sparda-mcp 0.66.2 → 0.67.0

package/README.md

@@ -44,7 +44,7 @@ Under the hood it compiles your backend into one language-agnostic graph — the
 >
 > Honesty first: _compiling_ a route is a parser result (the number above); _proving_ it safe is a separate per-repo verdict — and most real apps come back **NOT_PROVEN**, which is the true state, not a failure. (Our full 25-repo corpus stress compiles **3,565 routes** at ~150 routes/s; that one needs the corpus checked out.)
 
-**What the graph unlocks — 100% local, deterministic, zero runtime dependencies, zero API key:**
+**What the graph unlocks — 100% local, deterministic, 4 exact-pinned dependencies, zero API key:**
 
 | Command            | What it does                                                                                                                                                                                                                         |
 | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -341,12 +341,17 @@ runtime, so the guidance never goes stale.
 ## Supported frameworks
 
 - **Next.js App Router (13/14/15)** — file-based injection. SPARDA creates a catch-all route handler. It natively resolves wrapped handlers (`export const POST = withAuth(h)`) and deep effect chains.
-- **NestJS** — AST-based router injection. Deeply resolves Multi-hop Dependency Injection (Controller → Service → Repository), inherited DI, and `baseUrl`/`paths` imports. Supports Prisma, TypeORM, and Kysely.
-- **Express 4/5** (JS/TS, ESM/CJS) — AST-based router injection. Deeply resolves external controllers, Mongoose schemas, and barrel re-exports. Uses dynamic tree-scanning to find non-standard entry points (`bootstrap.ts`, etc).
+- **NestJS** — AST-based router injection. Deeply resolves Multi-hop Dependency Injection (Controller → Service → Repository), inherited DI, and `baseUrl`/`paths` imports. Resolves ORM writes: Prisma, Kysely, and TypeORM injected repositories (`@InjectRepository(Entity)` → `this.repo.save()`).
+- **Express 4/5** (JS/TS, ESM/CJS) — AST-based router injection. Deeply resolves external controllers, Mongoose schemas, barrel re-exports, and inline handlers. Uses dynamic tree-scanning to find non-standard entry points (`bootstrap.ts`, etc).
 - **MedusaJS** — Native AST ingestion of complex e-commerce routing.
 - **Any Backend On Earth (Go, Java, Rails, Laravel)** — Compiles flawlessly from OpenAPI 3.x specs.
 - **FastAPI** (Python >= 3.9) — AST-based router injection.
 
+### Effects it resolves (what makes the irreversibility & atomicity proofs bite)
+
+- **Databases** — Prisma (incl. named/multiline relations and interactive `$transaction(tx ⇒ …)`), TypeORM, Kysely, Drizzle, Knex, Sequelize, Mongoose, and raw SQL. Foreign keys become aggregate/consistency domains, so a multi-table write outside a transaction is caught.
+- **External side-effects** — recognized by call shape and by import origin, so an irreversible outbound effect next to a DB write is proven compensable-or-not: `fetch`/axios/got, Stripe, Twilio, SendGrid/Resend/nodemailer, AWS SDK v3 (`send(new PutObjectCommand())`), and other payment/mail/cloud/queue clients. A read on such a client stays a non-observable GET — no false alarms.
+
 ## Security posture (honest)
 
 - 4 runtime dependencies, exact-pinned.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.66.2",
+  "version": "0.67.0",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.",
   "type": "module",
@@ -61,12 +61,12 @@
   "author": "Residual Labs (residual-labs.fr)",
   "license": "BUSL-1.1",
   "dependencies": {
+    "@babel/parser": "8.0.4",
+    "@babel/traverse": "8.0.4",
+    "@clack/prompts": "1.7.0",
     "@modelcontextprotocol/sdk": "1.29.0"
   },
   "devDependencies": {
-    "@babel/parser": "^8.0.4",
-    "@babel/traverse": "^8.0.4",
-    "@clack/prompts": "^1.7.0",
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^10.7.0",

