code-auditor-mcp 5.0.1 → 5.2.0

package/plugin/skills/code-auditor/SKILL.md

@@ -5,7 +5,7 @@ description: Audit code quality, search the codebase semantically, enforce invar
 
 # Code Auditor Skill
 
-> **Version 5.0.1** • Run `code-audit --version` to check your installed version.
+> **Version 5.2.0** • Run `code-audit --version` to check your installed version.
 > If versions differ, the CLI is authoritative — use `code-audit <command> --help` to see what your install actually supports.
 
 You have the `code-audit` CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.
@@ -82,10 +82,31 @@ A dismissal is for *this finding is not relevant*, not for *I don't want to fix
 
 The tool can send dismissed findings to an anonymous feedback service that collects them. It is **off by default** and is turned on only by an explicit opt-in:
 
-- `mcp__code-auditor__telemetry` `status` / `enable` / `disable` manage the opt-in. `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
+- `code-audit telemetry status` / `enable` / `disable` manage the opt-in (the `mcp__code-auditor__telemetry` tool mirrors the same toggle). `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
 - When opted in, each dismissal sends only the reason plus a structural shape — **no code, identifiers, or file paths**.
 
-Before enabling, tell the user the privacy facts: **data is anonymous, and the ID is generated locally to avoid tracking anything personal.** Only the reason and enough shape to reproduce the finding are sent; nothing derived from their code or environment.
+On first contact, run `code-audit telemetry status` and read its `decided` field:
+
+- **`decided` is false** — the user has never been asked. Tell them the privacy facts (below), then ask **once** whether to opt in. Run `code-audit telemetry enable` on yes and `code-audit telemetry disable` on no — either records the decision so the question is never repeated.
+- **`decided` is true** — the user has already chosen. Never ask again; leave the setting exactly as it is.
+
+The privacy facts: each submission contains the tool version, the rule ID, the urgency level, the dismissal reason exactly as typed, a structural AST signature (grammar node types only, never their contents), a coarse language hint, a timestamp, and an anonymous install ID generated locally on your machine. Source code, identifiers, literals, file paths, and environment details are never sent, unless the user types them into the reason.
+
+### `code-audit request-rule` — request a rule for an unflagged defect
+
+When you find a *class* of defect the audit did not flag, request a new rule instead of silently working around it:
+
+```bash
+code-audit request-rule \
+  --title "Flag unbounded loops" \
+  --symptom "A loop with no exit condition hangs the process at runtime." \
+  --signal "A for-loop over a dynamic collection with no bound check." \
+  --language typescript \
+  --fires bad.ts \
+  --clean fixed.ts
+```
+
+Call `lookup_rule` or `explain_symptom` first to confirm no existing rule covers it. Provide a minimal example that *should* be flagged (`--fires`) and a corrected example that *should not* (`--clean`), each reduced to the smallest code that shows the difference, with secrets and proprietary identifiers removed. The CLI prints a receipt id so the request can be tracked.
 
 ### `code-audit config` — know the project's laws
 
@@ -235,6 +256,8 @@ The hook auto-installs the package to a cache dir on first use — no manual npm
 | Resolve file profiles | `code-audit config profiles --file <path>` |
 | Next file to fix | `code-audit next-file` |
 | Dismiss a false positive | `code-audit dismiss <fingerprint> --reason "…"` |
+| Telemetry opt-in | `code-audit telemetry status` / `enable` / `disable` |
+| Request a new rule | `code-audit request-rule` |
 | Sync index | `code-audit index sync --path .` |
 | Codebase map | `code-audit map -p .` |
 | Mine conventions | `code-audit conventions list` |

package/server.json

@@ -1,21 +1,27 @@
 {
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.BenAHammond/code-auditor-mcp",
-  "description": "Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.",
+  "description": "Enforces architectural invariants and code quality rules inside your AI agent's edit loop.",
   "repository": {
     "url": "https://github.com/BenAHammond/code-auditor-mcp",
     "source": "github"
   },
-  "version": "5.0.1",
+  "version": "5.0.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "code-auditor-mcp",
-      "version": "5.0.1",
+      "version": "5.0.2",
       "transport": {
         "type": "stdio"
       }
     }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://www.codeauditormcp.com/api/mcp"
+    }
   ]
 }

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts

@@ -1,6 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=tool.d.ts.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/scripts/tool.js

@@ -1,12 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=tool.js.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts

@@ -1,7 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=demo-module.d.ts.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.js

