code-auditor-mcp 4.1.1 → 5.0.2

package/dist/phase/conventionMining.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Spec 68 §3.2 — the `mined-conventions` corpus producer.
+ *
+ * The conventions analyzer is the third index-backed analyzer whose *rule* half
+ * moves onto the phase model (after styles and cross-domain). Its input is the
+ * mined-conventions set — a derived fact — so the producer is a corpus
+ * processor: `function-index` (the per-file fact) reduces to `mined-conventions`
+ * through the three pure miners that also back the SQLite path.
+ *
+ * The pure miners (`mineUsagePairsFromFacts` / `mineErrorHandlingFromFacts` /
+ * `mineNamingFromFacts` / `mineExportShapeFromFacts` /
+ * `mineImportFormFromFacts` in conventionMiner.ts) are byte-identical to the DB
+ * miners the legacy pipeline ran; the DB miners are now thin wrappers that
+ * project `functions`/`function_calls` rows into the same row types and call the
+ * pure function. So the corpus fact produced here is, for the five domains the
+ * `function-index` (+ `export-form` + `import-form`) facts can serve, the same
+ * set the SQLite `conventions` table held. `import-form` reads the `import-form`
+ * fact — a distinct per-file fact (regex-parsed source, not the AST `imports`
+ * fact) — but is still driven off the `function-index` distinct-file set, so a
+ * file with imports but no indexed function contributes nothing on either path.
+ *
+ * The DB-assigned `id` is dropped (a function's identity is `(file, name, line)`),
+ * so the array index stands in for it here; the miner uses `id` only to key the
+ * caller→function and caller→call-set maps, so 0-based indices are equivalent to
+ * 1-based auto-increments as long as the array order mirrors the DB row order.
+ * `hash`/`created_at` are storage-only fields the phase model has no analogue of.
+ */
+import type { ConventionMiningConfig } from '../types.js';
+import type { ExportFormFact, FunctionIndexFact, ImportFormFact, MinedConvention } from './types.js';
+/**
+ * The mining thresholds the production pipeline runs. `mineAllConventions`
+ * (codeIndexDB.ts) mines with exactly these values; keeping the phase producer's
+ * default identical means the corpus fact matches the SQLite `conventions` table
+ * on a real index-synced corpus.
+ */
+export declare const DEFAULT_MINING_CONFIG: ConventionMiningConfig;
+/**
+ * Mine the function-index-servable domains from the assembled fact and reduce
+ * them to the `mined-conventions` fact. The array index is the synthetic `id`
+ * (see the header) — the miner's exemplar anchor is `(file, line)`, so the
+ * numbering is only a key, never a finding field.
+ *
+ * `usage-pair` / `error-handling` / `naming` are servable from `function-index`
+ * alone. `export-shape` additionally needs the `export-form` fact (the
+ * AST-extracted `(name, isDefault)` exports the legacy reducer read as
+ * `exportsMap`), so it is mined only when `exportForms` is provided. `import-form`
+ * additionally needs the `import-form` fact (regex-parsed source), so it is mined
+ * only when `importForms` is provided — a caller that has not assembled those
+ * facts (the three-domain parity seed) simply gets the three domains, never a
+ * half-formed export-shape or import-form convention.
+ *
+ * @param facts - The assembled `function-index` facts to mine from.
+ * @param exportForms - The `export-form` facts (enables `export-shape` mining).
+ * @param importForms - The `import-form` facts (enables `import-form` mining).
+ * @param config - The mining thresholds (defaults to {@link DEFAULT_MINING_CONFIG}).
+ * @returns The mined conventions, capped per domain and stripped of DB-only fields.
+ */
+export declare function mineConventionsFromFunctionIndex(facts: readonly FunctionIndexFact[], exportForms?: readonly ExportFormFact[], importForms?: readonly ImportFormFact[], config?: ConventionMiningConfig): MinedConvention[];
+//# sourceMappingURL=conventionMining.d.ts.map

package/dist/phase/conventionMining.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conventionMining.d.ts","sourceRoot":"","sources":["../../src/phase/conventionMining.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAc,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAerG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,sBAKnC,CAAC;AAsBF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,WAAW,GAAE,SAAS,cAAc,EAAO,EAC3C,WAAW,GAAE,SAAS,cAAc,EAAO,EAC3C,MAAM,GAAE,sBAA8C,GACrD,eAAe,EAAE,CA2EnB"}

package/dist/phase/conventionMining.js

@@ -0,0 +1,152 @@
+/**
+ * Spec 68 §3.2 — the `mined-conventions` corpus producer.