package/src/ubg/apocalypse.js

@@ -304,12 +304,18 @@ export function checkGraph(graph) {
       });
     }
 
-    // O2 — writes into constrained tables need validated input
+    // O2 — writes into constrained tables need validated input. A DELETE removes a row, so it
+    // can never violate a value constraint (CHECK / NOT NULL / UNIQUE) — those constrain the
+    // values a row CARRIES, not its removal. Flagging a delete here was noise (medium finding on
+    // `DELETE /users/:id` because `users.email` is UNIQUE). Only value-writing ops qualify; an
+    // unknown op (raw SQL we couldn't classify) is kept, conservatively.
     obligations++;
-    const constrained = writes.filter((w) =>
-      (g.nodes.get(w.stateId)?.meta.invariants ?? []).some((i) =>
-        CONSTRAINING.has(i.type),
-      ),
+    const constrained = writes.filter(
+      (w) =>
+        w.effect.meta.op !== 'delete' &&
+        (g.nodes.get(w.stateId)?.meta.invariants ?? []).some((i) =>
+          CONSTRAINING.has(i.type),
+        ),
     );
     if (constrained.length) vec.validation = ep.meta.inputValidated ? 1 : -1;
     if (!ep.meta.inputValidated && constrained.length) {

package/src/ubg/express.js

@@ -224,6 +224,10 @@ export function extractExpress(cwd, entryFile) {
         sourceFile: relFile,
         sourceLine: arg.loc?.start.line ?? 0,
         fn: arg,
+        // deep-scan the inline handler like every other callable branch: follows its
+        // service/model calls AND carries the module's effect-client provenance (import
+        // labels), so an SDK call in an inline handler is recognized by origin.
+        scan: resolver.deepScan(arg, mod),
       };
     }
     if (arg.type === 'CallExpression') {

