code-auditor-mcp 4.1.1 → 5.0.2

package/dist/analyzers/tsEcosystem.js

@@ -0,0 +1,241 @@
+import { builtinModules } from 'node:module';
+import databasePackages from '../languages/typescript/database-packages.json' with { type: 'json' };
+/**
+ * The TypeScript resolution implementation's ecosystem data.
+ *
+ * Standing correction `specs/correction-seams-not-placement.md` §4: the ecosystem
+ * data moves behind the interface, not into a renamed home. `DB_PACKAGES`, the
+ * Node builtin set, the JS global set and the ORM method set are the *TypeScript*
+ * resolution implementation's own data — the npm/TypeScript/JS-runtime vocabulary
+ * — and live here, the TS counterpart of `GO_DB_PACKAGES` / `GO_STDLIB_PACKAGES`
+ * in `languages/go/goResolution.ts`. No module above the resolution interface
+ * reads these sets: the TS implementation modules (`provenance.ts`,
+ * `receiverRoot.ts`, `receiverResolution.ts`) read them directly because they
+ * *are* the implementation; every caller above them asks a predicate
+ * (`isNodeBuiltin`, `isOrmMethod`) rather than importing a set.
+ *
+ * This replaces the old claim in `provenance.ts` that these were a "universal,
+ * language-invariant vocabulary": `database/sql` and `*sql.DB` are not npm
+ * package names, and `better-sqlite3` is not a Go import path. There is one
+ * ecosystem per dialect, owned by that dialect's resolution implementation.
+ */
+/**
+ * Database packages — the npm/TypeScript package vocabulary (Spec R1.1).
+ *
+ * Spec 70 R4 / criterion 10: this set is loaded from the per-ecosystem manifest
+ * (`src/languages/typescript/database-packages.json`, beside the format adapter),
+ * a declarative data file. Adding an ORM is a data edit that turns
+ * `cannot-fire` into a verdict; failing to add it never produces a wrong verdict.
+ * This is the ORM residual — the one irreducible fact R3 cannot derive from the
+ * audited code (which packages are database clients).
+ *
+ * Decision A (§ "manifest keys on package AND type") refines the shape: each
+ * manifest entry is a package *keyed to the exported names that are DB handles*,
+ * not a bare package name. `DB_PACKAGES` remains the coarse key set — the
+ * staleness report and the `is-this-a-DB-package` predicates read it — while
+ * `DB_HANDLE_TYPES` carries the per-package handle names the import-seed step
+ * (`extractProvenancedImports`) consults to decide whether a *named* import
+ * seeds handle provenance. The motivating case is `@cloudflare/workers-types`:
+ * it exports hundreds of type names, of which only `D1Database` /
+ * `D1PreparedStatement` are DB handles — `KVNamespace`, `R2Bucket` and
+ * `ExecutionContext` must stay `unproven`, so package-level granularity is not
+ * enough.
+ */
+export const DB_PACKAGES = new Set(Object.keys(databasePackages));
+/**
+ * The per-package handle names (exported types/factories whose import seeds
+ * handle provenance), keyed by base package name. A named import
+ * (`import { Pool } from 'pg'`) seeds only when `Pool` is in the package's list;
+ * a default import (`import Database from 'better-sqlite3'`) or namespace import
+ * (`import * as pg from 'pg'`) seeds unconditionally — a DB package's default /
+ * namespace is its handle, and tree-sitter records no original export name for a
+ * default import to match against. A factory entry (`drizzle`, `neon`,
+ * `createClient`, `connect`, …) names the function whose *call* returns the
+ * handle, seeded so the call-return propagation rule reaches it.
+ */
+export const DB_HANDLE_TYPES = new Map(Object.entries(databasePackages).map(([pkg, types]) => [pkg, new Set(types)]));
+/**
+ * Resolve a module specifier to its DB-handle names, or `undefined` when the
+ * specifier does not name a DB package. Mirrors the exact-or-subpath match
+ * `provenance.ts` uses for `DB_PACKAGES` membership, so `pg/lib` and
+ * `mysql2/promise` resolve to their base package's handle names.
