code-auditor-mcp 3.0.6 → 3.1.0

package/dist/analyzers/universal/UniversalSchemaAnalyzer.js

@@ -1,9 +1,15 @@
 /**
- * Universal Schema Analyzer
- * Works across multiple programming languages using the adapter pattern
- * Analyzes code against database schemas
+ * Universal Schema Analyzer — Spec 17 R2
+ *
+ * R2.1: SQL-context-only extraction (AST-based, not regex scan-all-strings).
+ * R2.2: File gate — only analyze files with DB usage indicators.
+ * R2.3: Template expressions resolve to wildcards for known-table matching.
+ * R2.4: Unknown-table findings include SQL kind, line, and Levenshtein suggestions.
+ * R2.5: Legacy scan-all-strings path DELETED.
+ * R7:   schema/unknown-table severity is "suggestion".
  */
 import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
+import picomatch from 'picomatch';
 export const DEFAULT_SCHEMA_CONFIG = {
     enableTableUsageTracking: true,
     checkMissingReferences: true,
@@ -19,7 +25,13 @@ export const DEFAULT_SCHEMA_CONFIG = {
     schemaFilePatterns: ['*.schema.json', '*-schema.json'],
     dataFilePatterns: ['*.data.json', '*.example.json'],
     strictMode: false,
-    allowAdditionalProperties: true
+    allowAdditionalProperties: true,
+    // Spec-17 R2 defaults
+    sqlTagNames: ['sql', 'db'],
+    dbReceiverNames: ['db', 'database', 'sql', 'stmt', 'connection', 'pool', 'client'],
+    dbCallMethods: ['exec', 'prepare', 'batch', 'run', 'all', 'first', 'query', 'get', 'each'],
+    dbBindingNames: ['env.DB'],
+    fileGateGlobs: ['**/*.sql', '**/migrations/**'],
 };
 import { promises as fs } from 'fs';
 export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
@@ -29,22 +41,16 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     // Track references across files
     tableReferences = new Map();
     columnReferences = new Map();
-    /**
-     * Override analyze to handle both TypeScript files and JSON files
-     */
     async analyze(files, config) {
         const jsonFiles = files.filter(f => f.endsWith('.json'));
         const codeFiles = files.filter(f => !f.endsWith('.json'));
-        // Analyze code files using the standard Universal approach
         const codeResult = codeFiles.length > 0 ? await super.analyze(codeFiles, config) : {
             violations: [],
             errors: [],
             filesProcessed: 0,
             executionTime: 0
         };
-        // Analyze JSON schema files
         const jsonResult = await this.analyzeJsonSchemas(jsonFiles, config);
-        // Combine results
         return {
             violations: [...codeResult.violations, ...jsonResult.violations],
             errors: [...(codeResult.errors || []), ...(jsonResult.errors || [])],
@@ -55,11 +61,14 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     async analyzeAST(ast, adapter, config, sourceCode) {
         const violations = [];
         const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
+        // R2.2 — File gate: only analyze files with DB context
+        if (!this.passesFileGate(ast.filePath, sourceCode, finalConfig)) {
+            return violations;
+        }
         // Get available schemas
         const schemas = finalConfig.schemas || [];
         const allTables = new Set();
         const tableColumns = new Map();
-        // Build lookup maps
         for (const schema of schemas) {
             for (const table of schema.tables) {
                 allTables.add(table.name);
@@ -67,22 +76,25 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 tableColumns.set(table.name, columns);
             }
         }
-        // Check if schemas are required but missing
         if (finalConfig.requiredSchemas && finalConfig.requiredSchemas.length > 0 && schemas.length === 0) {
             violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'No database schemas loaded for analysis', 'warning', 'missing-schemas'));
             return violations;
         }
-        // Find table references in the code
-        const tableRefs = this.findTableReferences(ast, adapter, sourceCode);
+        // R2.1 — AST-based table reference extraction (replaces legacy regex scan-all-strings)
+        const tableRefs = this.findTableReferences(ast, adapter, sourceCode, finalConfig);
         const columnRefs = this.findColumnReferences(ast, adapter, sourceCode);
-        // Check for missing table references
+        // Check for missing table references — R2.4: Levenshtein suggestions
         if (finalConfig.checkMissingReferences) {
             for (const ref of tableRefs) {
                 if (!allTables.has(ref.table) && !this.isSystemTable(ref.table)) {
-                    violations.push(this.createViolation(ast.filePath, ref.location, `Reference to unknown table '${ref.table}'`, 'warning', 'unknown-table'));
+                    const suggestions = this.getNearestTableSuggestions(ref.table, allTables, 2);
+                    const msg = suggestions.length > 0
+                        ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
+                        : `Reference to unknown table '${ref.table}' (${ref.type})`;
+                    violations.push(this.createViolation(ast.filePath, ref.location, msg, 'suggestion', // R7
+                    'unknown-table'));
                 }
             }
-            // Check column references
             for (const ref of columnRefs) {
                 const columnSet = tableColumns.get(ref.table);
                 if (columnSet && !columnSet.has(ref.column)) {
@@ -98,61 +110,233 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         if (finalConfig.validateQueryPatterns) {
             violations.push(...this.checkQueryPatterns(ast, adapter, sourceCode, finalConfig));
         }
-        // Check for SQL injection patterns
+        // Check for SQL injection patterns — R7: no critical by default
         violations.push(...this.checkSQLInjection(ast, adapter, sourceCode));
         return violations;
     }
+    // ---------------------------------------------------------------------------
+    // R2.2 — File gate
+    // ---------------------------------------------------------------------------
     /**
-     * Find table references in the code
+     * Pre-filter: only analyze files that show DB usage.
