code-auditor-mcp 3.1.1 → 3.4.1

package/dist/analyzers/__tests__/fixtures/spec-17/twenty-methods-vs-complex.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"twenty-methods-vs-complex.js","sourceRoot":"","sources":["../../../../../src/analyzers/__tests__/fixtures/spec-17/twenty-methods-vs-complex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,aAAa;IACxB,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,CAAS,IAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CAC1C;AAED,2DAA2D;AAC3D,6CAA6C;AAC7C,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACjB,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;YAC5D,CAAC;YACD,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QACxD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE/B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACf,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.d.ts

@@ -1,12 +0,0 @@
-/**
- * Spec-17 R8 Fixture 11: unique-method-74-lines
- * Report section: R3.1 — Self-reference fix
- *
- * A single 74-line unique method should produce ZERO duplicate findings.
- * The self-reference fix (span-overlap check, R3.1) ensures a block
- * never cites itself as the "first occurrence."
- */
-export declare class ReportGenerator {
-    generateReport(title: string, data: number[]): string;
-}
-//# sourceMappingURL=unique-method-74-lines.d.ts.map

package/dist/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"unique-method-74-lines.d.ts","sourceRoot":"","sources":["../../../../../src/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,eAAe;IACnB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoE3D;CACF"}

package/dist/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.js

@@ -1,82 +0,0 @@
-/**
- * Spec-17 R8 Fixture 11: unique-method-74-lines
- * Report section: R3.1 — Self-reference fix
- *
- * A single 74-line unique method should produce ZERO duplicate findings.
- * The self-reference fix (span-overlap check, R3.1) ensures a block
- * never cites itself as the "first occurrence."
- */
-export class ReportGenerator {
-    generateReport(title, data) {
-        // Line 1 of method body
-        const header = `=== ${title} ===`;
-        // Line 2
-        const separator = "=".repeat(header.length);
-        // Line 3
-        let total = 0;
-        // Line 4
-        let min = Number.MAX_VALUE;
-        // Line 5
-        let max = Number.MIN_VALUE;
-        // Line 6
-        const processed = [];
-        // Line 7
-        for (const value of data) {
-            // Line 8
-            if (value > 0) {
-                // Line 9
-                processed.push(value);
-                // Line 10
-                total += value;
-                // Line 11
-                if (value < min)
-                    min = value;
-                // Line 12
-                if (value > max)
-                    max = value;
-                // Line 13
-            }
-            // Line 14
-        }
-        // Line 15
-        const average = processed.length > 0 ? total / processed.length : 0;
-        // Line 16
-        const lines = [];
-        // Line 17
-        lines.push(header);
-        // Line 18
-        lines.push(separator);
-        // Line 19
-        lines.push(`Count: ${processed.length}`);
-        // Line 20
-        lines.push(`Total: ${total}`);
-        // Line 21
-        lines.push(`Average: ${average.toFixed(2)}`);
-        // Line 22
-        lines.push(`Min: ${min}`);
-        // Line 23
-        lines.push(`Max: ${max}`);
-        // Line 24
-        lines.push(`Range: ${max - min}`);
-        // Line 25
-        if (processed.length > 0) {
-            // Line 26
-            lines.push("---");
-            // Line 27
-            lines.push("Details:");
-            // Line 28
-            for (let i = 0; i < processed.length; i++) {
-                // Line 29
-                lines.push(`  ${i + 1}. ${processed[i]}`);
-                // Line 30
-            }
-            // Line 31
-        }
-        // Line 32
-        lines.push(separator);
-        // Line 33
-        return lines.join("\n");
-        // Line 34
-    }
-}
-//# sourceMappingURL=unique-method-74-lines.js.map

