not of the
+ * extraction.
+ */
+import { collectExports } from '../analyzers/receiverResolution.js';
+/**
+ * One file's exported symbols as `ExportSymbolFact[]`.
+ *
+ * @param file - The parsed file whose exports are projected.
+ * @returns The file's full export set (named, default, and star re-exports).
+ */
+export function extractExportSymbols(file) {
+    return collectExports(file.ast, file.adapter, file.source).map((ex) => ({
+        file: file.file,
+        name: ex.name,
+        source: ex.source,
+        isDefault: ex.isDefault,
+    }));
+}
+//# sourceMappingURL=exportSymbols.js.map

package/dist/phase/exportSymbols.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exportSymbols.js","sourceRoot":"","sources":["../../src/phase/exportSymbols.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,SAAS,EAAE,EAAE,CAAC,SAAS;KACxB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/phase/fileHeader.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Spec 68 §3.2 — the per-file `file-header` producer.
+ *
+ * Projects the legacy `getFileDocumentation` walk (UniversalDocumentationAnalyzer)
+ * onto a single serializable fact: the file's leading documentation comment
+ * (trimmed), or `null` when there is none. The producer does not judge whether
+ * the comment is a *file header* (a `@fileoverview`/`@file`/`@module`/
+ * `@overview`/`@purpose` marker) — that classification is `file-documentation`'s,
+ * re-applied over the projected text so the producer stays a pure projection
+ * and the tree dies with the file.
+ */
+import type { AstFile, FileHeaderFact } from './types.js';
+/** One file's leading documentation comment as a `FileHeaderFact`. */
+export declare function extractFileHeader(file: AstFile): FileHeaderFact[];
+//# sourceMappingURL=fileHeader.d.ts.map

package/dist/phase/fileHeader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileHeader.d.ts","sourceRoot":"","sources":["../../src/phase/fileHeader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmB1D,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAEjE"}

package/dist/phase/fileHeader.js

@@ -0,0 +1,33 @@
+/**
+ * Spec 68 §3.2 — the per-file `file-header` producer.
+ *
+ * Projects the legacy `getFileDocumentation` walk (UniversalDocumentationAnalyzer)
+ * onto a single serializable fact: the file's leading documentation comment
+ * (trimmed), or `null` when there is none. The producer does not judge whether
+ * the comment is a *file header* (a `@fileoverview`/`@file`/`@module`/
+ * `@overview`/`@purpose` marker) — that classification is `file-documentation`'s,
+ * re-applied over the projected text so the producer stays a pure projection
+ * and the tree dies with the file.
+ */
+/**
+ * The leading documentation comment a file carries. Re-homes the legacy
+ * `getFileDocumentation`: when the AST's first child is itself a comment, that
+ * comment IS the candidate header (looking for a comment *preceding* it would
+ * wrongly return null); otherwise ask the adapter for the doc comment preceding
+ * the first node.
+ */
+function getFileDocumentation(ast, adapter, sourceCode) {
+    const firstChild = ast.root.children?.[0];
+    if (!firstChild)
+        return null;
+    if (firstChild.type === 'comment') {
+        const text = adapter.getNodeText(firstChild, sourceCode);
+        return text ? text.trim() : null;
+    }
+    return adapter.getDocumentation(firstChild);
+}
+/** One file's leading documentation comment as a `FileHeaderFact`. */
+export function extractFileHeader(file) {
+    return [{ file: file.file, headerDoc: getFileDocumentation(file.ast, file.adapter, file.source) }];
+}
+//# sourceMappingURL=fileHeader.js.map

package/dist/phase/fileHeader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileHeader.js","sourceRoot":"","sources":["../../src/phase/fileHeader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAQ,EAAE,OAAwB,EAAE,UAAkB;IAClF,MAAM,UAAU,GAAwB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACrG,CAAC"}

