code-auditor-mcp 5.0.2 → 5.3.3

package/plugin/scripts/hook-audit.sh

@@ -8,12 +8,13 @@
 #   0 — clean pass, no fresh result yet (the daemon is seeding/indexing, or
 #       this edit hasn't been re-audited — feedback arrives one edit later), or
 #       a broken tool (the failure is written to the log file, not stderr)
-#   2 — a gating finding was read from the daemon's cache (Claude Code feeds
-#       stdout back)
-#   The hook never exits 1 and never writes stderr: a hook that can fail the
-#   edit is worse than one that reports nothing (Spec 68 §hook-contract). A
-#   broken tool is written to the log file, not stderr, and still exits 0 — a
-#   failure surfaces on the next explicit audit, never on the edit.
+#   2 — a gating finding was read from the daemon's cache (the finding is
+#       written to stderr — the channel Claude Code feeds back on exit 2)
+#   The hook never exits 1, and writes stderr only to surface a finding on
+#   exit 2. A hook that can fail the edit is worse than one that reports
+#   nothing (Spec 68 §hook-contract). A broken tool is written to the log
+#   file, not stderr, and still exits 0 — a failure surfaces on the next
+#   explicit audit, never on the edit.
 set -euo pipefail
 
 # Shared resolver + compatibility pinning (see hook-common.sh). Source it from
@@ -85,16 +86,30 @@ assert_compatible "${CODE_AUDIT_BIN}" || exit 0
 mkdir -p "$(hook_log_dir)" 2>/dev/null || true
 set +e
 if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
-  echo "${file}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} changed --stdin --json -p "${CLAUDE_PROJECT_DIR}" 2>>"$(hook_log_file)"
+  finding="$(echo "${file}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} changed --stdin --json -p "${CLAUDE_PROJECT_DIR}" 2>>"$(hook_log_file)")"
 else
-  echo "${file}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} changed --stdin --json 2>>"$(hook_log_file)"
+  finding="$(echo "${file}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} changed --stdin --json 2>>"$(hook_log_file)")"
 fi
 exit_code=$?
 set -e
 
-# Exit 2 = a finding read from the daemon cache; propagate so Claude Code feeds
-# stdout back.
+# A completed run — clean (0) or finding (2) — is the positive "the hook is
+# alive and enqueueing" signal. Write it so the explicit-audit reader
+# (src/hookLog.ts) can clear a prior HOOK NOT RUNNING condition: the reader
+# resolves a condition by newest-record order, and without this line a hook that
+# recovered would leave the stale condition live forever.
+if [ "${exit_code}" -eq 0 ] || [ "${exit_code}" -eq 2 ]; then
+  hook_log "[code-auditor] HOOK RAN"
+fi
+
+# Exit 2 = a finding read from the daemon cache. A PostToolUse hook's feedback
+# channel on exit 2 is stderr (stdout is discarded), so re-emit the finding
+# there before propagating exit 2 — otherwise the finding is lost and Claude
+# Code reports an empty-stderr block. The finding is also written to the hook
+# log so the diagnostic trail records what surfaced to the agent.
 if [ ${exit_code} -eq 2 ]; then
+  hook_log "[code-auditor] FINDING: ${finding}"
+  printf '%s\n' "${finding}" >&2
   exit 2
 fi
 