+ *
+ * The conventions analyzer is the third index-backed analyzer whose *rule* half
+ * moves onto the phase model (after styles and cross-domain). Its input is the
+ * mined-conventions set — a derived fact — so the producer is a corpus
+ * processor: `function-index` (the per-file fact) reduces to `mined-conventions`
+ * through the three pure miners that also back the SQLite path.
+ *
+ * The pure miners (`mineUsagePairsFromFacts` / `mineErrorHandlingFromFacts` /
+ * `mineNamingFromFacts` / `mineExportShapeFromFacts` /
+ * `mineImportFormFromFacts` in conventionMiner.ts) are byte-identical to the DB
+ * miners the legacy pipeline ran; the DB miners are now thin wrappers that
+ * project `functions`/`function_calls` rows into the same row types and call the
+ * pure function. So the corpus fact produced here is, for the five domains the
+ * `function-index` (+ `export-form` + `import-form`) facts can serve, the same
+ * set the SQLite `conventions` table held. `import-form` reads the `import-form`
+ * fact — a distinct per-file fact (regex-parsed source, not the AST `imports`
+ * fact) — but is still driven off the `function-index` distinct-file set, so a
+ * file with imports but no indexed function contributes nothing on either path.
+ *
+ * The DB-assigned `id` is dropped (a function's identity is `(file, name, line)`),
+ * so the array index stands in for it here; the miner uses `id` only to key the
+ * caller→function and caller→call-set maps, so 0-based indices are equivalent to
+ * 1-based auto-increments as long as the array order mirrors the DB row order.
+ * `hash`/`created_at` are storage-only fields the phase model has no analogue of.
+ */
+import { mineUsagePairsFromFacts, mineErrorHandlingFromFacts, mineNamingFromFacts, mineExportShapeFromFacts, mineImportFormFromFacts, capPerDomain, } from '../conventions/conventionMiner.js';
+/**
+ * The mining thresholds the production pipeline runs. `mineAllConventions`
+ * (codeIndexDB.ts) mines with exactly these values; keeping the phase producer's
+ * default identical means the corpus fact matches the SQLite `conventions` table
+ * on a real index-synced corpus.
+ */
+export const DEFAULT_MINING_CONFIG = {
+    minCorpus: 20,
+    pairConfidence: 0.9,
+    modeShare: 0.8,
+    maxConventionsPerDomain: 200,
+};
+/** Strip the DB-only fields, keeping the detection projection. */
+function toMinedConvention(c) {
+    return {
+        domain: c.domain,
+        rule_id: c.rule_id,
+        antecedent: c.antecedent,
+        consequent: c.consequent,
+        pattern: c.pattern,
+        directory: c.directory,
+        file_path: c.file_path,
+        line: c.line,
+        support: c.support,
+        total_cases: c.total_cases,
+        confidence: c.confidence,
+        exemplar_file: c.exemplar_file,
+        exemplar_line: c.exemplar_line,
+        export_kind: c.export_kind ?? null,
+    };
+}
+/**
+ * Mine the function-index-servable domains from the assembled fact and reduce
+ * them to the `mined-conventions` fact. The array index is the synthetic `id`
+ * (see the header) — the miner's exemplar anchor is `(file, line)`, so the
+ * numbering is only a key, never a finding field.
+ *
+ * `usage-pair` / `error-handling` / `naming` are servable from `function-index`
+ * alone. `export-shape` additionally needs the `export-form` fact (the
+ * AST-extracted `(name, isDefault)` exports the legacy reducer read as
+ * `exportsMap`), so it is mined only when `exportForms` is provided. `import-form`
+ * additionally needs the `import-form` fact (regex-parsed source), so it is mined
+ * only when `importForms` is provided — a caller that has not assembled those
+ * facts (the three-domain parity seed) simply gets the three domains, never a
+ * half-formed export-shape or import-form convention.
+ *
+ * @param facts - The assembled `function-index` facts to mine from.
