codesift-mcp 0.7.0 → 0.8.4

package/dist/tools/yii-console-tools.js

@@ -0,0 +1,256 @@
+/**
+ * Yii2 console command inventory (N4).
+ *
+ * Console controllers in Yii2 (extends yii\\console\\Controller) are
+ * typically cron jobs, queue workers, or one-off ops scripts. They're
+ * a high-leverage surface to audit because they:
+ *   - run with elevated privileges (no HTTP auth gate)
+ *   - frequently lack the test coverage the web side has
+ *   - are the most common place to find unbounded ->all() reads
+ *
+ * The tool inventories every console controller and its action methods.
+ * For each action it surfaces:
+ *   - declared CLI argument list (extracted from the method signature)
+ *   - whether the action accepts variadic ...$args
+ *   - the docblock (often the only documentation for a command)
+ *   - flags (warnings / hints) about specific risks:
+ *       - exits-without-return-status: action returns void / nothing,
+ *         so cron schedulers can't tell success from failure
+ *       - has-unbounded-all: ->all() found in body without ->limit /
+ *         ->batch / ->each (cron killer)
+ *       - has-no-error-handling: no try/catch around the body
+ *
+ * Output is structured per-controller so consumers can:
+ *   - cross-reference with crontab / SystemCron entries
+ *   - flag commands that need test coverage
+ *   - prioritize commands that look risky
+ */
+import { getCodeIndex } from "./index-tools.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+const CONSOLE_BASE_NAMES = new Set(["Controller"]);
+/**
+ * Detect whether a class extends yii\\console\\Controller (or any descendant).
+ * Combines a path heuristic — files under `console/`, `commands/`, or
+ * `*Console*Controller.php` — with the structural extends check, so we
+ * don't pick up web controllers that happen to extend the same base
+ * `Controller` class but live under controllers/.
+ */
+function isConsoleControllerClass(cls, index) {
+    // Path heuristic: Yii2 advanced/standard convention puts console code
+    // under console/controllers/ or commands/. tgm-panel uses commands/.
+    // We accept either.
+    const inConsoleDir = /(?:^|\/)(?:console\/controllers|commands)\//.test(cls.file);
+    if (!inConsoleDir)
+        return false;
+    // Structural extends check. For the path-matched files we want to
+    // confirm the class actually extends a Yii2 Controller (the common
+    // base) — picking up vendor classes that happen to live under
+    // commands/ is a false positive risk that walking the chain prevents.
+    return walkExtendsForConsole(cls, index, new Set(), 0);
+}
+function walkExtendsForConsole(cls, index, visited, depth) {
+    if (depth > 5)
+        return false;
+    if (visited.has(cls.name))
+        return false;
+    visited.add(cls.name);
+    const exts = cls.extends ?? [];
+    for (const baseFqcn of exts) {
+        const last = baseFqcn.split(/[\\\\]+/).pop() ?? baseFqcn;
+        if (CONSOLE_BASE_NAMES.has(last))
+            return true;
+        // Also accept the explicit "ConsoleController" suffix used by some
+        // teams (matches the common convention where console controllers
+        // share a project-specific base class).
+        if (last === "ConsoleController")
+            return true;
+        const baseSym = index.symbols.find((s) => s.kind === "class" && s.name === last);
+        if (baseSym &&
+            walkExtendsForConsole(baseSym, index, visited, depth + 1)) {
+            return true;
+        }
+    }
+    // Fallback for stale indexes without extends metadata.