package/src/ubg/extract.js

@@ -109,6 +109,23 @@ const PRISMA_OPS = {
   delete: 'delete',
   deletemany: 'delete',
 };
+// TypeORM write verbs on a repository / entity-manager. Only fire when the RECEIVER is provably
+// a repository (in ctx.repoTables) — a generic `.save()`/`.update()` on an unknown object never
+// fires, so false positives stay near zero. Reads (find/findOne/count/…) are not here.
+const TYPEORM_WRITE = {
+  save: 'insert',
+  insert: 'insert',
+  upsert: 'insert',
+  update: 'update',
+  increment: 'update',
+  decrement: 'update',
+  delete: 'delete',
+  remove: 'delete',
+  softdelete: 'delete',
+  softremove: 'delete',
+  restore: 'update',
+};
+
 const FS_WRITE = new Set([
   'writefile',
   'writefilesync',
@@ -133,6 +150,310 @@ const FS_READ = new Set([
   'existssync',
 ]);
 const HTTP_CLIENTS = new Set(['axios', 'got', 'ky', 'superagent', 'undici']);
+
+// Innate immunity (PAMP table): vendor-SDK call shapes that ARE an irreversible external
+// effect but wear no `fetch`/http-client skin (the SDK hides the network call). Extraction
+// blind spot #1 in the audit: `stripe.charges.create()` charges a card, yet resolved to
+// nothing, so O4 (irreversibility) never fired on real payment code. We can't enumerate every
+// SDK — so, like the olfactory system, we recognize a small set of CONSERVED, highly-specific
+// call SHAPES directly (combinatorial coding, not one receptor per molecule). Matched on the
+// property path BELOW the (user-named) root, so the variable name is irrelevant; DB handlers
+// above have already returned, so no double-count. Additive + write-only: it can only ever
+// RAISE a finding (an observable http_call), never fabricate a false PROVEN — a stale catalog
+// under-detects, it never lies. This is the deterministic, zero-LLM, zero-network innate layer;
+// the adaptive layer (LLM-on-surprise → antibody) is a later brick that fills the long tail.
+const EFFECT_SDK_PATHS = new Set([
+  // Stripe — money movement, irreversible
+  'charges.create',
+  'paymentintents.create',
+  'paymentintents.confirm',
+  'paymentintents.capture',
+  'refunds.create',
+  'payouts.create',
+  'transfers.create',
+  'subscriptions.create',
+  'subscriptions.cancel',
+  'invoices.pay',
+  'checkout.sessions.create',
+  'paymentmethods.attach',
+  // Twilio — SMS / voice, irreversible once sent
+  'messages.create',
+  'calls.create',
+  // Resend / modern mail SDKs — the email leaves once sent
+  'emails.send',
+  'emails.create',
+]);
+// AWS SDK v3 & friends speak `client.send(new XCommand(...))` — the verb is a generic `.send`,
+// but the COMMAND class in the argument names the effect unmistakably. Match the command name
+// (lowercased) so the modern AWS style is not a blind spot the way v2 `s3.putObject()` isn't.
+const EFFECT_SDK_COMMANDS = new Set([
+  'putobjectcommand', // S3 write
+  'deleteobjectcommand',
+  'copyobjectcommand',
+  'sendemailcommand', // SES
+  'sendrawemailcommand',
+  'sendtemplatedemailcommand',
+  'sendmessagecommand', // SQS
+  'sendmessagebatchcommand',
+  'publishcommand', // SNS
+  'publishbatchcommand',
+  'invokecommand', // Lambda
+  'putitemcommand', // DynamoDB writes
+  'updateitemcommand',
+  'deleteitemcommand',
+]);
+// Strong single-token methods: specific enough to fire without a multi-segment path
+// (an email leaves, an object is written to a bucket, a message enters a queue — all
+// observable and irreversible). Deliberately narrow to keep false positives near zero.
+const EFFECT_SDK_METHODS = new Set([
+  'sendmail', // nodemailer transporter.sendMail
+  'sendemail', // AWS SES sendEmail
+  'sendemailcommand',
+  'putobject', // AWS S3 putObject
+  'deleteobject',
+  'copyobject',
+  'sendmessage', // AWS SQS sendMessage
+  'publishcommand',
+]);
+
+// The property path below the root of a call (`stripe.charges.create` → "charges.create"),
+// lowercased, non-computed segments only. Null if not a plain member chain.
+function memberPathBelowRoot(memberExpr) {
+  const segs = [];
+  let cur = memberExpr;
+  while (cur.type === 'MemberExpression') {
+    if (cur.computed || cur.property.type !== 'Identifier') return null;
+    segs.unshift(cur.property.name.toLowerCase());
+    if (cur.object.type === 'ThisExpression') break;
+    cur = cur.object;
+  }
+  segs.pop(); // drop the method itself — we want the path BELOW root, incl. method re-added below
+  return segs;
+}
+
+// Innate-immunity match: does this call's shape name a known irreversible external effect?