+ *
+ * @param specifier the module specifier to resolve to DB-handle names
+ * @returns the DB-handle names for the package, or undefined when not a DB package
+ */
+export function handleTypesForPackage(specifier) {
+    if (!specifier)
+        return undefined;
+    if (DB_HANDLE_TYPES.has(specifier))
+        return DB_HANDLE_TYPES.get(specifier);
+    const slash = specifier.indexOf('/');
+    if (slash > 0 && specifier.startsWith('@')) {
+        const scoped = specifier.slice(0, specifier.indexOf('/', slash + 1));
+        return DB_HANDLE_TYPES.get(scoped);
+    }
+    if (slash > 0)
+        return DB_HANDLE_TYPES.get(specifier.slice(0, slash));
+    return undefined;
+}
+/**
+ * The reverse index of `DB_HANDLE_TYPES`: every handle-type name across all
+ * manifest packages, flattened to one set. Decision A's type→package arm —
+ * `classifyTypeText` consults this to resolve a bare type annotation
+ * (`D1Database`, `Pool`, `Kysely`) to `handle`, while a name absent from every
+ * manifest entry (`KVNamespace`, `R2Bucket`, `ExecutionContext`) stays
+ * `unproven`. The verdict is a boolean (is this name a DB handle type of *some*
+ * package), so the *which-package* half is not carried here — that is answered by
+ * `handleTypesForPackage` at the import-seed step.
+ */
+const DB_HANDLE_TYPE_NAMES = new Set([...DB_HANDLE_TYPES.values()].flatMap((names) => [...names]));
+/**
+ * True when `name` is a handle type of *some* manifest DB package — the reverse
+ * of `handleTypesForPackage`. `classifyTypeText` uses this to resolve a bare type
+ * annotation to `handle` under Decision A.
+ */
+export function isDbHandleTypeName(name) {
+    return DB_HANDLE_TYPE_NAMES.has(name);
+}
+/**
+ * The *declaring packages* of a handle-type name — every manifest package whose
+ * handle list contains `name`. `classifyTypeText`'s ambient arm consults this to
+ * gate the unbound-name credit (Spec 70 criterion 9, Item 3): a bare `D1Database`
+ * with no import is `handle` only when a package that declares it is a declared
+ * dependency of the project — otherwise the name resolved to nothing. A name
+ * declared by several packages (`Pool` under `pg`/`mysql2`/`@neondatabase/serverless`,
+ * `Database` under `better-sqlite3`/`bun:sqlite`/`node:sqlite`) returns the whole
+ * set; the caller asks whether *any* of them is declared.
+ *
+ * @param name the handle-type name whose declaring packages are sought
+ * @returns the set of packages declaring the name, or undefined when none do
+ */
+export function dbHandlePackagesForName(name) {
+    if (!name)
+        return undefined;
+    const result = [];
+    for (const [pkg, names] of DB_HANDLE_TYPES) {
+        if (names.has(name))
+            result.push(pkg);
+    }
+    return result.length > 0 ? new Set(result) : undefined;
+}
+// ─── The package discriminant: Node builtins + JS globals ─────────────────────
+//
+// The handle/not-handle decision cannot rest on a method *name* — `join` is
+// `Array.prototype.join` and it is also `SQL JOIN`. The discriminant is the
+// *package* (or global type) a receiver's declaration resolves to. Both halves
+// are probed from the vendor, never maintained as a hand-written replica:
+/** Node's builtin module names — the authoritative runtime list from
+ *  `require('module').builtinModules`, extended with the `node:` prefix and
+ *  subpath forms (`fs`, `node:fs`, `fs/promises`). A root resolving to one of
+ *  these is `not-handle`, proven. */
+const NODE_BUILTIN_MODULES = new Set(builtinModules);
+/**
+ * True when a module specifier names a Node builtin (`fs`, `node:fs`,
+ * `fs/promises`). A bare import reaching here was not a database package, so a
+ * builtin is provably `not-handle` (criterion: no Node builtin is a DB client).
+ *
+ * @param specifier the module specifier to test
+ * @returns true when the specifier names a Node builtin module or subpath
+ */
+export function isNodeBuiltin(specifier) {
+    if (!specifier)
+        return false;
+    const s = specifier.startsWith('node:') ? specifier.slice('node:'.length) : specifier;
+    if (NODE_BUILTIN_MODULES.has(s))
+        return true;
+    // Subpath imports (`fs/promises`, `node:test/reporters`) resolve to the parent.