+ * @param exportForms - The `export-form` facts (enables `export-shape` mining).
+ * @param importForms - The `import-form` facts (enables `import-form` mining).
+ * @param config - The mining thresholds (defaults to {@link DEFAULT_MINING_CONFIG}).
+ * @returns The mined conventions, capped per domain and stripped of DB-only fields.
+ */
+export function mineConventionsFromFunctionIndex(facts, exportForms = [], importForms = [], config = DEFAULT_MINING_CONFIG) {
+    const usageFuncs = [];
+    const errFuncs = [];
+    const namingFuncs = [];
+    const exportShapeFuncs = [];
+    const calls = [];
+    facts.forEach((f, i) => {
+        // usage-pair reads every function (projectSymbols + exemplar anchor), no
+        // is_exported filter — mirrors `SELECT … FROM functions`.
+        usageFuncs.push({ id: i, name: f.name, file_path: f.file, line_number: f.line });
+        // error-handling reads only functions with a body — mirrors `WHERE body IS NOT NULL`.
+        if (f.body != null) {
+            errFuncs.push({ id: i, name: f.name, file_path: f.file, line_number: f.line, body: f.body });
+        }
+        // naming and export-shape read only exported functions — mirror
+        // `WHERE is_exported = 1`. The export-shape row projection is the same
+        // `SELECT id, name, file_path, line_number` the DB miner reads; the form
+        // comes from the export-form fact at reduction time.
+        if (f.isExported) {
+            namingFuncs.push({
+                id: i,
+                name: f.name,
+                file_path: f.file,
+                line_number: f.line,
+                entity_type: f.entityType,
+                component_type: f.componentType,
+            });
+            exportShapeFuncs.push({ id: i, name: f.name, file_path: f.file, line_number: f.line });
+        }
+        for (const callee of f.functionCalls) {
+            calls.push({ caller_id: i, callee_name: callee });
+        }
+    });
+    // file → exports (the export-form fact projected to the lookup `getExportForm`
+    // consumes). The fact is flat ({file, name, isDefault}[]), so group it.
+    const exportFormByFile = new Map();
+    for (const e of exportForms) {
+        const list = exportFormByFile.get(e.file);
+        if (list)
+            list.push({ name: e.name, isDefault: e.isDefault });
+        else
+            exportFormByFile.set(e.file, [{ name: e.name, isDefault: e.isDefault }]);
+    }
+    const mined = [
+        ...mineUsagePairsFromFacts(usageFuncs, calls, config),
+        ...mineErrorHandlingFromFacts(errFuncs, config),
+        ...mineNamingFromFacts(namingFuncs, config),
+    ];
+    if (exportForms.length > 0) {
+        mined.push(...mineExportShapeFromFacts(exportShapeFuncs, config, (fp) => exportFormByFile.get(fp)));
+    }
+    if (importForms.length > 0) {
+        // The legacy import-form miner read `SELECT DISTINCT file_path FROM functions`
+        // — the *distinct* file set in first-appearance order. The `function-index`
+        // fact is flat (one element per function), so derive that same distinct set
+        // here and drive the pure miner off it. A file with imports but no indexed
+        // function contributes nothing on either path (its imports are dropped by
+        // the distinct-file filter, matching the DB miner's source read).