+     * Checks: .sql/migration glob, D1/SQL imports, env-binding patterns, DB calls.
      */
-    findTableReferences(ast, adapter, sourceCode) {
+    passesFileGate(filePath, sourceCode, config) {
+        // Always pass .sql files and migration directories
+        const gateGlobs = config.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
+        for (const glob of gateGlobs) {
+            if (picomatch.isMatch(filePath, glob)) {
+                return true;
+            }
+        }
+        // Check for D1 or SQL API imports
+        const importPatterns = [
+            /import\s+.*\b(D1Database|D1PreparedStatement|D1Result)\b/,
+            /import\s+.*from\s+['"].*d1['"]/,
+            /import\s+.*from\s+['"].*pg['"]/,
+            /import\s+.*from\s+['"].*mysql['"]/,
+            /import\s+.*from\s+['"].*sqlite['"]/,
+            /import\s+.*from\s+['"].*knex['"]/,
+            /import\s+.*from\s+['"].*drizzle['"]/,
+            /import\s+.*from\s+['"].*prisma['"]/,
+        ];
+        for (const pat of importPatterns) {
+            if (pat.test(sourceCode))
+                return true;
+        }
+        // Check for env-binding patterns (e.g., env.DB in Cloudflare Workers)
+        const bindingNames = config.dbBindingNames ?? ['env.DB'];
+        for (const binding of bindingNames) {
+            if (sourceCode.includes(binding))
+                return true;
+        }
+        // Check for DB call patterns (receiver.method)
+        const receivers = config.dbReceiverNames ?? ['db', 'database', 'sql', 'stmt'];
+        const methods = config.dbCallMethods ?? ['exec', 'prepare', 'batch', 'run', 'all', 'first'];
+        for (const receiver of receivers) {
+            for (const method of methods) {
+                const pattern = new RegExp(`\\b${escapeRegex(receiver)}\\.${escapeRegex(method)}\\s*\\(`);
+                if (pattern.test(sourceCode))
+                    return true;
+            }
+        }
+        // Check for SQL tagged template literals
+        const sqlTags = config.sqlTagNames ?? ['sql', 'db'];
+        for (const tag of sqlTags) {
+            const pattern = new RegExp(`\\b${escapeRegex(tag)}\`\\s*SELECT|\\b${escapeRegex(tag)}\`\\s*INSERT|\\b${escapeRegex(tag)}\`\\s*UPDATE|\\b${escapeRegex(tag)}\`\\s*DELETE|\\b${escapeRegex(tag)}\`\\s*CREATE`, 'i');
+            if (pattern.test(sourceCode))
+                return true;
+        }
+        return false;
+    }
+    // ---------------------------------------------------------------------------
+    // R2.1 — AST-based table reference extraction (replaces legacy regex)
+    // ---------------------------------------------------------------------------
+    /**
+     * Extract table references exclusively from SQL contexts in the AST.
+     * R2.1: Only tagged template SQL and DB-call patterns produce candidates.
+     * R2.3: Template expressions (${var}) resolved to wildcards.