package/dist/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"unique-method-74-lines.js","sourceRoot":"","sources":["../../../../../src/analyzers/__tests__/fixtures/spec-17/unique-method-74-lines.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,eAAe;IACnB,cAAc,CAAC,KAAa,EAAE,IAAc;QACjD,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC;QAClC,SAAS;QACT,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,SAAS;QACT,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS;QACT,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC3B,SAAS;QACT,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC3B,SAAS;QACT,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,SAAS;QACT,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,SAAS;YACT,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,SAAS;gBACT,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,UAAU;gBACV,KAAK,IAAI,KAAK,CAAC;gBACf,UAAU;gBACV,IAAI,KAAK,GAAG,GAAG;oBAAE,GAAG,GAAG,KAAK,CAAC;gBAC7B,UAAU;gBACV,IAAI,KAAK,GAAG,GAAG;oBAAE,GAAG,GAAG,KAAK,CAAC;gBAC7B,UAAU;YACZ,CAAC;YACD,UAAU;QACZ,CAAC;QACD,UAAU;QACV,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,UAAU;QACV,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC9B,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;QAC1B,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;QAC1B,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;QAClC,UAAU;QACV,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU;YACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,UAAU;YACV,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,UAAU;YACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,UAAU;gBACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1C,UAAU;YACZ,CAAC;YACD,UAAU;QACZ,CAAC;QACD,UAAU;QACV,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,UAAU;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,UAAU;IACZ,CAAC;CACF"}

package/dist/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.d.ts

@@ -1,10 +0,0 @@
-/**
- * Spec-17 R8 Fixture 7: word-the-in-comment
- * Report section: R2.1 — SQL-context-only extraction
- *
- * The word "the" appearing in a comment or string literal should produce
- * ZERO schema findings. This was a ~4,500-count false positive in the
- * diagnostic: the old regex matched "the" in comments as a table ref.
- */
-export declare function tellTheStory(): string;
-//# sourceMappingURL=word-the-in-comment.d.ts.map

package/dist/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"word-the-in-comment.d.ts","sourceRoot":"","sources":["../../../../../src/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,wBAAgB,YAAY,IAAI,MAAM,CAGrC"}

package/dist/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.js

@@ -1,15 +0,0 @@
-/**
- * Spec-17 R8 Fixture 7: word-the-in-comment
- * Report section: R2.1 — SQL-context-only extraction
- *
- * The word "the" appearing in a comment or string literal should produce
- * ZERO schema findings. This was a ~4,500-count false positive in the
- * diagnostic: the old regex matched "the" in comments as a table ref.
- */
-// The quick brown fox jumps over the lazy dog
-// The answer to life, the universe, and everything
-export function tellTheStory() {
-    const message = "the hero returns from the journey";
-    return message;
-}
-//# sourceMappingURL=word-the-in-comment.js.map

package/dist/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"word-the-in-comment.js","sourceRoot":"","sources":["../../../../../src/analyzers/__tests__/fixtures/spec-17/word-the-in-comment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8CAA8C;AAC9C,mDAAmD;AAEnD,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,mCAAmC,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/analyzers/dataAccessAnalyzer.d.ts

@@ -1,46 +0,0 @@
-/**
- * Data Access Analyzer (Functional)
- * Analyzes database access patterns and data layer interactions
- *
- * Detects database usage, query patterns, performance risks,
- * and security concerns in data access code
- */
-import { AnalyzerDefinition } from '../types.js';
-/**
- * Configuration for Data Access analyzer
- */
-export interface DataAccessAnalyzerConfig {
-    databases?: {
-        [key: string]: {
-            name: string;
-            importPatterns: string[];
-            queryPatterns: string[];
-            ormPatterns?: string[];
-        };
-    };
-    organizationPatterns?: string[];
-    tablePatterns?: {
-        orm?: RegExp[];
-        sql?: RegExp[];
-        queryBuilder?: RegExp[];
-    };
-    performanceThresholds?: {
-        complexQueryCount?: number;
-        unfilteredQueryCount?: number;
-        joinedTableCount?: number;
-    };
-    securityPatterns?: {
-        sqlInjectionRisks?: string[];
-        parameterizedQueries?: string[];
-    };
-    sourcePatterns?: {
-        api?: string[];
-        page?: string[];
-        service?: string[];
-    };
-}
-/**
- * Data Access Analyzer definition
- */
-export declare const dataAccessAnalyzer: AnalyzerDefinition;
-//# sourceMappingURL=dataAccessAnalyzer.d.ts.map

