code-auditor-mcp 4.1.1 → 5.0.2

package/dist/analyzers/sqlLiteral.js

@@ -0,0 +1,419 @@
+/**
+ * Shared SQL-literal dequoting: turn the raw source text of a string/template
+ * literal node into the literal's *value* — the SQL text a parser expects —
+ * not the raw source slice.
+ *
+ * The raw source still carries the host language's escape sequences (`\'` for
+ * an embedded single quote, `\\` for a literal backslash, `\n` for a newline).
+ * Feeding that raw slice to the SQL parser corrupts the statement: the parser
+ * reads `\'` where the author meant `'` and mis-parses the string. `stripSqlQuotes`
+ * therefore both strips the surrounding delimiters *and* un-escapes the inner
+ * body to its runtime value.
+ *
+ * This was once a two-line `slice(1, -1)` duplicated verbatim in `provenance.ts`
+ * and `UniversalDataAccessAnalyzer.ts`; it lives here once so the two cannot
+ * drift. The `raw` flag preserves the one place the two languages disagree on
+ * backticks: a Go `raw_string_literal` is literal (no escapes), while a TS
+ * `template_string` is escape-bearing.
+ */
+import { SQL_TAG_NAMES } from './universal/schema/config.js';
+/**
+ * Strip the surrounding quote delimiters of a string/template literal and
+ * un-escape the inner escape sequences to the literal's runtime value.
+ *
+ * @param text - the raw source text of the literal node, delimiters included.
+ * @param opts.raw - true when the literal is a Go `raw_string_literal`
+ *   (backtick, no escape sequences); the body is then returned verbatim.
+ * @returns the unquoted literal body, un-escaped to its runtime value
+ */
+export function stripSqlQuotes(text, opts) {
+    if (text.length >= 2 && (text[0] === '"' || text[0] === "'" || text[0] === '`')) {
+        const body = text.slice(1, -1);
+        return opts?.raw ? body : unescapeLiteralBody(body);
+    }
+    return text;
+}
+/**
+ * Un-escape the body of an *interpreted* string/template literal — the inner
+ * text between the delimiters — to its runtime value. Covers the escapes JS/TS
+ * and Go share for SQL-relevant content: the quote/backtick/backslash escapes,
+ * the C-style control escapes, and the hex/unicode escapes. An unrecognized
+ * escape (`\d`) is preserved verbatim rather than dropped: dropping the
+ * backslash would silently rewrite a literal backslash the author meant.
+ */
+function unescapeLiteralBody(body) {
+    if (body.indexOf('\\') === -1)
+        return body;
+    let out = '';
+    let i = 0;
+    const n = body.length;
+    while (i < n) {
+        const ch = body[i];
+        if (ch !== '\\' || i + 1 >= n) {
+            out += ch;
+            i += 1;
+            continue;
+        }
+        const next = body[i + 1];
+        switch (next) {
+            case 'n':
+                out += '\n';
+                i += 2;
+                break;
+            case 't':
+                out += '\t';
+                i += 2;
+                break;
+            case 'r':
+                out += '\r';
+                i += 2;
+                break;
+            case 'b':
+                out += '\b';
+                i += 2;
+                break;
+            case 'f':
+                out += '\f';
+                i += 2;
+                break;
+            case 'v':
+                out += '\v';
+                i += 2;
+                break;
+            case '0':
+                out += '\0';
+                i += 2;
+                break;
+            case 'a':
+                out += '\x07';
+                i += 2;
+                break; // \a (bell) — Go only, harmless in JS
+            case '\\':
+                out += '\\';
+                i += 2;
+                break;
+            case "'":
+                out += "'";
+                i += 2;
+                break;
+            case '"':
+                out += '"';
+                i += 2;
+                break;
+            case '`':
+                out += '`';
+                i += 2;
+                break;
+            case '\n':
+                i += 2;
+                break; // line continuation — drop `\` + newline
+            case '\r': // `\` + `\r` (or `\r\n`) line continuation
+                i += 2;
+                if (i < n && body[i] === '\n')
+                    i += 1;
+                break;
+            case 'x': {
+                const hex = body.slice(i + 2, i + 4);