+     */
+    findTableReferences(ast, adapter, sourceCode, config) {
         const references = [];
-        // Common patterns for table references
-        const patterns = [
-            // ORM patterns
-            /from\s*\(\s*["'`]?(\w+)["'`]?\s*\)/gi,
-            /table\s*[:=]\s*["'`](\w+)["'`]/gi,
-            /\.(\w+Table)\s*\(/gi,
-            // SQL patterns
-            /FROM\s+["'`]?(\w+)["'`]?/gi,
-            /JOIN\s+["'`]?(\w+)["'`]?/gi,
-            /UPDATE\s+["'`]?(\w+)["'`]?/gi,
-            /INSERT\s+INTO\s+["'`]?(\w+)["'`]?/gi,
-            /DELETE\s+FROM\s+["'`]?(\w+)["'`]?/gi,
-            /CREATE\s+TABLE\s+["'`]?(\w+)["'`]?/gi,
-            // Schema definition patterns
-            /pgTable\s*\(\s*["'`](\w+)["'`]/gi,
-            /mysqlTable\s*\(\s*["'`](\w+)["'`]/gi,
-            /sqliteTable\s*\(\s*["'`](\w+)["'`]/gi
+        const sqlTags = config.sqlTagNames ?? ['sql', 'db'];
+        const dbMethods = config.dbCallMethods ?? ['exec', 'prepare', 'batch', 'run', 'all', 'first', 'query'];
+        const dbReceivers = config.dbReceiverNames ?? ['db', 'database', 'sql', 'stmt'];
+        // (1) Tagged template SQL — e.g. sql`SELECT * FROM heroes`
+        const taggedTemplates = adapter.findNodes(ast, {
+            custom: (node) => {
+                if (node.type !== 'call_expression')
+                    return false;
+                // Callee must be an identifier matching sqlTagNames
+                const callee = this.getCallee(node, adapter, sourceCode);
+                if (!callee || !sqlTags.includes(callee))
+                    return false;
+                // Must have a template string argument
+                return this.hasTemplateArgument(node, adapter);
+            },
+        });
+        for (const callNode of taggedTemplates) {
+            const templateText = this.getTemplateText(callNode, adapter, sourceCode);
+            if (!templateText)
+                continue;
+            const location = this.getCallLocation(callNode);
+            const tableRefs = this.parseSqlTables(templateText, location, sourceCode);
+            references.push(...tableRefs);
+        }
+        // (2) DB-call patterns — e.g. db.exec("SELECT * FROM heroes")
+        const dbCalls = adapter.findNodes(ast, {
+            custom: (node) => {
+                if (node.type !== 'call_expression')
+                    return false;
+                const callee = this.getCallee(node, adapter, sourceCode);
+                if (!callee)
+                    return false;
+                // Check if callee is a member expression like db.exec or db.prepare
+                return this.isDbMemberCall(node, callee, dbMethods, dbReceivers, adapter, sourceCode);
+            },
+        });
+        for (const callNode of dbCalls) {
+            const firstArg = this.getFirstStringArgument(callNode, adapter, sourceCode);
+            if (!firstArg)
+                continue;
+            const location = this.getCallLocation(callNode);
+            const tableRefs = this.parseSqlTables(firstArg, location, sourceCode);
+            references.push(...tableRefs);
+        }
+        // (3) .sql files and migration directories — scan the entire source
+        if (ast.filePath.endsWith('.sql') ||
+            ast.filePath.includes('/migrations/') ||
+            ast.filePath.includes('\\migrations\\')) {
+            const fileRefs = this.parseSqlTables(sourceCode, { line: 1, column: 1 }, sourceCode);
+            references.push(...fileRefs);
+        }
+        return references;
+    }
+    /**
+     * Parse SQL table names from a SQL text string.
+     * R2.3: Template expressions (${...}) resolve portions to wildcards.
+     */
+    parseSqlTables(sqlText, baseLocation, sourceCode) {
+        const references = [];
+        // R2.3: Strip template expressions — `${prefix}_builds` → `_builds`
+        // (the prefix is replaced with empty, the suffix remains for matching)
+        const cleaned = this.resolveTemplateExpressions(sqlText);
+        // SQL patterns anchored to SQL keywords (not arbitrary substrings)
+        const sqlPatterns = [
+            { regex: /\bFROM\s+([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'select' },
+            { regex: /\bJOIN\s+([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'select' },
+            { regex: /\bINSERT\s+INTO\s+([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'insert' },
+            { regex: /\bUPDATE\s+([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'update' },
+            { regex: /\bDELETE\s+FROM\s+([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'delete' },
+            { regex: /\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"']?)([a-zA-Z_]\w*)\1\b/gi, type: 'create' },
         ];
-        for (const pattern of patterns) {
+        for (const { regex, type } of sqlPatterns) {
             let match;
-            while ((match = pattern.exec(sourceCode)) !== null) {
-                const table = match[1];
-                const index = match.index;
-                const lines = sourceCode.substring(0, index).split('\n');
-                const line = lines.length;
-                const column = lines[lines.length - 1].length + 1;
+            // Create fresh regex since we might consume with exec
+            const re = new RegExp(regex.source, regex.flags);
+            while ((match = re.exec(cleaned)) !== null) {
+                const table = match[2]; // The table name (capture group 2)
+                if (!table || this.isSystemTable(table))
+                    continue;
+                // Skip common false positives: common variable names, keywords
+                if (this.isSqlKeyword(table))
+                    continue;
+                // Calculate position in original source
+                const offset = sqlText.indexOf(match[0]);
+                const location = offset >= 0
+                    ? this.offsetToLocation(sourceCode, sourceCode.indexOf(cleaned) + offset, baseLocation)
+                    : baseLocation;
                 references.push({
                     table,
-                    type: this.getQueryType(match[0]),
-                    location: { line, column },
-                    context: match[0]
+                    type,
+                    location,
+                    context: match[0].trim(),
                 });
             }
         }
         return references;
     }
     /**
-     * Find column references
+     * R2.3: Resolve template expressions in SQL text.