+    const slash = s.indexOf('/');
+    return slash > 0 && NODE_BUILTIN_MODULES.has(s.slice(0, slash));
+}
+/**
+ * JS builtin global names — enumerated from the global object at load, never a
+ * hand-written list. A receiver whose declaration resolves to one of these types
+ * (`Array`, `Map`, `Set`, `String`, `JSON`, `Object`, `Number`, `RegExp`,
+ * `Promise`, `Date`, `Buffer`, …) is `not-handle`, proven: no global is a
+ * database client. Constructors (function with a `prototype`) and namespace
+ * objects (`JSON`, `Math`, `crypto`) are both included.
+ */
+export const JS_GLOBALS = (() => {
+    const names = new Set();
+    for (const name of Object.getOwnPropertyNames(globalThis)) {
+        // `localStorage` is the one global whose getter has a side effect: Node 22+
+        // emits an `ExperimentalWarning` (and, under `--experimental-webstorage`,
+        // throws) when it is read without `--localstorage-file`. It returns
+        // `undefined` in that state, so it would never enter the set anyway — skip
+        // it by name rather than evaluate it and pollute stderr (the hook's
+        // 0B-stderr contract turns any stray line into a blocking error). Every
+        // other global — including the other accessor globals (`sessionStorage`,
+        // `process`, `Buffer`, `crypto`, `fs`, …) — is evaluated normally.
+        if (name === 'localStorage')
+            continue;
+        let value;
+        try {
+            value = globalThis[name];
+        }
+        catch {
+            continue;
+        }
+        if (typeof value === 'function' || (value !== null && typeof value === 'object')) {
+            names.add(name);
+        }
+    }
+    return names;
+})();
+/** ORM method patterns — fixed API surface for ORM recognition (Spec 21 R1) */
+export const ORM_METHODS = new Set([
+    'find',
+    'findOne',
+    'findMany',
+    'findFirst',
+    'findUnique',
+    'select',
+    'insert',
+    'insertMany',
+    'update',
+    'updateOne',
+    'updateMany',
+    'delete',
+    'deleteOne',
+    'deleteMany',
+    'from',
+    'where',
+    'join',
+    'leftJoin',
+    'rightJoin',
+    'innerJoin',
+    'create',
+    'createMany',
+    'aggregate',
+    'count',
+    'distinct',
+    'execute',
+    'query',
+    // Kysely builder verbs (camelCase SQL, absent from the SQL-keyword path).
+    'selectFrom',
+    'selectAll',
+    'insertInto',
+    'updateTable',
+    'deleteFrom',
+    'executeTakeFirst',
+    'executeTakeFirstOrThrow',
+    'values',
+    'set',
+    'onConflict',
+    'returning',
+    'whereRef',
+]);
+/**
+ * True when a method name is an ORM method. The one ecosystem predicate a caller
+ * above the resolution interface needs: `dbMethodInMemberChain` (inside the
+ * implementation) reads `ORM_METHODS` directly, but the data-access analyzer's
+ * query-compiler discriminator (`isSqlStringConstruction`) must not read the set
+ * itself. `ORM_METHODS` is mixed-case (`findUnique`, `selectFrom`), so the match
+ * tests both the lowercased form (for lowercase entries like `find`/`select`/`set`)
+ * and the raw name (for camelCase entries).
+ */
+export function isOrmMethod(method) {
+    const lower = method.toLowerCase();
+    return ORM_METHODS.has(lower) || ORM_METHODS.has(method);
+}
+//# sourceMappingURL=tsEcosystem.js.map

package/dist/analyzers/tsEcosystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsEcosystem.js","sourceRoot":"","sources":["../../src/analyzers/tsEcosystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,gBAAgB,MAAM,gDAAgD,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAEpG;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6C,IAAI,GAAG,CAC9E,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,CAC1F,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CACvD,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAC7D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAE1E;;;qCAGqC;AACrC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,gFAAgF;IAChF,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,KAAK,GAAG,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,GAAG,EAAE;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QACtC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAI,UAAsC,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,MAAM;IACN,SAAS;IACT,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,WAAW;IACX,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,OAAO;IACP,UAAU;IACV,SAAS;IACT,OAAO;IACP,0EAA0E;IAC1E,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,kBAAkB;IAClB,yBAAyB;IACzB,QAAQ;IACR,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC"}

package/dist/analyzers/tsExpressionDescriptor.d.ts

@@ -0,0 +1,156 @@
+/**
+ * TS within-file-provenance split — the classify arm + the serializable descriptor
+ * (Spec 70 Item 4 / Item 3).