+        const distinctFiles = [...new Set(facts.map((f) => f.file))];
+        const importFormByFile = new Map();
+        for (const imp of importForms) {
+            const list = importFormByFile.get(imp.file);
+            if (list)
+                list.push({ source: imp.source, form: imp.form, line: imp.line });
+            else
+                importFormByFile.set(imp.file, [{ source: imp.source, form: imp.form, line: imp.line }]);
+        }
+        mined.push(...mineImportFormFromFacts(distinctFiles, (fp) => importFormByFile.get(fp), config));
+    }
+    return capPerDomain(mined, config.maxConventionsPerDomain).map(toMinedConvention);
+}
+//# sourceMappingURL=conventionMining.js.map

package/dist/phase/conventionMining.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conventionMining.js","sourceRoot":"","sources":["../../src/phase/conventionMining.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,YAAY,GAMb,MAAM,mCAAmC,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,GAAG;IACd,uBAAuB,EAAE,GAAG;CAC7B,CAAC;AAEF,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,CAAa;IACtC,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAmC,EACnC,cAAyC,EAAE,EAC3C,cAAyC,EAAE,EAC3C,SAAiC,qBAAqB;IAEtD,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAClD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAEhC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,yEAAyE;QACzE,0DAA0D;QAC1D,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjF,sFAAsF;QACtF,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,gEAAgE;QAChE,uEAAuE;QACvE,yEAAyE;QACzE,qDAAqD;QACrD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC;gBACf,EAAE,EAAE,CAAC;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI;gBACnB,WAAW,EAAE,CAAC,CAAC,UAAU;gBACzB,cAAc,EAAE,CAAC,CAAC,aAAa;aAChC,CAAC,CAAC;YACH,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuD,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;;YACzD,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAiB;QAC1B,GAAG,uBAAuB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;QACrD,GAAG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC/C,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC;KAC5C,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAiF,CAAC;QAClH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;;gBACvE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AACpF,CAAC"}

package/dist/phase/coverage.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Spec 68 §8 — derived coverage.
+ *
+ * The legacy pipeline derived per-rule coverage by cross-referencing the
+ * registry against the analyzer-results map, a visitor/reducer status machine,
+ * and a per-rule `input` mapping (`buildCoverageReport` in pipeline.ts). That
+ * required a hand-maintained `input` list per rule — the exact "there is a
+ * list to be omitted from" defect class §0 exists to remove — and could only
+ * say `unassessed` for a rule with no mapping.
+ *
+ * Derived coverage inverts the direction: a rule's `needs` *declaration* is the
+ * whole story. Every rule already declares the formats it can evaluate and the
+ * fact kinds it reads (enforced by the type), so its coverage state is a pure
+ * function of (a) whether it fired, (b) whether any of its declared formats was
+ * present, (c) whether every declared fact has a producer able to serve a
+ * declared format, and (d) whether every declared fact was complete for every
+ * file. No per-rule list, no status machine — the declaration is the input.
+ *
+ * Five states, resolved in precedence order (first match wins):
+ *
+ *   | # | State          | Trigger                                                        |
+ *   |---|----------------|----------------------------------------------------------------|
+ *   | 1 | `fired`        | ≥1 finding carries this rule's id                              |
+ *   | 2 | `notApplicable`| rule not enabled, or no file of a declared format present      |
+ *   | 3 | `cannot-fire`  | a declared fact has no producer for any declared format        |
+ *   | 4 | `incomplete`   | a declared fact is missing for ≥1 file (parse/producer/worker) |
+ *   | 5 | `clean`        | otherwise — could have fired, produced nothing                 |
+ *
+ * `incomplete` is §8's replacement for the legacy `unassessed`: it names the
+ * *fact* and the *files* that went missing, so a partial run is observable
+ * rather than silently recorded as either `clean` (a false negative) or
+ * `unassessed` (no provenance). The precedence puts `cannot-fire` above
+ * `incomplete` — a structurally broken rule is broken whether or not its input
+ * was complete — and `incomplete` above `clean`, because a rule whose declared
+ * fact is partially absent cannot honestly assert "could have fired".
+ */
+import type { FactKind, Format, Finding, RuleDefinition } from './types.js';
+import type { RuleCoverage } from '../types.js';
+export interface CoverageInput {
+    /** The rules in scope (the migrated set, or the whole registry). */
+    rules: readonly RuleDefinition<any>[];
+    /** The findings produced this run. */
+    findings: readonly Finding[];
+    /** Formats present in the corpus (discovered files), regardless of parse success. */
+    presentFormats: ReadonlySet<Format>;
+    /** The enabled rule subset; undefined runs every rule. Disabled rules read
+     *  `notApplicable` — a stated skip, not silence (Spec 66 R6). */
+    enabledRules?: ReadonlySet<string>;
+    /** Fact kind → files whose fact is incomplete (parse dropped, producer threw,
+     *  or a worker shard was lost). Absent = every declared fact was complete. */
+    incompleteFacts?: ReadonlyMap<FactKind, ReadonlySet<string>>;
+    /** Resolve a rule's analyzer/group label for {@link RuleCoverage.analyzer}.