+// Returns { httpMethod, target } to emit as an observable http_call, or null.
+function knownExternalEffect(callee, methodLower, node) {
+  if (callee.type !== 'MemberExpression') return null;
+  // AWS SDK v3 shape: `client.send(new PutObjectCommand(...))` — the command class in the
+  // argument names the effect, the `.send` verb alone does not.
+  if (methodLower === 'send' && node) {
+    const arg0 = node.arguments?.[0];
+    const cmd =
+      arg0?.type === 'NewExpression' && arg0.callee?.type === 'Identifier'
+        ? arg0.callee.name.toLowerCase()
+        : null;
+    if (cmd && EFFECT_SDK_COMMANDS.has(cmd))
+      return { httpMethod: 'POST', target: `sdk:${cmd}` };
+  }
+  const below = memberPathBelowRoot(callee); // e.g. ["charges"] for stripe.charges.create
+  const path = below === null ? methodLower : [...below, methodLower].join('.');
+  const hit =
+    EFFECT_SDK_METHODS.has(methodLower) ||
+    EFFECT_SDK_PATHS.has(path) ||
+    [...EFFECT_SDK_PATHS].some((sig) => path.endsWith('.' + sig));
+  if (!hit) return null;
+  // Vendor writes are non-idempotent from the outside → POST makes the effect algebra mark
+  // it observable + non-compensable, which is the whole point (O4 must see the irreversibility).
+  return { httpMethod: 'POST', target: `sdk:${path}` };
+}
+// Import provenance for effect clients (the ant cuticular-hydrocarbon / "colony odor" model):
+// a binding IMPORTED from a package whose whole job is an external side effect (payment, mail,
+// SMS, cloud storage, queue, push) carries an effect LABEL acquired at its source — and that
+// label propagates by contact: `const stripe = require('stripe')(key)`, `const s3 = new
+// S3Client()`, `const x = s3`. Thereafter ANY call on a labeled binding is recognized as an
+// external effect by ORIGIN, not by guessing the method name — which is what the bare `.send()`
+// tail (SendGrid `sgMail.send`, Kafka `producer.send`) needs. Read-shaped methods stay GET (not
+// observable), so a `.get`/`.list`/`.retrieve` never becomes a false irreversibility finding.
+const EFFECT_PACKAGES = new Set([
+  // payment
+  'stripe',
+  'braintree',
+  'razorpay',
+  'square',
+  // mail
+  '@sendgrid/mail',
+  'nodemailer',
+  'resend',
+  'postmark',
+  'mailgun.js',
+  '@mailchimp/mailchimp_transactional',
+  // sms / comms / push
+  'twilio',
+  '@slack/web-api',
+  'firebase-admin',
+  // cloud (v3 clients) + legacy aws-sdk v2
+  'aws-sdk',
+  '@aws-sdk/client-s3',
+  '@aws-sdk/client-ses',
+  '@aws-sdk/client-sesv2',
+  '@aws-sdk/client-sns',
+  '@aws-sdk/client-sqs',
+  '@aws-sdk/client-lambda',
+  '@aws-sdk/client-dynamodb',
+  '@google-cloud/storage',
+  '@google-cloud/pubsub',
+  // queues / streams
+  'kafkajs',
+  'amqplib',
+]);
+// A read-shaped method on an effect client is a GET (idempotent, NOT observable) — so tagging a
+// client can never turn a `.retrieve`/`.list` into a false irreversible effect. Everything else
+// on a labeled client is treated as an outbound POST (observable). Config/wiring methods emit no
+// effect at all.
+const SDK_READ_METHOD =
+  /^(get|list|describe|retrieve|fetch|read|find|query|scan|head|count|exists|search)/;
+const SDK_IGNORE_METHOD = new Set([
+  'setapikey',
+  'config',
+  'configure',
+  'use',
+  'on',
+  'once',
+  'off',
+  'addeventlistener',
+  'connect',
+  'disconnect',
+  'end',
+  'destroy',
+  'constructor',
+  'middleware',
+  'setclient',
+]);
+
+// Collect the effect-labeled bindings of a module, in source order so a later `new X()` sees the
+// earlier `import X`. Pure over the top-level body; returns a Set of local names.
+function collectEffectClients(body) {
+  const labeled = new Set();
+  const isLabeled = (n) => n?.type === 'Identifier' && labeled.has(n.name);
+  for (const node of body) {
+    if (node.type === 'ImportDeclaration') {
+      if (EFFECT_PACKAGES.has(node.source.value))
+        for (const s of node.specifiers) labeled.add(s.local.name);
+      continue;
+    }
+    if (node.type !== 'VariableDeclaration') continue;
+    for (const d of node.declarations) {
+      const init = d.init;
+      if (!init || d.id.type !== 'Identifier') continue;
+      const requirePkg =
+        init.type === 'CallExpression' &&
+        init.callee.type === 'Identifier' &&
+        init.callee.name === 'require' &&
+        init.arguments[0]?.type === 'StringLiteral'
+          ? init.arguments[0].value
+          : null;
+      if (
+        // const x = require('stripe')  OR  const x = require('stripe')(key)  (factory)