+     * `${prefix}_builds` → `_builds` (dynamic prefix removed, suffix kept).
+     * `${identifier}` (fully dynamic) → empty string (no finding produced).
      */
+    resolveTemplateExpressions(text) {
+        // Replace dynamic segments with wildcard-aware placeholders
+        // ${var} alone → consume the entire segment (no table name to extract)
+        // ${p}_suffix → keep "_suffix" for matching
+        return text.replace(/\$\{[^}]+\}/g, '');
+    }
+    // ---------------------------------------------------------------------------
+    // R2.4 — Levenshtein suggestions
+    // ---------------------------------------------------------------------------
+    /**
+     * Return known table names within edit distance ≤ maxDist.
+     */
+    getNearestTableSuggestions(name, knownTables, maxDist) {
+        const results = [];
+        for (const known of knownTables) {
+            const dist = this.levenshteinDistance(name.toLowerCase(), known.toLowerCase());
+            if (dist <= maxDist) {
+                results.push({ table: known, distance: dist });
+            }
+        }
+        // Sort by distance ascending
+        results.sort((a, b) => a.distance - b.distance);
+        return results.slice(0, 3).map(r => `'${r.table}'`);
+    }
+    levenshteinDistance(a, b) {
+        const m = a.length;
+        const n = b.length;
+        // Optimize: early exit if length difference exceeds threshold
+        if (Math.abs(m - n) > 3)
+            return Infinity;
+        const dp = Array.from({ length: m + 1 }, () => Array(n + 1).fill(0));
+        for (let i = 0; i <= m; i++)
+            dp[i][0] = i;
+        for (let j = 0; j <= n; j++)
+            dp[0][j] = j;
+        for (let i = 1; i <= m; i++) {
+            for (let j = 1; j <= n; j++) {
+                if (a[i - 1] === b[j - 1]) {
+                    dp[i][j] = dp[i - 1][j - 1];
+                }
+                else {
+                    dp[i][j] = 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+                }
+            }
+        }
+        return dp[m][n];
+    }
+    // ---------------------------------------------------------------------------
+    // Column references (unchanged for now)
+    // ---------------------------------------------------------------------------
     findColumnReferences(ast, adapter, sourceCode) {
         const references = [];
-        // Patterns for column references
         const patterns = [
-            /(\w+)\.(\w+)\s*[=<>]/gi, // table.column comparison
-            /SELECT\s+.*?(\w+)\.(\w+)/gi, // SELECT table.column
-            /WHERE\s+.*?(\w+)\.(\w+)/gi, // WHERE table.column
+            /(\w+)\.(\w+)\s*[=<>]/gi,
+            /SELECT\s+.*?(\w+)\.(\w+)/gi,
+            /WHERE\s+.*?(\w+)\.(\w+)/gi,
         ];
         for (const pattern of patterns) {
             let match;
@@ -172,17 +356,15 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return references;
     }
-    /**
-     * Check naming conventions
-     */
+    // ---------------------------------------------------------------------------
+    // Naming conventions
+    // ---------------------------------------------------------------------------
     checkNamingConventions(references, filePath) {
         const violations = [];
         for (const ref of references) {
-            // Check for camelCase tables (should be snake_case)
             if (/[A-Z]/.test(ref.table) && !ref.table.endsWith('Table')) {
                 violations.push(this.createViolation(filePath, ref.location, `Table name '${ref.table}' should use snake_case convention`, 'suggestion', 'naming-convention'));
             }
-            // Check for reserved words
             const reserved = ['user', 'order', 'group', 'table', 'column', 'index'];
             if (reserved.includes(ref.table.toLowerCase())) {
                 violations.push(this.createViolation(filePath, ref.location, `Table name '${ref.table}' is a reserved word. Consider using a different name.`, 'warning', 'reserved-word'));
@@ -190,12 +372,11 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return violations;
     }
-    /**
-     * Check query patterns
-     */
+    // ---------------------------------------------------------------------------
+    // Query patterns
+    // ---------------------------------------------------------------------------
     checkQueryPatterns(ast, adapter, sourceCode, config) {
         const violations = [];
-        // Count queries per function
         const functions = adapter.extractFunctions(ast);
         for (const func of functions) {
             const funcNode = this.findNodeByLocation(ast.root, func.location.start);
@@ -207,34 +388,172 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 violations.push(this.createViolation(ast.filePath, func.location.start, `Function '${func.name}' has ${queryCount} queries, exceeding the maximum of ${config.maxQueriesPerFunction}`, 'warning', 'too-many-queries'));
             }
         }
-        // Check for N+1 query patterns
+        // N+1 query check — only flag if we have actual DB calls, not grep
         if (sourceCode.includes('.map') && (sourceCode.includes('.query') || sourceCode.includes('SELECT'))) {
             violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'Potential N+1 query pattern detected. Consider using a join or batch query.', 'warning', 'n-plus-one'));
         }
         return violations;
     }
-    /**
-     * Check for SQL injection vulnerabilities
-     */
+    // ---------------------------------------------------------------------------
+    // SQL injection — R7: severity changed from critical to warning
+    // ---------------------------------------------------------------------------
     checkSQLInjection(ast, adapter, sourceCode) {
         const violations = [];