+     *  Defaults to the rule id (the registry mapping is deleted in §15). */
+    groupOf?: (ruleId: string) => string;
+}
+/**
+ * Derive per-rule coverage from the rules' declarations and the run's findings.
+ *
+ * @param input - The run's rules, findings, present formats, and completeness map.
+ * @returns One `RuleCoverage` per rule, in the input rule order.
+ */
+export declare function deriveCoverage(input: CoverageInput): RuleCoverage[];
+/** The formats present in a discovered file list, for feeding {@link CoverageInput}. */
+export declare function presentFormatsOf(filePaths: readonly string[]): ReadonlySet<Format>;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/phase/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../src/phase/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoBhD,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,KAAK,EAAE,SAAS,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,sCAAsC;IACtC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,qFAAqF;IACrF,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC;qEACiE;IACjE,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC;kFAC8E;IAC9E,eAAe,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D;4EACwE;IACxE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,YAAY,EAAE,CA6DnE;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAElF"}

package/dist/phase/coverage.js

@@ -0,0 +1,121 @@
+/**
+ * Spec 68 §8 — derived coverage.
+ *
+ * The legacy pipeline derived per-rule coverage by cross-referencing the
+ * registry against the analyzer-results map, a visitor/reducer status machine,
+ * and a per-rule `input` mapping (`buildCoverageReport` in pipeline.ts). That
+ * required a hand-maintained `input` list per rule — the exact "there is a
+ * list to be omitted from" defect class §0 exists to remove — and could only
+ * say `unassessed` for a rule with no mapping.
+ *
+ * Derived coverage inverts the direction: a rule's `needs` *declaration* is the
+ * whole story. Every rule already declares the formats it can evaluate and the
+ * fact kinds it reads (enforced by the type), so its coverage state is a pure
+ * function of (a) whether it fired, (b) whether any of its declared formats was
+ * present, (c) whether every declared fact has a producer able to serve a
+ * declared format, and (d) whether every declared fact was complete for every
+ * file. No per-rule list, no status machine — the declaration is the input.
+ *
+ * Five states, resolved in precedence order (first match wins):
+ *
+ *   | # | State          | Trigger                                                        |
+ *   |---|----------------|----------------------------------------------------------------|
+ *   | 1 | `fired`        | ≥1 finding carries this rule's id                              |
+ *   | 2 | `notApplicable`| rule not enabled, or no file of a declared format present      |
+ *   | 3 | `cannot-fire`  | a declared fact has no producer for any declared format        |
+ *   | 4 | `incomplete`   | a declared fact is missing for ≥1 file (parse/producer/worker) |
+ *   | 5 | `clean`        | otherwise — could have fired, produced nothing                 |
+ *
+ * `incomplete` is §8's replacement for the legacy `unassessed`: it names the
+ * *fact* and the *files* that went missing, so a partial run is observable
+ * rather than silently recorded as either `clean` (a false negative) or
+ * `unassessed` (no provenance). The precedence puts `cannot-fire` above
+ * `incomplete` — a structurally broken rule is broken whether or not its input
+ * was complete — and `incomplete` above `clean`, because a rule whose declared
+ * fact is partially absent cannot honestly assert "could have fired".
+ */
+import { PRODUCERS, CORPUS_PRODUCERS } from './producers.js';
+import { formatFor } from './runner.js';
+/** Producer availability: the formats each *file* fact kind can be supplied by. */
+function producerFormats(kind) {
+    const formats = PRODUCERS[kind];
+    return new Set(formats ? Object.keys(formats) : []);
+}
+/** True when `kind` is corpus-produced (format-independent), not a file fact. */
+function isCorpusFact(kind) {
+    return Object.prototype.hasOwnProperty.call(CORPUS_PRODUCERS, kind);
+}
+/** The declared fact kinds a producer can serve for a present declared format. */
+function servable(kind, presentDeclared) {
+    if (isCorpusFact(kind))
+        return true;
+    const formats = producerFormats(kind);
+    return presentDeclared.some((f) => formats.has(f));
+}
+/**
+ * Derive per-rule coverage from the rules' declarations and the run's findings.
+ *
+ * @param input - The run's rules, findings, present formats, and completeness map.
+ * @returns One `RuleCoverage` per rule, in the input rule order.