+                if (i + 4 <= n && /^[0-9a-fA-F]{2}$/.test(hex)) {
+                    out += String.fromCharCode(parseInt(hex, 16));
+                    i += 4;
+                }
+                else {
+                    out += '\\x';
+                    i += 2;
+                }
+                break;
+            }
+            case 'u': {
+                if (body[i + 2] === '{') {
+                    const close = body.indexOf('}', i + 2);
+                    const hex = close === -1 ? '' : body.slice(i + 3, close);
+                    if (close !== -1 && /^[0-9a-fA-F]{1,6}$/.test(hex)) {
+                        const cp = parseInt(hex, 16);
+                        if (cp <= 0x10ffff) {
+                            out += String.fromCodePoint(cp);
+                            i = close + 1;
+                            break;
+                        }
+                    }
+                    out += '\\u';
+                    i += 2;
+                }
+                else {
+                    const hex = body.slice(i + 2, i + 6);
+                    if (i + 6 <= n && /^[0-9a-fA-F]{4}$/.test(hex)) {
+                        out += String.fromCharCode(parseInt(hex, 16));
+                        i += 6;
+                    }
+                    else {
+                        out += '\\u';
+                        i += 2;
+                    }
+                }
+                break;
+            }
+            default:
+                out += '\\' + next;
+                i += 2;
+                break;
+        }
+    }
+    return out;
+}
+// ── Static SQL extraction ─────────────────────────────────────────────────────
+//
+// `extractStaticSql` is the single production extraction point for a call's
+// static SQL text (Spec 70 R2): a call's string/template argument, a tagged
+// template's body, or a variable assignment's RHS literal. It was moved out of
+// `UniversalDataAccessAnalyzer.ts` into this neutral SQL-literal module so the
+// data-access analyzer's *class* could be deleted without orphaning the live
+// candidate extractors (`extractDataAccessCallCandidates` /
+// `extractLoopQueryRawCandidates`) that call it. `provenance.ts` keeps its own
+// R3-specific literal-argument slice (`extractStaticSqlArgument`) — that one is
+// not this function and does not move.
+/** True when a node type is a literal that can carry static SQL text — TS/JS
+ *  `string` / `template_string` and Go's `interpreted_string_literal` /
+ *  `raw_string_literal`. */
+function isSqlStringLiteralType(type) {
+    return type === 'string' ||
+        type === 'template_string' ||
+        type === 'interpreted_string_literal' ||
+        type === 'raw_string_literal';
+}
+/** Unquote a string/template literal node's text; null when the template is
+ *  dynamic (carries a `${…}` substitution). Go `raw_string_literal`s are literal
+ *  (no escapes) and pass `raw: true` so their backticks are not un-escaped. */
+function staticLiteralText(node, adapter, sourceCode) {
+    const nodeType = adapter.getNodeType(node);
+    if (nodeType === 'template_string') {
+        const children = adapter.getChildren(node) ?? [];
+        if (children.some((c) => adapter.getNodeType(c) === 'template_substitution'))
+            return null;
+    }
+    const raw = adapter.getNodeText(node, sourceCode) ?? '';
+    return stripSqlQuotes(raw, { raw: nodeType === 'raw_string_literal' });
+}
+/** True when a node is a template literal (TS `template_string`). */
+export function isTemplateLiteral(node, _adapter) {
+    return node.type === 'template_string';
+}
+/** The variable-assignment node types whose RHS can carry a static SQL literal. */
+const VARIABLE_ASSIGNMENT_SQL_TYPES = new Set([
+    // TS/JS
+    'variable_declaration',
+    'lexical_declaration',
+    'variable_declarator',
+    'assignment_expression',
+    // Go
+    'short_var_declaration',
+    'var_declaration',
+    'var_spec',
+    'assignment_statement',
+]);
+/**
+ * The static string/template literal a variable-assignment node initialises
+ * with, or null. Only a *direct* initializer qualifies: `const q = "SELECT"` is
+ * static, `const q = "SELECT" + x` is dynamic (its literal is nested inside a
+ * binary expression) and yields null. The declaration containers
+ * (`lexical_declaration`, `var_declaration`) descend to their declarator/spec
+ * first; Go wraps the RHS in an `expression_list`.