-        // Patterns that indicate potential SQL injection
         const dangerousPatterns = [
-            /query\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/g, // Template literals in queries
-            /query\s*\(\s*['"][^'"]*['"]?\s*\+/g, // String concatenation
-            /execute\s*\(\s*['"][^'"]*['"]?\s*\+/g, // String concatenation in execute
+            /query\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/g,
+            /query\s*\(\s*['"][^'"]*['"]?\s*\+/g,
+            /execute\s*\(\s*['"][^'"]*['"]?\s*\+/g,
         ];
         for (const pattern of dangerousPatterns) {
             if (pattern.test(sourceCode)) {
-                violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'Potential SQL injection vulnerability. Use parameterized queries.', 'critical', 'sql-injection'));
+                violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'Potential SQL injection vulnerability. Use parameterized queries.', 'warning', // R7: was 'critical'
+                'sql-injection'));
                 break;
             }
         }
         return violations;
     }
+    // ---------------------------------------------------------------------------
+    // AST helpers for R2.1
+    // ---------------------------------------------------------------------------
     /**
-     * Helper methods
+     * Extract the callee text from a call_expression node.
      */
+    getCallee(node, adapter, sourceCode) {
+        // For db.exec() → callee is "db.exec"
+        if (!node.children)
+            return null;
+        for (const child of node.children) {
+            const type = adapter.getNodeType(child);
+            if (type === 'identifier' ||
+                type === 'member_expression' ||
+                type === 'call_expression') {
+                return adapter.getNodeText(child, sourceCode).trim();
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if call_expression has a template string argument.
+     */
+    hasTemplateArgument(node, adapter) {
+        if (!node.children)
+            return false;
+        for (const child of node.children) {
+            const type = adapter.getNodeType(child);
+            if (type === 'template_string' || type === 'template_literal') {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get the text of the first template string argument.
+     */
+    getTemplateText(node, adapter, sourceCode) {
+        if (!node.children)
+            return null;
+        for (const child of node.children) {
+            const type = adapter.getNodeType(child);
+            if (type === 'template_string' || type === 'template_literal') {
+                return adapter.getNodeText(child, sourceCode).trim();
+            }
+        }
+        return null;
+    }
+    /**
+     * Get the first string/template argument from a call expression.
+     */
+    getFirstStringArgument(node, adapter, sourceCode) {
+        if (!node.children)
+            return null;
+        // Look for 'arguments' child first
+        for (const child of node.children) {
+            const type = adapter.getNodeType(child);
+            if (type === 'arguments' && child.children) {
+                for (const arg of child.children) {
+                    const argType = adapter.getNodeType(arg);
+                    if (argType === 'string' ||
+                        argType === 'template_string' ||
+                        argType === 'template_literal') {
+                        const text = adapter.getNodeText(arg, sourceCode).trim();
+                        // Strip surrounding quotes from string literals
+                        if ((text.startsWith("'") && text.endsWith("'")) ||
+                            (text.startsWith('"') && text.endsWith('"')) ||
+                            (text.startsWith('`') && text.endsWith('`'))) {
+                            return text.slice(1, -1);
+                        }
+                        return text;
+                    }
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if a callee is a DB member call like db.exec, database.query, etc.
+     */
+    isDbMemberCall(node, calleeText, methods, receivers, adapter, sourceCode) {
+        // calleeText might be like "db.exec"
+        const dotIdx = calleeText.indexOf('.');
+        if (dotIdx === -1)
+            return false;
+        const receiver = calleeText.substring(0, dotIdx);
+        const method = calleeText.substring(dotIdx + 1);
+        return receivers.includes(receiver) && methods.includes(method);
+    }
+    /**
+     * Get the line/column location of the call expression.
+     */
+    getCallLocation(node) {
+        return node.location.start;
+    }
+    /**
+     * Convert a character offset to a line/column location.
+     */
+    offsetToLocation(sourceCode, offset, base) {
+        if (offset < 0 || offset >= sourceCode.length)
+            return base;
+        const before = sourceCode.substring(0, offset);
+        const lineOffset = before.split('\n').length - 1;
+        const lastNewline = before.lastIndexOf('\n');
+        const column = lastNewline >= 0 ? offset - lastNewline : offset + 1;
+        return { line: base.line + lineOffset, column };
+    }
+    // ---------------------------------------------------------------------------
+    // General helpers
+    // ---------------------------------------------------------------------------
+    isSystemTable(table) {
+        const systemTables = [
+            'information_schema',
+            'pg_catalog',
+            'mysql',
+            'performance_schema',
+            'sys',
+            'sqlite_master',
+            'sqlite_sequence',
+        ];
+        return systemTables.some(st => table.toLowerCase() === st || table.toLowerCase().startsWith(st + '.'));
+    }
+    /**
+     * Common SQL keywords and identifiers that are not real table names.
