typescript

func (*Provider) AnalyzePractices ¶

func (*Provider) AnalyzePractices(providers.SourceFile) ([]findings.Finding, error)

AnalyzePractices is a stub; the best-practice rules arrive in Prompt 1.2.

func (*Provider) AnalyzeSecurity ¶

func (p *Provider) AnalyzeSecurity(src providers.SourceFile) ([]findings.Finding, error)

AnalyzeSecurity runs the embedded deterministic security rules over src and returns the findings. The provider is a thin adapter: it loads/compiles the rules (once), parses the file, and hands both to the language-agnostic ruleengine — no detection logic lives here.

func (*Provider) AnalyzeSurface ¶

func (p *Provider) AnalyzeSurface(src providers.SourceFile) ([]findings.SurfaceItem, error)

AnalyzeSurface maps the auditable structural surface of a TypeScript file by running the provider's surface queries through the agnostic framework, which stamps the stable ids. Today only IDOR (Next App Router) is wired; authz and over-fetching are added as their queries land.

func (*Provider) Capability ¶ added in v0.2.9

func (*Provider) Capability() providers.Capability

Capability declares what the TypeScript provider implements. Security is Enumerable:true — its 9 rule IDs are the exact set loaded by ruleengine.LoadFS(rules.FS, "typescript/security") (securityRules, above), so Control A (capability_test.go's set-equality test) checks Declared against the real loader, not a copy. Practices is Enumerable:false with an empty Declared: AnalyzePractices is a stub (see typescript.go) — nothing is implemented yet, so nothing is declared. Surface lists all four categories this provider's surfaceQueries() run (idor, authz, overfetch, nplus1). CoverageManifest is true: the provider implements CoverageManifest() (coverage.go).

func (*Provider) CoverageManifest ¶

func (*Provider) CoverageManifest() coverage.Manifest

CoverageManifest declares what codefit audits for TypeScript and how — what the codefit-coverage tool serves and what the human-facing COVERAGE.md mirrors (PRD §10, RF-07). Each entry carries an id, a one-line claim, and the full prose as its detail; the tool sends the claims always and the prose only when an agent names an id. An entry short enough to say everything in its claim carries no detail rather than repeating itself. It is NOT itself the root source: the rules (rules/<lang>/, internal/sensors/, and the DB dimension's four rule roots) are, and this manifest is a HAND-MAINTAINED mirror of them that has to be verified against them before it is edited. Calling it the source is how drift returns one level down. The two categories that split between a deterministic rule and mapped surface (ADR 0004) appear in BOTH lists, each side describing exactly what it covers, so an evaluator reads a division of labor, not a gap.

CoverageManifest is a provider method (not yet on the shared LanguageProvider interface) — the interface convergence is deferred until the Go provider also emits this (ADR 0003).

The DB dimension's entries (schema-only, language-independent — ADR 0018) live in core/dbcoverage and are appended here rather than duplicated: this file carries TypeScript/Next/Express/Fastify/NestJS entries only. They are appended at the END of each bucket, which is where they already sat before this composition existed, so the manifest's entry ORDER is unchanged. The composition itself is unchanged too: dbcoverage returns entries and this file appends them, exactly as it appended strings before.

func (*Provider) DefaultPathCriticality ¶

func (*Provider) DefaultPathCriticality() config.PathCriticality

func (*Provider) ExtractQueryFilters ¶ added in v0.2.4

func (p *Provider) ExtractQueryFilters(src providers.SourceFile) ([]query.QueryFilter, error)

ExtractQueryFilters extracts the neutral QueryFilter of every Prisma query call-site in src that FILTERS by one or more columns (has a WHERE). It is a pure AST fact — the code side of the code↔schema cross — reusing the same call-site machinery as N+1 and over-fetching (walkTS/isPrismaCall/prismaCallInfo). A call with no WHERE (a create, a bare findMany, an aggregate without filter) yields no filter: there is nothing to cross against an index.

func (*Provider) FileExtensions ¶

func (*Provider) FileExtensions() []string

func (*Provider) Frameworks ¶

func (*Provider) Frameworks() []string

func (*Provider) Language ¶

func (*Provider) Language() string

func (*Provider) Parse ¶

func (*Provider) Parse(src providers.SourceFile) (syntax.Node, error)

Parse parses a TypeScript (.ts) or TSX (.tsx) file and returns the root of the parser-agnostic AST. The concrete gotreesitter tree is hidden behind syntax.Node so the core never depends on the parser.

func (*Provider) ParseSchema ¶ added in v0.2.0

func (*Provider) ParseSchema(sources []providers.SourceFile) (*db.Schema, error)

ParseSchema parses Prisma schema source(s) into the neutral db.Schema model. It is a hand-written, line-oriented parser over the Prisma DSL (not tree-sitter — ADR 0014), so it yields a Pos line for every element for free. It is TWO-PASS: a field's type can be a scalar, a model name (a virtual relation field — excluded as a column) or an enum name (a real column). Pass one collects the model and enum names; pass two resolves each field against those sets. Without it, an enum column (role Role) would be silently dropped as a relation.

Prisma view blocks are out of scope and are skipped without error (Schema.Views stays empty here; the SQL-DDL parser, which does fill Views, is the path where DB-020 has anything to read).