+ *
+ * `computeTsWithinFileProvenance` (receiverResolution.ts) reaches a fixed point
+ * over a file's AST: package-import seeds → propagation → wrapper classes →
+ * DB-returning functions, ≤10 passes. The phase model's collapse of the
+ * double-parse needs that same result *without* a second parse, so the work is
+ * split the way Go already splits it (`buildGoBindingEnv` = extract,
+ * `classifyGoBindings` = classify):
+ *
+ *   • extract  — `extractTsWithinFileProvenance` (provenance.ts, where the AST
+ *                walkers live) projects everything the fixed point reads into a
+ *                serializable {@link TsWithinFileProvenanceExtract}.
+ *   • classify — this module re-runs the fixed point over the projection, with no
+ *                AST, no adapter, and no source text.
+ *
+ * The two are pinned byte-identical by `spec70-ts-within-file-parity.spec.ts`:
+ * `classifyTsWithinFileProvenance(extractTsWithinFileProvenance(ast, …))` must
+ * equal `computeTsWithinFileProvenance(ast, …)` for every fixture.
+ *
+ * The descriptor is a **closed set** — five structured shapes plus an `unproven`
+ * residue — not a general expression serializer. It projects exactly the shapes
+ * `tryPropagateFromExpression` / `tryCallProvenance` / `delegatesToProvenanced`
+ * dispatch on, and nothing else.
+ */
+import { type Binding } from './receiverRoot.js';
+import type { ProvenanceEvidence } from './provenance.js';
+export type TsExpressionDescriptor = {
+    readonly kind: 'await';
+    readonly operand: TsExpressionDescriptor | null;
+} | {
+    readonly kind: 'new';
+    readonly ctorName: string | null;
+} | {
+    readonly kind: 'call';
+    readonly callee: TsExpressionDescriptor | null;
+    readonly args: readonly TsExpressionDescriptor[];
+} | {
+    readonly kind: 'identifier';
+    readonly name: string;
+} | {
+    readonly kind: 'member';
+    readonly receiver: TsExpressionDescriptor | null;
+    readonly property: string | null;
+    /**
+     * Full source text of this member node (`getNodeText`). `getMemberExpressionReceiver`
+     * returns the *full text* of a compound receiver (`env.DB` → "env.DB", `this.db` →
+     * "this.db"), and that text cannot be reconstructed from the structural chain once
+     * `this`/`super` collapse to `unproven` — so it is folded here, provenance-free,
+     * exactly like `isD1Rest` and `new.ctorName`.
+     */
+    readonly text: string;
+} | {
+    readonly kind: 'unproven';
+};
+/** A single-file propagation rule, projected in AST pre-order. */
+export type PropagationRule = {
+    readonly kind: 'variable-declarator';
+    readonly names: readonly string[];
+    readonly value: TsExpressionDescriptor | null;
+} | {
+    readonly kind: 'default-parameter';
+    readonly name: string;
+    readonly value: TsExpressionDescriptor;
+} | {
+    readonly kind: 'class-field';
+    readonly field: string;
+    readonly value: TsExpressionDescriptor;
+} | {
+    readonly kind: 'member-assignment';
+    readonly field: string;
+    readonly value: TsExpressionDescriptor;
+};
+/** One call inside a wrapper function's own body (nested functions excluded). */
+export interface OwnCall {
+    readonly callee: TsExpressionDescriptor | null;
+    /** `isD1RestCall` folded at extract — provenance-free, so it is precomputed. */
+    readonly isD1Rest: boolean;
+}
+/** One `new`/call expression inside a wrapper class body (nested classes/functions excluded). */
+export type ClassCall = {
+    readonly kind: 'new';
+    readonly ctorName: string | null;
+} | {
+    readonly kind: 'call';
+    readonly callee: TsExpressionDescriptor | null;
+    readonly isD1Rest: boolean;
+};
+export interface TsWithinFileProvenanceExtract {
+    /** `extractDBProvenancedImports` — the DB-package import seeds. */
+    readonly seeds: ReadonlyMap<string, ProvenanceEvidence>;
+    /**
+     * `buildBindingEnv` — the file's binding environment, projected at extract time
+     * so the classify arm can run the package discriminant (`classifyRootIdentifier`)
+     * over a receiver root's declaration with no AST. Carried whole rather than
+     * reconstructed: `buildBindingEnv` already serializes every binding as a
+     * `Binding`/`ValueDescriptor`, so re-deriving it from the propagation rules would
+     * be a lossy replica.