+     */
+    isSqlKeyword(word) {
+        const keywords = new Set([
+            'select', 'from', 'where', 'join', 'inner', 'outer', 'left', 'right',
+            'full', 'cross', 'on', 'and', 'or', 'not', 'in', 'as', 'is', 'null',
+            'like', 'between', 'order', 'group', 'by', 'having', 'limit', 'offset',
+            'union', 'all', 'distinct', 'case', 'when', 'then', 'else', 'end',
+            'insert', 'into', 'values', 'update', 'set', 'delete', 'create',
+            'table', 'alter', 'drop', 'index', 'view', 'if', 'exists', 'primary',
+            'key', 'foreign', 'references', 'constraint', 'default', 'unique',
+            'check', 'asc', 'desc', 'count', 'sum', 'avg', 'min', 'max',
+            'integer', 'text', 'varchar', 'text', 'boolean', 'float', 'blob',
+            'real', 'timestamp', 'date', 'time', 'datetime', 'serial', 'bigint',
+            'the', 'a', 'an',
+        ]);
+        return keywords.has(word.toLowerCase());
+    }
     getQueryType(context) {
         const upper = context.toUpperCase();
         if (upper.includes('SELECT'))
@@ -249,16 +568,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             return 'create';
         return 'reference';
     }
-    isSystemTable(table) {
-        const systemTables = [
-            'information_schema',
-            'pg_catalog',
-            'mysql',
-            'performance_schema',
-            'sys'
-        ];
-        return systemTables.some(st => table.toLowerCase().startsWith(st));
-    }
     countQueries(text) {
         const patterns = [
             /\.query\s*\(/g,
@@ -266,7 +575,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             /SELECT\s+/gi,
             /INSERT\s+INTO/gi,
             /UPDATE\s+/gi,
-            /DELETE\s+FROM/gi
+            /DELETE\s+FROM/gi,
         ];
         let count = 0;
         for (const pattern of patterns) {
@@ -290,9 +599,9 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return null;
     }
-    /**
-     * Analyze JSON Schema files
-     */
+    // ---------------------------------------------------------------------------
+    // JSON Schema validation (unchanged from original)
+    // ---------------------------------------------------------------------------
     async analyzeJsonSchemas(files, config) {
         const violations = [];
         const errors = [];
@@ -302,18 +611,15 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         if (!finalConfig.validateJsonSchemas) {
             return { violations, errors, filesProcessed, executionTime: 0 };
         }
-        // Categorize files
         const schemaFiles = this.identifySchemaFiles(files, finalConfig);
         const dataFiles = this.identifyDataFiles(files, finalConfig);
         const unknownJsonFiles = files.filter(f => !schemaFiles.includes(f) && !dataFiles.includes(f));
-        // Load and validate schema files
         const schemas = new Map();
         for (const file of schemaFiles) {
             try {
                 const content = await fs.readFile(file, 'utf8');
                 const schema = JSON.parse(content);
                 schemas.set(file, schema);
-                // Validate the JSON Schema itself
                 const fileViolations = this.validateJsonSchema(schema, file, finalConfig);
                 violations.push(...fileViolations);
                 filesProcessed++;
@@ -324,7 +630,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                         file,
                         line: 1,
                         column: 1,
-                        severity: 'critical',
+                        severity: 'warning',
                         message: `Invalid JSON: ${error.message}`,
                         rule: 'invalid-json',
                         analyzer: 'schema'
@@ -339,9 +645,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 filesProcessed++;
             }
         }
-        // Validate data files against schemas
         if (finalConfig.schemaDataPairs) {
-            // Use explicit schema-data pairs
             for (const pair of finalConfig.schemaDataPairs) {
                 const schema = schemas.get(pair.schema) || await this.loadSchema(pair.schema);
                 if (schema) {
@@ -357,7 +661,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             }
         }
         else {
-            // Try to match data files with schemas based on naming conventions
             for (const dataFile of [...dataFiles, ...unknownJsonFiles]) {
                 const matchedSchema = this.findMatchingSchema(dataFile, schemas, finalConfig);
                 if (matchedSchema) {
@@ -365,7 +668,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     violations.push(...dataViolations);
                 }
                 else if (unknownJsonFiles.includes(dataFile)) {
-                    // For unknown files, just check if they're valid JSON
                     try {
                         const content = await fs.readFile(dataFile, 'utf8');
                         JSON.parse(content);
@@ -375,7 +677,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                             file: dataFile,
                             line: 1,
                             column: 1,
-                            severity: 'critical',
+                            severity: 'warning',
                             message: `Invalid JSON: ${error instanceof Error ? error.message : 'Parse error'}`,
                             rule: 'invalid-json',
                             analyzer: 'schema'
@@ -392,12 +694,8 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             executionTime: Date.now() - startTime
         };
     }
-    /**
-     * Validate a JSON Schema
-     */
     validateJsonSchema(schema, filePath, config) {
         const violations = [];
-        // Check for $schema property
         if (!schema.$schema && config.jsonSchemaVersion) {
             violations.push({
                 file: filePath,
@@ -409,11 +707,8 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 analyzer: 'schema'
             });
         }
-        // Validate types recursively
         this.validateSchemaTypes(schema, filePath, config, violations);
-        // Check for common issues