+        (requirePkg && EFFECT_PACKAGES.has(requirePkg)) ||
+        (init.type === 'CallExpression' &&
+          init.callee.type === 'CallExpression' &&
+          init.callee.callee?.type === 'Identifier' &&
+          init.callee.callee.name === 'require' &&
+          EFFECT_PACKAGES.has(init.callee.arguments?.[0]?.value)) ||
+        // const y = new X(...)  /  const y = X(...)  where X is already labeled
+        (init.type === 'NewExpression' && isLabeled(init.callee)) ||
+        (init.type === 'CallExpression' && isLabeled(init.callee)) ||
+        // const y = x  (alias)
+        isLabeled(init)
+      )
+        labeled.add(d.id.name);
+    }
+  }
+  return labeled;
+}
+
+// TypeORM repository provenance — like the effect-client label, but for ORM repositories, so a
+// `repo.save()` / `this.userRepo.save()` resolves to a db_write with its entity table even though
+// the table is nowhere in the call. Two sources: (1) a class constructor param that is an injected
+// or typed repository (`@InjectRepository(User) repo` / `repo: Repository<User>`), keyed by field
+// name; (2) a local `const r = getRepository(User)` (or `ds.getRepository(User)`), keyed by var.
+// The entity name is lowercased to a table, matching how Prisma models are keyed.
+export function collectRepoFields(cls) {
+  const map = new Map();
+  if (!cls?.body?.body) return map;
+  const ctor = cls.body.body.find(
+    (m) => m.type === 'ClassMethod' && m.kind === 'constructor',
+  );
+  for (const param of ctor?.params ?? []) {
+    // NestJS constructor params are `TSParameterProperty` wrapping the real Identifier.
+    const inner = param.type === 'TSParameterProperty' ? param.parameter : param;
+    const field = inner?.type === 'Identifier' ? inner.name : null;
+    if (!field) continue;
+    // entity from `@InjectRepository(User)` (authoritative) …
+    let entity = null;
+    for (const dec of param.decorators ?? []) {
+      const call = dec.expression;
+      if (
+        call?.type === 'CallExpression' &&
+        call.callee.type === 'Identifier' &&
+        call.callee.name === 'InjectRepository' &&
+        call.arguments[0]?.type === 'Identifier'
+      )
+        entity = call.arguments[0].name;
+    }
+    // … or from the `Repository<User>` / `TreeRepository<User>` type annotation.
+    if (!entity) {
+      const ta = inner.typeAnnotation?.typeAnnotation;
+      if (
+        ta?.type === 'TSTypeReference' &&
+        /repository$/i.test(ta.typeName?.name ?? '') &&
+        ta.typeParameters?.params?.[0]?.type === 'TSTypeReference'
+      )
+        entity = ta.typeParameters.params[0].typeName?.name ?? null;
+    }
+    if (entity) map.set(field, entity.toLowerCase());
+  }
+  return map;
+}
+
+// Merge the class-level repo fields with the body-local repo vars into one lookup (or null when
+// both are empty, so the common non-TypeORM path allocates nothing).
+function mergeRepoTables(fields, vars) {
+  if ((!fields || !fields.size) && (!vars || !vars.size)) return null;
+  const m = new Map(fields ?? []);
+  for (const [k, v] of vars ?? []) m.set(k, v);
+  return m;
+}
+
+function collectRepoVars(fnNode) {
+  const map = new Map();
+  walkAst(fnNode, (node) => {
+    if (
+      node.type !== 'VariableDeclarator' ||
+      node.id?.type !== 'Identifier' ||
+      node.init?.type !== 'CallExpression'
+    )
+      return;
+    const callee = node.init.callee;
+    const isGetRepo =
+      (callee.type === 'Identifier' && callee.name === 'getRepository') ||
+      (callee.type === 'MemberExpression' &&
+        callee.property?.type === 'Identifier' &&
+        callee.property.name === 'getRepository');
+    const entity = node.init.arguments?.[0];
+    if (isGetRepo && entity?.type === 'Identifier')
+      map.set(node.id.name, entity.name.toLowerCase());
+  });
+  return map;
+}
+
+// walkAst lives in resolve.js; a local minimal copy for the collectors above (extract.js must not
+// import resolve.js — resolve.js imports extract.js).
+function walkAst(node, fn) {
+  if (!node || typeof node !== 'object') return;
+  if (Array.isArray(node)) {
+    for (const n of node) walkAst(n, fn);
+    return;
+  }
+  if (typeof node.type === 'string') fn(node);
+  for (const k of Object.keys(node)) {
+    if (k === 'loc' || k === 'leadingComments' || k === 'trailingComments') continue;
+    const v = node[k];
+    if (v && typeof v === 'object') walkAst(v, fn);
+  }
+}
+
 const GUARD_NAME = /auth|guard|acl|permission|verif|session|admin|protect|role|token/i;
 