+ */
+export function deriveCoverage(input) {
+    const countByRule = new Map();
+    for (const f of input.findings) {
+        countByRule.set(f.ruleId, (countByRule.get(f.ruleId) ?? 0) + 1);
+    }
+    return input.rules.map((rule) => {
+        const group = input.groupOf?.(rule.id) ?? rule.id;
+        const count = countByRule.get(rule.id) ?? 0;
+        if (count > 0)
+            return { ruleId: rule.id, analyzer: group, state: 'fired', count };
+        if (input.enabledRules && !input.enabledRules.has(rule.id)) {
+            return {
+                ruleId: rule.id,
+                analyzer: group,
+                state: 'notApplicable',
+                count: 0,
+                reason: `rule "${rule.id}" not enabled`,
+            };
+        }
+        const declared = rule.needs.formats;
+        const presentDeclared = declared.filter((f) => input.presentFormats.has(f));
+        if (presentDeclared.length === 0) {
+            return {
+                ruleId: rule.id,
+                analyzer: group,
+                state: 'notApplicable',
+                count: 0,
+                reason: `no file of a declared format present (declares: ${declared.join(', ')})`,
+            };
+        }
+        const facts = rule.needs.facts;
+        const unservable = facts.filter((fact) => !servable(fact, presentDeclared));
+        if (unservable.length > 0) {
+            return {
+                ruleId: rule.id,
+                analyzer: group,
+                state: 'cannot-fire',
+                count: 0,
+                reason: `fact(s) ${unservable.join(', ')} have no producer for declared format(s) ${presentDeclared.join(', ')}`,
+            };
+        }
+        for (const fact of facts) {
+            const files = input.incompleteFacts?.get(fact);
+            if (files && files.size > 0) {
+                return {
+                    ruleId: rule.id,
+                    analyzer: group,
+                    state: 'incomplete',
+                    count: 0,
+                    reason: `fact "${fact}" incomplete for ${files.size} file(s)`,
+                };
+            }
+        }
+        return { ruleId: rule.id, analyzer: group, state: 'clean', count: 0 };
+    });
+}
+/** The formats present in a discovered file list, for feeding {@link CoverageInput}. */
+export function presentFormatsOf(filePaths) {
+    return new Set(filePaths.map((p) => formatFor(p)));
+}
+//# sourceMappingURL=coverage.js.map

package/dist/phase/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../src/phase/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,mFAAmF;AACnF,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,OAAO,GAAI,SAAgE,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC,CAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,IAAc,EAAE,eAAkC;IAClE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAoBD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QAElD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAkB,CAAC;QAElG,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE,eAAe;aACxB,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAA4B,CAAC;QACzD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,mDAAmD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAClE,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAA4B,CAAC;QACtD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjG,CAAC;QACpB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,YAAY;oBACnB,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,SAAS,IAAI,oBAAoB,KAAK,CAAC,IAAI,UAAU;iBAC9C,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAkB,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,SAA4B;IAC3D,OAAO,IAAI,GAAG,CAAS,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/phase/dag.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Spec 68 §5 — the fact DAG.
+ *
+ * `CorpusProcessor.needs` forms a directed graph over fact kinds: an edge
+ * `produces → need` means "this fact depends on that fact, so that fact must
+ * complete first." Topological levels over this graph are the schedule — every
+ * producer in a level runs concurrently, and a level begins only when the
+ * previous level has completed for every file.
+ *
+ * A cycle in this graph is a real defect (a fact that transitively depends on
+ * itself), and it is caught here by a DFS that returns the cycle path so the
+ * guard test can name both ends of the back edge (§16 guard 4, criterion 5) —
+ * rather than a boolean "has a cycle" that leaves the offending edge to be
+ * found by hand.
+ */
+import type { FactKind } from './types.js';
+/** The minimal producer projection the graph walks: what it makes, what it needs. */
+export type FactProducer = {
+    readonly produces: FactKind;
+    readonly needs?: readonly FactKind[];
+};
+/**
+ * Every dependency edge in the graph, as `[produces, needs]` pairs.
+ *
+ * @param producers - The producer map whose `needs` edges are enumerated.
+ * @returns One `[produces, needs]` pair per declared dependency.