         if (schema.type === 'object' && schema.properties) {
-            // Check for inconsistent required fields
             if (schema.required && Array.isArray(schema.required)) {
                 for (const field of schema.required) {
                     if (!schema.properties[field]) {
@@ -421,7 +716,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                             file: filePath,
                             line: 1,
                             column: 1,
-                            severity: 'critical',
+                            severity: 'warning',
                             message: `Required field "${field}" not defined in properties`,
                             rule: 'undefined-required-field',
                             analyzer: 'schema'
@@ -432,13 +727,9 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return violations;
     }
-    /**
-     * Recursively validate schema types
-     */
     validateSchemaTypes(schema, filePath, config, violations, path = '') {
         if (!schema || typeof schema !== 'object')
             return;
-        // Check type validity
         if (schema.type && config.allowedJsonTypes) {
             const types = Array.isArray(schema.type) ? schema.type : [schema.type];
             for (const type of types) {
@@ -447,7 +738,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                         file: filePath,
                         line: 1,
                         column: 1,
-                        severity: 'critical',
+                        severity: 'warning',
                         message: `Invalid type "${type}" at ${path || 'root'}. Allowed types: ${config.allowedJsonTypes.join(', ')}`,
                         rule: 'invalid-type',
                         analyzer: 'schema'
@@ -455,7 +746,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
         }
-        // Check numeric constraints
         if (schema.type === 'integer' || schema.type === 'number') {
             if (schema.minimum !== undefined && schema.maximum !== undefined) {
                 if (schema.minimum > schema.maximum) {
@@ -463,7 +753,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                         file: filePath,
                         line: 1,
                         column: 1,
-                        severity: 'critical',
+                        severity: 'warning',
                         message: `Invalid range at ${path}: minimum (${schema.minimum}) > maximum (${schema.maximum})`,
                         rule: 'invalid-range',
                         analyzer: 'schema'
@@ -471,24 +761,18 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
         }
-        // Recursively check properties
         if (schema.properties) {
             for (const [key, value] of Object.entries(schema.properties)) {
                 this.validateSchemaTypes(value, filePath, config, violations, `${path}.${key}`);
             }
         }
-        // Check array items
         if (schema.items) {
             this.validateSchemaTypes(schema.items, filePath, config, violations, `${path}[items]`);
         }
-        // Check additional properties
         if (schema.additionalProperties && typeof schema.additionalProperties === 'object') {
             this.validateSchemaTypes(schema.additionalProperties, filePath, config, violations, `${path}[additionalProperties]`);
         }
     }
-    /**
-     * Identify schema files based on patterns
-     */
     identifySchemaFiles(files, config) {
         if (!config.schemaFilePatterns)
             return [];
@@ -500,9 +784,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             });
         });
     }
-    /**
-     * Identify data files based on patterns
-     */
     identifyDataFiles(files, config) {
         if (!config.dataFilePatterns)
             return [];
@@ -514,9 +795,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             });
         });
     }
-    /**
-     * Load a schema from file
-     */
     async loadSchema(schemaPath) {
         try {
             const content = await fs.readFile(schemaPath, 'utf8');
@@ -526,13 +804,9 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             return null;
         }
     }
-    /**
-     * Find matching schema for a data file
-     */
     findMatchingSchema(dataFile, schemas, config) {
         const dataFileName = dataFile.split('/').pop() || '';
         const dataBaseName = dataFileName.replace(/\.(data|example|test)\.json$/, '');
-        // Look for schema with matching base name
         for (const [schemaFile, schema] of schemas) {
             const schemaFileName = schemaFile.split('/').pop() || '';
             const schemaBaseName = schemaFileName.replace(/[.-]?schema\.json$/, '');
@@ -540,21 +814,16 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 return schema;
             }
         }
-        // If only one schema exists, use it for all data files
         if (schemas.size === 1) {
             return schemas.values().next().value;
         }
         return null;
     }
-    /**
-     * Validate data against a JSON Schema
-     */
     async validateDataAgainstSchema(dataFile, schema, config) {
         const violations = [];
         try {
             const content = await fs.readFile(dataFile, 'utf8');
             const data = JSON.parse(content);
-            // Validate the data against the schema
             this.validateAgainstSchema(data, schema, dataFile, violations, config);
         }
         catch (error) {
@@ -563,7 +832,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     file: dataFile,
                     line: 1,
                     column: 1,
-                    severity: 'critical',
+                    severity: 'warning',
                     message: `Invalid JSON: ${error.message}`,
                     rule: 'invalid-json',
                     analyzer: 'schema'
@@ -574,7 +843,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     file: dataFile,
                     line: 1,
                     column: 1,
-                    severity: 'critical',
+                    severity: 'warning',
                     message: `Error reading file: ${error instanceof Error ? error.message : 'Unknown error'}`,