+    if (!cls.extends && cls.source) {
+        return /extends\s+(?:\\?yii\\console\\Controller|Controller)\b/.test(cls.source);
+    }
+    return false;
+}
+export async function analyzeYiiConsoleCommands(repo, options) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        throw new Error(`Repository "${repo}" not found.`);
+    const consoleClasses = index.symbols.filter((s) => {
+        if (s.kind !== "class")
+            return false;
+        if (!s.file.endsWith(".php"))
+            return false;
+        if (!s.name.endsWith("Controller"))
+            return false;
+        if (!isConsoleControllerClass(s, index))
+            return false;
+        return true;
+    });
+    const controllers = [];
+    for (const cls of consoleClasses) {
+        const cliId = pascalToKebab(cls.name.replace(/Controller$/, ""));
+        if (options?.controller_id && cliId !== options.controller_id)
+            continue;
+        const actionMethods = index.symbols.filter((s) => s.parent === cls.id &&
+            s.kind === "method" &&
+            s.name.startsWith("action") &&
+            s.name.length > "action".length);
+        const actions = actionMethods.map((m) => {
+            const actionId = pascalToKebab(m.name.slice("action".length));
+            const args = parseActionArguments(m.signature ?? "");
+            const variadic = /\.{3}\$\w+/.test(m.signature ?? "");
+            const flags = scanActionFlags(m.source ?? "", m.name);
+            return {
+                name: m.name,
+                cli_id: actionId,
+                arguments: args,
+                variadic,
+                docstring: m.docstring ?? null,
+                start_line: m.start_line,
+                flags,
+            };
+        });
+        actions.sort((a, b) => a.name.localeCompare(b.name));
+        controllers.push({
+            class: cls.name,
+            cli_id: cliId,
+            file: cls.file,
+            actions,
+        });
+    }
+    controllers.sort((a, b) => a.cli_id.localeCompare(b.cli_id));
+    // Cross-controller summary: actions with ≥2 flags, sorted by flag count.
+    const highRisk = [];
+    for (const c of controllers) {
+        for (const a of c.actions) {
+            if (a.flags.length >= 2) {
+                highRisk.push({
+                    controller: c.class,
+                    action: a.name,
+                    cli_id: `${c.cli_id}/${a.cli_id}`,
+                    flags: a.flags,
+                });
+            }
+        }
+    }
+    highRisk.sort((a, b) => b.flags.length - a.flags.length);
+    const totalActions = controllers.reduce((n, c) => n + c.actions.length, 0);
+    return {
+        repo,
+        total_controllers: controllers.length,
+        total_actions: totalActions,
+        controllers,
+        high_risk_actions: highRisk,
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function pascalToKebab(s) {
+    return s.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+/**
+ * Parse a method signature string like "(string $repo, int $limit = 10, ...$rest)"
+ * into a structured argument list. Type and default are best-effort — we
+ * preserve the source-side spelling, callers can normalize.
+ */
+function parseActionArguments(signature) {
+    if (!signature)
+        return [];
+    // Strip leading "(" and trailing "): ReturnType" → keep just the param list
+    const inner = signature.replace(/^\(|\).*$/g, "");
+    if (!inner.trim())
+        return [];
+    const args = [];
+    // Split on commas at top level only — parameters can have default values
+    // containing commas (e.g. `array $cfg = [1, 2]`). For a CLI tool this is
+    // rare so a comma-split + simple bracket-balance fixup is enough.
+    const parts = splitParams(inner);
+    for (const part of parts) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        // Skip variadic — handled separately by the caller via .test()
+        if (/^\.{3}\$/.test(trimmed))
+            continue;
+        // Extract: optional type + $name + optional `= default`
+        const m = /^(?:([?\w\\|&]+)\s+)?\$(\w+)(?:\s*=\s*(.+))?$/.exec(trimmed);
+        if (!m)
+            continue;
+        const type = m[1] ?? null;
+        const name = m[2];
+        const defaultValue = m[3]?.trim() ?? null;
+        args.push({
+            name,
+            type,
+            default: defaultValue,
+            required: defaultValue === null,
+        });
+    }
+    return args;
+}
+function splitParams(s) {
+    const out = [];
+    let depth = 0;
+    let buf = "";
+    for (const c of s) {
+        if (c === "(" || c === "[" || c === "{")
+            depth++;
+        else if (c === ")" || c === "]" || c === "}")
+            depth--;
+        if (c === "," && depth === 0) {
+            out.push(buf);
+            buf = "";
+        }
+        else {
+            buf += c;
+        }
+    }
+    if (buf.trim())
+        out.push(buf);
+    return out;
+}
+function scanActionFlags(body, methodName) {
+    const flags = [];
+    if (!body)
+        return flags;
+    // exits-without-return-status: actions that have no `return` statement OR
+    // return only void/null. Yii2's ExitCode constants are the recommended
+    // way to surface success/failure to the cron scheduler.