package/dist/analyzers/dataAccessAnalyzer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dataAccessAnalyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/dataAccessAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AA0BrB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAEvC,SAAS,CAAC,EAAE;QACV,CAAC,GAAG,EAAE,MAAM,GAAG;YACb,IAAI,EAAE,MAAM,CAAC;YACb,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,aAAa,EAAE,MAAM,EAAE,CAAC;YACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IAGF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGhC,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAGF,qBAAqB,CAAC,EAAE;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAGF,gBAAgB,CAAC,EAAE;QACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IAGF,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AA6hBD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBA8BhC,CAAC"}

package/dist/analyzers/dataAccessAnalyzer.js

@@ -1,474 +0,0 @@
-/**
- * Data Access Analyzer (Functional)
- * Analyzes database access patterns and data layer interactions
- *
- * Detects database usage, query patterns, performance risks,
- * and security concerns in data access code
- */
-import { processFiles, createViolation } from './analyzerUtils.js';
-import { getImports, findNodesByKind, getLineAndColumn } from '../utils/astUtils.js';
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-/** Get raw text from a tree-sitter node stored on ASTNode.raw. */
-function rawText(node) {
-    return node.raw?.text ?? '';
-}
-/**
- * Default configuration
- */
-const DEFAULT_CONFIG = {
-    databases: {
-        'primary': {
-            name: 'Primary Database',
-            importPatterns: ['/database/', '/db/', 'drizzle', 'prisma', 'typeorm'],
-            queryPatterns: ['select', 'insert', 'update', 'delete', 'query'],
-            ormPatterns: ['from', 'where', 'join', 'orderBy', 'groupBy']
-        },
-        'secondary': {
-            name: 'Secondary Database',
-            importPatterns: ['/analytics/', '/reporting/'],
-            queryPatterns: ['query', 'execute', 'run'],
-            ormPatterns: []
-        }
-    },
-    organizationPatterns: [
-        'organizationId',
-        'organization_id',
-        'orgId',
-        'org_id',
-        'tenantId',
-        'tenant_id',
-        'companyId',
-        'company_id',
-        'filterByOrganization',
-        'whereOrganization',
-        'scopeToOrg'
-    ],
-    tablePatterns: {
-        orm: [
-            /\.from\(['"`]?(\w+)['"`]?\)/g,
-            /\.table\(['"`]?(\w+)['"`]?\)/g,
-            /\.into\(['"`]?(\w+)['"`]?\)/g,
-            /\.update\(['"`]?(\w+)['"`]?\)/g
-        ],
-        sql: [
-            /(?:FROM|JOIN|INTO|UPDATE)\s+['"`]?(\w+)['"`]?/gi,
-            /(?:INSERT\s+INTO)\s+['"`]?(\w+)['"`]?/gi,
-            /(?:DELETE\s+FROM)\s+['"`]?(\w+)['"`]?/gi
-        ],
-        queryBuilder: [
-            /table:\s*['"`](\w+)['"`]/g,
-            /from:\s*['"`](\w+)['"`]/g
-        ]
-    },
-    performanceThresholds: {
-        complexQueryCount: 3,
-        unfilteredQueryCount: 5,
-        joinedTableCount: 2
-    },
-    securityPatterns: {
-        sqlInjectionRisks: [
-            'concatenation',
-            '${',
-            'string interpolation',
-            '+ variable',
-            'raw(',
-            'unsafeRaw'
-        ],
-        parameterizedQueries: [
-            'prepared',
-            'parameterized',
-            'bind',
-            '?',
-            '$1',
-            ':param'
-        ]
-    },
-    sourcePatterns: {
-        api: ['/api/', '/routes/', '/endpoints/'],
-        page: ['/pages/', '/app/', '/views/'],
-        service: ['/services/', '/lib/', '/utils/']
-    }
-};
-// ---------------------------------------------------------------------------
-// Main analysis
-// ---------------------------------------------------------------------------
-/**
- * Analyze a single file for data access patterns.
- * Now accepts a pre-parsed AST (from processFiles) instead of parsing internally.
- */
-async function analyzeFile(filePath, ast, config, sourceCode) {
-    const imports = getImports(ast.root);
-    const patterns = [];
-    const violations = [];
-    // Extract database calls
-    const dbCalls = extractDatabaseCalls(ast.root, imports, filePath, config, sourceCode);
-    // Group calls by database type
-    const callsByDb = new Map();