+ */
+function variableInitializerLiteral(node, adapter) {
+    const type = adapter.getNodeType(node);
+    if (type === 'lexical_declaration' || type === 'variable_declaration') {
+        for (const c of adapter.getChildren(node) ?? []) {
+            if (adapter.getNodeType(c) === 'variable_declarator') {
+                const lit = variableInitializerLiteral(c, adapter);
+                if (lit)
+                    return lit;
+            }
+        }
+        return null;
+    }
+    if (type === 'var_declaration') {
+        for (const c of adapter.getChildren(node) ?? []) {
+            if (adapter.getNodeType(c) === 'var_spec') {
+                const lit = variableInitializerLiteral(c, adapter);
+                if (lit)
+                    return lit;
+            }
+        }
+        return null;
+    }
+    for (const c of adapter.getChildren(node) ?? []) {
+        const t = adapter.getNodeType(c);
+        if (isSqlStringLiteralType(t))
+            return c;
+        if (t === 'expression_list') {
+            for (const e of adapter.getChildren(c) ?? []) {
+                if (isSqlStringLiteralType(adapter.getNodeType(e)))
+                    return e;
+            }
+        }
+    }
+    return null;
+}
+/** The callee of a call expression, limited to the identifier / member /
+ *  selector shapes a tagged-template tag can take. Inlined here (the shared
+ *  `getCallExpressionCallee` lives in `provenance.ts`, which imports this module
+ *  for `stripSqlQuotes` — importing it back would close an import cycle). */
+function taggedTemplateCallee(node, adapter) {
+    for (const child of adapter.getChildren(node)) {
+        if (child.type === 'arguments')
+            break;
+        if (child.type === 'identifier' ||
+            child.type === 'member_expression' ||
+            child.type === 'selector_expression') {
+            return child;
+        }
+    }
+    return null;
+}
+/** True when a call is a SQL tagged template (`sql\`…\`` / `this.sql\`…\``) under
+ *  the given tag names.
+ *
+ * @param node - the candidate call node to classify
+ * @param adapter - the language adapter used to read children and text
+ * @param sourceCode - the file source text for reading tag names
+ * @param tagNames - the recognized SQL tag names to match against
+ * @returns true when the call is a SQL tagged template under one of `tagNames`
+ */
+export function isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames) {
+    if (node.type !== 'call_expression')
+        return false;
+    // A tagged-template call carries the template string as a direct child (there
+    // is no `arguments` node), but accept both shapes for robustness.
+    const children = adapter.getChildren(node);
+    const hasTemplate = children.some((c) => isTemplateLiteral(c, adapter)) ||
+        children.some((c) => adapter.getNodeType(c) === 'arguments' &&
+            adapter.getChildren(c).some((a) => isTemplateLiteral(a, adapter)));
+    if (!hasTemplate)
+        return false;
+    const callee = taggedTemplateCallee(node, adapter);
+    if (!callee)
+        return false;
+    const calleeType = adapter.getNodeType(callee);
+    // Bare tag: `sql\`…\`` / `db\`…\``.
+    if (calleeType === 'identifier') {
+        return tagNames.includes(adapter.getNodeText(callee, sourceCode));
+    }
+    // Member tag on `this`: `this.sql\`…\`` — a wrapper re-exposing the tag.
+    if (calleeType === 'member_expression') {
+        const parts = adapter.getChildren(callee);
+        const prop = parts.find((c) => adapter.getNodeType(c) === 'property_identifier');
+        if (!prop || !tagNames.includes(adapter.getNodeText(prop, sourceCode)))
+            return false;
+        const receiver = parts.find((c) => adapter.getNodeType(c) !== 'property_identifier');
+        return !!receiver && adapter.getNodeText(receiver, sourceCode) === 'this';
+    }
+    return false;
+}
+/**
+ * The static SQL argument of a candidate node, or null when it carries none.