 const moduleCache = new Map(); // absFile -> module facts (parse once per compile run)
@@ -181,6 +502,7 @@ export function parseModule(absFile) {
   }
 
   for (const node of facts.ast.program.body) collectTopLevel(node, facts, absFile, false);
+  facts.effectClients = collectEffectClients(facts.ast.program.body);
   return facts;
 }
 
@@ -346,6 +668,29 @@ function collectTopLevel(node, facts, absFile, exported) {
       const resolved = resolveRelImport(absFile, rhs.arguments[0].value);
       if (resolved) facts.reexports.set(left.property.name, resolved);
     }
+    // Direct function export: `module.exports.createOrder = async (b) => …` / `exports.f =
+    // function () {}` / a wrapped `exports.create = catchAsync(async () => …)`. A common
+    // CommonJS style the const-arrow path never saw, so the exported function was invisible
+    // and every effect below it (often a sibling workspace package away) dead-ended. Register
+    // it under the exported name so a `service.createOrder()` call resolves to this body.
+    else if (isExports) {
+      const bodyFn =
+        rhs.type === 'ArrowFunctionExpression' || rhs.type === 'FunctionExpression'
+          ? rhs
+          : rhs.type === 'CallExpression'
+            ? rhs.arguments.find(
+                (a) =>
+                  a?.type === 'ArrowFunctionExpression' ||
+                  a?.type === 'FunctionExpression',
+              )
+            : null;
+      if (bodyFn)
+        facts.functions.set(left.property.name, {
+          node: bodyFn,
+          line: node.loc?.start.line ?? 0,
+          exported: true,
+        });
+    }
   }
 }
 
@@ -854,6 +1199,12 @@ export function scanFunction(fnNode, env = {}) {
     // CLASS METHOD reached through `new X(req.params.collection)` — lets a
     // `this.knex(this.collection)` inside a service resolve to `:collection`.
     thisSymbols: env.thisSymbols ?? null,
+    // effect-labeled bindings of the owning module (import-provenance), so a call on an
+    // SDK client is recognized by origin. Absent → the path/command catalog still applies.
+    effectClients: env.effectClients ?? null,
+    // TypeORM repository provenance: class-injected repo fields (env.repoFields, from the owning
+    // class) merged with local `getRepository(Entity)` vars found in THIS body → receiver → table.
+    repoTables: mergeRepoTables(env.repoFields, collectRepoVars(fnNode)),
   });
   // guard-dominance: a mutation on an unguarded path is a real bypass ONLY when THIS body also holds
   // a guard (so a guard is genuinely being circumvented). A body with no guard of its own is guarded
@@ -1256,10 +1607,26 @@ function visit(node, out, ctx) {
       callee.property?.type === 'Identifier' &&
       TX_WRAPPERS.has(callee.property.name)
     ) {
+      // Client-provenance (the "prion" bind): an interactive transaction hands its callback a
+      // transactional client — `prisma.$transaction(async (tx) => { tx.order.create(...) })`. The
+      // param `tx` IS a db client, but wears a name the /prisma|client|db/ heuristic can't see, so
+      // every write inside used to VANISH (audit blind spot #3: the dominant Prisma idiom compiled
+      // to SURFACE). We propagate the receiver's db-identity onto the callback param name for the
+      // scope of the transaction — templated by contact, not by name. Scoped to txCtx, so the alias
+      // never leaks past the transaction body.
+      const cbParams = node.arguments
+        .filter(
+          (a) =>
+            a?.type === 'ArrowFunctionExpression' || a?.type === 'FunctionExpression',
+        )
+        .flatMap((fn) => fn.params ?? [])
+        .filter((p) => p?.type === 'Identifier')
+        .map((p) => p.name);
       const txCtx = {
         ...ctx,
         tx: node.loc?.start.line ?? 0,
         isolation: isolationLiteralOf(node) ?? 'default',
+        dbAliases: new Set([...(ctx.dbAliases ?? []), ...cbParams]),
       };
       for (const arg of node.arguments) visit(arg, out, txCtx);
       return;
@@ -1475,6 +1842,29 @@ function inspectCall(node, out, ctx) {
     }
   }
 