-    dbCalls.forEach(call => {
-        if (!callsByDb.has(call.type)) {
-            callsByDb.set(call.type, []);
-        }
-        callsByDb.get(call.type).push(call);
-    });
-    // Create patterns for each database type used
-    callsByDb.forEach((calls, dbType) => {
-        const allTables = new Set();
-        const queries = [];
-        let hasOrgFilter = false;
-        let hasSqlInjectionRisk = false;
-        calls.forEach(call => {
-            call.tables.forEach(table => allTables.add(table));
-            hasOrgFilter = hasOrgFilter || call.hasOrganizationFilter;
-            hasSqlInjectionRisk = hasSqlInjectionRisk || call.hasSqlInjectionRisk;
-            // Create query info with enhanced analysis
-            const queryInfo = extractQueryInfo(call, config);
-            queries.push(queryInfo);
-        });
-        const pattern = {
-            source: detectSourceType(filePath, config),
-            filePath,
-            database: dbType,
-            tables: Array.from(allTables),
-            queries,
-            hasOrganizationFilter: hasOrgFilter,
-            performanceRisk: assessPerformanceRisk(queries, config),
-            hasSqlInjectionRisk
-        };
-        patterns.push(pattern);
-        // Check for violations
-        violations.push(...checkDataAccessViolations(pattern));
-    });
-    return { patterns, violations };
-}
-/**
- * Detect source type based on file path
- */
-function detectSourceType(filePath, config) {
-    if (config.sourcePatterns.api.some(pattern => filePath.includes(pattern))) {
-        return 'api';
-    }
-    else if (config.sourcePatterns.page.some(pattern => filePath.includes(pattern))) {
-        return 'component';
-    }
-    else if (config.sourcePatterns.service.some(pattern => filePath.includes(pattern))) {
-        return 'service';
-    }
-    return 'service';
-}
-/**
- * Extract database calls from the AST.
- * Uses tree-sitter call_expression nodes instead of TS API.
- */
-function extractDatabaseCalls(ast, imports, filePath, config, sourceCode) {
-    const calls = [];
-    // Map imports to database types
-    const dbImports = mapDatabaseImports(imports, config);
-    // Find all call expressions using tree-sitter node type
-    const callExpressions = findNodesByKind(ast, 'call_expression');
-    callExpressions.forEach(callExpr => {
-        const callText = rawText(callExpr);
-        const { line, column } = getLineAndColumn(callExpr);
-        // Check each configured database
-        Object.entries(dbImports).forEach(([dbType, importInfo]) => {
-            if (importInfo.hasImports && isDatabaseCall(callText, importInfo)) {
-                const tables = extractTablesFromCall(callText, config);
-                const hasOrgFilter = checkOrganizationFilter(callText, config);
-                const securityCheck = checkQuerySecurity(callText, config);
-                calls.push({
-                    type: dbType,
-                    method: extractMethodName(callExpr),
-                    file: filePath,
-                    line,
-                    column,
-                    tables,
-                    hasOrganizationFilter: hasOrgFilter,
-                    hasParameterizedQuery: securityCheck.parameterized,
-                    hasSqlInjectionRisk: securityCheck.injectionRisk
-                });
-            }
-        });
-    });
-    return calls;
-}
-/**
- * Map imports to database types
- */
-function mapDatabaseImports(imports, config) {
-    const result = {};
-    Object.entries(config.databases).forEach(([key, dbConfig]) => {
-        const importNames = [];
-        let hasImports = false;
-        imports.forEach(imp => {
-            if (dbConfig.importPatterns.some((pattern) => imp.moduleSpecifier.includes(pattern))) {
-                hasImports = true;
-                importNames.push(...imp.importedNames);
-            }
-        });
-        result[key] = {
-            hasImports,
-            importNames,
-            patterns: [...dbConfig.queryPatterns, ...importNames]
-        };
-    });
-    return result;
-}
-/**
- * Check if a call is a database call
- */
-function isDatabaseCall(callText, importInfo) {
-    if (!importInfo.hasImports)
-        return false;
-    return importInfo.patterns.some(pattern => callText.includes(pattern));
-}
-/**
- * Extract method name from a tree-sitter call_expression node.
- *