+ */
+export declare function factEdges(producers: Readonly<Record<string, FactProducer>>): ReadonlyArray<readonly [FactKind, FactKind]>;
+/**
+ * Detects a cycle in the producer dependency graph, returning the cycle path
+ * (which repeats its first node at the end, so both ends of the back edge are
+ * named) or `null` when the graph is acyclic.
+ *
+ * @param producers - The producer map whose dependency graph is inspected.
+ * @returns The cycle path (first node repeated at the end), or `null` if acyclic.
+ */
+export declare function detectFactCycle(producers: Readonly<Record<string, FactProducer>>): FactKind[] | null;
+/**
+ * The schedule: fact kinds grouped into topological levels. A producer with no
+ * `needs` is level 0 (nothing precedes it); a corpus producer's level is one
+ * past the deepest of its needs' levels. A cycle makes the level-set infinite
+ * and is a defect — callers are expected to have run {@link detectFactCycle}
+ * first; this function returns `null` on a cycle rather than looping.
+ *
+ * @param producers - The producer map whose fact kinds are scheduled.
+ * @returns A `factKind` → level map, or `null` when the graph has a cycle.
+ */
+export declare function topologicalLevels(producers: Readonly<Record<string, FactProducer>>): Map<FactKind, number> | null;
+//# sourceMappingURL=dag.d.ts.map

package/dist/phase/dag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dag.d.ts","sourceRoot":"","sources":["../../src/phase/dag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAMzH;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CA0CpG;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAkBjH"}

package/dist/phase/dag.js

@@ -0,0 +1,120 @@
+/**
+ * Spec 68 §5 — the fact DAG.
+ *
+ * `CorpusProcessor.needs` forms a directed graph over fact kinds: an edge
+ * `produces → need` means "this fact depends on that fact, so that fact must
+ * complete first." Topological levels over this graph are the schedule — every
+ * producer in a level runs concurrently, and a level begins only when the
+ * previous level has completed for every file.
+ *
+ * A cycle in this graph is a real defect (a fact that transitively depends on
+ * itself), and it is caught here by a DFS that returns the cycle path so the
+ * guard test can name both ends of the back edge (§16 guard 4, criterion 5) —
+ * rather than a boolean "has a cycle" that leaves the offending edge to be
+ * found by hand.
+ */
+/**
+ * Every dependency edge in the graph, as `[produces, needs]` pairs.
+ *
+ * @param producers - The producer map whose `needs` edges are enumerated.
+ * @returns One `[produces, needs]` pair per declared dependency.
+ */
+export function factEdges(producers) {
+    const edges = [];
+    for (const p of Object.values(producers)) {
+        for (const need of p.needs ?? [])
+            edges.push([p.produces, need]);
+    }
+    return edges;
+}
+/**
+ * Detects a cycle in the producer dependency graph, returning the cycle path
+ * (which repeats its first node at the end, so both ends of the back edge are
+ * named) or `null` when the graph is acyclic.
+ *
+ * @param producers - The producer map whose dependency graph is inspected.
+ * @returns The cycle path (first node repeated at the end), or `null` if acyclic.
+ */
+export function detectFactCycle(producers) {
+    const adj = new Map();
+    for (const p of Object.values(producers)) {
+        const list = adj.get(p.produces) ?? [];
+        for (const need of p.needs ?? [])
+            list.push(need);
+        adj.set(p.produces, list);
+    }
+    const WHITE = 0;
+    const GRAY = 1;
+    const BLACK = 2;
+    const color = new Map();
+    const stack = [];
+    const visit = (node) => {
+        color.set(node, GRAY);
+        stack.push(node);
+        for (const next of adj.get(node) ?? []) {
+            const c = color.get(next) ?? WHITE;
+            if (c === GRAY) {
+                // Back edge: `next` is already on the DFS stack, so `stack.slice(idx)`
+                // is the path from `next` back to itself — both ends of the edge named.
+                const idx = stack.indexOf(next);
+                return [...stack.slice(idx), next];
+            }
+            if (c === WHITE) {
+                const cycle = visit(next);
+                if (cycle)
+                    return cycle;
+            }
+        }
+        stack.pop();
+        color.set(node, BLACK);
+        return null;
+    };
+    for (const node of adj.keys()) {
+        if ((color.get(node) ?? WHITE) === WHITE) {
+            const cycle = visit(node);
+            if (cycle)
+                return cycle;
+        }
+    }
+    return null;
+}
+/**
+ * The schedule: fact kinds grouped into topological levels. A producer with no
+ * `needs` is level 0 (nothing precedes it); a corpus producer's level is one
+ * past the deepest of its needs' levels. A cycle makes the level-set infinite
+ * and is a defect — callers are expected to have run {@link detectFactCycle}
+ * first; this function returns `null` on a cycle rather than looping.