package/plugin/scripts/hook-common.sh

@@ -53,18 +53,23 @@ plugin_root() {
   printf '%s' "${root}"
 }
 
+# The hook-log path tail + file name are single-sourced in hook-log-path.sh,
+# generated by scripts/write-hook-log-path.mjs from the same source as
+# src/hookLogPath.generated.ts (the reader's copy). Sourced here so the write
+# half and the read half (src/hookLog.ts) can never drift apart.
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)/hook-log-path.sh"
+
 # hook_log_dir / hook_log_file / hook_log — the hook's diagnostic log.
 #
-# The PostToolUse hook must never write stderr: the host may block on stderr
-# content, so a single warning could block the edit. Every diagnostic — info,
-# warnings, and failures alike — goes to this log file instead, and the hook
-# still exits 0. A broken install therefore surfaces on the next explicit audit
-# (and in this log), never on the edit itself.
+# Diagnostics (info, warnings, failures) go here, never to stderr, and the hook
+# still exits 0 — a broken install surfaces on the next explicit audit (and in
+# this log), never as a blocked edit. The one intentional stderr write is a
+# gating finding on exit 2, which is the hook's purpose, not a diagnostic.
 hook_log_dir() {
-  printf '%s' "${XDG_CACHE_HOME:-$HOME/.cache}/code-auditor/logs"
+  printf '%s' "${XDG_CACHE_HOME:-$HOME/.cache}/${HOOK_LOG_DIR_TAIL}"
 }
 hook_log_file() {
-  printf '%s' "$(hook_log_dir)/hook.log"
+  printf '%s' "$(hook_log_dir)/${HOOK_LOG_FILE}"
 }
 hook_log() {
   mkdir -p "$(hook_log_dir)" 2>/dev/null || return 0

package/plugin/scripts/hook-drift-check.sh

@@ -33,7 +33,13 @@ manifest=""
 for f in "${ROOT}/.claude-plugin/manifest.json" "${ROOT}/manifest.json"; do
   if [ -f "$f" ]; then manifest="$f"; break; fi
 done
-[ -n "${manifest}" ] || exit 0
+if [ -z "${manifest}" ]; then
+  # No manifest to compare against is still a completed run — the drift check
+  # never exits non-zero, so write the success record that resolves a prior
+  # HOOK NOT RUNNING condition before the no-op exit.
+  hook_log "[code-auditor] HOOK RAN"
+  exit 0
+fi
 
 MANIFEST_PATH="${manifest}" PLUGIN_ROOT="${ROOT}" node <<'NODE'
 const fs = require('fs');
@@ -73,4 +79,7 @@ if (problems.length > 0) {
 }
 NODE
 
+# A completed run (drift found or not) resolves a prior HOOK NOT RUNNING
+# condition — the drift check never exits non-zero.
+hook_log "[code-auditor] HOOK RAN"
 exit 0

package/plugin/scripts/hook-log-path.sh

@@ -0,0 +1,7 @@
+# @generated — do not edit. Written by `scripts/write-hook-log-path.mjs`.
+#
+# Single source of truth for the hook-log path, shared by the TS reader
+# (src/hookLog.ts) and the bash writer (plugin/scripts/hook-common.sh).
+# Regenerate with `npm run build:hooklog`.
+HOOK_LOG_DIR_TAIL='code-auditor/logs'
+HOOK_LOG_FILE='hook.log'

package/plugin/scripts/hook-self-audit.sh

@@ -15,9 +15,11 @@
 # Exit codes:
 #   0 — clean pass, out of scope, or a broken tool (the failure is written to
 #       the log file, not stderr)
-#   2 — a blocking self-audit finding (Claude Code feeds stdout back)
-#   The hook never exits 1 and never writes stderr: a broken tool is written to
-#   the log file, not stderr, and still exits 0 (Spec 68 §hook-contract).
+#   2 — a blocking self-audit finding (the finding is written to stderr — the
+#       channel Claude Code feeds back on exit 2)
+#   The hook never exits 1, and writes stderr only to surface a finding on
+#   exit 2: a broken tool is written to the log file, not stderr, and still
+#   exits 0 (Spec 68 §hook-contract).
 set -euo pipefail
 