- * call_expression node structure:
- *   children[0] = identifier           (e.g., "query()")
- *   OR
- *   children[0] = member_expression    (e.g., "db.query()")
- *     children[0] = identifier         (e.g., "db")
- *     children[1] = "."
- *     children[2] = property_identifier (e.g., "query")
- */
-function extractMethodName(callExpr) {
-    const expression = callExpr.children?.[0];
-    if (!expression)
-        return 'unknown';
-    if (expression.type === 'member_expression') {
-        // e.g., db.query() — the property_identifier child holds the method name
-        const propId = expression.children?.find(c => c.type === 'property_identifier');
-        if (propId) {
-            return rawText(propId);
-        }
-    }
-    else if (expression.type === 'identifier') {
-        // e.g., query()
-        return rawText(expression);
-    }
-    return 'unknown';
-}
-/**
- * Extract table names from call
- */
-function extractTablesFromCall(callText, config) {
-    const tables = new Set();
-    // Try all table extraction patterns
-    Object.values(config.tablePatterns).forEach(patterns => {
-        patterns.forEach(pattern => {
-            const matches = Array.from(callText.matchAll(pattern));
-            matches.forEach(match => {
-                if (match[1]) {
-                    tables.add(match[1].toLowerCase());
-                }
-            });
-        });
-    });
-    return Array.from(tables);
-}
-/**
- * Check for organization filtering
- */
-function checkOrganizationFilter(callText, config) {
-    return config.organizationPatterns.some(pattern => callText.toLowerCase().includes(pattern.toLowerCase()));
-}
-/**
- * Check query security
- */
-function checkQuerySecurity(callText, config) {
-    const hasParameterized = config.securityPatterns.parameterizedQueries.some(pattern => callText.includes(pattern));
-    const hasInjectionRisk = config.securityPatterns.sqlInjectionRisks.some(pattern => callText.includes(pattern));
-    return {
-        parameterized: hasParameterized,
-        injectionRisk: hasInjectionRisk && !hasParameterized
-    };
-}
-/**
- * Extract query info from database call
- */
-function extractQueryInfo(call, config) {
-    return {
-        type: inferQueryType(call.method),
-        tables: call.tables,
-        line: call.line,
-        hasJoins: detectJoins(call.method),
-        hasOrganizationFilter: call.hasOrganizationFilter,
-        complexity: analyzeQueryComplexity(call, config)
-    };
-}
-/**
- * Infer query type from method name
- */
-function inferQueryType(method) {
-    const methodLower = method.toLowerCase();
-    if (methodLower.includes('select') || methodLower.includes('find') || methodLower.includes('get')) {
-        return 'select';
-    }
-    else if (methodLower.includes('insert') || methodLower.includes('create')) {
-        return 'insert';
-    }
-    else if (methodLower.includes('update')) {
-        return 'update';
-    }
-    else if (methodLower.includes('delete') || methodLower.includes('remove')) {
-        return 'delete';
-    }
-    return 'other';
-}
-/**
- * Detect if a query has joins
- */
-function detectJoins(method) {
-    const joinPatterns = [
-        'join',
-        'leftJoin',
-        'rightJoin',
-        'innerJoin',
-        'outerJoin',
-        'fullJoin'
-    ];
-    return joinPatterns.some(pattern => method.toLowerCase().includes(pattern.toLowerCase()));
-}
-/**
- * Analyze query complexity
- */
-function analyzeQueryComplexity(call, config) {
-    let complexityScore = 0;
-    // Table count factor
-    if (call.tables.length > config.performanceThresholds.joinedTableCount) {
-        complexityScore += 2;
-    }
-    else if (call.tables.length > 1) {
-        complexityScore += 1;
-    }
-    // Method complexity
-    if (detectJoins(call.method)) {
-        complexityScore += 2;
-    }
-    // Security risk adds complexity
-    if (call.hasSqlInjectionRisk) {
-        complexityScore += 3;
-    }
-    // Missing org filter in multi-tenant context
-    if (!call.hasOrganizationFilter && call.tables.length > 0) {
-        complexityScore += 1;
-    }
-    // Determine complexity level
-    if (complexityScore >= 5)
-        return 'complex';
-    if (complexityScore >= 2)
-        return 'moderate';
-    return 'simple';
-}
-/**
- * Assess performance risk based on queries
- */
-function assessPerformanceRisk(queries, config) {