+     */
+    readonly bindings: ReadonlyMap<string, Binding>;
+    /** `collectLocalFunctionNames` — S5f refuses to forward through these. */
+    readonly localFunctions: ReadonlySet<string>;
+    /** The propagation rules, in `walkAST` pre-order. */
+    readonly propagationRules: readonly PropagationRule[];
+    /** Wrapper-function names + their own-call projections, in `findNodes` pre-order. */
+    readonly wrapperFunctions: readonly {
+        readonly name: string;
+        readonly ownCalls: readonly OwnCall[];
+    }[];
+    /** Wrapper-class names + their class-call projections, in `findNodes` pre-order. */
+    readonly wrapperClasses: readonly {
+        readonly name: string;
+        readonly classCalls: readonly ClassCall[];
+    }[];
+    /** Function names + their return-expression projections, in `findNodes` pre-order. */
+    readonly returningFunctions: readonly {
+        readonly name: string;
+        readonly returnExprs: readonly TsExpressionDescriptor[];
+    }[];
+    /**
+     * `extractInterfaceFields` — interface / type-alias field types
+     * (`Env → { DB: 'D1Database' }`), for the member-chain resolution arm
+     * (Spec 70 decision B3). Absent for Go.
+     */
+    readonly interfaceFields?: ReadonlyMap<string, ReadonlyMap<string, string>>;
+}
+/**
+ * Mirror of `propagateProvenance` over the projection's rule list.
+ * @param extract - The provenance-free within-file projection (rules + seeds).
+ * @param provenanceMap - The starting provenance map to propagate into.
+ * @returns The map after the propagation rules reach a fixed point.
+ */
+export declare function propagateProvenanceFromExtract(extract: TsWithinFileProvenanceExtract, provenanceMap: ReadonlyMap<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+/**
+ * Mirror of `detectDbWrappers`' *function* arm over the projection — the exact
+ * step `buildProvenanceContext` runs (functions only, no classes). The build-side
+ * provenance the four receiver consumers read stops at function wrappers; the
+ * classify-side fixed point (`classifyTsWithinFileProvenance`) additionally scans
+ * classes and returning functions, so the two need distinct mirrors.
+ * @param extract - The provenance-free within-file projection (wrapper functions).
+ * @param provenanceMap - The provenance map to fold wrapper names into.
+ * @returns The map with any function wrappers marked provenanced.
+ */
+export declare function detectDbWrapperFunctionsFromExtract(extract: TsWithinFileProvenanceExtract, provenanceMap: Map<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+/**
+ * Re-run `computeTsWithinFileProvenance`'s fixed point over a serializable
+ * projection, with no AST. `classifyTsWithinFileProvenance(
+ * extractTsWithinFileProvenance(ast, …), extraSeeds)` must equal
+ * `computeTsWithinFileProvenance(ast, …, extraSeeds)` — pinned by the parity spec.
+ * @param extract - The provenance-free within-file projection to classify.
+ * @param extraSeeds - Additional cross-file provenanced names to seed the map with.
+ * @returns The file's provenance map after the fixed point converges.
+ */
+export declare function classifyTsWithinFileProvenance(extract: TsWithinFileProvenanceExtract, extraSeeds?: ReadonlyMap<string, ProvenanceEvidence>): Map<string, ProvenanceEvidence>;
+//# sourceMappingURL=tsExpressionDescriptor.d.ts.map

package/dist/analyzers/tsExpressionDescriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsExpressionDescriptor.d.ts","sourceRoot":"","sources":["../../src/analyzers/tsExpressionDescriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAA0B,KAAK,OAAO,EAA0B,MAAM,mBAAmB,CAAC;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAM1D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GAC3H;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAoBlC,kEAAkE;AAClE,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,GAC1H;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACrG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAChG;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAE3G,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,iGAAiG;AACjG,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1G,MAAM,WAAW,6BAA6B;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,qFAAqF;IACrF,QAAQ,CAAC,gBAAgB,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,EAAE,CAAC;IACvG,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAA;KAAE,EAAE,CAAC;IACzG,sFAAsF;IACtF,QAAQ,CAAC,kBAAkB,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAA;KAAE,EAAE,CAAC;IAC3H;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7E;AAgQD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,6BAA6B,EACtC,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAgBjC;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,6BAA6B,EACtC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAgBjC;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,6BAA6B,EACtC,UAAU,GAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAa,GAC9D,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAgBjC"}