+ *
+ * @param producers - The producer map whose fact kinds are scheduled.
+ * @returns A `factKind` → level map, or `null` when the graph has a cycle.
+ */
+export function topologicalLevels(producers) {
+    if (detectFactCycle(producers))
+        return null;
+    const level = new Map();
+    const resolve = (node) => {
+        const memo = level.get(node);
+        if (memo !== undefined)
+            return memo;
+        const p = producers[findProducerFor(node, producers)];
+        const needs = p?.needs ?? [];
+        const depth = needs.length === 0 ? 0 : 1 + Math.max(...needs.map(resolve));
+        level.set(node, depth);
+        return depth;
+    };
+    for (const node of Object.keys(producers).map((k) => producers[k].produces)) {
+        resolve(node);
+    }
+    return level;
+}
+function findProducerFor(node, producers) {
+    for (const [id, p] of Object.entries(producers)) {
+        if (p.produces === node)
+            return id;
+    }
+    // A `needs` target with no producer is a residue defect caught elsewhere
+    // (checks.ts `_allProduced`); here it just has no deeper dependencies, so it
+    // resolves at level 0.
+    return '';
+}
+//# sourceMappingURL=dag.js.map

package/dist/phase/dag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dag.js","sourceRoot":"","sources":["../../src/phase/dag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiD;IACzE,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiD;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,MAAM,KAAK,GAAG,CAAC,IAAc,EAAqB,EAAE;QAClD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiD;IACjF,IAAI,eAAe,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAc,EAAU,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAc,EAAE,SAAiD;IACxF,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,yEAAyE;IACzE,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/phase/dataAccessCalls.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Spec 68 §3.2 — the `data-access-calls` FileProcessor extraction.
+ *
+ * Re-homes the "extract resolved calls" half of `UniversalDataAccessAnalyzer`
+ * as a pure per-file processor. The analyzer's `analyzeWithFacts` did two jobs:
+ * extract `DatabaseCall[]` and derive violations from them. The producer keeps
+ * only the extraction — the calls the missing-org-filter / unfiltered-query /
+ * sql-injection-risk rules read. The analyzer's `extractDataAccessCalls` export
+ * is the synchronous extraction (its body was never actually awaited), run on
+ * {@link DEFAULT_DATA_ACCESS_CONFIG} since config is the §10 tuning surface and
+ * is not available to a `process(file)` call.
+ *
+ * `DatabaseCall` is structurally identical to the `ResolvedQuery` fact, so the
+ * mapping is the identity — this module owns only the `AstFile` → fact
+ * unwrapping, and the fact shape is pinned in `phase/types.ts`.
+ */
+import type { AstFile, ResolvedQuery } from './types.js';
+/** Extract the per-file resolved DB calls from one parsed file.
+ *
+ *  Spec 69 §10 S5a — when the legacy pipeline's cross-file resolution pre-pass
+ *  seeded this file's provenanced identifiers (`file.receiverProvenance`), thread
+ *  them as the extraction's provenance seed. This makes the finding path's
+ *  "proven handle" notion identical to the disposition classifier's, so a
+ *  query-shaped call on a proven handle is extracted (and can fire), a
+ *  proven-not-a-handle is skipped, and an unproven receiver is not silently
+ *  clean. Absent a seed (slice tests), the extraction runs on the default
+ *  config exactly as before.
+ *
+ * @param file the parsed file to extract DB calls from
+ * @returns the file's resolved DB calls
+ */
+export declare function extractDataAccessCalls(file: AstFile): ResolvedQuery[];
+//# sourceMappingURL=dataAccessCalls.d.ts.map

package/dist/phase/dataAccessCalls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataAccessCalls.d.ts","sourceRoot":"","sources":["../../src/phase/dataAccessCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMzD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,EAAE,CASrE"}