-    // Count complex queries
-    const complexQueries = queries.filter(q => q.hasJoins ||
-        q.tables.length > config.performanceThresholds.joinedTableCount ||
-        q.complexity === 'complex').length;
-    // Count queries without org filter
-    const unfiltered = queries.filter(q => !q.hasOrganizationFilter).length;
-    if (complexQueries > config.performanceThresholds.complexQueryCount ||
-        unfiltered > config.performanceThresholds.unfilteredQueryCount) {
-        return 'high';
-    }
-    else if (complexQueries > 1 || unfiltered > 2) {
-        return 'medium';
-    }
-    return 'low';
-}
-/**
- * Check for data access violations
- */
-function checkDataAccessViolations(pattern) {
-    const violations = [];
-    // Check for missing organization filter in multi-tenant scenarios
-    if (!pattern.hasOrganizationFilter && pattern.tables.length > 0) {
-        violations.push(createViolation({
-            analyzer: 'data-access',
-            severity: 'warning',
-            type: 'data-access',
-            file: pattern.filePath,
-            line: 1,
-            column: 1,
-            message: 'Database queries may be missing tenant/organization filtering',
-            recommendation: 'Add appropriate filtering to ensure data isolation in multi-tenant environments',
-            estimatedEffort: 'small'
-        }));
-    }
-    // Check for SQL injection risks
-    if (pattern.hasSqlInjectionRisk) {
-        violations.push(createViolation({
-            analyzer: 'data-access',
-            severity: 'critical',
-            type: 'data-access',
-            file: pattern.filePath,
-            line: 1,
-            column: 1,
-            message: 'Potential SQL injection vulnerability detected',
-            recommendation: 'Use parameterized queries or prepared statements instead of string concatenation',
-            estimatedEffort: 'medium'
-        }));
-    }
-    // Check for performance risks
-    if (pattern.performanceRisk === 'high') {
-        violations.push(createViolation({
-            analyzer: 'data-access',
-            severity: 'warning',
-            type: 'data-access',
-            file: pattern.filePath,
-            line: 1,
-            column: 1,
-            message: 'High performance risk detected in data access patterns',
-            recommendation: 'Optimize queries, add indexes, implement caching, or paginate results',
-            estimatedEffort: 'medium'
-        }));
-    }
-    // Check for direct database access in presentation layer
-    if (pattern.source === 'component') {
-        violations.push(createViolation({
-            analyzer: 'data-access',
-            severity: 'suggestion',
-            type: 'data-access',
-            file: pattern.filePath,
-            line: 1,
-            column: 1,
-            message: 'Direct database access detected in presentation layer',
-            recommendation: 'Consider moving data access to service layer or API endpoints for better separation of concerns',
-            estimatedEffort: 'medium'
-        }));
-    }
-    return violations;
-}
-// ---------------------------------------------------------------------------
-// Analyzer definition
-// ---------------------------------------------------------------------------
-/**
- * Data Access Analyzer definition
- */
-export const dataAccessAnalyzer = {
-    name: 'data-access',
-    defaultConfig: DEFAULT_CONFIG,
-    analyze: async (files, config, options, progressCallback) => {
-        const mergedConfig = { ...DEFAULT_CONFIG, ...config };
-        // Custom processor to handle patterns collection
-        const patterns = [];
-        const allViolations = [];
-        const result = await processFiles(files, async (filePath, ast, procConfig, sourceCode) => {
-            const fileResult = await analyzeFile(filePath, ast, mergedConfig, sourceCode);
-            patterns.push(...fileResult.patterns);
-            allViolations.push(...fileResult.violations);
-            return fileResult.violations;
-        }, 'data-access', mergedConfig, progressCallback ?
-            (current, total, file) => progressCallback({ current, total, analyzer: 'data-access', file }) :
-            undefined);
-        // Override violations with our collected ones
-        result.violations = allViolations;
-        return result;
-    }
-};
-//# sourceMappingURL=dataAccessAnalyzer.js.map