package/dist/phase/fileImports.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Spec 68 §8 — the `file-imports` producer.
+ *
+ * Re-homes `clCollectFileInfo` / `clDynamicImport` (pipelineAdapters.ts) — the
+ * per-file import/export half of the cross-language visitor that the legacy
+ * dependency-graph reducer folded into `unreferenced-module`. The entity half
+ * stayed with the `cross-language-entities` producer; this fact carries the
+ * file-level reachability inputs a dead-module check needs:
+ *
+ *   - `imports` — resolved static import specifiers (TS `import_statement` +
+ *     `export ... from` re-exports, Go `import_declaration`, static-string
+ *     dynamic `import()`/`require()`) — the forward edges;
+ *   - `hasExports` — TS/JS `export_statement`, or Go capitalized top-level
+ *     names (the legacy visitor derived this from the extracted entities);
+ *   - `unresolvedDynamicImports` — computed-specifier dynamic imports that
+ *     cannot become an edge (a coverage diagnostic, not a finding).
+ *
+ * Re-homed (not imported) so §15 can delete the legacy visitor without the
+ * phase model reaching back into it. `walkAST`/`getNodeText`/`getFieldNode`
+ * are shared adapterBridge utilities — they survive §15; the walk bodies here
+ * are the private helpers that don't.
+ */
+import type { AST } from '../languages/types.js';
+import type { FileImportsFact } from './types.js';
+/**
+ * Extract one file's `file-imports` fact. `hasExports` for Go is the
+ * capitalized-top-level-name check the legacy visitor derived from the
+ * extracted entities (Go has no `export` keyword); the entity extraction is
+ * re-used verbatim so the definition of "public" cannot drift from the
+ * `cross-language-entities` producer. §6 collapses this to a single parse.
+ *
+ * @param ast - The parsed file's AST to walk for imports and export presence.
+ * @param filePath - The file's path (used for the Go entity extraction and the fact).
+ * @param sourceCode - The file's source text (for node text and Go entities).
+ * @param lang - The file's language key (`'go'` vs TS/JS).
+ * @returns The file's imports, export presence, and unresolved dynamic imports.
+ */
+export declare function extractFileImports(ast: AST, filePath: string, sourceCode: string, lang: string): FileImportsFact;
+//# sourceMappingURL=fileImports.d.ts.map

package/dist/phase/fileImports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileImports.d.ts","sourceRoot":"","sources":["../../src/phase/fileImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAW,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAiGlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,eAAe,CAWjB"}