+  // ---- TypeORM: `repo.save(dto)` / `this.userRepo.update(...)` / `manager.remove(...)`. Fires
+  // ONLY when the receiver is a known repository (ctx.repoTables — injected/typed repo field or a
+  // local getRepository(Entity) var), so a generic `.save()`/`.update()` never trips it. The table
+  // is the entity the repo is typed to; a repo with no resolvable entity still yields a db_write
+  // with an unknown table (enough for O1 guard checks and to lift the handler off SURFACE).
+  if (TYPEORM_WRITE[methodLower] !== undefined && ctx.repoTables) {
+    const recv =
+      callee.object.type === 'Identifier' || callee.object.type === 'MemberExpression'
+        ? clientBaseName(callee.object)
+        : null;
+    if (recv && ctx.repoTables.has(recv)) {
+      const table = ctx.repoTables.get(recv);
+      pushEffect(out, ctx, {
+        effectType: 'db_write',
+        op: TYPEORM_WRITE[methodLower],
+        table: table || null,
+        ...(valueTainted(node.arguments[0], ctx) ? { tainted: true } : {}),
+        line,
+      });
+      return;
+    }
+  }
+
   // ---- prisma: prisma.user.findMany() → table "user". Literal values in
   // `data:`/`where:` are harvested like SQL SET/WHERE literals — they are the
   // raw material StateMachineInference reads (lowercased, same trade-off)
@@ -1489,7 +1879,7 @@ function inspectCall(node, out, ctx) {
       !obj.computed &&
       obj.property.type === 'Identifier' &&
       client &&
-      /prisma|client|db/i.test(client)
+      (/prisma|client|db/i.test(client) || ctx.dbAliases?.has(client))
     ) {
       const op = PRISMA_OPS[methodLower];
       const data = prismaLiteralsOf(node.arguments[0], 'data');
@@ -1564,6 +1954,32 @@ function inspectCall(node, out, ctx) {
     return;
   }
 
+  // ---- innate immunity: known vendor-SDK effects (stripe.charges.create, transporter.sendMail…)
+  // that carry no http-client skin. Checked AFTER every DB handler has returned, so an ORM call
+  // is never misread as an SDK effect. See EFFECT_SDK_PATHS.
+  const sdkEffect = knownExternalEffect(callee, methodLower, node);
+  if (sdkEffect) {
+    pushEffect(out, ctx, { effectType: 'http_call', ...sdkEffect, line });
+    return;
+  }
+  // Import-provenance: a call whose ROOT binding was labeled an effect client (imported from a
+  // payment/mail/cloud/queue package, or built from one). Recognized by origin, not method name —
+  // this is what catches the bare `.send()` tail (sgMail.send, producer.send). A read-shaped
+  // method stays GET (not observable); config/wiring methods emit nothing.
+  if (
+    rootName &&
+    ctx.effectClients?.has(rootName) &&
+    !SDK_IGNORE_METHOD.has(methodLower)
+  ) {
+    pushEffect(out, ctx, {
+      effectType: 'http_call',
+      target: `sdk:${rootName}.${methodLower}`,
+      httpMethod: SDK_READ_METHOD.test(methodLower) ? 'GET' : 'POST',
+      line,
+    });
+    return;
+  }
+
   // ---- HTTP clients: axios.get(...), got.post(...) — the member IS the method
   if (rootName && HTTP_CLIENTS.has(rootName.toLowerCase())) {
     const httpMethod = /^(get|post|put|patch|delete|head)$/.test(methodLower)

package/src/ubg/prisma.js

@@ -192,14 +192,9 @@ function parseModel(modelName, body, line, sourceFile, enums, modelNames, skippe
     const name = fieldName.toLowerCase();
     const typeLower = rawType.toLowerCase();
 
-    // relation field (points at another model) — FK lives in @relation
-    if (modelNames.has(rawType)) {
-      const rel = attrs.match(
-        /@relation\(\s*fields:\s*\[([^\]]*)\]\s*,\s*references:\s*\[([^\]]*)\]/,
-      );
-      if (rel) fk(fieldList(rel[1]), rawType, fieldList(rel[2]));
-      continue; // relations are edges, not columns
-    }
+    // relation field (points at another model) — an edge, never a column. The FK itself is
+    // harvested from the WHOLE body below (multiline- and order-robust), not from this line.
+    if (modelNames.has(rawType)) continue;
     if (isList) continue; // scalar lists & back-relations carry no column
 
     const isPk = /@id\b/.test(attrs);
@@ -237,6 +232,21 @@ function parseModel(modelName, body, line, sourceFile, enums, modelNames, skippe
     }
   }
 