 # Shared resolver + compatibility pinning (see hook-common.sh). Source it from
@@ -85,15 +87,28 @@ assert_compatible "${CODE_AUDIT_BIN}" || exit 0
 mkdir -p "$(hook_log_dir)" 2>/dev/null || true
 set +e
 if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
-  echo "${file_abs}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} self-audit --stdin --json -p "${CLAUDE_PROJECT_DIR}" 2>>"$(hook_log_file)"
+  finding="$(echo "${file_abs}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} self-audit --stdin --json -p "${CLAUDE_PROJECT_DIR}" 2>>"$(hook_log_file)")"
 else
-  echo "${file_abs}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} self-audit --stdin --json 2>>"$(hook_log_file)"
+  finding="$(echo "${file_abs}" | CODE_AUDITOR_HOOK=1 ${CODE_AUDIT_BIN} self-audit --stdin --json 2>>"$(hook_log_file)")"
 fi
 exit_code=$?
 set -e
 
-# Exit 2 = a blocking self-audit finding; propagate so Claude Code feeds it back.
+# A completed run — clean (0) or finding (2) — is the positive "the hook is
+# alive" signal, mirroring hook-audit.sh. Write it so the reader (src/hookLog.ts)
+# can clear a prior HOOK NOT RUNNING condition: the reader resolves by
+# newest-record order, and without this line a recovered hook would leave the
+# stale condition live forever.
+if [ "${exit_code}" -eq 0 ] || [ "${exit_code}" -eq 2 ]; then
+  hook_log "[code-auditor] HOOK RAN"
+fi
+
+# Exit 2 = a blocking self-audit finding; re-emit it to stderr — the channel
+# Claude Code feeds back on exit 2 — before propagating, and record it in the
+# hook log so the diagnostic trail shows what surfaced to the agent.
 if [ ${exit_code} -eq 2 ]; then
+  hook_log "[code-auditor] FINDING: ${finding}"
+  printf '%s\n' "${finding}" >&2
   exit 2
 fi
 

package/plugin/scripts/hook-warm.sh

@@ -26,18 +26,24 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
 # Nothing safe to warm if the manifest version can't be read: warming @latest
 # could pin a different version than resolve_code_audit's fallback would fetch.
 pv="$(plugin_version)"
-[ -n "${pv}" ] || exit 0
 
-dir="$(pin_dir)"
-bin="${dir}/node_modules/.bin/code-audit"
+if [ -n "${pv}" ]; then
+  dir="$(pin_dir)"
+  bin="${dir}/node_modules/.bin/code-audit"
 
-# Already installed — nothing to warm. Re-running npm install here would re-check
-# the registry on every session, which is exactly the cost this hook exists to avoid.
-[ -x "${bin}" ] && exit 0
+  # Already installed — nothing to warm. Re-running npm install here would re-check
+  # the registry on every session, which is exactly the cost this hook exists to avoid.
+  if [ ! -x "${bin}" ]; then
+    # Background the exact install the hook's last-resort path runs. Output to
+    # /dev/null (silent), stdin from /dev/null (don't hold the hook's stdin open),
+    # nohup so the install survives this hook's exit.
+    nohup npm install --prefer-offline --prefix "${dir}" "code-auditor-mcp@${pv}" \
+      --no-audit --no-fund --ignore-scripts --silent >/dev/null 2>&1 </dev/null &
+  fi
+fi
 
-# Background the exact install the hook's last-resort path runs. Output to
-# /dev/null (silent), stdin from /dev/null (don't hold the hook's stdin open),
-# nohup so the install survives this hook's exit.
-nohup npm install --prefer-offline --prefix "${dir}" "code-auditor-mcp@${pv}" \
-  --no-audit --no-fund --ignore-scripts --silent >/dev/null 2>&1 </dev/null &
+# A completed run — the warm hook never exits non-zero, so every path through it
+# is a success — writes the positive record that resolves a prior HOOK NOT RUNNING
+# condition (CLAUDE_PLUGIN_ROOT unset) in the reader (src/hookLog.ts).
+hook_log "[code-auditor] HOOK RAN"
 exit 0

package/plugin/skills/code-auditor/SKILL.md

@@ -5,7 +5,7 @@ description: Audit code quality, search the codebase semantically, enforce invar
 
 # Code Auditor Skill
 
-> **Version 5.0.2** • Run `code-audit --version` to check your installed version.
+> **Version 5.3.3** • Run `code-audit --version` to check your installed version.
 > If versions differ, the CLI is authoritative — use `code-audit <command> --help` to see what your install actually supports.
 