package/dist/phase/fileImports.js

@@ -0,0 +1,138 @@
+/**
+ * Spec 68 §8 — the `file-imports` producer.
+ *
+ * Re-homes `clCollectFileInfo` / `clDynamicImport` (pipelineAdapters.ts) — the
+ * per-file import/export half of the cross-language visitor that the legacy
+ * dependency-graph reducer folded into `unreferenced-module`. The entity half
+ * stayed with the `cross-language-entities` producer; this fact carries the
+ * file-level reachability inputs a dead-module check needs:
+ *
+ *   - `imports` — resolved static import specifiers (TS `import_statement` +
+ *     `export ... from` re-exports, Go `import_declaration`, static-string
+ *     dynamic `import()`/`require()`) — the forward edges;
+ *   - `hasExports` — TS/JS `export_statement`, or Go capitalized top-level
+ *     names (the legacy visitor derived this from the extracted entities);
+ *   - `unresolvedDynamicImports` — computed-specifier dynamic imports that
+ *     cannot become an edge (a coverage diagnostic, not a finding).
+ *
+ * Re-homed (not imported) so §15 can delete the legacy visitor without the
+ * phase model reaching back into it. `walkAST`/`getNodeText`/`getFieldNode`
+ * are shared adapterBridge utilities — they survive §15; the walk bodies here
+ * are the private helpers that don't.
+ */
+import { walkAST, getNodeText, getFieldNode } from '../languages/adapterBridge.js';
+import { extractCrossLanguageEntities } from '../pipelineAdapters.js';
+/**
+ * Detect a dynamic `import('…')`/`require('…')` call expression (re-homed from
+ * `clDynamicImport`). Returns `{ specifier }` for a static-string argument,
+ * `{ computed, expression }` for a computed specifier, or `null` otherwise.
+ */
+function dynamicImport(node, sourceCode) {
+    if (node.type !== 'call_expression')
+        return null;
+    const fn = node.children?.[0];
+    const isImport = fn?.type === 'import';
+    const isRequire = fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require';
+    if (!isImport && !isRequire)
+        return null;
+    const args = node.children?.find((c) => c.type === 'arguments');
+    const stringNode = args?.children?.find((c) => c.type === 'string');
+    if (stringNode) {
+        const text = getNodeText(stringNode, sourceCode);
+        if (text.length >= 2) {
+            return { specifier: text.slice(1, -1) };
+        }
+    }
+    // A template literal with no `${…}` substitution is a compile-time constant,
+    // not a computed specifier — `import(\`@babel/plugin-syntax-jsx\`)` resolves
+    // to an edge just like `import('@babel/plugin-syntax-jsx')`. Only an
+    // interpolated template (`` import(`./${name}.js`) ``) is genuinely computed.
+    const templateNode = args?.children?.find((c) => c.type === 'template_string');
+    if (templateNode) {
+        const hasSubstitution = (templateNode.children ?? []).some((c) => c.type === 'template_substitution');
+        if (!hasSubstitution) {
+            const t = getNodeText(templateNode, sourceCode);
+            if (t.length >= 2 && t.startsWith('`') && t.endsWith('`')) {
+                return { specifier: t.slice(1, -1) };
+            }
+        }
+    }
+    // Computed specifier — the target module cannot be resolved statically.
+    const named = args?.children?.[0];
+    const expression = named
+        ? getNodeText(named, sourceCode)
+        : getNodeText(args, sourceCode).replace(/^\(|\)$/g, '').trim();
+    return { computed: true, expression };
+}
+/** The re-homed `ClFileInfo` walk: imports, export presence, unresolved dynamics. */
+function collectFileInfo(root, lang, sourceCode) {
+    const imports = new Set();
+    const unresolvedDynamicImports = [];
+    let hasExports = false;
+    walkAST(root, (node) => {
+        if (node.type === 'import_statement') {
+            const source = getFieldNode(node, 'source');
+            if (source) {
+                const text = getNodeText(source, sourceCode);
+                imports.add(text.replace(/^['"]|['"]$/g, ''));
+            }
+        }
+        else if (node.type === 'import_declaration') {
+            for (const spec of node.children ?? []) {
+                if (spec.type === 'import_spec') {
+                    const p = getFieldNode(spec, 'path');
+                    if (p) {
+                        const text = getNodeText(p, sourceCode);
+                        imports.add(text.replace(/^['"]|['"]$/g, ''));
+                    }
+                }
+            }
+        }
+        else if (node.type === 'export_statement') {
+            hasExports = true;
+            // Re-exports (`export { x } from './y'`, `export * from './y'`) are import
+            // edges for reachability: a barrel re-exporting a module marks it live.
+            const source = getFieldNode(node, 'source');
+            if (source) {
+                const text = getNodeText(source, sourceCode);
+                imports.add(text.replace(/^['"]|['"]$/g, ''));
+            }
+        }
+        else if (node.type === 'call_expression') {
+            const dyn = dynamicImport(node, sourceCode);
+            if (dyn && 'specifier' in dyn) {
+                imports.add(dyn.specifier);
+            }
+            else if (dyn) {
+                unresolvedDynamicImports.push({ line: node.location.start.line, expression: dyn.expression });
+            }
+        }
+    });
+    return { imports: [...imports], hasExports, unresolvedDynamicImports };
+}
+/**
+ * Extract one file's `file-imports` fact. `hasExports` for Go is the
+ * capitalized-top-level-name check the legacy visitor derived from the
+ * extracted entities (Go has no `export` keyword); the entity extraction is
+ * re-used verbatim so the definition of "public" cannot drift from the
+ * `cross-language-entities` producer. §6 collapses this to a single parse.
+ *
+ * @param ast - The parsed file's AST to walk for imports and export presence.
+ * @param filePath - The file's path (used for the Go entity extraction and the fact).
+ * @param sourceCode - The file's source text (for node text and Go entities).
+ * @param lang - The file's language key (`'go'` vs TS/JS).
+ * @returns The file's imports, export presence, and unresolved dynamic imports.
+ */
+export function extractFileImports(ast, filePath, sourceCode, lang) {
+    const info = collectFileInfo(ast.root, lang, sourceCode);
+    const hasExports = lang === 'go'
+        ? extractCrossLanguageEntities(ast, filePath, sourceCode, lang).some((e) => e.visibility === 'public')
+        : info.hasExports;
+    return {
+        file: filePath,
+        imports: info.imports,
+        hasExports,
+        unresolvedDynamicImports: info.unresolvedDynamicImports,
+    };
+}
+//# sourceMappingURL=fileImports.js.map