+    const hasExitReturn = /\breturn\s+(?:ExitCode::|self::|static::)/.test(body);
+    const hasIntReturn = /\breturn\s+(?:0|1|-?\d+)\s*;/.test(body);
+    const hasAnyReturn = /\breturn\b/.test(body);
+    if (!hasExitReturn && !hasIntReturn && !hasAnyReturn) {
+        flags.push("exits-without-return-status");
+    }
+    // has-unbounded-all: ->all() with no ->limit / ->batch / ->each in
+    // the same body. Same heuristic as the perf pattern.
+    if (/->all\s*\(\s*\)/.test(body) &&
+        !/->(?:limit|batch|each)\b/.test(body)) {
+        flags.push("has-unbounded-all");
+    }
+    // has-no-error-handling: no try/catch around the body. Cron jobs that
+    // throw uncaught exceptions can leave their state half-written; at
+    // minimum a top-level catch + ExitCode::OK / UNSPECIFIED_ERROR is
+    // worth surfacing.
+    if (!/\btry\s*\{/.test(body)) {
+        flags.push("has-no-error-handling");
+    }
+    // uses-output-via-echo: directly printing via echo / print. The Yii2
+    // idiom is `$this->stdout(...)` / `$this->stderr(...)` which respects
+    // output piping and color settings. Skipped on actionHelp / actionInit
+    // where echo is a fine choice.
+    if (!/^action(?:Help|Init|Index)$/.test(methodName) &&
+        /\b(?:echo|print)\s+(?!Yii::)/.test(body)) {
+        flags.push("uses-output-via-echo");
+    }
+    return flags;
+}
+//# sourceMappingURL=yii-console-tools.js.map

package/dist/tools/yii-console-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yii-console-tools.js","sourceRoot":"","sources":["../../src/tools/yii-console-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAoDhD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAkBnD;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,GAAgG,EAChG,KAAgB;IAEhB,sEAAsE;IACtE,qEAAqE;IACrE,oBAAoB;IACpB,MAAM,YAAY,GAChB,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,kEAAkE;IAClE,mEAAmE;IACnE,8DAA8D;IAC9D,sEAAsE;IACtE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAkF,EAClF,KAAgB,EAChB,OAAoB,EACpB,KAAa;IAEb,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;QACzD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,mEAAmE;QACnE,iEAAiE;QACjE,wCAAwC;QACxC,IAAI,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAC7C,CAAC;QACF,IACE,OAAO;YACP,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,EACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO,wDAAwD,CAAC,IAAI,CAClE,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,OAAoC;IAEpC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,cAAc,CAAC,CAAC;IAE/D,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAA2B,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,EAAE,aAAa,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa;YAAE,SAAS;QAExE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE;YACnB,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAClC,CAAC;QAEF,MAAM,OAAO,GAAuB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAErD,WAAW,CAAC,IAAI,CAAC;YACf,KAAK,EAAE,GAAG,CAAC,IAAI;YACf,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7D,yEAAyE;IACzE,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,UAAU,EAAE,CAAC,CAAC,KAAK;oBACnB,MAAM,EAAE,CAAC,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE;oBACjC,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,IAAI;QACJ,iBAAiB,EAAE,WAAW,CAAC,MAAM;QACrC,aAAa,EAAE,YAAY;QAC3B,WAAW;QACX,iBAAiB,EAAE,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAkC,EAAE,CAAC;IAC/C,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,+DAA+D;QAC/D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAEvC,wDAAwD;QACxD,MAAM,CAAC,GAAG,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,YAAY;YACrB,QAAQ,EAAE,YAAY,KAAK,IAAI;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,UAAkB;IAElB,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,aAAa,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5C,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,IACE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EACtC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,kEAAkE;IAClE,mBAAmB;IACnB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,uEAAuE;IACvE,+BAA+B;IAC/B,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EACzC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/tools/yii-migrations-tools.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Yii2 migrations audit (N2).
+ *
+ * Yii2 ships its own PHP-DSL migration system — `extends Migration` with
+ * `$this->createTable()`, `$this->addColumn()`, `$this->dropTable()`, etc.
+ * The generic SQL toolchain (migration_lint, analyze_schema, sql_audit) is
+ * auto-loaded for composer.json projects but parses only `.sql` files, so
+ * the 379 migrations in tgm-panel are invisible to it.