+ *
+ * Spec 70 R2 — the single extraction point for the SQL-content facts: a call's
+ * string/template argument (unquoted), a tagged template's body, or a variable
+ * assignment's RHS literal. A template carrying a `${…}` substitution is
+ * dynamic and yields null (its shape is interpolated, not a parseable literal);
+ * that is `cannot-fire`, not a negative verdict.
+ *
+ * @param node - the candidate node carrying the SQL argument
+ * @param adapter - the language adapter used to read children and text
+ * @param sourceCode - the file source text for reading node text
+ * @returns the static SQL text, or null when the node carries none (dynamic/interpolated)
+ */
+export function extractStaticSql(node, adapter, sourceCode) {
+    const type = adapter.getNodeType(node);
+    // Tagged template (sql`…`) or a template literal found as a call argument.
+    // Go's string literals are `interpreted_string_literal` / `raw_string_literal`.
+    if (isSqlStringLiteralType(type)) {
+        return staticLiteralText(node, adapter, sourceCode);
+    }
+    // Variable assignment: the static RHS literal, if one. The declaration
+    // containers (`lexical_declaration`, `var_declaration`) descend to their
+    // declarator/spec; the declarator/spec/assignment then yields its direct
+    // string/template literal (a literal nested inside a binary expression is
+    // dynamic and yields null).
+    if (VARIABLE_ASSIGNMENT_SQL_TYPES.has(type)) {
+        const value = variableInitializerLiteral(node, adapter);
+        return value ? staticLiteralText(value, adapter, sourceCode) : null;
+    }
+    // Call/new expression: the first static string/template argument.
+    if (type === 'call_expression' || type === 'new_expression') {
+        const argListType = adapter.name === 'go' ? 'argument_list' : 'arguments';
+        const children = adapter.getChildren(node);
+        const args = children.find((c) => adapter.getNodeType(c) === argListType);
+        // A tagged template (`sql\`…\`` / `this.sql\`…\``) carries its template as a
+        // DIRECT child — there is no `arguments` node. Extract that body (or null when
+        // the template is interpolated, i.e. dynamic).
+        if (!args) {
+            const template = children.find((c) => isTemplateLiteral(c, adapter));
+            return template ? staticLiteralText(template, adapter, sourceCode) : null;
+        }
+        for (const arg of adapter.getChildren(args)) {
+            const t = adapter.getNodeType(arg);
+            if (t === '(' || t === ')' || t === ',')
+                continue;
+            if (isSqlStringLiteralType(t))
+                return staticLiteralText(arg, adapter, sourceCode);
+            // A tagged-template first argument (`db.execute(sql\`…\`)`) — recurse into
+            // its body. Only a SQL tag (recognized by name) qualifies; a non-SQL tag is
+            // `cannot-fire`.
+            if (t === 'call_expression' && isTaggedTemplateSqlCall(arg, adapter, sourceCode, SQL_TAG_NAMES)) {
+                return extractStaticSql(arg, adapter, sourceCode);
+            }
+            // ctx-first methods (Go `Query(ctx, sql)`, pgx `Query(ctx, "SELECT…")`)
+            // carry a leading `context.Context`/options argument. Skip past it to the
+            // first static string: a non-literal argument is not itself `cannot-fire`,
+            // it may sit *ahead* of the SQL argument (Spec 70 R2, pgx/sqlc precision).
+            continue;
+        }
+        return null;
+    }
+    return null;
+}
+/** The static SQL argument of a Go call, resolving a sqlc-generated package-level
+ *  const identifier (`q.db.QueryContext(ctx, getAllUsers)` where `getAllUsers` is
+ *  `const getAllUsers = `-- name: GetAllUsers :many\nSELECT …``) to its literal.
+ *  The literal path is {@link extractStaticSql} (already ctx-first); this adds the
+ *  one Go-only step — an identifier argument resolved through the file's `const`
+ *  bindings — so sqlc's SQL reaches the parser instead of surfacing `cannot-fire`.
+ *  Returns null when the call carries no static SQL (a ctx/options-only argument
+ *  list, or an identifier that is not a const literal).