package/dist/phase/fileImports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileImports.js","sourceRoot":"","sources":["../../src/phase/fileImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAGtE;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAa,EAAE,UAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,EAAE,EAAE,IAAI,KAAK,QAAQ,CAAC;IACvC,MAAM,SAAS,GAAG,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC;IACzF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACpE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CACpC,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAC1C,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,KAAK;QACtB,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC;QAChC,CAAC,CAAC,WAAW,CAAC,IAAK,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CACtB,IAAa,EACb,IAAY,EACZ,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,wBAAwB,GAAgD,EAAE,CAAC;IACjF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACrC,IAAI,CAAC,EAAE,CAAC;wBACN,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;wBACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC5C,UAAU,GAAG,IAAI,CAAC;YAClB,2EAA2E;YAC3E,wEAAwE;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC5C,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,wBAAwB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAQ,EACR,QAAgB,EAChB,UAAkB,EAClB,IAAY;IAEZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI;QAC9B,CAAC,CAAC,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;QACtG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU;QACV,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CAAC;AACJ,CAAC"}

package/dist/phase/fileSymbols.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Spec 68 §3.2 — the `file-symbols` producer's extraction.
+ *
+ * This is where the SOLID analyzer's per-file AST walking *used* to happen. It
+ * folds `adapter.extractFunctions` / `extractClasses` / `extractInterfaces`
+ * into a serializable `FileSymbols` per symbol, pre-computing every metric a
+ * symbol-level rule needs (complexity, concern groups, line/param counts, the
+ * open-closed `instanceof` targets, the LSP `throws` signal). The tree dies
+ * with the file; `analyze` sees only these plain-data records.
+ *
+ * This is a temporary re-homing of the SOLID analyzer's private helpers
+ * (`BUILTIN_TYPES`, `findNodeByLocation`, `methodThrows`, …). They live in
+ * `UniversalSOLIDAnalyzer.ts` today and are deleted with that analyzer in §15;
+ * importing them across the phase boundary would couple the new pipeline to a
+ * class that is about to be removed, so they are re-declared here instead.
+ */
+import type { AstFile, FileSymbols } from './types.js';
+/**
+ * Extract every symbol (function / class / interface) from one parsed file.
+ *
+ * @param file - The parsed file whose symbols are projected.
+ * @returns The file's functions, classes, and interfaces as plain-data symbols.
+ */
+export declare function extractFileSymbols(file: AstFile): FileSymbols[];
+//# sourceMappingURL=fileSymbols.d.ts.map

package/dist/phase/fileSymbols.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSymbols.d.ts","sourceRoot":"","sources":["../../src/phase/fileSymbols.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAuC,MAAM,YAAY,CAAC;AA+B5F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,EAAE,CA8B/D"}