+ *
+ * This tool fills that gap. For each migration class we:
+ *   1. Map the DSL calls to a structured operation list
+ *      (create_table, drop_table, add_column, ...).
+ *   2. Run audit checks per migration:
+ *        - missing_safe_down       (irreversible)
+ *        - drop_without_safety     (drop in safeUp without index/backup hint)
+ *        - alter_without_online_ddl (alter on large tables without
+ *                                    ALGORITHM=INPLACE, LOCK=NONE for MySQL 8)
+ *        - fk_without_index        (addForeignKey on a column without
+ *                                   a corresponding createIndex earlier)
+ *   3. Surface a per-table operation index (which migrations touch table X).
+ *
+ * The DSL parser is deliberately regex-based, not tree-sitter. Migration
+ * methods follow a small, stable grammar (a few verbs from yii\\db\\Migration
+ * with predictable argument shapes) and the AST coverage we'd buy with a
+ * full walker isn't worth the cost. The audit is a discovery tool, not a
+ * gate — false positives are acceptable, false negatives are the failure
+ * mode we minimize.
+ */
+export type YiiMigrationOpKind = "create_table" | "drop_table" | "rename_table" | "add_column" | "drop_column" | "alter_column" | "rename_column" | "create_index" | "drop_index" | "add_primary_key" | "drop_primary_key" | "add_foreign_key" | "drop_foreign_key" | "execute_raw_sql" | "insert" | "update" | "delete" | "batch_insert";
+export interface YiiMigrationOp {
+    kind: YiiMigrationOpKind;
+    /** Primary table the op touches, when statically determinable. */
+    table: string | null;
+    /** Column name when applicable (add_column, alter_column, rename_column). */
+    column?: string;
+    /** Index name when applicable (create_index, drop_index). */
+    index_name?: string;
+    /** Foreign key constraint name when applicable. */
+    fk_name?: string;
+    /** 1-based line within the migration class source where the op occurred. */
+    line: number;
+    /** Raw method name from the DSL call. */
+    raw: string;
+}
+export interface YiiMigrationAuditFinding {
+    rule_id: "missing-safe-down" | "drop-without-safety" | "alter-without-online-ddl" | "fk-without-index" | "raw-sql-without-comment";
+    severity: "high" | "medium" | "low";
+    description: string;
+    fix: string;
+}
+export interface YiiMigrationFile {
+    file: string;
+    class_name: string;
+    /** Up-flow operations (`up()` or `safeUp()`). */
+    up_ops: YiiMigrationOp[];
+    /** Down-flow operations (`down()` or `safeDown()`). */
+    down_ops: YiiMigrationOp[];
+    /** True iff the migration uses safeUp/safeDown (transactional in Yii2). */
+    is_safe_transactional: boolean;
+    /** Tables touched by this migration (union of up + down). */
+    tables: string[];
+    findings: YiiMigrationAuditFinding[];
+}
+export interface YiiMigrationsAudit {
+    repo: string;
+    scanned_files: number;
+    total_migrations: number;
+    /** All migration files keyed by canonical relative path. */
+    migrations: YiiMigrationFile[];
+    /** Per-table back-index: list of migrations touching that table. */
+    by_table: Record<string, string[]>;
+    /** Aggregate finding counts by rule. */
+    findings_summary: Record<string, number>;
+}
+export declare function analyzeYiiMigrations(repo: string, options?: {
+    file_pattern?: string;
+    rules?: YiiMigrationAuditFinding["rule_id"][];
+}): Promise<YiiMigrationsAudit>;
+//# sourceMappingURL=yii-migrations-tools.d.ts.map

package/dist/tools/yii-migrations-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yii-migrations-tools.d.ts","sourceRoot":"","sources":["../../src/tools/yii-migrations-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,aAAa,GACb,cAAc,GACd,eAAe,GACf,cAAc,GACd,YAAY,GACZ,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,cAAc,CAAC;AAEnB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EACH,mBAAmB,GACnB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,GAClB,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,uDAAuD;IACvD,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,2EAA2E;IAC3E,qBAAqB,EAAE,OAAO,CAAC;IAC/B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,wCAAwC;IACxC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AA+ND,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAA;CAAE,GACjF,OAAO,CAAC,kBAAkB,CAAC,CAmG7B"}