+ *
+ * @param node - the Go call node carrying the SQL argument
+ * @param adapter - the language adapter used to read children and text
+ * @param sourceCode - the file source text for reading node text
+ * @param goEnv - the Go resolution environment holding the file's const bindings
+ * @returns the static SQL text (const literal resolved), or null when none
+ */
+export function extractGoStaticSql(node, adapter, sourceCode, goEnv) {
+    const literal = extractStaticSql(node, adapter, sourceCode);
+    if (literal !== null)
+        return literal;
+    if (!goEnv || adapter.name !== 'go')
+        return null;
+    const children = adapter.getChildren(node);
+    const args = children.find((c) => adapter.getNodeType(c) === 'argument_list');
+    if (!args)
+        return null;
+    for (const arg of adapter.getChildren(args)) {
+        const t = adapter.getNodeType(arg);
+        if (t === '(' || t === ')' || t === ',')
+            continue;
+        if (t !== 'identifier')
+            continue; // ctx/options/other — skip
+        const name = adapter.getNodeText(arg, sourceCode);
+        if (!name)
+            continue;
+        const binding = goEnv.bindings.get(name);
+        if (binding?.kind !== 'const' || !binding.value)
+            continue;
+        const v = binding.value;
+        if (v.type === 'interpreted_string_literal' || v.type === 'raw_string_literal') {
+            return stripSqlQuotes(v.text, { raw: v.type === 'raw_string_literal' });
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=sqlLiteral.js.map

package/dist/analyzers/sqlLiteral.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlLiteral.js","sourceRoot":"","sources":["../../src/analyzers/sqlLiteral.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAwB;IACnE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACrC,KAAK,GAAG;gBAAE,GAAG,IAAI,MAAM,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,CAAC,sCAAsC;YAC9E,KAAK,IAAI;gBAAE,GAAG,IAAI,IAAI,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACtC,KAAK,GAAG;gBAAE,GAAG,IAAI,GAAG,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACpC,KAAK,GAAG;gBAAE,GAAG,IAAI,GAAG,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACpC,KAAK,GAAG;gBAAE,GAAG,IAAI,GAAG,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YACpC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,CAAC,yCAAyC;YACnE,KAAK,IAAI,EAAE,2CAA2C;gBACpD,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9C,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,KAAK,CAAC;oBACb,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;oBACzD,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC7B,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;4BACnB,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;4BAChC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;4BACd,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,GAAG,IAAI,KAAK,CAAC;oBACb,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC/C,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;wBAC9C,CAAC,IAAI,CAAC,CAAC;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,IAAI,KAAK,CAAC;wBACb,CAAC,IAAI,CAAC,CAAC;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD;gBACE,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC;gBACnB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4DAA4D;AAC5D,+EAA+E;AAC/E,gFAAgF;AAChF,uCAAuC;AAEvC;;4BAE4B;AAC5B,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI,KAAK,QAAQ;QACtB,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,4BAA4B;QACrC,IAAI,KAAK,oBAAoB,CAAC;AAClC,CAAC;AAED;;+EAE+E;AAC/E,SAAS,iBAAiB,CACxB,IAAa,EACb,OAAwB,EACxB,UAAkB;IAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,uBAAuB,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,KAAK,oBAAoB,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,QAAyB;IACxE,OAAO,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,QAAQ;IACR,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;IACvB,KAAK;IACL,uBAAuB;IACvB,iBAAiB;IACjB,UAAU;IACV,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,IAAa,EACb,OAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,qBAAqB,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,0BAA0B,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACnD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,0BAA0B,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACnD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,sBAAsB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;6EAG6E;AAC7E,SAAS,oBAAoB,CAAC,IAAa,EAAE,OAAwB;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM;QACtC,IACE,KAAK,CAAC,IAAI,KAAK,YAAY;YAC3B,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAClC,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAa,EACb,OAAwB,EACxB,UAAkB,EAClB,QAA2B;IAE3B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAElD,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GACf,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW;YAC3C,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CACpE,CAAC;IACJ,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE/C,oCAAoC;IACpC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,MAAM,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,OAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEvC,2EAA2E;IAC3E,gFAAgF;IAChF,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,4BAA4B;IAC5B,IAAI,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,kEAAkE;IAClE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;QAC1E,6EAA6E;QAC7E,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACrE,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,SAAS;YAClD,IAAI,sBAAsB,CAAC,CAAC,CAAC;gBAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAClF,2EAA2E;YAC3E,4EAA4E;YAC5E,iBAAiB;YACjB,IAAI,CAAC,KAAK,iBAAiB,IAAI,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;gBAChG,OAAO,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAa,EACb,OAAwB,EACxB,UAAkB,EAClB,KAAkC;IAElC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QAClD,IAAI,CAAC,KAAK,YAAY;YAAE,SAAS,CAAC,2BAA2B;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,4BAA4B,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/E,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/analyzers/tsEcosystem.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The TypeScript resolution implementation's ecosystem data.