@@ -1,13 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=demo-module.js.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-interface Row {
-    id: number;
-    name: string;
-}
-export declare function insertMany(db: any, rows: Row[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-01-prepare-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js

@@ -1,16 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-export async function insertMany(db, rows) {
-    const stmts = [];
-    for (const row of rows) {
-        const stmt = db.prepare('INSERT INTO items (id, name) VALUES (?, ?)');
-        stmts.push(stmt);
-    }
-    await db.batch(stmts);
-}
-//# sourceMappingURL=item-01-prepare-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAO,EAAE,IAAW;IACnD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts

@@ -1,15 +0,0 @@
-/**
- * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
- *
- * The explicit accumulate-then-batch shape: each loop iteration prepares and
- * binds a statement (statement construction — no I/O), pushes it to an array,
- * and a single `.batch()` after the loop executes them all. The eager call sits
- * outside the loop, so this is not an N+1.
- */
-interface ScoreRow {
-    id: number;
-    score: number;
-}
-export declare function rescoreMany(db: any, items: ScoreRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-02-prepare-bind-accumulate-batch.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js

@@ -1,17 +0,0 @@
-/**
- * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
- *
- * The explicit accumulate-then-batch shape: each loop iteration prepares and
- * binds a statement (statement construction — no I/O), pushes it to an array,
- * and a single `.batch()` after the loop executes them all. The eager call sits
- * outside the loop, so this is not an N+1.
- */
-export async function rescoreMany(db, items) {
-    const stmts = [];
-    for (const item of items) {
-        const stmt = db.prepare('UPDATE scores SET score = ? WHERE id = ?').bind(item.score, item.id);
-        stmts.push(stmt);
-    }
-    await db.batch(stmts);
-}
-//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.js.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-02-prepare-bind-accumulate-batch.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,KAAiB;IAC1D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
- *
- * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
- * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
- * skip must be surgical and leave eager member methods firing.
- */
-interface ItemRow {
-    id: number;
-    name: string;
-}
-export declare function renameAll(items: ItemRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-03-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-03-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAQD,wBAAsB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
- *
- * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
- * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
- * skip must be surgical and leave eager member methods firing.
- */
-import Database from 'better-sqlite3';
-// Spec 70 R4 — the handle is proven by the manifest-package import
-// (`better-sqlite3`), not a `D1Database` type annotation. `db.exec(sql)` with a
-// dynamic (interpolated) argument has no static SQL for R3, so the import is the
-// proof; the `D1Database` binding would read `unproven` (cannot-fire).
-const db = new Database(':memory:');
-export async function renameAll(items) {
-    for (const item of items) {
-        db.exec(`UPDATE items SET name = 'renamed' WHERE id = ${item.id}`);
-    }
-}
-//# sourceMappingURL=item-03-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-03-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAOtC,mEAAmE;AACnE,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts

@@ -1,18 +0,0 @@
-/**
- * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
- *
- * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
- * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
- * N+1 that must keep firing — the two-direction proof's positive arm.
- */
-interface RankRow {
-    id: number;
-    rank: number;
-}
-export declare class Leaderboard {
-    private sql;
-    constructor(sql: D1Database);
-    applyRanks(rows: RankRow[]): Promise<void>;
-}
-export {};
-//# sourceMappingURL=item-04-storage-sql-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;gBAEZ,GAAG,EAAE,UAAU;IAIrB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjD"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
- *
- * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
- * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
- * N+1 that must keep firing — the two-direction proof's positive arm.
- */
-export class Leaderboard {
-    sql;
-    constructor(sql) {
-        this.sql = sql;
-    }
-    async applyRanks(rows) {
-        for (const row of rows) {
-            this.sql.exec('UPDATE leaderboard SET rank = ? WHERE id = ?', row.rank, row.id);
-        }
-    }
-}
-//# sourceMappingURL=item-04-storage-sql-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,WAAW;IACd,GAAG,CAAa;IAExB,YAAY,GAAe;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
- * classified as `insert` writes).
- *
- * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
- * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
- * write classifier previously only matched `INSERT INTO`, so every rule reading
- * the write set (written-never-read, multi-table-write) missed them.
- *
- * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
- * is the table-extraction path that feeds `schema_usage.usage_type`.
- */
-export declare const UPSERT_QUERIES: {
-    readonly insertOrIgnore: "INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly insertOrReplace: "INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly replaceInto: "REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly onConflictDoUpdate: "INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled";
-};
-//# sourceMappingURL=item-05-upsert-forms.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-05-upsert-forms.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,cAAc;;;;;CASjB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
- * classified as `insert` writes).
- *
- * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
- * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
- * write classifier previously only matched `INSERT INTO`, so every rule reading
- * the write set (written-never-read, multi-table-write) missed them.
- *
- * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
- * is the table-extraction path that feeds `schema_usage.usage_type`.
- */
-export const UPSERT_QUERIES = {
-    insertOrIgnore: 'INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    insertOrReplace: 'INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    replaceInto: 'REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    onConflictDoUpdate: 'INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled',
-};
-//# sourceMappingURL=item-05-upsert-forms.js.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-05-upsert-forms.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc,EACZ,kEAAkE;IACpE,eAAe,EACb,mEAAmE;IACrE,WAAW,EACT,yDAAyD;IAC3D,kBAAkB,EAChB,mHAAmH;CAC7G,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts

@@ -1,17 +0,0 @@
-/**
- * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
- *
- * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
- * accumulate-then-batch shape (where the statement is pushed to an array and a
- * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
- * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
- * it skips standalone construction but leaves a prepare/bind that is chained
- * into an eager call firing.
- */
-interface SyncJob {
-    id: number;
-    slug: string;
-}
-export declare function syncBuildsForHeroes(db: D1Database, jobs: SyncJob[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-06-chained-prepare-run-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASxF"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
- *
- * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
- * accumulate-then-batch shape (where the statement is pushed to an array and a
- * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
- * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
- * it skips standalone construction but leaves a prepare/bind that is chained
- * into an eager call firing.
- */
-export async function syncBuildsForHeroes(db, jobs) {
-    for (const job of jobs) {
-        await db
-            .prepare(`UPDATE sync_jobs SET status = 'running', started_at = datetime('now') WHERE id = ?`)
-            .bind(job.id)
-            .run();
-    }
-}
-//# sourceMappingURL=item-06-chained-prepare-run-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAc,EAAE,IAAe;IACvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE;aACL,OAAO,CACN,oFAAoF,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts

@@ -1,25 +0,0 @@
-/**
- * Spec-52 R1 item 7 — chained prepare→bind→first<Row>() in a loop (oracle: MUST fire).
- *
- * The typed-read N+1: `.first<Row>()` (and `.all<Row>()`) is the D1 read idiom.
- * The generic type argument must not hide the eager method from detection — the
- * same gap that bit `too-many-queries`'s text regex. The AST path reads the
- * property name directly, so `first` is visible regardless of `<Row>`.
- */
-interface HeroRow {
-    id: number;
-    name: string;
-}
-interface Statement {
-    bind(...args: unknown[]): Statement;
-    first<T>(): T | null;
-    all<T>(): T[];
-    run(): unknown;
-}
-interface D1Database {
-    prepare(sql: string): Statement;
-    batch(stmts: unknown[]): unknown;
-}
-export declare function fetchHeroById(db: D1Database, ids: number[]): Promise<HeroRow[]>;
-export {};
-//# sourceMappingURL=item-07-chained-prepare-bind-first-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAID,UAAU,SAAS;IACjB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACd,GAAG,IAAI,OAAO,CAAC;CAChB;AACD,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;CAClC;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAUrF"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.js

@@ -1,21 +0,0 @@
-/**
- * Spec-52 R1 item 7 — chained prepare→bind→first<Row>() in a loop (oracle: MUST fire).
- *
- * The typed-read N+1: `.first<Row>()` (and `.all<Row>()`) is the D1 read idiom.
- * The generic type argument must not hide the eager method from detection — the
- * same gap that bit `too-many-queries`'s text regex. The AST path reads the
- * property name directly, so `first` is visible regardless of `<Row>`.
- */
-export async function fetchHeroById(db, ids) {
-    const out = [];
-    for (const id of ids) {
-        const row = await db
-            .prepare('SELECT id, name FROM heroes WHERE id = ?')
-            .bind(id)
-            .first();
-        if (row)
-            out.push(row);
-    }
-    return out;
-}
-//# sourceMappingURL=item-07-chained-prepare-bind-first-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,GAAa;IAC/D,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,OAAO,CAAC,0CAA0C,CAAC;aACnD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAW,CAAC;QACpB,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.d.ts