 You have the `code-audit` CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.
@@ -82,10 +82,31 @@ A dismissal is for *this finding is not relevant*, not for *I don't want to fix
 
 The tool can send dismissed findings to an anonymous feedback service that collects them. It is **off by default** and is turned on only by an explicit opt-in:
 
-- `mcp__code-auditor__telemetry` `status` / `enable` / `disable` manage the opt-in. `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
+- `code-audit telemetry status` / `enable` / `disable` manage the opt-in (the `mcp__code-auditor__telemetry` tool mirrors the same toggle). `enable` needs no arguments — it opts in against the built-in service endpoint and generates the anonymous install ID.
 - When opted in, each dismissal sends only the reason plus a structural shape — **no code, identifiers, or file paths**.
 
-Before enabling, tell the user the privacy facts: **data is anonymous, and the ID is generated locally to avoid tracking anything personal.** Only the reason and enough shape to reproduce the finding are sent; nothing derived from their code or environment.
+On first contact, run `code-audit telemetry status` and read its `decided` field:
+
+- **`decided` is false** — the user has never been asked. Tell them the privacy facts (below), then ask **once** whether to opt in. Run `code-audit telemetry enable` on yes and `code-audit telemetry disable` on no — either records the decision so the question is never repeated.
+- **`decided` is true** — the user has already chosen. Never ask again; leave the setting exactly as it is.
+
+The privacy facts: each submission contains the tool version, the rule ID, the urgency level, the dismissal reason exactly as typed, a structural AST signature (grammar node types only, never their contents), a coarse language hint, a timestamp, and an anonymous install ID generated locally on your machine. Source code, identifiers, literals, file paths, and environment details are never sent, unless the user types them into the reason.
+
+### `code-audit request-rule` — request a rule for an unflagged defect
+
+When you find a *class* of defect the audit did not flag, request a new rule instead of silently working around it:
+
+```bash
+code-audit request-rule \
+  --title "Flag unbounded loops" \
+  --symptom "A loop with no exit condition hangs the process at runtime." \
+  --signal "A for-loop over a dynamic collection with no bound check." \
+  --language typescript \
+  --fires bad.ts \
+  --clean fixed.ts
+```
+
+Call `lookup_rule` or `explain_symptom` first to confirm no existing rule covers it. Provide a minimal example that *should* be flagged (`--fires`) and a corrected example that *should not* (`--clean`), each reduced to the smallest code that shows the difference, with secrets and proprietary identifiers removed. The CLI prints a receipt id so the request can be tracked.
 
 ### `code-audit config` — know the project's laws
 
@@ -235,6 +256,8 @@ The hook auto-installs the package to a cache dir on first use — no manual npm
 | Resolve file profiles | `code-audit config profiles --file <path>` |
 | Next file to fix | `code-audit next-file` |
 | Dismiss a false positive | `code-audit dismiss <fingerprint> --reason "…"` |
+| Telemetry opt-in | `code-audit telemetry status` / `enable` / `disable` |
+| Request a new rule | `code-audit request-rule` |
 | Sync index | `code-audit index sync --path .` |
 | Codebase map | `code-audit map -p .` |
 | Mine conventions | `code-audit conventions list` |

package/server.json

@@ -6,13 +6,13 @@
     "url": "https://github.com/BenAHammond/code-auditor-mcp",
     "source": "github"
   },
-  "version": "5.0.2",
+  "version": "5.3.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "code-auditor-mcp",
-      "version": "5.0.2",
+      "version": "5.3.3",
       "transport": {
         "type": "stdio"
       }

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts

@@ -1,6 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=tool.d.ts.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/scripts/tool.js

@@ -1,12 +0,0 @@
-/**
- * Scripts-tree module with an undocumented exported function.
- * Same code as src/demo-module.ts — the profile controls what fires.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=tool.js.map

package/dist/__tests__/fixtures/spec-20/scripts/tool.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/scripts/tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts

@@ -1,7 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export declare function calculateTotal(items: number[]): number;
-//# sourceMappingURL=demo-module.d.ts.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAMtD"}

package/dist/__tests__/fixtures/spec-20/src/demo-module.js

@@ -1,13 +0,0 @@
-/**
- * Source-tree module with an undocumented exported function.
- * When requireFunctionDocs is true (default), the documentation analyzer
- * flags this. When a profile sets requireFunctionDocs=false, skip entirely.
- */
-export function calculateTotal(items) {
-    let total = 0;
-    for (const item of items) {
-        total += item * 1.1;
-    }
-    return total;
-}
-//# sourceMappingURL=demo-module.js.map

package/dist/__tests__/fixtures/spec-20/src/demo-module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"demo-module.js","sourceRoot":"","sources":["../../../../../src/__tests__/fixtures/spec-20/src/demo-module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-interface Row {
-    id: number;
-    name: string;
-}
-export declare function insertMany(db: any, rows: Row[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-01-prepare-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js

@@ -1,16 +0,0 @@
-/**
- * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
- *
- * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
- * The statements are accumulated and executed once by a single `.batch()` after
- * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
- */
-export async function insertMany(db, rows) {
-    const stmts = [];
-    for (const row of rows) {
-        const stmt = db.prepare('INSERT INTO items (id, name) VALUES (?, ?)');
-        stmts.push(stmt);
-    }
-    await db.batch(stmts);
-}
-//# sourceMappingURL=item-01-prepare-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-01-prepare-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAO,EAAE,IAAW;IACnD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts

@@ -1,15 +0,0 @@
-/**
- * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
- *
- * The explicit accumulate-then-batch shape: each loop iteration prepares and
- * binds a statement (statement construction — no I/O), pushes it to an array,
- * and a single `.batch()` after the loop executes them all. The eager call sits
- * outside the loop, so this is not an N+1.
- */
-interface ScoreRow {
-    id: number;
-    score: number;
-}
-export declare function rescoreMany(db: any, items: ScoreRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-02-prepare-bind-accumulate-batch.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js

@@ -1,17 +0,0 @@
-/**
- * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
- *
- * The explicit accumulate-then-batch shape: each loop iteration prepares and
- * binds a statement (statement construction — no I/O), pushes it to an array,
- * and a single `.batch()` after the loop executes them all. The eager call sits
- * outside the loop, so this is not an N+1.
- */
-export async function rescoreMany(db, items) {
-    const stmts = [];
-    for (const item of items) {
-        const stmt = db.prepare('UPDATE scores SET score = ? WHERE id = ?').bind(item.score, item.id);
-        stmts.push(stmt);
-    }
-    await db.batch(stmts);
-}
-//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.js.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-02-prepare-bind-accumulate-batch.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,KAAiB;IAC1D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts

@@ -1,14 +0,0 @@
-/**
- * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
- *
- * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
- * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
- * skip must be surgical and leave eager member methods firing.
- */
-interface ItemRow {
-    id: number;
-    name: string;
-}
-export declare function renameAll(items: ItemRow[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-03-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-03-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAQD,wBAAsB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
- *
- * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
- * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
- * skip must be surgical and leave eager member methods firing.
- */
-import Database from 'better-sqlite3';
-// Spec 70 R4 — the handle is proven by the manifest-package import
-// (`better-sqlite3`), not a `D1Database` type annotation. `db.exec(sql)` with a
-// dynamic (interpolated) argument has no static SQL for R3, so the import is the
-// proof; the `D1Database` binding would read `unproven` (cannot-fire).
-const db = new Database(':memory:');
-export async function renameAll(items) {
-    for (const item of items) {
-        db.exec(`UPDATE items SET name = 'renamed' WHERE id = ${item.id}`);
-    }
-}
-//# sourceMappingURL=item-03-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-03-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAOtC,mEAAmE;AACnE,gFAAgF;AAChF,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts

@@ -1,18 +0,0 @@
-/**
- * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
- *
- * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
- * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
- * N+1 that must keep firing — the two-direction proof's positive arm.
- */
-interface RankRow {
-    id: number;
-    rank: number;
-}
-export declare class Leaderboard {
-    private sql;
-    constructor(sql: D1Database);
-    applyRanks(rows: RankRow[]): Promise<void>;
-}
-export {};
-//# sourceMappingURL=item-04-storage-sql-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;gBAEZ,GAAG,EAAE,UAAU;IAIrB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAKjD"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
- *
- * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
- * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
- * N+1 that must keep firing — the two-direction proof's positive arm.
- */
-export class Leaderboard {
-    sql;
-    constructor(sql) {
-        this.sql = sql;
-    }
-    async applyRanks(rows) {
-        for (const row of rows) {
-            this.sql.exec('UPDATE leaderboard SET rank = ? WHERE id = ?', row.rank, row.id);
-        }
-    }
-}
-//# sourceMappingURL=item-04-storage-sql-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-04-storage-sql-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,WAAW;IACd,GAAG,CAAa;IAExB,YAAY,GAAe;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
- * classified as `insert` writes).
- *
- * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
- * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
- * write classifier previously only matched `INSERT INTO`, so every rule reading
- * the write set (written-never-read, multi-table-write) missed them.
- *
- * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
- * is the table-extraction path that feeds `schema_usage.usage_type`.
- */
-export declare const UPSERT_QUERIES: {
-    readonly insertOrIgnore: "INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly insertOrReplace: "INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly replaceInto: "REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)";
-    readonly onConflictDoUpdate: "INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled";
-};
-//# sourceMappingURL=item-05-upsert-forms.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-05-upsert-forms.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,cAAc;;;;;CASjB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
- * classified as `insert` writes).
- *
- * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
- * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
- * write classifier previously only matched `INSERT INTO`, so every rule reading
- * the write set (written-never-read, multi-table-write) missed them.
- *
- * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
- * is the table-extraction path that feeds `schema_usage.usage_type`.
- */
-export const UPSERT_QUERIES = {
-    insertOrIgnore: 'INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    insertOrReplace: 'INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    replaceInto: 'REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
-    onConflictDoUpdate: 'INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled',
-};
-//# sourceMappingURL=item-05-upsert-forms.js.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-05-upsert-forms.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc,EACZ,kEAAkE;IACpE,eAAe,EACb,mEAAmE;IACrE,WAAW,EACT,yDAAyD;IAC3D,kBAAkB,EAChB,mHAAmH;CAC7G,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts

@@ -1,17 +0,0 @@
-/**
- * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
- *
- * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
- * accumulate-then-batch shape (where the statement is pushed to an array and a
- * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
- * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
- * it skips standalone construction but leaves a prepare/bind that is chained
- * into an eager call firing.
- */
-interface SyncJob {
-    id: number;
-    slug: string;
-}
-export declare function syncBuildsForHeroes(db: D1Database, jobs: SyncJob[]): Promise<void>;
-export {};
-//# sourceMappingURL=item-06-chained-prepare-run-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASxF"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js

@@ -1,19 +0,0 @@
-/**
- * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
- *
- * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
- * accumulate-then-batch shape (where the statement is pushed to an array and a
- * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
- * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
- * it skips standalone construction but leaves a prepare/bind that is chained
- * into an eager call firing.
- */
-export async function syncBuildsForHeroes(db, jobs) {
-    for (const job of jobs) {
-        await db
-            .prepare(`UPDATE sync_jobs SET status = 'running', started_at = datetime('now') WHERE id = ?`)
-            .bind(job.id)
-            .run();
-    }
-}
-//# sourceMappingURL=item-06-chained-prepare-run-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"item-06-chained-prepare-run-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAc,EAAE,IAAe;IACvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE;aACL,OAAO,CACN,oFAAoF,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}