                     rule: 'file-error',
                     analyzer: 'schema'
@@ -583,17 +852,12 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return violations;
     }
-    /**
-     * Validate data against schema recursively
-     */
     validateAgainstSchema(data, schema, filePath, violations, config, path = '') {
-        // Type validation
         if (schema.type) {
             const actualType = Array.isArray(data) ? 'array' :
                 data === null ? 'null' :
                     typeof data;
             const allowedTypes = Array.isArray(schema.type) ? schema.type : [schema.type];
-            // Special handling for integer vs number
             const isValidType = allowedTypes.some((type) => {
                 if (type === 'integer') {
                     return typeof data === 'number' && Number.isInteger(data);
@@ -605,15 +869,14 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     file: filePath,
                     line: 1,
                     column: 1,
-                    severity: 'critical',
+                    severity: 'warning',
                     message: `Type mismatch at ${path || 'root'}: expected ${allowedTypes.join(' | ')}, got ${actualType}`,
                     rule: 'type-mismatch',
                     analyzer: 'schema'
                 });
-                return; // Don't validate further if type is wrong
+                return;
             }
         }
-        // String validations
         if (schema.type === 'string' && typeof data === 'string') {
             if (schema.minLength !== undefined && data.length < schema.minLength) {
                 violations.push({
@@ -652,7 +915,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
             if (schema.format) {
-                // Basic format validation
                 switch (schema.format) {
                     case 'email':
                         if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data)) {
@@ -680,11 +942,9 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                             });
                         }
                         break;
-                    // Add more formats as needed
                 }
             }
         }
-        // Number validations
         if ((schema.type === 'number' || schema.type === 'integer') && typeof data === 'number') {
             if (schema.minimum !== undefined && data < schema.minimum) {
                 violations.push({
@@ -709,7 +969,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 });
             }
         }
-        // Array validations
         if (schema.type === 'array' && Array.isArray(data)) {
             if (schema.minItems !== undefined && data.length < schema.minItems) {
                 violations.push({
@@ -739,9 +998,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 });
             }
         }
-        // Object validations
         if (schema.type === 'object' && typeof data === 'object' && data !== null) {
-            // Check required fields
             if (schema.required && Array.isArray(schema.required)) {
                 for (const requiredField of schema.required) {
                     if (!(requiredField in data)) {
@@ -749,7 +1006,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                             file: filePath,
                             line: 1,
                             column: 1,
-                            severity: 'critical',
+                            severity: 'warning',
                             message: `Missing required field "${requiredField}" at ${path}`,
                             rule: 'missing-required-field',
                             analyzer: 'schema'
@@ -757,7 +1014,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     }
                 }
             }
-            // Validate properties
             if (schema.properties) {
                 for (const [key, propSchema] of Object.entries(schema.properties)) {
                     if (key in data) {
@@ -765,7 +1021,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     }
                 }
             }
-            // Check additional properties
             if (schema.additionalProperties === false || (config.strictMode && !schema.additionalProperties)) {
                 const definedKeys = new Set(Object.keys(schema.properties || {}));
                 const actualKeys = Object.keys(data);
@@ -775,7 +1030,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                             file: filePath,
                             line: 1,
                             column: 1,
-                            severity: config.strictMode ? 'critical' : 'warning',
+                            severity: 'warning',
                             message: `Unexpected property "${key}" at ${path}`,
                             rule: 'unexpected-property',
                             analyzer: 'schema'
@@ -784,7 +1039,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
             else if (typeof schema.additionalProperties === 'object') {
-                // Validate additional properties against schema
                 const definedKeys = new Set(Object.keys(schema.properties || {}));
                 for (const [key, value] of Object.entries(data)) {
                     if (!definedKeys.has(key)) {
@@ -793,14 +1047,13 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
         }
-        // Enum validation
         if (schema.enum && Array.isArray(schema.enum)) {
             if (!schema.enum.includes(data)) {
                 violations.push({
                     file: filePath,
                     line: 1,
                     column: 1,
-                    severity: 'critical',
+                    severity: 'warning',
                     message: `Value at ${path} not in enum: ${JSON.stringify(data)}. Allowed: ${schema.enum.join(', ')}`,
                     rule: 'enum-mismatch',
                     analyzer: 'schema'
@@ -809,4 +1062,10 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
     }
 }
+/**
+ * Escape regex special characters in a string.
+ */
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 //# sourceMappingURL=UniversalSchemaAnalyzer.js.map