+ *
+ * Standing correction `specs/correction-seams-not-placement.md` §4: the ecosystem
+ * data moves behind the interface, not into a renamed home. `DB_PACKAGES`, the
+ * Node builtin set, the JS global set and the ORM method set are the *TypeScript*
+ * resolution implementation's own data — the npm/TypeScript/JS-runtime vocabulary
+ * — and live here, the TS counterpart of `GO_DB_PACKAGES` / `GO_STDLIB_PACKAGES`
+ * in `languages/go/goResolution.ts`. No module above the resolution interface
+ * reads these sets: the TS implementation modules (`provenance.ts`,
+ * `receiverRoot.ts`, `receiverResolution.ts`) read them directly because they
+ * *are* the implementation; every caller above them asks a predicate
+ * (`isNodeBuiltin`, `isOrmMethod`) rather than importing a set.
+ *
+ * This replaces the old claim in `provenance.ts` that these were a "universal,
+ * language-invariant vocabulary": `database/sql` and `*sql.DB` are not npm
+ * package names, and `better-sqlite3` is not a Go import path. There is one
+ * ecosystem per dialect, owned by that dialect's resolution implementation.
+ */
+/**
+ * Database packages — the npm/TypeScript package vocabulary (Spec R1.1).
+ *
+ * Spec 70 R4 / criterion 10: this set is loaded from the per-ecosystem manifest
+ * (`src/languages/typescript/database-packages.json`, beside the format adapter),
+ * a declarative data file. Adding an ORM is a data edit that turns
+ * `cannot-fire` into a verdict; failing to add it never produces a wrong verdict.
+ * This is the ORM residual — the one irreducible fact R3 cannot derive from the
+ * audited code (which packages are database clients).
+ *
+ * Decision A (§ "manifest keys on package AND type") refines the shape: each
+ * manifest entry is a package *keyed to the exported names that are DB handles*,
+ * not a bare package name. `DB_PACKAGES` remains the coarse key set — the
+ * staleness report and the `is-this-a-DB-package` predicates read it — while
+ * `DB_HANDLE_TYPES` carries the per-package handle names the import-seed step
+ * (`extractProvenancedImports`) consults to decide whether a *named* import
+ * seeds handle provenance. The motivating case is `@cloudflare/workers-types`:
+ * it exports hundreds of type names, of which only `D1Database` /
+ * `D1PreparedStatement` are DB handles — `KVNamespace`, `R2Bucket` and
+ * `ExecutionContext` must stay `unproven`, so package-level granularity is not
+ * enough.
+ */
+export declare const DB_PACKAGES: ReadonlySet<string>;
+/**
+ * The per-package handle names (exported types/factories whose import seeds
+ * handle provenance), keyed by base package name. A named import
+ * (`import { Pool } from 'pg'`) seeds only when `Pool` is in the package's list;
+ * a default import (`import Database from 'better-sqlite3'`) or namespace import
+ * (`import * as pg from 'pg'`) seeds unconditionally — a DB package's default /
+ * namespace is its handle, and tree-sitter records no original export name for a
+ * default import to match against. A factory entry (`drizzle`, `neon`,
+ * `createClient`, `connect`, …) names the function whose *call* returns the
+ * handle, seeded so the call-return propagation rule reaches it.