+  // FK harvest over the WHOLE model body — real schemas write `@relation("Name", fields: [...],
+  // references: [...], onDelete: Cascade)` with a leading relation name, extra attributes, or the
+  // call split across several lines. The old single-line `@relation(\s*fields:` regex silently
+  // dropped all of those, so consistency domains collapsed to one-table islands on serious apps
+  // (ghostfolio: 0 FK edges) and O3/O5 never fired. Scanning the body with `[\s\S]` and pulling
+  // `fields:`/`references:` INDEPENDENTLY makes the harvest order- and newline-robust. The field's
+  // type token (a known model) is captured right before `@relation(`; back-relation list fields
+  // carry no `fields:`/`references:` and are naturally skipped.
+  for (const rm of body.matchAll(/(\w+)(?:\[\])?\??\s+@relation\(([\s\S]*?)\)/g)) {
+    if (!modelNames.has(rm[1])) continue; // the token before @relation must be a model (the target)
+    const fMatch = rm[2].match(/fields:\s*\[([^\]]*)\]/);
+    const rMatch = rm[2].match(/references:\s*\[([^\]]*)\]/);
+    if (fMatch && rMatch) fk(fieldList(fMatch[1]), rm[1], fieldList(rMatch[1]));
+  }
+
   const name = modelName.toLowerCase();
   return {
     name,

package/src/ubg/resolve.js

@@ -26,6 +26,7 @@ import {
   methodInClassChain,
   computeThisSymbols,
   resolveExportedFunction,
+  collectRepoFields,
 } from './extract.js';
 
 export const MAX_RESOLVE_DEPTH = 6;
@@ -146,7 +147,7 @@ export function createResolver({ cwd, scannedFiles, helpers }) {
   // resolved methods. `this.<m>()` dispatches from the INSTANTIATED class, so an
   // override (ActivityService.readByQuery) wins over the base method it shadows.
   function deepScan(fnNode, owningMod) {
-    const base = scanFunction(fnNode);
+    const base = scanFunction(fnNode, { effectClients: owningMod?.effectClients });
     const merged = {
       ...base,
       effects: [...base.effects],
@@ -202,7 +203,7 @@ export function createResolver({ cwd, scannedFiles, helpers }) {
             // `assertIntegrationEnvironmentScope` gating a public register → a false PROVEN).
             // A route's real gate is a chain step or a DIRECTLY-resolved verifier, not any
             // denying function somewhere in its transitive closure. Effects merge; guards do not.
-            const bare = scanFunction(fn);
+            const bare = scanFunction(fn, { effectClients: fnMod?.effectClients });
             bare.guardSignals = { deniesWithStatus: false };
             mergeScan(merged, bare);
             followCalls(fn, fnMod, merged, seen, depth + 1, null, stack);
@@ -318,7 +319,10 @@ export function createResolver({ cwd, scannedFiles, helpers }) {
         sourceLine: fn.line,
         fn: fn.node,
       });
-      mergeScan(merged, scanFunction(fn.node));
+      mergeScan(
+        merged,
+        scanFunction(fn.node, { effectClients: targetMod?.effectClients }),
+      );
       followCalls(fn.node, targetMod, merged, seen, depth + 1, null, stack);
     });
   }
@@ -369,7 +373,12 @@ export function createResolver({ cwd, scannedFiles, helpers }) {
     if (cached) return cached;
     if (stack.has(key)) return null; // reference cycle — contribute nothing, don't cache
     stack.add(key);
-    const base = scanFunction(hit.fn, { thisSymbols });
+    const base = scanFunction(hit.fn, {
+      thisSymbols,
+      effectClients: hit.mod?.effectClients,
+      // the method's own class supplies the injected/typed repository fields (TypeORM)
+      repoFields: collectRepoFields(hit.cls ?? topCls),
+    });
     const bundle = {
       ...base,
       key,
@@ -417,7 +426,11 @@ export function createResolver({ cwd, scannedFiles, helpers }) {
   // service → repository → kysely, wiring often inherited), which is why the walk
   // is recursive, bounded, and memoized (E-027: twenty took 34s without the memo).
   function handlerScan(method, di, mod, cls) {
-    const base = scanFunction(method); // the handler body itself
+    // the handler body itself
+    const base = scanFunction(method, {
+      effectClients: mod?.effectClients,
+      repoFields: collectRepoFields(cls),
+    });
     const merged = {
       ...base,
       effects: [...base.effects],