@@ -1,15 +0,0 @@
-/**
- * Spec-52 R1 item 8 — Promise.all of plain statements in a loop (oracle: MUST NOT fire).
- *
- * `Promise.all([db.prepare(sql).bind(x), …])` wraps *statement objects* (no
- * `.run()`/`.all()`/`.first()`), so nothing executes inside the loop. This is
- * construction, not an N+1. `Promise.all` must not be misread as the eager D1
- * `.all()` method just because its property name is "all".
- */
-interface ItemRow {
-    id: number;
-    name: string;
-}
-export declare function stageMany(db: any, items: ItemRow[]): Promise<unknown[]>;
-export {};
-//# sourceMappingURL=item-08-promise-all-of-statements-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-08-promise-all-of-statements-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAW7E"}

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 8 — Promise.all of plain statements in a loop (oracle: MUST NOT fire).
- *
- * `Promise.all([db.prepare(sql).bind(x), …])` wraps *statement objects* (no
- * `.run()`/`.all()`/`.first()`), so nothing executes inside the loop. This is
- * construction, not an N+1. `Promise.all` must not be misread as the eager D1
- * `.all()` method just because its property name is "all".
- */
-export async function stageMany(db, items) {
-    const staged = [];
-    for (const item of items) {
-        staged.push(await Promise.all([
-            db.prepare('SELECT id FROM items WHERE id = ?').bind(item.id),
-            db.prepare('SELECT name FROM items WHERE id = ?').bind(item.id),
-        ]));
-    }
-    return staged;
-}
-//# sourceMappingURL=item-08-promise-all-of-statements-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-08-promise-all-of-statements-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAO,EAAE,KAAgB;IACvD,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 9 — Promise.all of a .map() of plain statements (oracle: MUST NOT fire).
- *
- * `Promise.all(rows.map(r => db.prepare(sql).bind(r)))` wraps *statement
- * objects* (no `.run()`/`.all()`/`.first()`), so nothing executes inside the
- * loop. The walk-up must cross the arrow function boundary and still recognise
- * `Promise.all` as the promise combinator, not the eager D1 `.all()`.
- */
-interface ItemRow {
-    id: number;
-}
-export declare function stageMapped(db: any, rows: ItemRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-09-promise-all-map-of-statements-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-09-promise-all-map-of-statements-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzE"}

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.js

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 9 — Promise.all of a .map() of plain statements (oracle: MUST NOT fire).
- *
- * `Promise.all(rows.map(r => db.prepare(sql).bind(r)))` wraps *statement
- * objects* (no `.run()`/`.all()`/`.first()`), so nothing executes inside the
- * loop. The walk-up must cross the arrow function boundary and still recognise
- * `Promise.all` as the promise combinator, not the eager D1 `.all()`.
- */
-export async function stageMapped(db, rows) {
-    for (const row of rows) {
-        await Promise.all(rows.map((r) => db.prepare('SELECT id FROM items WHERE id = ?').bind(r.id)));
-    }
-}
-//# sourceMappingURL=item-09-promise-all-map-of-statements-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-09-promise-all-map-of-statements-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,IAAe;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts

@@ -1,15 +0,0 @@
-/**
- * Spec-52 R1 item 10 — Promise.all of a .map() of eager `.all()` calls (oracle: MUST fire).
- *
- * The discriminating positive for the Promise.all guard: `Promise.all` is a
- * promise combinator and must be *skipped*, but the eager D1 `.all()` on each
- * mapped statement still executes per row — a genuine N+1. Crossing the arrow
- * function to reach the eager method (and skip the combinator on the way) is
- * exactly what the guard must get right.
- */
-interface ItemRow {
-    id: number;
-}
-export declare function fetchMapped(db: D1Database, rows: ItemRow[]): Promise<unknown[]>;
-export {};
-//# sourceMappingURL=item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAOrF"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.js

@@ -1,16 +0,0 @@
-/**
- * Spec-52 R1 item 10 — Promise.all of a .map() of eager `.all()` calls (oracle: MUST fire).
- *
- * The discriminating positive for the Promise.all guard: `Promise.all` is a
- * promise combinator and must be *skipped*, but the eager D1 `.all()` on each
- * mapped statement still executes per row — a genuine N+1. Crossing the arrow
- * function to reach the eager method (and skip the combinator on the way) is
- * exactly what the guard must get right.
- */
-export async function fetchMapped(db, rows) {
-    for (const row of rows) {
-        await Promise.all(rows.map((r) => db.prepare('SELECT id FROM items WHERE id = ?').bind(r.id).all()));
-    }
-    return [];
-}
-//# sourceMappingURL=item-10-promise-all-map-of-eager-all-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,IAAe;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}