+ */
+export declare const DB_HANDLE_TYPES: ReadonlyMap<string, ReadonlySet<string>>;
+/**
+ * Resolve a module specifier to its DB-handle names, or `undefined` when the
+ * specifier does not name a DB package. Mirrors the exact-or-subpath match
+ * `provenance.ts` uses for `DB_PACKAGES` membership, so `pg/lib` and
+ * `mysql2/promise` resolve to their base package's handle names.
+ *
+ * @param specifier the module specifier to resolve to DB-handle names
+ * @returns the DB-handle names for the package, or undefined when not a DB package
+ */
+export declare function handleTypesForPackage(specifier: string): ReadonlySet<string> | undefined;
+/**
+ * True when `name` is a handle type of *some* manifest DB package — the reverse
+ * of `handleTypesForPackage`. `classifyTypeText` uses this to resolve a bare type
+ * annotation to `handle` under Decision A.
+ */
+export declare function isDbHandleTypeName(name: string): boolean;
+/**
+ * The *declaring packages* of a handle-type name — every manifest package whose
+ * handle list contains `name`. `classifyTypeText`'s ambient arm consults this to
+ * gate the unbound-name credit (Spec 70 criterion 9, Item 3): a bare `D1Database`
+ * with no import is `handle` only when a package that declares it is a declared
+ * dependency of the project — otherwise the name resolved to nothing. A name
+ * declared by several packages (`Pool` under `pg`/`mysql2`/`@neondatabase/serverless`,
+ * `Database` under `better-sqlite3`/`bun:sqlite`/`node:sqlite`) returns the whole
+ * set; the caller asks whether *any* of them is declared.
+ *
+ * @param name the handle-type name whose declaring packages are sought
+ * @returns the set of packages declaring the name, or undefined when none do
+ */
+export declare function dbHandlePackagesForName(name: string): ReadonlySet<string> | undefined;
+/**
+ * True when a module specifier names a Node builtin (`fs`, `node:fs`,
+ * `fs/promises`). A bare import reaching here was not a database package, so a
+ * builtin is provably `not-handle` (criterion: no Node builtin is a DB client).
+ *
+ * @param specifier the module specifier to test
+ * @returns true when the specifier names a Node builtin module or subpath
+ */
+export declare function isNodeBuiltin(specifier: string): boolean;
+/**
+ * JS builtin global names — enumerated from the global object at load, never a
+ * hand-written list. A receiver whose declaration resolves to one of these types
+ * (`Array`, `Map`, `Set`, `String`, `JSON`, `Object`, `Number`, `RegExp`,
+ * `Promise`, `Date`, `Buffer`, …) is `not-handle`, proven: no global is a
+ * database client. Constructors (function with a `prototype`) and namespace
+ * objects (`JSON`, `Math`, `crypto`) are both included.
+ */
+export declare const JS_GLOBALS: ReadonlySet<string>;
+/** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
+export declare const ORM_METHODS: ReadonlySet<string>;
+/**
+ * True when a method name is an ORM method. The one ecosystem predicate a caller
+ * above the resolution interface needs: `dbMethodInMemberChain` (inside the
+ * implementation) reads `ORM_METHODS` directly, but the data-access analyzer's
+ * query-compiler discriminator (`isSqlStringConstruction`) must not read the set
+ * itself. `ORM_METHODS` is mixed-case (`findUnique`, `selectFrom`), so the match
+ * tests both the lowercased form (for lowercase entries like `find`/`select`/`set`)
+ * and the raw name (for camelCase entries).
+ */
+export declare function isOrmMethod(method: string): boolean;
+//# sourceMappingURL=tsEcosystem.d.ts.map

package/dist/analyzers/tsEcosystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsEcosystem.d.ts","sourceRoot":"","sources":["../../src/analyzers/tsEcosystem.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAA0C,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAEpE,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAUxF;AAgBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAOrF;AAeD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAuBvC,CAAC;AAEL,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAyC1C,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGnD"}